react-doctor 0.5.6 → 0.5.7-dev.2cadd3f

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="79c9f922-1713-5894-a0aa-142d0cd9c7ba")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fc85ab90-476c-5c45-bfa1-cfead22c445d")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -9,12 +9,12 @@ import * as NFS from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
 import process$1 from "node:process";
 import * as ts from "typescript";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
 import os, { tmpdir } from "node:os";
 import { parseJSON5 } from "confbox";
 import * as NodeUrl from "node:url";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
 import * as Crypto from "node:crypto";
 import crypto, { createHash, randomUUID } from "node:crypto";
@@ -10277,7 +10277,7 @@ const provideContext$1 = /* @__PURE__ */ dual(2, (self, context) => {
 	return updateContext$1(self, merge$3(context));
 });
 /** @internal */
-const provideService$1 = function() {
+const provideService$3 = function() {
 	if (arguments.length === 1) return dual(2, (self, impl) => provideServiceImpl(self, arguments[0], impl));
 	return dual(3, (self, service, impl) => provideServiceImpl(self, service, impl)).apply(this, arguments);
 };
@@ -10508,7 +10508,7 @@ const constScopeEmpty = { _tag: "Empty" };
 /** @internal */
 const scope = scopeTag;
 /** @internal */
-const provideScope = /* @__PURE__ */ provideService$1(scopeTag);
+const provideScope = /* @__PURE__ */ provideService$3(scopeTag);
 /** @internal */
 const scoped$1 = (self) => withFiber$1((fiber) => {
 	const prev = fiber.context;
@@ -10949,9 +10949,9 @@ const makeLatchUnsafe = (open) => new Latch(open ?? false);
 /** @internal */
 const makeLatch = (open) => sync$2(() => makeLatchUnsafe(open));
 /** @internal */
-const withTracer$1 = /* @__PURE__ */ dual(2, (effect, tracer) => provideService$1(effect, Tracer, tracer));
+const withTracer$1 = /* @__PURE__ */ dual(2, (effect, tracer) => provideService$3(effect, Tracer, tracer));
 /** @internal */
-const withTracerEnabled$1 = /* @__PURE__ */ provideService$1(TracerEnabled);
+const withTracerEnabled$1 = /* @__PURE__ */ provideService$3(TracerEnabled);
 const bigint0 = /* @__PURE__ */ BigInt(0);
 const NoopSpanProto = {
 	_tag: "Span",
@@ -11032,7 +11032,7 @@ const useSpan$1 = (name, ...args) => {
 		}));
 	});
 };
-const provideParentSpan = /* @__PURE__ */ provideService$1(ParentSpan);
+const provideParentSpan = /* @__PURE__ */ provideService$3(ParentSpan);
 /** @internal */
 const withParentSpan$1 = function() {
 	const dataFirst = isEffect$1(arguments[0]);
@@ -12599,7 +12599,7 @@ var CurrentMemoMap = class extends Service()("effect/Layer/CurrentMemoMap") {
 * @category memo map
 * @since 2.0.0
 */
-const buildWithMemoMap = /* @__PURE__ */ dual(3, (self, memoMap, scope) => provideService$1(map$4(self.build(memoMap, scope), add(CurrentMemoMap, memoMap)), CurrentMemoMap, memoMap));
+const buildWithMemoMap = /* @__PURE__ */ dual(3, (self, memoMap, scope) => provideService$3(map$4(self.build(memoMap, scope), add(CurrentMemoMap, memoMap)), CurrentMemoMap, memoMap));
 /**
 * Builds a layer into an `Effect` value. Any resources associated with this
 * layer will be released when the specified scope is closed unless their scope
@@ -13952,7 +13952,7 @@ const provide$1 = /* @__PURE__ */ dual((args) => isEffect$1(args[0]), (self, sou
 /** @internal */
 const repeatOrElse = /* @__PURE__ */ dual(3, (self, schedule, orElse) => flatMap$4(toStepWithMetadata(schedule), (step) => {
 	let meta = CurrentMetadata.defaultValue();
-	return catch_$2(forever$2(tap$2(flatMap$4(suspend$3(() => provideService$1(self, CurrentMetadata, meta)), step), (meta_) => sync$2(() => {
+	return catch_$2(forever$2(tap$2(flatMap$4(suspend$3(() => provideService$3(self, CurrentMetadata, meta)), step), (meta_) => sync$2(() => {
 		meta = meta_;
 	})), { disableYield: true }), (error) => isDone$2(error) ? succeed$5(error.value) : orElse(error, meta.attempt === 0 ? none() : some(meta)));
 }));
@@ -13960,7 +13960,7 @@ const repeatOrElse = /* @__PURE__ */ dual(3, (self, schedule, orElse) => flatMap
 const retryOrElse = /* @__PURE__ */ dual(3, (self, policy, orElse) => flatMap$4(toStepWithMetadata(policy), (step) => {
 	let meta = CurrentMetadata.defaultValue();
 	let lastError;
-	const loop = catch_$2(suspend$3(() => provideService$1(self, CurrentMetadata, meta)), (error) => {
+	const loop = catch_$2(suspend$3(() => provideService$3(self, CurrentMetadata, meta)), (error) => {
 		lastError = error;
 		return flatMap$4(step(error), (meta_) => {
 			meta = meta_;
@@ -16076,7 +16076,7 @@ const updateContext = updateContext$1;
 * @category Context
 * @since 2.0.0
 */
-const provideService = provideService$1;
+const provideService$2 = provideService$3;
 /**
 * Scopes all resources used in this workflow to the lifetime of the workflow,
 * ensuring that their finalizers are run as soon as this workflow completes
@@ -21091,6 +21091,20 @@ function decodeUnknownOption$1(schema, options) {
 	return asOption(decodeUnknownEffect(schema, options));
 }
 /**
+* Creates a synchronous decoder for `unknown` input.
+*
+* **Details**
+*
+* The returned function returns the decoded `Type` on success and throws an
+* `Error` with the `SchemaIssue.Issue` in its `cause` on decoding failure.
+*
+* @category decoding
+* @since 3.10.0
+*/
+function decodeUnknownSync$1(schema, options) {
+	return asSync(decodeUnknownEffect(schema, options));
+}
+/**
 * Creates an effectful encoder for `unknown` input.
 *
 * **Details**
@@ -21392,6 +21406,40 @@ function isSchemaError(u) {
 */
 const decodeUnknownOption = decodeUnknownOption$1;
 /**
+* Decodes an `unknown` input against a schema synchronously, returning the
+* decoded value or throwing an `Error` whose cause contains the schema issue.
+* Use this when you want to validate data at a boundary and treat a schema
+* mismatch as an exception. For typed input use `decodeSync`.
+*
+* **Details**
+*
+* Only service-free schemas can be decoded synchronously. For non-throwing
+* alternatives see `decodeUnknownOption`, `decodeUnknownExit`, or
+* `decodeUnknownEffect`. Options may be provided either when creating the
+* decoder or when applying it; application options override creation options.
+*
+* **Example** (Decoding with a transformation schema)
+*
+* ```ts
+* import { Schema } from "effect"
+*
+* const NumberFromString = Schema.NumberFromString
+*
+* console.log(Schema.decodeUnknownSync(NumberFromString)("42"))
+* // Output: 42
+*
+* Schema.decodeUnknownSync(NumberFromString)("not a number")
+* // throws SchemaError: NumberFromString
+* //   └─ Encoded side transformation failure
+* //      └─ NumberFromString
+* //         └─ Expected a numeric string, actual "not a number"
+* ```
+*
+* @category decoding
+* @since 4.0.0
+*/
+const decodeUnknownSync = decodeUnknownSync$1;
+/**
 * Encodes an `unknown` input against a schema synchronously, throwing a
 * {@link SchemaError} on failure. Use this when you want to serialize data at a
 * boundary and treat a schema mismatch as an unrecoverable error. For
@@ -22358,7 +22406,8 @@ var Diagnostic = class extends Class("Diagnostic")({
 	category: String$1,
 	fileContext: optional(Literals(["test", "story"])),
 	suppressionHint: optional(String$1),
-	relatedLocations: optional(ArraySchema(DiagnosticRelatedLocation))
+	relatedLocations: optional(ArraySchema(DiagnosticRelatedLocation)),
+	fixGroupId: optional(String$1)
 }) {};
 const JsonReportMode = Literals([
 	"full",
@@ -22400,6 +22449,7 @@ var JsonReportProjectEntry = class extends Class("JsonReportProjectEntry")({
 	score: Unknown,
 	skippedChecks: ArraySchema(String$1),
 	skippedCheckReasons: optional(Record$1(String$1, String$1)),
+	scannedFileCount: optional(Number$1),
 	elapsedMilliseconds: Number$1
 }) {};
 /**
@@ -28269,6 +28319,14 @@ const runWith = (self, f, onHalt) => suspend$2(() => {
 	return catchDone(flatMap$2(toTransform(self)(done$1(), scope), f), onHalt ? onHalt : succeed$2).pipe(onExit$2((exit) => close(scope, exit)));
 });
 /**
+* Provides a concrete service for a context key, removing that service
+* requirement from the returned channel.
+*
+* @category services
+* @since 2.0.0
+*/
+const provideService$1 = /* @__PURE__ */ dual(3, (self, key, service) => fromTransform$1((upstream, scope) => map$3(provideService$2(toTransform(self)(upstream, scope), key, service), provideService$2(key, service))));
+/**
 * Runs a channel and applies an effect to each output element.
 *
 * **Example** (Running effects for each output)
@@ -29657,6 +29715,44 @@ const splitLines = (self) => self.channel.pipe(pipeTo(splitLines$1()), fromChann
 */
 const ensuring = /* @__PURE__ */ dual(2, (self, finalizer) => fromChannel(ensuring$1(self.channel, finalizer)));
 /**
+* Provides the stream with a single required service, eliminating that
+* requirement from its environment.
+*
+* **Example** (Providing a stream service)
+*
+* ```ts
+* import { Console, Context, Effect, Stream } from "effect"
+*
+* class Greeter extends Context.Service<Greeter, {
+*   greet: (name: string) => string
+* }>()("Greeter") {}
+*
+* const stream = Stream.fromEffect(
+*   Effect.service(Greeter).pipe(
+*     Effect.map((greeter) => greeter.greet("Ada"))
+*   )
+* )
+*
+* const program = Effect.gen(function*() {
+*   const collected = yield* Stream.runCollect(
+*     stream.pipe(
+*       Stream.provideService(Greeter, {
+*         greet: (name) => `Hello, ${name}`
+*       })
+*     )
+*   )
+*   yield* Console.log(collected)
+* })
+*
+* Effect.runPromise(program)
+* //=> ["Hello, Ada"]
+* ```
+*
+* @category services
+* @since 2.0.0
+*/
+const provideService = /* @__PURE__ */ dual(3, (self, key, service) => fromChannel(provideService$1(self.channel, key, service)));
+/**
 * Runs a stream with a sink and returns the sink result.
 *
 * **Example** (Running a stream with a sink)
@@ -33086,7 +33182,7 @@ const make$8 = /* @__PURE__ */ fnUntraced(function* (options) {
 	const runFork = runForkWith(services);
 	const exportInterval = max(fromInputUnsafe(options.exportInterval), zero);
 	let disabledUntil = void 0;
-	const client = filterStatusOk(get$4(services, HttpClient)).pipe(transformResponse(provideService(TracerPropagationEnabled, false)), retryTransient({
+	const client = filterStatusOk(get$4(services, HttpClient)).pipe(transformResponse(provideService$2(TracerPropagationEnabled, false)), retryTransient({
 		schedule: policy,
 		times: 3
 	}));
@@ -35883,16 +35979,23 @@ const isMinifiedSource = (absolutePath) => {
 		if (fileDescriptor !== void 0) NFS.closeSync(fileDescriptor);
 	}
 };
-const isLargeMinifiedFile = (absolutePath) => {
-	let sizeBytes;
+const cachedIsLargeMinifiedByPath = /* @__PURE__ */ new Map();
+const statSourceFileSize = (absolutePath) => {
 	try {
-		sizeBytes = NFS.statSync(absolutePath).size;
+		return NFS.statSync(absolutePath).size;
 	} catch {
-		return false;
+		return null;
 	}
-	if (sizeBytes < 2e4) return false;
-	return isMinifiedSource(absolutePath);
 };
+const isLargeMinifiedFile = (absolutePath, knownSizeBytes) => {
+	const cached = cachedIsLargeMinifiedByPath.get(absolutePath);
+	if (cached !== void 0) return cached;
+	const sizeBytes = knownSizeBytes === void 0 ? statSourceFileSize(absolutePath) : knownSizeBytes;
+	const result = sizeBytes !== null && sizeBytes >= 2e4 && isMinifiedSource(absolutePath);
+	cachedIsLargeMinifiedByPath.set(absolutePath, result);
+	return result;
+};
+const isErrnoException = (error) => error instanceof Error && "code" in error;
 const IGNORABLE_READDIR_ERROR_CODES = new Set([
 	"EACCES",
 	"EPERM",
@@ -35902,11 +36005,7 @@ const IGNORABLE_READDIR_ERROR_CODES = new Set([
 	"ELOOP",
 	"ENAMETOOLONG"
 ]);
-const isIgnorableReaddirError = (error) => {
-	if (typeof error !== "object" || error === null) return false;
-	const errorCode = error.code;
-	return typeof errorCode === "string" && IGNORABLE_READDIR_ERROR_CODES.has(errorCode);
-};
+const isIgnorableReaddirError = (error) => isErrnoException(error) && typeof error.code === "string" && IGNORABLE_READDIR_ERROR_CODES.has(error.code);
 const readDirectoryEntries = (directoryPath) => {
 	try {
 		return NFS.readdirSync(directoryPath, { withFileTypes: true });
@@ -35953,7 +36052,7 @@ const readPackageJsonUncached = (packageJsonPath) => {
 		return JSON.parse(NFS.readFileSync(packageJsonPath, "utf-8"));
 	} catch (error) {
 		if (error instanceof SyntaxError) return {};
-		if (error instanceof Error && "code" in error) {
+		if (isErrnoException(error)) {
 			const { code } = error;
 			if (code === "EISDIR" || code === "EACCES" || code === "EPERM" || code === "ENOENT") return {};
 		}
@@ -36678,17 +36777,13 @@ const isPackageJsonReactNativeAware = (packageJson) => {
 	return false;
 };
 const hasReactNativeWorkspaceAnywhere = (rootDirectory, rootPackageJson) => someWorkspacePackageJson(rootDirectory, rootPackageJson, isPackageJsonReactNativeAware);
-const getExpoDependencySpec = (packageJson) => {
-	const spec = packageJson.dependencies?.expo ?? packageJson.devDependencies?.expo ?? packageJson.peerDependencies?.expo ?? packageJson.optionalDependencies?.expo;
+const getDependencySpec = (packageJson, packageName) => {
+	const spec = packageJson.dependencies?.[packageName] ?? packageJson.devDependencies?.[packageName] ?? packageJson.peerDependencies?.[packageName] ?? packageJson.optionalDependencies?.[packageName];
 	return typeof spec === "string" ? spec : null;
 };
-const findExpoVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, getExpoDependencySpec);
+const findExpoVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => getDependencySpec(packageJson, "expo"));
 const SHOPIFY_FLASH_LIST_PACKAGE_NAME = "@shopify/flash-list";
-const getShopifyFlashListDependencySpec = (packageJson) => {
-	const spec = packageJson.dependencies?.["@shopify/flash-list"] ?? packageJson.devDependencies?.["@shopify/flash-list"] ?? packageJson.peerDependencies?.["@shopify/flash-list"] ?? packageJson.optionalDependencies?.["@shopify/flash-list"];
-	return typeof spec === "string" ? spec : null;
-};
-const findShopifyFlashListVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, getShopifyFlashListDependencySpec);
+const findShopifyFlashListVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => getDependencySpec(packageJson, SHOPIFY_FLASH_LIST_PACKAGE_NAME));
 const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, version }) => {
 	if (version === null || !isCatalogReference(version)) return version;
 	const catalogName = extractCatalogName(version);
@@ -36700,11 +36795,7 @@ const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson,
 	if (!isFile(monorepoPackageJsonPath)) return version;
 	return resolveCatalogVersion(readPackageJson$1(monorepoPackageJsonPath), packageName, monorepoRoot, catalogName) ?? version;
 };
-const getNextjsDependencySpec = (packageJson) => {
-	const spec = packageJson.dependencies?.next ?? packageJson.devDependencies?.next ?? packageJson.peerDependencies?.next ?? packageJson.optionalDependencies?.next;
-	return typeof spec === "string" ? spec : null;
-};
-const findNextjsVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, getNextjsDependencySpec);
+const findNextjsVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => getDependencySpec(packageJson, "next"));
 const getPreactVersion = (packageJson) => {
 	return {
 		...packageJson.peerDependencies,
@@ -36771,6 +36862,7 @@ const DOCS_URL = "https://react.doctor/docs";
 const DOCS_RULES_BASE_URL = `${DOCS_URL}/rules`;
 const FETCH_TIMEOUT_MS = 1e4;
 const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
+const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
 const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
 const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
 const OXLINT_NODE_REQUIREMENT = "^20.19.0 || >=22.12.0";
@@ -36793,6 +36885,11 @@ const ES_TARGET_YEAR_BY_NAME = {
 	esnext: 9999
 };
 /**
+* tsconfig filenames probed when resolving a project's TypeScript
+* compiler options — the root config first, then a monorepo base config.
+*/
+const TSCONFIG_FILENAMES = ["tsconfig.json", "tsconfig.base.json"];
+/**
 * Project-config files that `StagedFiles.materialize` copies into
 * the temp directory alongside staged sources so oxlint resolves
 * `tsconfig` / `package.json` / lint configs the same way it would
@@ -36842,7 +36939,16 @@ const CANONICAL_DISCORD_URL = "https://react.doctor/discord";
 const SKILL_NAME = "react-doctor";
 const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
 const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
+const NODE_COMPILE_CACHE_DIR_NAME = "node-compile-cache";
+const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
+const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
+const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
+const LINT_PHASE_TIMEOUT_MS = 3e5;
+const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
+const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
+const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
+const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const REACT_SERVER_DOM_PACKAGES = [
 	"react-server-dom-webpack",
@@ -36865,14 +36971,25 @@ const APP_ONLY_RULE_KEYS = new Set([
 ]);
 const COMPILER_CLEANUP_BUCKET = "compiler-cleanup";
 const COMPILER_CLEANUP_RULE_KEYS = new Set(["react-doctor/react-compiler-no-manual-memoization"]);
+const ROOT_CAUSE_GROUPABLE_RULE_KEYS = new Set([
+	"react-doctor/no-derived-state",
+	"react-doctor/no-derived-state-effect",
+	"react-doctor/no-derived-useState",
+	"react-doctor/no-adjust-state-on-prop-change",
+	"react-doctor/no-reset-all-state-on-prop-change"
+]);
 const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
 const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 const SOCKET_FREE_PURL_API_BASE = "https://firewall-api.socket.dev/purl";
 const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
 const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
+const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
+const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SUPPLY_CHAIN_PLUGIN = "socket";
 const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
 const SUPPLY_CHAIN_CATEGORY = "Security";
+const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
+const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
 const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
 const TSCONFIG_FILENAME = "tsconfig.json";
 const isRelativeExtendsValue = (extendsValue) => extendsValue.startsWith("./") || extendsValue.startsWith("../") || Path.isAbsolute(extendsValue);
@@ -37314,6 +37431,7 @@ const isTailwindAtLeast = (detected, required) => {
 	if (detected.major !== required.major) return detected.major > required.major;
 	return detected.minor >= required.minor;
 };
+const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
 var InvalidGlobPatternError = class extends Error {
 	pattern;
 	reason;
@@ -37342,7 +37460,7 @@ const compileGlobPattern = (rawPattern) => {
 	try {
 		return import_picomatch.default.makeRe(normalizeGlobPattern(rawPattern), PICOMATCH_OPTIONS);
 	} catch (caughtError) {
-		throw new InvalidGlobPatternError(rawPattern, caughtError instanceof Error ? caughtError.message : String(caughtError));
+		throw new InvalidGlobPatternError(rawPattern, messageFromUnknown(caughtError));
 	}
 };
 const compileGlobPatternsLenient = (patterns, onInvalid) => {
@@ -37438,115 +37556,6 @@ const buildRuleSeverityControls = (config) => {
 		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
 	};
 };
-const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
-const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
-const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
-	let stringDelimiter = null;
-	for (let charIndex = 0; charIndex < openerCharIndex; charIndex++) {
-		const character = line[charIndex];
-		if (stringDelimiter !== null) {
-			if (character === "\\") {
-				charIndex++;
-				continue;
-			}
-			if (character === stringDelimiter) stringDelimiter = null;
-			continue;
-		}
-		if (character === "\"" || character === "'" || character === "`") {
-			stringDelimiter = character;
-			continue;
-		}
-		if (character === "/" && line[charIndex + 1] === "/") return true;
-	}
-	return false;
-};
-const findOpenerTagOnLine = (line) => {
-	for (const match of line.matchAll(JSX_OPENER_TAG_PATTERN)) {
-		if (match.index === void 0) continue;
-		if (!isOpenerMatchInsideLineComment(line, match.index)) return { startCharIndex: match.index + match[0].length };
-	}
-	return null;
-};
-const findJsxOpenerSpan = (lines, openerLineIndex) => {
-	const openerLine = lines[openerLineIndex];
-	if (openerLine === void 0) return null;
-	const opener = findOpenerTagOnLine(openerLine);
-	if (!opener) return null;
-	const lookaheadLimit = Math.min(lines.length, openerLineIndex + 32);
-	let braceDepth = 0;
-	let innerAngleDepth = 0;
-	let stringDelimiter = null;
-	for (let lineIndex = openerLineIndex; lineIndex < lookaheadLimit; lineIndex++) {
-		const currentLine = lines[lineIndex];
-		const startCharForLine = lineIndex === openerLineIndex ? opener.startCharIndex : 0;
-		for (let charIndex = startCharForLine; charIndex < currentLine.length; charIndex++) {
-			const character = currentLine[charIndex];
-			if (stringDelimiter !== null) {
-				if (character === "\\") {
-					charIndex++;
-					continue;
-				}
-				if (character === stringDelimiter) stringDelimiter = null;
-				continue;
-			}
-			if (character === "\"" || character === "'" || character === "`") {
-				stringDelimiter = character;
-				continue;
-			}
-			if (character === "{") {
-				braceDepth++;
-				continue;
-			}
-			if (character === "}") {
-				braceDepth--;
-				continue;
-			}
-			if (braceDepth !== 0) continue;
-			if (character === "<") {
-				const followCharacter = currentLine[charIndex + 1];
-				if (followCharacter !== void 0 && JSX_TAG_NAME_FOLLOW.test(followCharacter)) innerAngleDepth++;
-				continue;
-			}
-			if (character !== ">") continue;
-			const previousCharacter = currentLine[charIndex - 1];
-			const nextCharacter = currentLine[charIndex + 1];
-			if (previousCharacter === "=" || nextCharacter === "=") continue;
-			if (innerAngleDepth > 0) {
-				innerAngleDepth--;
-				continue;
-			}
-			return lineIndex;
-		}
-	}
-	return null;
-};
-const findEnclosingMultilineJsxOpenerStart = (lines, diagnosticLineIndex) => {
-	for (let candidateIndex = diagnosticLineIndex - 1; candidateIndex >= 0 && diagnosticLineIndex - candidateIndex <= 32; candidateIndex--) {
-		const openerCloseIndex = findJsxOpenerSpan(lines, candidateIndex);
-		if (openerCloseIndex !== null && openerCloseIndex >= diagnosticLineIndex) return candidateIndex;
-	}
-	return null;
-};
-const DISABLE_NEXT_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-next-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
-const findStackedDisableCommentsAbove = (lines, anchorIndex) => {
-	const collected = [];
-	let isStillInChain = true;
-	for (let candidateIndex = anchorIndex - 1; candidateIndex >= 0 && anchorIndex - candidateIndex <= 10; candidateIndex--) {
-		const candidateLine = lines[candidateIndex];
-		if (candidateLine === void 0) break;
-		const match = candidateLine.match(DISABLE_NEXT_LINE_PATTERN);
-		if (match) {
-			collected.push({
-				commentLineIndex: candidateIndex,
-				ruleList: match[1],
-				isInChain: isStillInChain
-			});
-			continue;
-		}
-		isStillInChain = false;
-	}
-	return collected;
-};
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -37671,7 +37680,13 @@ for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_N
 }
 const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
 const canonicalizeRuleKey = (ruleKey) => LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey] ?? ruleKey;
-const isSameRuleKey = (candidateRuleKey, targetRuleKey) => canonicalizeRuleKey(candidateRuleKey) === canonicalizeRuleKey(targetRuleKey);
+const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
+const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
+	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
+	const canonicalTarget = canonicalizeRuleKey(targetRuleKey);
+	if (canonicalCandidate === canonicalTarget) return true;
+	return isReactDoctorShortIdOf(canonicalCandidate, canonicalTarget) || isReactDoctorShortIdOf(canonicalTarget, canonicalCandidate);
+};
 const getEquivalentRuleKeys = (ruleKey) => {
 	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
 	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
@@ -37681,12 +37696,182 @@ const stripDescriptionTail = (ruleList) => {
 	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
 	return ruleList.slice(0, descriptionMatch.index);
 };
-const isRuleListedInComment = (ruleList, ruleId) => {
+const tokenizeRuleList = (ruleList) => {
 	const trimmed = ruleList?.trim();
-	if (!trimmed) return true;
+	if (!trimmed) return [];
 	const ruleSection = stripDescriptionTail(trimmed).trim();
-	if (!ruleSection) return true;
-	return ruleSection.split(/[,\s]+/).some((token) => isSameRuleKey(token.trim(), ruleId));
+	if (!ruleSection) return [];
+	return ruleSection.split(/[,\s]+/).map((token) => token.trim()).filter(Boolean);
+};
+const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
+const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
+const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
+const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — change it to \`${ruleId}\`.`;
+const tokenMisnamesRule = (token, ruleId) => token !== ruleId && isSameRuleKey(token, ruleId);
+const detectInlineNearMiss = (lines, diagnosticLineIndex, ruleId) => {
+	const candidates = [{
+		line: lines[diagnosticLineIndex],
+		requiredScope: "line"
+	}, {
+		line: lines[diagnosticLineIndex - 1],
+		requiredScope: "next-line"
+	}];
+	for (const { line, requiredScope } of candidates) {
+		const match = line?.match(FOREIGN_INLINE_DISABLE_PATTERN);
+		if (!match) continue;
+		const [, tool, scope, ruleList] = match;
+		if (scope !== requiredScope) continue;
+		const tokens = tokenizeRuleList(ruleList);
+		if (tokens.includes(ruleId)) continue;
+		for (const token of tokens) if (tokenMisnamesRule(token, ruleId)) return buildHint(tool, token, ruleId);
+	}
+	return null;
+};
+const detectBlockNearMiss = (lines, diagnosticLineIndex, ruleId) => {
+	let openMisname = null;
+	const lastLineIndex = Math.min(diagnosticLineIndex, lines.length - 1);
+	for (let lineIndex = 0; lineIndex <= lastLineIndex; lineIndex++) {
+		const line = lines[lineIndex];
+		if (line === void 0 || !line.includes("-disable") && !line.includes("-enable")) continue;
+		const disableMatch = line.match(FOREIGN_BLOCK_DISABLE_PATTERN);
+		if (disableMatch) {
+			const [, tool, ruleList] = disableMatch;
+			const tokens = tokenizeRuleList(ruleList);
+			if (tokens.includes(ruleId)) openMisname = null;
+			else {
+				const misnamed = tokens.find((token) => tokenMisnamesRule(token, ruleId));
+				if (misnamed) openMisname = {
+					tool,
+					token: misnamed
+				};
+			}
+			continue;
+		}
+		const enableMatch = line.match(FOREIGN_BLOCK_ENABLE_PATTERN);
+		if (enableMatch) {
+			const enabledRules = tokenizeRuleList(enableMatch[1]);
+			if (enabledRules.length === 0 || enabledRules.some((rule) => isSameRuleKey(rule, ruleId))) openMisname = null;
+		}
+	}
+	return openMisname ? buildHint(openMisname.tool, openMisname.token, ruleId) : null;
+};
+const detectForeignDisableNearMiss = (lines, diagnosticLineIndex, ruleId) => {
+	if (!ruleId.startsWith("react-doctor/")) return null;
+	return detectInlineNearMiss(lines, diagnosticLineIndex, ruleId) ?? detectBlockNearMiss(lines, diagnosticLineIndex, ruleId);
+};
+const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
+const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
+const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
+	let stringDelimiter = null;
+	for (let charIndex = 0; charIndex < openerCharIndex; charIndex++) {
+		const character = line[charIndex];
+		if (stringDelimiter !== null) {
+			if (character === "\\") {
+				charIndex++;
+				continue;
+			}
+			if (character === stringDelimiter) stringDelimiter = null;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			stringDelimiter = character;
+			continue;
+		}
+		if (character === "/" && line[charIndex + 1] === "/") return true;
+	}
+	return false;
+};
+const findOpenerTagOnLine = (line) => {
+	for (const match of line.matchAll(JSX_OPENER_TAG_PATTERN)) {
+		if (match.index === void 0) continue;
+		if (!isOpenerMatchInsideLineComment(line, match.index)) return { startCharIndex: match.index + match[0].length };
+	}
+	return null;
+};
+const findJsxOpenerSpan = (lines, openerLineIndex) => {
+	const openerLine = lines[openerLineIndex];
+	if (openerLine === void 0) return null;
+	const opener = findOpenerTagOnLine(openerLine);
+	if (!opener) return null;
+	const lookaheadLimit = Math.min(lines.length, openerLineIndex + 32);
+	let braceDepth = 0;
+	let innerAngleDepth = 0;
+	let stringDelimiter = null;
+	for (let lineIndex = openerLineIndex; lineIndex < lookaheadLimit; lineIndex++) {
+		const currentLine = lines[lineIndex];
+		const startCharForLine = lineIndex === openerLineIndex ? opener.startCharIndex : 0;
+		for (let charIndex = startCharForLine; charIndex < currentLine.length; charIndex++) {
+			const character = currentLine[charIndex];
+			if (stringDelimiter !== null) {
+				if (character === "\\") {
+					charIndex++;
+					continue;
+				}
+				if (character === stringDelimiter) stringDelimiter = null;
+				continue;
+			}
+			if (character === "\"" || character === "'" || character === "`") {
+				stringDelimiter = character;
+				continue;
+			}
+			if (character === "{") {
+				braceDepth++;
+				continue;
+			}
+			if (character === "}") {
+				braceDepth--;
+				continue;
+			}
+			if (braceDepth !== 0) continue;
+			if (character === "<") {
+				const followCharacter = currentLine[charIndex + 1];
+				if (followCharacter !== void 0 && JSX_TAG_NAME_FOLLOW.test(followCharacter)) innerAngleDepth++;
+				continue;
+			}
+			if (character !== ">") continue;
+			const previousCharacter = currentLine[charIndex - 1];
+			const nextCharacter = currentLine[charIndex + 1];
+			if (previousCharacter === "=" || nextCharacter === "=") continue;
+			if (innerAngleDepth > 0) {
+				innerAngleDepth--;
+				continue;
+			}
+			return lineIndex;
+		}
+	}
+	return null;
+};
+const findEnclosingMultilineJsxOpenerStart = (lines, diagnosticLineIndex) => {
+	for (let candidateIndex = diagnosticLineIndex - 1; candidateIndex >= 0 && diagnosticLineIndex - candidateIndex <= 32; candidateIndex--) {
+		const openerCloseIndex = findJsxOpenerSpan(lines, candidateIndex);
+		if (openerCloseIndex !== null && openerCloseIndex >= diagnosticLineIndex) return candidateIndex;
+	}
+	return null;
+};
+const DISABLE_NEXT_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-next-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
+const findStackedDisableCommentsAbove = (lines, anchorIndex) => {
+	const collected = [];
+	let isStillInChain = true;
+	for (let candidateIndex = anchorIndex - 1; candidateIndex >= 0 && anchorIndex - candidateIndex <= 10; candidateIndex--) {
+		const candidateLine = lines[candidateIndex];
+		if (candidateLine === void 0) break;
+		const match = candidateLine.match(DISABLE_NEXT_LINE_PATTERN);
+		if (match) {
+			collected.push({
+				commentLineIndex: candidateIndex,
+				ruleList: match[1],
+				isInChain: isStillInChain
+			});
+			continue;
+		}
+		isStillInChain = false;
+	}
+	return collected;
+};
+const isRuleListedInComment = (ruleList, ruleId) => {
+	const tokens = tokenizeRuleList(ruleList);
+	if (tokens.length === 0) return true;
+	return tokens.some((token) => isSameRuleKey(token, ruleId));
 };
 const DISABLE_LINE_PATTERN = /(?:\/\/|\/\*)\s*react-doctor-disable-line\b(?:\s+([^\r\n]*?))?\s*(?:\*\/)?\s*\}?\s*$/;
 const formatLineGap = (gapLineCount) => `${gapLineCount} line${gapLineCount === 1 ? "" : "s"}`;
@@ -37730,7 +37915,7 @@ const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
 	};
 	return {
 		isSuppressed: false,
-		nearMissHint: classifyFromComments([directComments, openerComments], diagnosticLineIndex, ruleId)
+		nearMissHint: classifyFromComments([directComments, openerComments], diagnosticLineIndex, ruleId) ?? detectForeignDisableNearMiss(lines, diagnosticLineIndex, ruleId)
 	};
 };
 /**
@@ -38156,6 +38341,11 @@ var OxlintBatchExceeded = class extends TaggedErrorClass()("OxlintBatchExceeded"
 		}
 	}
 };
+var ScanDeadlineExceeded = class extends TaggedErrorClass()("ScanDeadlineExceeded", { detail: String$1 }) {
+	get message() {
+		return `Scan exceeded its overall time budget: ${this.detail}`;
+	}
+};
 var OxlintSpawnFailed = class extends TaggedErrorClass()("OxlintSpawnFailed", { cause: Unknown }) {
 	get message() {
 		return `Failed to run oxlint: ${pretty(fail$6(this.cause))}`;
@@ -38219,6 +38409,7 @@ var GitBaseBranchInvalid = class extends TaggedErrorClass()("GitBaseBranchInvali
 const ReactDoctorErrorReason = Union([
 	OxlintUnavailable,
 	OxlintBatchExceeded,
+	ScanDeadlineExceeded,
 	OxlintSpawnFailed,
 	OxlintOutputUnparseable,
 	ConfigParseFailed,
@@ -38291,15 +38482,105 @@ const layerOtlp = unwrap$3(gen(function* () {
 	}).pipe(provide$2(layer$9));
 }).pipe(orDie));
 /**
-* Resolves a requested lint worker count to a clamped integer within
-* `[MIN_SCAN_CONCURRENCY, MAX_SCAN_CONCURRENCY]`. `"auto"` uses the
-* machine's CPU cores; out-of-range or non-finite requests degrade to
+* Read a positive-millisecond timeout from an env var, falling back to
+* `defaultMs` when the var is unset, non-finite, or not strictly positive.
+*/
+const readPositiveEnvMs = (envVarName, defaultMs) => {
+	const rawValue = process.env[envVarName];
+	if (rawValue === void 0) return defaultMs;
+	const parsedValue = Number(rawValue);
+	if (!Number.isFinite(parsedValue) || parsedValue <= 0) return defaultMs;
+	return parsedValue;
+};
+const CGROUP_V2_MEMORY_MAX_PATH = "/sys/fs/cgroup/memory.max";
+const CGROUP_V1_MEMORY_LIMIT_PATH = "/sys/fs/cgroup/memory/memory.limit_in_bytes";
+const CGROUP_UNLIMITED_SENTINEL_BYTES = Number.MAX_SAFE_INTEGER;
+/**
+* Parses one raw cgroup memory-limit file value into a positive byte count, or
+* `undefined` when it represents "no limit" (the v2 `"max"` literal, an empty
+* read, a non-positive / non-finite value, or v1's near-2^63 unlimited
+* sentinel). Pure and exported so the classification is unit-testable without
+* touching the filesystem.
+*/
+const parseCgroupMemoryLimitBytes = (raw) => {
+	if (raw === void 0) return void 0;
+	const trimmed = raw.trim();
+	if (trimmed === "" || trimmed === "max") return void 0;
+	const parsed = Number(trimmed);
+	if (!Number.isFinite(parsed) || parsed <= 0 || parsed >= CGROUP_UNLIMITED_SENTINEL_BYTES) return;
+	return parsed;
+};
+const CGROUP_MEMORY_LIMIT_PATHS = [CGROUP_V2_MEMORY_MAX_PATH, CGROUP_V1_MEMORY_LIMIT_PATH];
+/**
+* Reads this process's cgroup memory limit in bytes from the first candidate
+* path that yields a real limit, or `undefined` when none does — no cgroup, no
+* limit, or the files are unreadable (e.g. macOS / Windows dev machines).
+* `os.totalmem()` reports the HOST total and ignores cgroup memory limits, so a
+* memory-constrained container over-reports total memory; `resolveAutoScan-
+* Concurrency` takes `min(totalmem, this)` to honor the limit.
+*
+* The cgroup v2 read is the mount-root `memory.max`, which IS the container's
+* limit under the standard cgroup-namespace setup CI runners use (the
+* container's own cgroup is the root of its namespaced view). A process in a
+* non-namespaced nested/delegated cgroup whose root reads `"max"` is not
+* detected here and falls back to the host total; the EAGAIN/ENOMEM serial
+* replay in `spawnLintBatches` remains the runtime backstop for that case.
+*
+* `candidatePaths` is injectable so tests exercise the v2-wins-over-v1
+* precedence, the skip-unreadable fallback, and the all-missing case without a
+* real `/sys/fs/cgroup`.
+*/
+const readCgroupMemoryLimitBytes = (candidatePaths = CGROUP_MEMORY_LIMIT_PATHS) => {
+	for (const limitPath of candidatePaths) {
+		let raw;
+		try {
+			raw = fs.readFileSync(limitPath, "utf8");
+		} catch {
+			continue;
+		}
+		const limitBytes = parseCgroupMemoryLimitBytes(raw);
+		if (limitBytes !== void 0) return limitBytes;
+	}
+};
+/**
+* Clamps a requested lint worker count to `[MIN_SCAN_CONCURRENCY,
+* HARD_MAX_SCAN_CONCURRENCY]` as a finite integer. This is the explicit-pin and
+* spawn-boundary clamp — the memory-and-core-budgeted auto count comes from
+* `resolveAutoScanConcurrency`. Out-of-range or non-finite requests degrade to
 * `MIN_SCAN_CONCURRENCY` rather than oversubscribing or running zero workers.
 */
 const resolveScanConcurrency = (requested) => {
-	const desired = requested === "auto" ? os.availableParallelism() : requested;
-	if (!Number.isFinite(desired) || desired < 1) return 1;
-	return Math.max(1, Math.min(Math.floor(desired), 16));
+	if (!Number.isFinite(requested) || requested < 1) return 1;
+	return Math.min(Math.floor(requested), 32);
+};
+const readSystemFacts = () => ({
+	availableCores: os.availableParallelism(),
+	totalMemoryBytes: os.totalmem(),
+	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
+});
+/**
+* Auto lint-worker count: the smaller of the (cgroup-CPU-aware) core count and
+* the number of `PER_WORKER_MEM_BUDGET_BYTES` workers that fit in available
+* memory, then clamped to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
+*
+* `os.availableParallelism()` already respects cgroup CPU quotas, so the core
+* term needs no help. Available memory is `os.totalmem()` floored by the cgroup
+* memory limit — `os.freemem()` is deliberately NOT used: it excludes
+* reclaimable page cache and reads near-zero on macOS / cache-heavy Linux, which
+* would collapse the auto path to a single worker. `os.totalmem()` reports the
+* host total even inside a container, so the cgroup limit (read directly,
+* because Node doesn't fold it into `totalmem()`) is the real ceiling there.
+*
+* `facts` is injectable so tests exercise core-bound, memory-bound, cgroup-
+* limited, and ceiling cases without mocking `os` or the filesystem.
+*/
+const resolveAutoScanConcurrency = (facts = readSystemFacts()) => {
+	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
+	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
+	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
+};
+const resolveLintBatchOrdering = () => {
+	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "cost" ? "cost" : "arrival";
 };
 /**
 * Per-batch oxlint wall-clock budget. Reads from the env var on
@@ -38307,11 +38588,38 @@ const resolveScanConcurrency = (requested) => {
 * microVMs without recompiling react-doctor. Tests override via
 * `Layer.succeed(OxlintSpawnTimeoutMs, ...)`.
 */
-var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => {
-	const raw = process.env["REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS"];
-	if (raw === void 0) return OXLINT_SPAWN_TIMEOUT_MS;
+var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS", OXLINT_SPAWN_TIMEOUT_MS) }) {};
+/**
+* Effect-side cap on the lint phase. The env var lets CI / eval runners
+* raise the phase budget for slow large repos without recompiling.
+* Tests override via `Layer.succeed(LintPhaseTimeoutMs, ...)`.
+*/
+var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", LINT_PHASE_TIMEOUT_MS) }) {};
+/**
+* Effect-side cap on the dead-code phase, sitting above the in-worker
+* timeout as a runtime-independent backstop. The env var raises it for
+* type-heavy projects; tests override via
+* `Layer.succeed(DeadCodePhaseTimeoutMs, ...)`.
+*/
+var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", DEAD_CODE_PHASE_TIMEOUT_MS) }) {};
+/**
+* Overall scan deadline backstop, bounding everything the per-phase
+* timeouts don't (wedged git / IO). The env var raises it for very
+* large repos; tests override via `Layer.succeed(ScanDeadlineMs, ...)`.
+*/
+var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", SCAN_TOTAL_DEADLINE_MS) }) {};
+/**
+* Wall-clock budget for the supply-chain check when it runs on a background
+* fiber overlapping the lint pass. Reads from the env var on startup so the
+* eval harness can raise the budget under sandbox microVMs (slower network)
+* without recompiling react-doctor. Tests override via
+* `Layer.succeed(SupplyChainOverlapTimeoutMs, ...)`.
+*/
+var SupplyChainOverlapTimeoutMs = class extends Reference("react-doctor/SupplyChainOverlapTimeoutMs", { defaultValue: () => {
+	const raw = process.env["REACT_DOCTOR_SUPPLY_CHAIN_TIMEOUT_MS"];
+	if (raw === void 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
 	const parsed = Number(raw);
-	if (!Number.isFinite(parsed) || parsed <= 0) return OXLINT_SPAWN_TIMEOUT_MS;
+	if (!Number.isFinite(parsed) || parsed <= 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
 	return parsed;
 } }) {};
 /**
@@ -38322,31 +38630,93 @@ var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTime
 */
 var OxlintOutputMaxBytes = class extends Reference("react-doctor/OxlintOutputMaxBytes", { defaultValue: () => OXLINT_OUTPUT_MAX_BYTES }) {};
 /**
-* Number of oxlint subprocesses the lint pass runs in parallel. Defaults
-* to auto-detected CPU cores (parallel) so large repos scan fast out of
-* the box; `spawnLintBatches` transparently falls back to a single worker
-* if a parallel run exhausts system resources. The CLI's `--no-parallel`
-* flag forces serial via `Layer.succeed`; the `REACT_DOCTOR_PARALLEL` env
-* var seeds the default for programmatic / CI callers that never touch the
-* flag — parallelism is opt-OUT, so only the explicit serial values pin
-* one worker:
-*
-*   - unset / `auto` / `true` / `on`  → available CPU cores (clamped)
+* Number of oxlint subprocesses the lint pass runs in parallel. Defaults to a
+* memory-and-core-budgeted auto count (`resolveAutoScanConcurrency`) so large
+* repos scan fast out of the box without OOMing the native binding on a
+* high-core / low-memory box; `spawnLintBatches` transparently falls back to a
+* single worker if a parallel run still exhausts system resources. The CLI's
+* `--no-parallel` flag forces serial via `Layer.succeed`; the
+* `REACT_DOCTOR_PARALLEL` env var seeds the default for programmatic / CI
+* callers that never touch the flag — parallelism is opt-OUT, so only the
+* explicit serial values pin one worker:
+*
+*   - unset / `auto` / `true` / `on`  → memory-and-core-budgeted auto count
 *   - `0` / `false` / `off`           → `1` (serial)
 *   - a positive integer              → that many workers (clamped)
-*   - any other value                 → available CPU cores (clamped)
+*   - any other value                 → memory-and-core-budgeted auto count
 *
 * The resolved value is always within
-* `[MIN_SCAN_CONCURRENCY, MAX_SCAN_CONCURRENCY]`.
+* `[MIN_SCAN_CONCURRENCY, HARD_MAX_SCAN_CONCURRENCY]`.
 */
 var OxlintConcurrency = class extends Reference("react-doctor/OxlintConcurrency", { defaultValue: () => {
 	const raw = process.env["REACT_DOCTOR_PARALLEL"];
-	if (raw === void 0) return resolveScanConcurrency("auto");
+	if (raw === void 0) return resolveAutoScanConcurrency();
 	const normalized = raw.trim().toLowerCase();
 	if (normalized === "0" || normalized === "false" || normalized === "off") return 1;
 	const parsed = Number.parseInt(normalized, 10);
 	if (Number.isInteger(parsed) && parsed > 0) return resolveScanConcurrency(parsed);
-	return resolveScanConcurrency("auto");
+	return resolveAutoScanConcurrency();
+} }) {};
+/**
+* Three-state control for overlapping the dead-code pass with the lint pass —
+* forking dead-code as a child fiber that runs DURING lint instead of strictly
+* after it.
+*
+*   - `"auto"` (default) / `"off"` → strictly SEQUENTIAL: dead-code runs after
+*     lint with the full core budget. Both deslop's parse pool and the oxlint
+*     pool are CPU-bound and each size themselves to all cores, so overlapping
+*     them only oversubscribes (~2x the cores) and starves the parse pass past
+*     its timeout — for no wall-clock win, since there are no spare cores to
+*     absorb the second pass. Sequential is both faster per-phase and safe.
+*   - `"on"` → force the overlap anyway. The orchestrator then SPLITS the core
+*     budget (`DEAD_CODE_OVERLAP_PARSE_SHARE`): deslop's parse pool is capped
+*     and lint shrinks to the remainder, so the two sum to the cores instead of
+*     doubling them, and the dead-code timeout scales up for the reduced share.
+*
+* Seeded from `REACT_DOCTOR_DEAD_CODE_OVERLAP` so operators get a redeploy-free
+* switch; tests pin it via `Layer.succeed(DeadCodeOverlap, ...)`.
+*/
+var DeadCodeOverlap = class extends Reference("react-doctor/DeadCodeOverlap", { defaultValue: () => {
+	const raw = process.env["REACT_DOCTOR_DEAD_CODE_OVERLAP"]?.trim().toLowerCase();
+	if (raw === "on" || raw === "true" || raw === "1") return "on";
+	if (raw === "off" || raw === "false" || raw === "0") return "off";
+	return "auto";
+} }) {};
+/**
+* How the full-scan lint pass orders its file batches. `"arrival"` (the
+* default) keeps `git ls-files` discovery order. `"cost"` opts into LPT (feed
+* the largest files first); set `REACT_DOCTOR_LINT_BATCH_ORDERING=cost`. NOTE:
+* `cost` is OFF by default because the current sort-desc-then-chunk-100 packs
+* the heaviest files into one wave-1 batch — on size-skewed repos that mega-
+* batch is a straggler (and can trip the per-batch timeout + split), measurably
+* regressing the common full-scan case. LPT needs the heavy files SPREAD across
+* batches before `cost` earns the default. Tests override via
+* `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans never reach this
+* — they pass user-scoped `includePaths` that skip discovery and stay in
+* arrival order; only the full-scan branch reads it.
+*/
+var LintBatchOrdering = class extends Reference("react-doctor/LintBatchOrdering", { defaultValue: resolveLintBatchOrdering }) {};
+const CACHE_DISABLED_VALUES$1 = new Set(["1", "true"]);
+/**
+* Whether the per-file lint cache (`runners/oxlint/file-lint-cache.ts`) is
+* active. Defaults ON — repeat scans re-lint only the files whose content
+* changed, and correctness is guaranteed byte-identical to a cold scan by the
+* always-fresh cross-file sidecar. Opt-OUT, two knobs (matching the whole-repo
+* scan cache's `REACT_DOCTOR_NO_CACHE`):
+*
+*   - `REACT_DOCTOR_NO_CACHE` — the global off-switch; disables BOTH the
+*     whole-repo scan cache and this per-file cache.
+*   - `REACT_DOCTOR_NO_FILE_CACHE` — granular: bust only the per-file cache
+*     while keeping the whole-repo short-circuit.
+*
+* Tests override via `Layer.succeed(PerFileLintCacheEnabled, false)`.
+*/
+var PerFileLintCacheEnabled = class extends Reference("react-doctor/PerFileLintCacheEnabled", { defaultValue: () => {
+	const noCache = process.env["REACT_DOCTOR_NO_CACHE"]?.toLowerCase() ?? "";
+	const noFileCache = process.env["REACT_DOCTOR_NO_FILE_CACHE"]?.toLowerCase() ?? "";
+	if (CACHE_DISABLED_VALUES$1.has(noCache)) return false;
+	if (CACHE_DISABLED_VALUES$1.has(noFileCache)) return false;
+	return true;
 } }) {};
 const DIAGNOSTIC_SURFACES = [
 	"cli",
@@ -38520,7 +38890,6 @@ const PACKAGE_JSON_FILENAME = "package.json";
 const PACKAGE_JSON_CONFIG_KEY$1 = "reactDoctor";
 const LEGACY_CONFIG_FILENAME = "react-doctor.config.json";
 const jiti = createJiti(import.meta.url);
-const formatError = (error) => error instanceof Error ? error.message : String(error);
 const importDefaultExport = async (jitiInstance, filePath) => {
 	const imported = await jitiInstance.import(filePath);
 	return imported?.default ?? imported;
@@ -38552,7 +38921,7 @@ const loadModuleConfig = async (filePath) => {
 		try {
 			return await importDefaultExport(aliasJiti, filePath);
 		} catch (retryError) {
-			throw new Error(`${formatError(error)} (retry with ${SELF_PACKAGE_IMPORT_SPECIFIER} aliased to the running react-doctor package also failed: ${formatError(retryError)})`, { cause: retryError });
+			throw new Error(`${messageFromUnknown(error)} (retry with ${SELF_PACKAGE_IMPORT_SPECIFIER} aliased to the running react-doctor package also failed: ${messageFromUnknown(retryError)})`, { cause: retryError });
 		}
 	}
 };
@@ -38601,7 +38970,7 @@ const loadLegacyConfig = (directory) => {
 		}
 		warn(`${LEGACY_CONFIG_FILENAME} must contain an object, ignoring.`);
 	} catch (error) {
-		warn(`Failed to load ${LEGACY_CONFIG_FILENAME}: ${formatError(error)}`);
+		warn(`Failed to load ${LEGACY_CONFIG_FILENAME}: ${messageFromUnknown(error)}`);
 	}
 	return {
 		status: "invalid",
@@ -38628,7 +38997,7 @@ const loadConfigFromDirectory = async (directory) => {
 			warn(`${CONFIG_BASENAME}.${extension} must export an object, ignoring.`);
 			sawBrokenConfigFile = true;
 		} catch (error) {
-			warn(`Failed to load ${CONFIG_BASENAME}.${extension}: ${formatError(error)}`);
+			warn(`Failed to load ${CONFIG_BASENAME}.${extension}: ${messageFromUnknown(error)}`);
 			sawBrokenConfigFile = true;
 		}
 	}
@@ -38758,6 +39127,31 @@ const resolveScanTarget = async (requestedDirectory, options = {}) => {
 		didRedirectViaRootDir: redirectedDirectory !== null
 	};
 };
+const buildFixGroupId = (diagnostic) => createHash("sha1").update(JSON.stringify([
+	diagnostic.filePath,
+	`${diagnostic.plugin}/${diagnostic.rule}`,
+	diagnostic.message
+])).digest("hex").slice(0, 16);
+const isGroupableRule = (diagnostic) => ROOT_CAUSE_GROUPABLE_RULE_KEYS.has(`${diagnostic.plugin}/${diagnostic.rule}`);
+const assignFixGroups = (diagnostics) => {
+	const siteCountByGroupId = /* @__PURE__ */ new Map();
+	for (const diagnostic of diagnostics) {
+		if (!isGroupableRule(diagnostic)) continue;
+		const groupId = buildFixGroupId(diagnostic);
+		siteCountByGroupId.set(groupId, (siteCountByGroupId.get(groupId) ?? 0) + 1);
+	}
+	return diagnostics.map((diagnostic) => {
+		if (!isGroupableRule(diagnostic)) return diagnostic;
+		const groupId = buildFixGroupId(diagnostic);
+		if ((siteCountByGroupId.get(groupId) ?? 0) < 2) return diagnostic;
+		return {
+			...diagnostic,
+			fixGroupId: groupId
+		};
+	});
+};
+const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const sortDiagnosticsStable = (diagnostics) => [...diagnostics].sort((left, right) => compareStrings(left.filePath, right.filePath) || left.line - right.line || left.column - right.column || compareStrings(left.plugin, right.plugin) || compareStrings(left.rule, right.rule) || compareStrings(left.severity, right.severity) || compareStrings(left.message, right.message));
 const getDirectDependencyNames = (packageJson) => new Set([...Object.keys(packageJson.dependencies ?? {}), ...Object.keys(packageJson.devDependencies ?? {})]);
 const buildExpoCheckContext = (rootDirectory, expoVersion) => {
 	const packageJson = readPackageJson$1(Path.join(rootDirectory, "package.json"));
@@ -39264,10 +39658,15 @@ const buildHardeningDiagnostic = (input) => ({
 	column: input.column ?? 0,
 	category: "Security"
 });
-const checkPnpmHardening = (rootDirectory) => {
-	if (!isPnpmManagedProject(rootDirectory)) return [];
-	const workspacePath = Path.join(rootDirectory, PNPM_WORKSPACE_FILE);
-	const settings = parseHardeningSettings(isFile(workspacePath) ? NFS.readFileSync(workspacePath, "utf-8") : "");
+const checkPnpmHardening = (scanDirectory) => {
+	if (!isPnpmManagedProject(scanDirectory)) return [];
+	const workspacePath = Path.join(scanDirectory, PNPM_WORKSPACE_FILE);
+	const hasWorkspaceFile = isFile(workspacePath);
+	if (!hasWorkspaceFile) {
+		const monorepoRoot = findMonorepoRoot(scanDirectory);
+		if (monorepoRoot !== null && isFile(Path.join(monorepoRoot, PNPM_WORKSPACE_FILE))) return [];
+	}
+	const settings = parseHardeningSettings(hasWorkspaceFile ? NFS.readFileSync(workspacePath, "utf-8") : "");
 	const diagnostics = [];
 	if (settings.minimumReleaseAge === null) diagnostics.push(buildHardeningDiagnostic({
 		message: "pnpm-workspace.yaml is missing `minimumReleaseAge` — newly published versions can ship malware that gets caught and unpublished within hours",
@@ -39903,7 +40302,7 @@ const readIgnoreFile = (filePath) => {
 	try {
 		content = NFS.readFileSync(filePath, "utf-8");
 	} catch (error) {
-		const errnoCode = error?.code;
+		const errnoCode = isErrnoException(error) ? error.code : void 0;
 		if (errnoCode && errnoCode !== "ENOENT") runSync(warn$1(`Could not read ignore file ${filePath}: ${errnoCode}`));
 		return [];
 	}
@@ -39941,8 +40340,8 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
+const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const KNIP_JSON_FILENAME = "knip.json";
-const isRecord$1$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const readJsonFileSafe = (filePath) => {
 	let rawContents;
 	try {
@@ -39958,10 +40357,10 @@ const readJsonFileSafe = (filePath) => {
 };
 const readKnipConfig = (rootDirectory) => {
 	const knipJson = readJsonFileSafe(path.join(rootDirectory, KNIP_JSON_FILENAME));
-	if (isRecord$1$1(knipJson)) return knipJson;
+	if (isRecord$2(knipJson)) return knipJson;
 	const packageJson = readJsonFileSafe(path.join(rootDirectory, "package.json"));
-	const packageKnipConfig = isRecord$1$1(packageJson) ? packageJson.knip : null;
-	return isRecord$1$1(packageKnipConfig) ? packageKnipConfig : null;
+	const packageKnipConfig = isRecord$2(packageJson) ? packageJson.knip : null;
+	return isRecord$2(packageKnipConfig) ? packageKnipConfig : null;
 };
 const normalizePatternList = (value) => {
 	if (typeof value === "string" && value.length > 0) return [value];
@@ -39973,10 +40372,10 @@ const prefixWorkspacePatterns = (workspacePattern, patterns) => {
 	return patterns.map((pattern) => pattern.startsWith("!") ? `!${normalizedWorkspacePattern}/${pattern.slice(1)}` : `${normalizedWorkspacePattern}/${pattern}`);
 };
 const collectKnipWorkspacePatterns = (workspaces, settingName) => {
-	if (!isRecord$1$1(workspaces)) return [];
+	if (!isRecord$2(workspaces)) return [];
 	const patterns = [];
 	for (const [workspacePattern, workspaceConfig] of Object.entries(workspaces)) {
-		if (!isRecord$1$1(workspaceConfig)) continue;
+		if (!isRecord$2(workspaceConfig)) continue;
 		patterns.push(...prefixWorkspacePatterns(workspacePattern, normalizePatternList(workspaceConfig[settingName])));
 	}
 	return patterns;
@@ -39986,12 +40385,11 @@ const collectKnipPatterns = (rootDirectory, settingName) => {
 	if (!config) return [];
 	return [...normalizePatternList(config[settingName]), ...collectKnipWorkspacePatterns(config.workspaces, settingName)];
 };
-const collectDeadCodeIgnorePatterns = (rootDirectory, userConfig) => {
+const collectDeadCodeIgnorePatterns = (rootDirectory) => {
 	const seen = /* @__PURE__ */ new Set();
 	const sources = [
 		readIgnoreFile(path.join(rootDirectory, ".gitignore")),
 		collectIgnorePatterns(rootDirectory),
-		userConfig?.ignore?.files ?? [],
 		collectKnipPatterns(rootDirectory, "ignore")
 	];
 	for (const source of sources) for (const pattern of source) seen.add(pattern);
@@ -40022,8 +40420,6 @@ const toCanonicalPath = (filePath) => {
 };
 const DEAD_CODE_PLUGIN = "deslop";
 const DEAD_CODE_CATEGORY = "Maintainability";
-const TSCONFIG_FILENAMES$1 = ["tsconfig.json", "tsconfig.base.json"];
-const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const DEAD_CODE_WORKER_SCRIPT = `
 const inputChunks = [];
 process.stdin.on("data", (chunk) => inputChunks.push(chunk));
@@ -40071,6 +40467,22 @@ process.stdin.on("end", () => {
         ...(workerInput.ignorePatterns.length > 0
           ? { ignorePatterns: workerInput.ignorePatterns }
           : {}),
+        // We consume only deslop's GRAPH-based findings (unusedFiles, unusedExports,
+        // unusedDependencies, circularDependencies). Everything else deslop can compute
+        // is pure wasted work for us, and it's the bulk of the runtime:
+        //   - semantic: a full TS Program for unusedTypes/enum/class-members/
+        //     misclassifiedDependencies (~37-45% of the phase).
+        //   - reportCodeQuality: the duplicate-block, complexity, feature-flag,
+        //     TypeScript-smell, private-type-leak and re-export-cycle detectors. These
+        //     are the single most expensive pass — duplicate-block detection alone was
+        //     ~83s of a ~130s Sentry scan — so skipping them is an ~8.5x dead-code
+        //     speedup on a large repo.
+        // Both are provably safe: the consumed graph findings are computed by their own
+        // detectors, independent of these passes (confirmed byte-identical on
+        // excalidraw + mui-material + sentry). tsConfigPath stays — the module resolver
+        // needs it for path-alias resolution in the import graph.
+        semantic: { enabled: false },
+        reportCodeQuality: false,
       };
       const result = await analyze(defineConfig(config));
       emit({ ok: true, result: normalizeResult(result) });
@@ -40081,7 +40493,7 @@ process.stdin.on("end", () => {
 });
 `;
 const resolveTsConfigPath = (rootDirectory) => {
-	for (const filename of TSCONFIG_FILENAMES$1) {
+	for (const filename of TSCONFIG_FILENAMES) {
 		const candidate = Path.join(rootDirectory, filename);
 		if (NFS.existsSync(candidate)) return candidate;
 	}
@@ -40200,7 +40612,11 @@ const createDeadCodeWorker = (input) => {
 			"pipe",
 			"pipe"
 		],
-		windowsHide: true
+		windowsHide: true,
+		env: input.parseConcurrency === void 0 ? process.env : {
+			...process.env,
+			DESLOP_PARSE_CONCURRENCY: String(input.parseConcurrency)
+		}
 	});
 	const stdoutChunks = [];
 	const stderrChunks = [];
@@ -40245,42 +40661,39 @@ const createDeadCodeWorker = (input) => {
 		}
 	};
 };
-const runDeadCodeWorkerWithTimeout = (handle, timeoutMs) => new Promise((resolve, reject) => {
+const runDeadCodeWorkerWithTimeout = (handle, timeoutMs, abortSignal) => new Promise((resolve, reject) => {
 	let didSettle = false;
-	const timeoutHandle = setTimeout(() => {
-		if (didSettle) return;
-		didSettle = true;
-		handle.terminate?.();
-		reject(/* @__PURE__ */ new Error(`Dead-code worker timed out after ${timeoutMs / MILLISECONDS_PER_SECOND}s.`));
-	}, timeoutMs);
-	timeoutHandle.unref?.();
-	handle.result.then((value) => {
+	const settle = (finish) => {
 		if (didSettle) return;
 		didSettle = true;
 		clearTimeout(timeoutHandle);
+		abortSignal?.removeEventListener("abort", onAbort);
 		handle.terminate?.();
-		resolve(value);
-	}, (error) => {
-		if (didSettle) return;
-		didSettle = true;
-		clearTimeout(timeoutHandle);
-		handle.terminate?.();
-		reject(error);
-	});
+		finish();
+	};
+	const onAbort = () => settle(() => reject(/* @__PURE__ */ new Error("Dead-code worker aborted.")));
+	const timeoutHandle = setTimeout(() => settle(() => reject(/* @__PURE__ */ new Error(`Dead-code worker timed out after ${timeoutMs / MILLISECONDS_PER_SECOND}s.`))), timeoutMs);
+	timeoutHandle.unref?.();
+	if (abortSignal?.aborted) {
+		onAbort();
+		return;
+	}
+	abortSignal?.addEventListener("abort", onAbort, { once: true });
+	handle.result.then((value) => settle(() => resolve(value)), (error) => settle(() => reject(error)));
 });
 const checkDeadCode = async (options) => {
-	const { userConfig } = options;
 	const rootDirectory = toCanonicalPath(options.rootDirectory);
 	if (!NFS.existsSync(Path.join(rootDirectory, "package.json"))) return [];
 	const entryPatterns = collectDeadCodeEntryPatterns(rootDirectory);
-	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory, userConfig);
+	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory);
 	const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
 		rootDirectory,
 		entryPatterns,
 		tsConfigPath: resolveTsConfigPath(rootDirectory),
 		ignorePatterns,
-		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js")
-	}), options.workerTimeoutMs ?? 12e4));
+		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
+		parseConcurrency: options.parseConcurrency
+	}), options.workerTimeoutMs ?? 12e4, options.abortSignal));
 	const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -40378,7 +40791,37 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const excludeMinifiedFiles = (rootDirectory, relativePaths) => relativePaths.filter((relativePath) => !isLargeMinifiedFile(Path.resolve(rootDirectory, relativePath)));
+/**
+* Budget for the dead-code phase, scaled to the work. deslop's graph build is
+* CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
+* for a large repo (where the pass legitimately runs that long) and is then
+* tipped over by any concurrent load — silently dropping every dead-code
+* finding. Scaling the budget with file count (and inversely with the core
+* share when overlapped) lets the pass complete, while the ceiling still
+* reclaims a genuinely wedged worker. Returns the in-worker SIGKILL deadline
+* and the Effect-side phase backstop that sits a margin above it.
+*/
+const resolveDeadCodeTimeout = (input) => {
+	const coreShareFactor = Math.max(1, input.fullConcurrency / Math.max(1, input.deadCodeConcurrency));
+	const workerTimeoutMs = Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor)));
+	return {
+		workerTimeoutMs,
+		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
+	};
+};
+const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
+	const entries = [];
+	for (const relativePath of relativePaths) {
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (isLargeMinifiedFile(absolutePath, sizeBytes)) continue;
+		entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+	}
+	return entries;
+};
 const listSourceFilesViaGit = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
@@ -40411,7 +40854,8 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 	}
 	return filePaths;
 };
-const listSourceFiles = (rootDirectory) => excludeMinifiedFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
+const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const resolveLintIncludePaths = (rootDirectory, userConfig, project) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
@@ -40454,24 +40898,25 @@ var Config = class Config extends Service()("react-doctor/Config") {
 var DeadCode = class DeadCode extends Service()("react-doctor/DeadCode") {
 	static layerNode = succeed$3(DeadCode, DeadCode.of({ run: (input) => unwrap(fn("DeadCode.run")(function* () {
 		return yield* tryPromise({
-			try: () => checkDeadCode({
+			try: (signal) => checkDeadCode({
 				rootDirectory: input.rootDirectory,
-				userConfig: input.userConfig
+				userConfig: input.userConfig,
+				parseConcurrency: input.parseConcurrency,
+				workerTimeoutMs: input.workerTimeoutMs,
+				abortSignal: signal
 			}),
 			catch: (cause) => new ReactDoctorError({ reason: new DeadCodeAnalysisFailed({ cause }) })
 		}).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)));
 	})()) }));
 	static layerOf = (diagnostics) => succeed$3(DeadCode, DeadCode.of({ run: () => fromIterable$1(diagnostics) }));
 };
-const createNodeReadFileLinesSync = (rootDirectory) => {
-	return (filePath) => {
-		const absolutePath = Path.isAbsolute(filePath) ? filePath : Path.join(rootDirectory, filePath);
-		try {
-			return NFS.readFileSync(absolutePath, "utf-8").split("\n");
-		} catch {
-			return null;
-		}
-	};
+const createNodeReadFileLinesSync = (rootDirectory) => (filePath) => {
+	const absolutePath = Path.isAbsolute(filePath) ? filePath : Path.join(rootDirectory, filePath);
+	try {
+		return NFS.readFileSync(absolutePath, "utf-8").split("\n");
+	} catch {
+		return null;
+	}
 };
 var Files = class Files extends Service()("react-doctor/Files") {
 	static layerNode = succeed$3(Files, Files.of({
@@ -40682,7 +41127,10 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				directory: input.directory,
 				cause
 			}) });
-		}));
+		}), withSpan("git.exec", { attributes: {
+			"git.command": input.command,
+			"git.subcommand": input.args[0] ?? ""
+		} }));
 		const runGit = (directory, args) => runCommand({
 			command: "git",
 			args,
@@ -40710,7 +41158,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			]);
 			if (candidates.status !== 0) return null;
 			return trimOrNull(candidates.stdout.split("\n")[0] ?? "");
-		});
+		}).pipe(withSpan("Git.defaultBranch"));
 		const branchExists = (directory, branch) => runGit(directory, [
 			"rev-parse",
 			"--verify",
@@ -40757,7 +41205,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			const result = resultOption.value;
 			if (result.status !== 0) return null;
 			return parseGithubViewerPermission(result.stdout);
-		}).pipe(catch_$1(() => succeed$2(null)));
+		}).pipe(catch_$1(() => succeed$2(null)), withSpan("Git.githubViewerPermission"));
 		/**
 		* Resolves a `--diff A..B` / `A...B` commit range into a changed-file
 		* selection. Each endpoint is validated with `isSafeGitRevision`
@@ -40871,7 +41319,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 					changedFiles: splitNullSeparated(diff.stdout),
 					isCurrentChanges: false
 				};
-			}),
+			}).pipe(withSpan("Git.diffSelection")),
 			stagedFilePaths: (directory) => runGit(directory, [
 				"diff",
 				"--cached",
@@ -40913,7 +41361,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 					status: result.status,
 					stdout: result.stdout
 				};
-			}),
+			}).pipe(withSpan("Git.grep")),
 			changedLineRanges: ({ directory, baseRef, cached, files }) => gen(function* () {
 				if (files.length === 0) return [];
 				if (baseRef !== void 0 && !isSafeGitRevision(baseRef)) return null;
@@ -40929,7 +41377,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				]);
 				if (result.status !== 0) return null;
 				return parseChangedLineRanges(result.stdout);
-			})
+			}).pipe(withSpan("Git.changedLineRanges"))
 		});
 	})).pipe(provide$2(layer$3.pipe(provide$2(mergeAll$1(layer$2, layer$1)))));
 	/**
@@ -41144,7 +41592,7 @@ const neutralizeDisableDirectives = async (rootDirectory, includePaths) => {
 		for (const [absolutePath, originalContent] of originalContents) try {
 			NFS.writeFileSync(absolutePath, originalContent);
 		} catch (error) {
-			process.stderr.write(`[react-doctor] Failed to restore inline disable directives in ${absolutePath}: ${error instanceof Error ? error.message : String(error)}\n[react-doctor] Run: git checkout -- ${absolutePath}\n`);
+			process.stderr.write(`[react-doctor] Failed to restore inline disable directives in ${absolutePath}: ${messageFromUnknown(error)}\n[react-doctor] Run: git checkout -- ${absolutePath}\n`);
 		}
 	};
 	const onExit = () => restore();
@@ -41168,6 +41616,14 @@ const neutralizeDisableDirectives = async (rootDirectory, includePaths) => {
 		process.removeListener("exit", onExit);
 	};
 };
+const ROOT_DIRECTORY_PLACEHOLDER = "<root>";
+const normalizeConfigForHash = (config) => {
+	const clone = JSON.parse(JSON.stringify(config));
+	if (clone?.settings?.["react-doctor"]) clone.settings["react-doctor"].rootDirectory = ROOT_DIRECTORY_PLACEHOLDER;
+	if (Array.isArray(clone?.jsPlugins)) clone.jsPlugins = clone.jsPlugins.map((_, index) => `<plugin:${index}>`);
+	return clone;
+};
+const computeRulesetHash = (input) => crypto.createHash("sha1").update(JSON.stringify(normalizeConfigForHash(input.config))).update("\0").update([...input.toolchainVersions].join("\0")).update("\0").update([...input.ignorePatterns].join("\n")).update(" ").update(input.tsconfigContent ?? "").digest("hex");
 /**
 * Loads a plugin module via the local require resolver and extracts
 * `(name, ruleNames)` from either `module.exports.meta + rules` or
@@ -41250,7 +41706,7 @@ const resolveUserPlugin = (spec, configSourceDirectory) => {
 	try {
 		resolvedSpecifier = isRelative ? Path.resolve(configSourceDirectory, spec) : candidateRequire.resolve(spec);
 	} catch (error) {
-		warnConfigIssue(`config.plugins entry "${spec}" could not be resolved from ${configSourceDirectory}: ${error instanceof Error ? error.message : String(error)}`);
+		warnConfigIssue(`config.plugins entry "${spec}" could not be resolved from ${configSourceDirectory}: ${messageFromUnknown(error)}`);
 		return null;
 	}
 	const { name, ruleNames } = readPluginShape(resolvedSpecifier, (target) => candidateRequire(target));
@@ -41322,8 +41778,8 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), serverAuthFunctionNames, severityControls, userPlugins = [] }) => {
-	const reactHooksJsPlugin = resolveReactHooksJsPlugin(project.hasReactCompiler, customRulesOnly);
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection }) => {
+	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" ? null : resolveReactHooksJsPlugin(project.hasReactCompiler, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
 	const jsPlugins = [];
 	if (reactHooksJsPlugin) jsPlugins.push(reactHooksJsPlugin.entry);
@@ -41332,6 +41788,8 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 	for (const registryEntry of REACT_DOCTOR_RULES) {
 		const rule = reactDoctorPlugin.rules[registryEntry.id];
 		if (!rule) continue;
+		if (ruleSelection === "cacheable" && CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
+		if (ruleSelection === "sidecar" && !CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
 		if (rule.scan !== void 0) continue;
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
@@ -41346,7 +41804,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		enabledReactDoctorRules[registryEntry.key] = severity;
 	}
 	const userPluginRules = {};
-	for (const userPlugin of userPlugins) {
+	if (ruleSelection !== "sidecar") for (const userPlugin of userPlugins) {
 		Object.assign(userPluginRules, buildUserPluginRules(userPlugin, severityControls));
 		jsPlugins.push(userPlugin.entry);
 	}
@@ -41376,6 +41834,100 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		}
 	};
 };
+const atomicWriteJson = (filePath, value) => {
+	try {
+		NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
+		const temporaryPath = `${filePath}.${process.pid}.tmp`;
+		NFS.writeFileSync(temporaryPath, JSON.stringify(value));
+		NFS.renameSync(temporaryPath, filePath);
+	} catch {
+		return;
+	}
+};
+const failOpenReadJson = (filePath, fallback) => {
+	try {
+		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
+	} catch {
+		return fallback;
+	}
+};
+const validateDiagnostic = decodeUnknownSync(Diagnostic);
+const decodeFileDiagnostics = (raw) => {
+	if (!Array.isArray(raw)) return null;
+	try {
+		for (const entry of raw) validateDiagnostic(entry);
+		return raw;
+	} catch {
+		return null;
+	}
+};
+const emptyCache = () => ({
+	version: 1,
+	rulesets: {}
+});
+const loadRulesetEntries = (cacheFilePath, rulesetHash) => {
+	const entries = /* @__PURE__ */ new Map();
+	const persisted = failOpenReadJson(cacheFilePath, emptyCache());
+	if (persisted.version !== 1 || !isRecord$2(persisted.rulesets)) return entries;
+	const bucket = persisted.rulesets[rulesetHash];
+	if (!isRecord$2(bucket) || !isRecord$2(bucket.files)) return entries;
+	for (const [fileKey, rawDiagnostics] of Object.entries(bucket.files)) {
+		const decoded = decodeFileDiagnostics(rawDiagnostics);
+		if (decoded !== null) entries.set(fileKey, decoded);
+	}
+	return entries;
+};
+const createFileLintCache = (cacheDirectory, rulesetHash) => {
+	const cacheFilePath = Path.join(cacheDirectory, FILE_LINT_CACHE_FILENAME);
+	const entries = loadRulesetEntries(cacheFilePath, rulesetHash);
+	return {
+		lookup: (fileKey) => entries.get(fileKey) ?? null,
+		store: (fileKey, diagnostics) => {
+			entries.delete(fileKey);
+			entries.set(fileKey, diagnostics);
+		},
+		persist: () => {
+			const onDisk = failOpenReadJson(cacheFilePath, emptyCache());
+			const rulesets = onDisk.version === 1 && isRecord$2(onDisk.rulesets) ? { ...onDisk.rulesets } : {};
+			const existingBucket = rulesets[rulesetHash];
+			const existingFiles = isRecord$2(existingBucket) && isRecord$2(existingBucket.files) ? existingBucket.files : {};
+			const ourFiles = {};
+			for (const [fileKey, diagnostics] of entries) ourFiles[fileKey] = diagnostics;
+			const cappedEntries = Object.entries({
+				...existingFiles,
+				...ourFiles
+			}).slice(-FILE_LINT_CACHE_MAX_FILE_COUNT);
+			rulesets[rulesetHash] = {
+				updatedAtMs: Date.now(),
+				files: Object.fromEntries(cappedEntries)
+			};
+			const keptHashes = Object.entries(rulesets).sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8).map(([hash]) => hash);
+			const prunedRulesets = {};
+			for (const hash of keptHashes) prunedRulesets[hash] = rulesets[hash];
+			atomicWriteJson(cacheFilePath, {
+				version: 1,
+				rulesets: prunedRulesets
+			});
+		}
+	};
+};
+const bundledRequire$2 = createRequire(import.meta.url);
+const TOOLCHAIN_PACKAGE_SPECIFIERS$1 = [
+	"oxlint/package.json",
+	"oxlint-plugin-react-doctor/package.json",
+	"eslint-plugin-react-hooks/package.json"
+];
+const resolveOxlintToolchainVersions = () => {
+	const versions = [`node=${process.version}`];
+	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS$1) try {
+		const packageJson = bundledRequire$2(specifier);
+		const version = typeof packageJson.version === "string" ? packageJson.version : "unknown";
+		versions.push(`${specifier}=${version}`);
+	} catch {
+		versions.push(`${specifier}=missing`);
+	}
+	return versions;
+};
 const esmRequire = createRequire(import.meta.url);
 const resolveOxlintBinary = () => {
 	const oxlintMainPath = esmRequire.resolve("oxlint");
@@ -41383,7 +41935,6 @@ const resolveOxlintBinary = () => {
 	return Path.join(oxlintPackageDirectory, "bin", "oxlint");
 };
 const resolvePluginPath = () => esmRequire.resolve("oxlint-plugin-react-doctor");
-const TSCONFIG_FILENAMES = ["tsconfig.json", "tsconfig.base.json"];
 const resolveTsConfigRelativePath = (rootDirectory) => {
 	for (const filename of TSCONFIG_FILENAMES) if (NFS.existsSync(Path.join(rootDirectory, filename))) return `./${filename}`;
 	return null;
@@ -41755,7 +42306,7 @@ const scopeContainsNonImportBinding = (node, scopeNode, identifierName) => {
 const isIdentifierShadowedByLocalBinding = (identifier, sourceFile) => {
 	let currentNode = identifier.parent;
 	while (currentNode) {
-		if (isScopeNode(currentNode)) {
+		if (isScopeBoundary(currentNode)) {
 			if (scopeContainsNonImportBinding(currentNode, currentNode, identifier.text)) return true;
 		}
 		if (currentNode === sourceFile) return false;
@@ -41846,11 +42397,10 @@ const findResolutionInScope = (scopeNode, identifierName, reactImportBindings, s
 	});
 	return resolution;
 };
-const isScopeNode = isScopeBoundary;
 const resolveIdentifierBinding = (identifier, reactImportBindings, sourceFile, visitedDeclarations = /* @__PURE__ */ new Set()) => {
 	let currentNode = identifier.parent;
 	while (currentNode) {
-		if (isScopeNode(currentNode)) {
+		if (isScopeBoundary(currentNode)) {
 			const resolution = findResolutionInScope(currentNode, identifier.text, reactImportBindings, sourceFile, visitedDeclarations);
 			if (resolution) return resolution;
 		}
@@ -42020,9 +42570,9 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 	try {
 		parsed = JSON.parse(sanitizedStdout);
 	} catch {
-		throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 200) }) });
+		throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 600) }) });
 	}
-	if (!isOxlintOutput(parsed)) throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 200) }) });
+	if (!isOxlintOutput(parsed)) throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 600) }) });
 	const minifiedFileCache = /* @__PURE__ */ new Map();
 	const isMinifiedDiagnosticFile = (filename) => {
 		const absolutePath = Path.isAbsolute(filename) ? filename : Path.resolve(rootDirectory || ".", filename);
@@ -42059,15 +42609,19 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		};
 	});
 };
-const SANITIZED_ENV = (() => {
-	const sanitized = {};
-	for (const [name, value] of Object.entries(process.env)) {
+const buildOxlintChildEnv = (sourceEnv) => {
+	const childEnv = {};
+	for (const [name, value] of Object.entries(sourceEnv)) {
 		if (name === "NODE_OPTIONS" || name === "NODE_DEBUG") continue;
 		if (name.startsWith("npm_config_")) continue;
-		sanitized[name] = value;
+		childEnv[name] = value;
 	}
-	return sanitized;
-})();
+	const isCompileCacheDisabled = Boolean(sourceEnv.NODE_DISABLE_COMPILE_CACHE);
+	const isCompileCacheAlreadySet = childEnv.NODE_COMPILE_CACHE !== void 0;
+	if (!isCompileCacheDisabled && !isCompileCacheAlreadySet) childEnv.NODE_COMPILE_CACHE = Path.join(os.tmpdir(), NODE_COMPILE_CACHE_DIR_NAME);
+	return childEnv;
+};
+const SANITIZED_ENV = buildOxlintChildEnv(process.env);
 /**
 * Spawn one oxlint subprocess with hard ceilings on wall time and
 * output size. Returns stdout on success; raises a tagged
@@ -42084,7 +42638,11 @@ const SANITIZED_ENV = (() => {
 * The first three are splittable (the caller's binary-split retry
 * shrinks the batch and re-spawns); the fourth isn't.
 */
-const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLINT_SPAWN_TIMEOUT_MS, outputMaxBytes = OXLINT_OUTPUT_MAX_BYTES) => new Promise((resolve, reject) => {
+const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLINT_SPAWN_TIMEOUT_MS, outputMaxBytes = OXLINT_OUTPUT_MAX_BYTES, abortSignal) => new Promise((resolve, reject) => {
+	if (abortSignal?.aborted) {
+		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
+		return;
+	}
 	const child = spawn(nodeBinaryPath, args, {
 		cwd: rootDirectory,
 		env: SANITIZED_ENV,
@@ -42094,11 +42652,18 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 			"pipe"
 		]
 	});
+	const onAbort = () => {
+		child.kill("SIGKILL");
+		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
+	};
+	abortSignal?.addEventListener("abort", onAbort, { once: true });
+	const clearAbortListener = () => abortSignal?.removeEventListener("abort", onAbort);
 	const timeoutHandle = setTimeout(() => {
+		clearAbortListener();
 		child.kill("SIGKILL");
 		reject(new ReactDoctorError({ reason: new OxlintBatchExceeded({
 			kind: "timeout",
-			detail: `${spawnTimeoutMs / 1e3}s budget exceeded`
+			detail: `${spawnTimeoutMs / MILLISECONDS_PER_SECOND}s budget exceeded`
 		}) }));
 	}, spawnTimeoutMs);
 	timeoutHandle.unref?.();
@@ -42129,10 +42694,12 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 	});
 	child.on("error", (error) => {
 		clearTimeout(timeoutHandle);
+		clearAbortListener();
 		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: error }) }));
 	});
 	child.on("close", (_code, signal) => {
 		clearTimeout(timeoutHandle);
+		clearAbortListener();
 		if (didKillForSize) {
 			reject(new ReactDoctorError({ reason: new OxlintBatchExceeded({
 				kind: "output-too-large",
@@ -42199,26 +42766,28 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal } = input;
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	const totalFileCount = fileBatches.reduce((sum, batch) => sum + batch.length, 0);
 	const runBatchPass = async (concurrency) => {
 		const allDiagnostics = [];
 		const droppedFiles = [];
 		let firstDropReason = null;
-		const spawnLintBatch = async (batch) => {
+		const splitDeadlineMs = Date.now() + splitTotalBudgetMs;
+		const spawnLintBatch = async (batch, depth) => {
 			const batchArgs = [...baseArgs, ...batch];
 			try {
-				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes), project, rootDirectory);
+				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory);
 			} catch (error) {
 				if (!isSplittableReactDoctorError(error)) throw error;
-				if (batch.length <= 1) {
+				const splitBudgetExhausted = Date.now() >= splitDeadlineMs || depth >= splitMaxDepth;
+				if (batch.length <= 1 || splitBudgetExhausted) {
 					droppedFiles.push(...batch);
-					if (firstDropReason === null) firstDropReason = error.message;
+					if (firstDropReason === null) firstDropReason = splitBudgetExhausted && batch.length > 1 ? `${error.message} (split budget exhausted after ${splitMaxDepth} levels / ${splitTotalBudgetMs / MILLISECONDS_PER_SECOND}s)` : error.message;
 					return [];
 				}
 				const splitIndex = Math.ceil(batch.length / 2);
-				return [...await spawnLintBatch(batch.slice(0, splitIndex)), ...await spawnLintBatch(batch.slice(splitIndex))];
+				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1)];
 			}
 		};
 		let startedFileCount = 0;
@@ -42235,7 +42804,7 @@ const spawnLintBatches = async (input) => {
 		try {
 			const batchResults = await mapWithConcurrency(fileBatches, concurrency, async (batch) => {
 				startedFileCount += batch.length;
-				const batchDiagnostics = await spawnLintBatch(batch);
+				const batchDiagnostics = await spawnLintBatch(batch, 0);
 				scannedFileCount += batch.length;
 				if (onFileProgress) {
 					displayedFileCount = Math.min(Math.max(displayedFileCount, scannedFileCount), totalFileCount);
@@ -42296,6 +42865,22 @@ const validateRuleRegistration = () => {
 	].filter((entry) => entry !== null).join("; ");
 	console.warn(`[react-doctor] rule-registration drift: ${detail}`);
 };
+const hashFileContents = (filePath) => {
+	try {
+		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
+	} catch {
+		return null;
+	}
+};
+const projectCacheSubdir = (projectDirectory) => crypto.createHash("sha256").update(projectDirectory).digest("hex").slice(0, 16);
+const resolveReactDoctorCacheDir = (projectDirectory) => {
+	const cacheDirOverride = process.env["REACT_DOCTOR_CACHE_DIR"]?.trim();
+	if (cacheDirOverride) return Path.join(cacheDirOverride, projectCacheSubdir(projectDirectory));
+	const nodeModulesDirectory = Path.join(projectDirectory, "node_modules");
+	if (NFS.existsSync(nodeModulesDirectory)) return Path.join(nodeModulesDirectory, ".cache", "react-doctor");
+	return Path.join(os.tmpdir(), "react-doctor-cache", projectCacheSubdir(projectDirectory));
+};
+const sortSourceFilesByCost = (entries) => [...entries].sort((left, right) => right.sizeBytes - left.sizeBytes).map((entry) => entry.path);
 /**
 * Atomically (re)writes the generated oxlintrc.json. Used twice in
 * the runner: once for the primary scan, once for the
@@ -42313,6 +42898,28 @@ const writeOxlintConfig = (configPath, configToWrite) => {
 		NFS.closeSync(fileHandle);
 	}
 };
+const REACT_HOOKS_JS_DROP_PREFIX = "React Compiler rules (react-hooks-js/*) skipped — eslint-plugin-react-hooks failed to load in this environment";
+/**
+* Detects an oxlint config-load crash caused by the optional
+* `react-hooks-js` (eslint-plugin-react-hooks) React Compiler plugin and
+* builds the partial-failure note for it; returns `null` when the failure
+* was anything else.
+*
+* oxlint prints a framed error to stdout (not stderr) and exits non-zero
+* when a `jsPlugins` entry can't be imported; that non-JSON stdout
+* surfaces as `OxlintOutputUnparseable`. Because oxlint fails the WHOLE
+* config load on it, leaving the plugin in would drop every curated
+* react-doctor diagnostic too — so the caller retries with the plugin
+* stripped (issue #833). Both markers sit at the start of oxlint's
+* message, so they survive the `preview` slice even for deep pnpm paths.
+*/
+const reactHooksJsPluginDropNote = (error) => {
+	if (!(error instanceof ReactDoctorError) || error.reason._tag !== "OxlintOutputUnparseable") return null;
+	const { preview } = error.reason;
+	if (!preview.includes("Failed to load JS plugin") || !preview.includes("eslint-plugin-react-hooks")) return null;
+	const underlyingReason = preview.match(/Error:[^\n]*/)?.[0]?.trim();
+	return `${REACT_HOOKS_JS_DROP_PREFIX}${underlyingReason ? `: ${underlyingReason}` : ""}. Other rules ran normally.`;
+};
 /**
 * The oxlint runner. Composed of three pieces in `runners/oxlint/`:
 *
@@ -42332,7 +42939,7 @@ const writeOxlintConfig = (configPath, configToWrite) => {
 *   6. always restore disable directives + clean up the temp dir
 */
 const runOxlint = async (options) => {
-	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, spawnTimeoutMs, outputMaxBytes } = options;
+	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, perFileLintCacheEnabled = false, onCacheStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "arrival" } = options;
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
@@ -42340,38 +42947,165 @@ const runOxlint = async (options) => {
 	const pluginPath = resolvePluginPath();
 	const extendsPaths = (adoptExistingLintConfig && !customRulesOnly ? detectUserLintConfigPaths(rootDirectory) : []).filter(canOxlintExtendConfig);
 	const userPlugins = resolveUserPlugins(userConfig?.plugins, configSourceDirectory);
-	const buildConfig = (extendsForThisAttempt) => createOxlintConfig({
+	const buildConfig = (overrides) => createOxlintConfig({
 		pluginPath,
 		project,
 		customRulesOnly,
-		extendsPaths: extendsForThisAttempt,
+		extendsPaths: overrides.extendsPaths,
 		ignoredTags,
 		serverAuthFunctionNames,
 		severityControls,
-		userPlugins
+		userPlugins,
+		disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
+		ruleSelection: overrides.ruleSelection
 	});
 	const restoreDisableDirectives = respectInlineDisables ? () => {} : await neutralizeDisableDirectives(rootDirectory, includePaths);
 	const configDirectory = NFS.mkdtempSync(Path.join(os.tmpdir(), "react-doctor-oxlintrc-"));
 	const configPath = Path.join(configDirectory, "oxlintrc.json");
 	try {
-		const baseArgs = [
-			resolveOxlintBinary(),
-			"-c",
-			configPath,
-			"--format",
-			"json"
-		];
+		const oxlintBinary = resolveOxlintBinary();
+		const sharedArgs = [];
+		let tsconfigContent = null;
 		if (project.hasTypeScript) {
 			const tsconfigRelativePath = resolveTsConfigRelativePath(rootDirectory);
-			if (tsconfigRelativePath) baseArgs.push("--tsconfig", tsconfigRelativePath);
+			if (tsconfigRelativePath) {
+				sharedArgs.push("--tsconfig", tsconfigRelativePath);
+				try {
+					tsconfigContent = NFS.readFileSync(Path.resolve(rootDirectory, tsconfigRelativePath), "utf8");
+				} catch {
+					tsconfigContent = null;
+				}
+			}
 		}
 		const combinedPatterns = collectIgnorePatterns(rootDirectory);
 		if (combinedPatterns.length > 0) {
 			const combinedIgnorePath = Path.join(configDirectory, "combined.ignore");
 			NFS.writeFileSync(combinedIgnorePath, `${combinedPatterns.join("\n")}\n`);
-			baseArgs.push("--ignore-path", combinedIgnorePath);
+			sharedArgs.push("--ignore-path", combinedIgnorePath);
+		}
+		const makeBaseArgs = (oxlintConfigPath) => [
+			oxlintBinary,
+			"-c",
+			oxlintConfigPath,
+			"--format",
+			"json",
+			...sharedArgs
+		];
+		const discoverScanFiles = () => lintBatchOrdering === "cost" ? sortSourceFilesByCost(listSourceFilesWithSize(rootDirectory)) : listSourceFiles(rootDirectory);
+		const candidateFiles = includePaths !== void 0 ? includePaths : discoverScanFiles();
+		const runConfigOverFiles = async (buildConfigForPass, configFileName, files, fileProgress) => {
+			if (files.length === 0) return {
+				diagnostics: [],
+				didDropReactHooksJsPlugin: false,
+				hadPartialFailure: false
+			};
+			let hadPartialFailure = false;
+			const reportPartialFailure = (reason) => {
+				hadPartialFailure = true;
+				onPartialFailure?.(reason);
+			};
+			const passConfigPath = Path.join(configDirectory, configFileName);
+			const passBaseArgs = makeBaseArgs(passConfigPath);
+			const passFileBatches = batchIncludePaths(passBaseArgs, files);
+			const spawnPass = () => spawnLintBatches({
+				baseArgs: passBaseArgs,
+				fileBatches: passFileBatches,
+				rootDirectory,
+				nodeBinaryPath,
+				project,
+				onPartialFailure: reportPartialFailure,
+				onFileProgress: fileProgress,
+				spawnTimeoutMs,
+				outputMaxBytes,
+				concurrency: options.concurrency,
+				signal: options.signal
+			});
+			writeOxlintConfig(passConfigPath, buildConfigForPass({}));
+			try {
+				return {
+					diagnostics: await spawnPass(),
+					didDropReactHooksJsPlugin: false,
+					hadPartialFailure
+				};
+			} catch (error) {
+				const reactHooksJsDropNote = reactHooksJsPluginDropNote(error);
+				if (reactHooksJsDropNote === null) throw error;
+				writeOxlintConfig(passConfigPath, buildConfigForPass({ disableReactHooksJsPlugin: true }));
+				const diagnostics = await spawnPass();
+				reportPartialFailure(reactHooksJsDropNote);
+				return {
+					diagnostics,
+					didDropReactHooksJsPlugin: true,
+					hadPartialFailure
+				};
+			}
+		};
+		if (perFileLintCacheEnabled && respectInlineDisables && !project.hasReactCompiler && extendsPaths.length === 0 && userPlugins.length === 0) {
+			const rulesetHash = computeRulesetHash({
+				config: buildConfig({
+					extendsPaths: [],
+					ruleSelection: "cacheable"
+				}),
+				toolchainVersions: resolveOxlintToolchainVersions(),
+				ignorePatterns: combinedPatterns,
+				tsconfigContent
+			});
+			const cache = createFileLintCache(resolveReactDoctorCacheDir(rootDirectory), rulesetHash);
+			const cacheKeyByFile = /* @__PURE__ */ new Map();
+			const missFiles = [];
+			const replayedDiagnostics = [];
+			for (const candidateFile of candidateFiles) {
+				const contentHash = hashFileContents(Path.resolve(rootDirectory, candidateFile));
+				if (contentHash === null) {
+					missFiles.push(candidateFile);
+					continue;
+				}
+				const cacheKey = `${candidateFile.replaceAll("\\", "/")}${contentHash}`;
+				cacheKeyByFile.set(candidateFile, cacheKey);
+				const cachedDiagnostics = cache.lookup(cacheKey);
+				if (cachedDiagnostics === null) missFiles.push(candidateFile);
+				else replayedDiagnostics.push(...cachedDiagnostics);
+			}
+			const cacheHitFileCount = candidateFiles.length - missFiles.length;
+			const cacheableResult = await runConfigOverFiles((overrides) => buildConfig({
+				extendsPaths: [],
+				ruleSelection: "cacheable",
+				disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin
+			}), "oxlintrc.cacheable.json", missFiles, void 0);
+			const sidecarResult = await runConfigOverFiles(() => buildConfig({
+				extendsPaths: [],
+				ruleSelection: "sidecar"
+			}), "oxlintrc.sidecar.json", candidateFiles, options.onFileProgress);
+			onCacheStats?.(cacheHitFileCount, candidateFiles.length);
+			const missFileByNormalizedPath = /* @__PURE__ */ new Map();
+			for (const missFile of missFiles) missFileByNormalizedPath.set(missFile.replaceAll("\\", "/"), missFile);
+			const freshDiagnosticsByFile = /* @__PURE__ */ new Map();
+			let isAttributionSound = true;
+			for (const diagnostic of cacheableResult.diagnostics) {
+				const missFile = missFileByNormalizedPath.get(diagnostic.filePath);
+				if (missFile === void 0) {
+					isAttributionSound = false;
+					break;
+				}
+				const fileDiagnostics = freshDiagnosticsByFile.get(missFile) ?? [];
+				fileDiagnostics.push(diagnostic);
+				freshDiagnosticsByFile.set(missFile, fileDiagnostics);
+			}
+			if (!cacheableResult.didDropReactHooksJsPlugin && !cacheableResult.hadPartialFailure && isAttributionSound) {
+				for (const missFile of missFiles) {
+					const cacheKey = cacheKeyByFile.get(missFile);
+					if (cacheKey !== void 0) cache.store(cacheKey, freshDiagnosticsByFile.get(missFile) ?? []);
+				}
+				cache.persist();
+			}
+			return dedupeDiagnostics([
+				...replayedDiagnostics,
+				...cacheableResult.diagnostics,
+				...sidecarResult.diagnostics
+			]);
 		}
-		const fileBatches = batchIncludePaths(baseArgs, includePaths !== void 0 ? includePaths : listSourceFiles(rootDirectory));
+		const baseArgs = makeBaseArgs(configPath);
+		const fileBatches = batchIncludePaths(baseArgs, candidateFiles);
 		const runBatches = () => spawnLintBatches({
 			baseArgs,
 			fileBatches,
@@ -42382,14 +43116,25 @@ const runOxlint = async (options) => {
 			onFileProgress: options.onFileProgress,
 			spawnTimeoutMs,
 			outputMaxBytes,
-			concurrency: options.concurrency
+			concurrency: options.concurrency,
+			signal: options.signal
 		});
-		writeOxlintConfig(configPath, buildConfig(extendsPaths));
+		writeOxlintConfig(configPath, buildConfig({ extendsPaths }));
 		try {
 			return await runBatches();
 		} catch (error) {
+			const reactHooksJsDropNote = reactHooksJsPluginDropNote(error);
+			if (reactHooksJsDropNote !== null) {
+				writeOxlintConfig(configPath, buildConfig({
+					extendsPaths,
+					disableReactHooksJsPlugin: true
+				}));
+				const diagnostics = await runBatches();
+				onPartialFailure?.(reactHooksJsDropNote);
+				return diagnostics;
+			}
 			if (extendsPaths.length === 0) throw error;
-			writeOxlintConfig(configPath, buildConfig([]));
+			writeOxlintConfig(configPath, buildConfig({ extendsPaths: [] }));
 			return await runBatches();
 		}
 	} finally {
@@ -42451,9 +43196,11 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 		const spawnTimeoutMs = yield* OxlintSpawnTimeoutMs;
 		const outputMaxBytes = yield* OxlintOutputMaxBytes;
 		const concurrency = yield* OxlintConcurrency;
+		const lintBatchOrdering = yield* LintBatchOrdering;
+		const perFileLintCacheEnabled = yield* PerFileLintCacheEnabled;
 		const collectedFailures = [];
 		const diagnostics = yield* tryPromise({
-			try: () => runOxlint({
+			try: (signal) => runOxlint({
 				rootDirectory: input.rootDirectory,
 				project: input.project,
 				includePaths: input.includePaths ? [...input.includePaths] : void 0,
@@ -42468,9 +43215,13 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 					collectedFailures.push(reason);
 				},
 				onFileProgress: input.onFileProgress,
+				perFileLintCacheEnabled,
+				onCacheStats: input.onCacheStats,
 				spawnTimeoutMs,
 				outputMaxBytes,
-				concurrency
+				concurrency,
+				signal,
+				lintBatchOrdering
 			}),
 			catch: ensureReactDoctorError
 		});
@@ -42862,14 +43613,46 @@ const parseArtifactFromBody = (body) => {
 	}
 	return null;
 };
-const fetchSocketArtifact = (dependency) => tryPromise(async (signal) => {
+const isSupplyChainCacheDisabled = () => {
+	const noCache = process.env["REACT_DOCTOR_NO_CACHE"]?.toLowerCase() ?? "";
+	return noCache === "1" || noCache === "true";
+};
+const supplyChainCacheFile = (cacheDirectory, dependency) => {
+	const purlHash = crypto.createHash("sha256").update(toPurl(dependency)).digest("hex").slice(0, 16);
+	return Path.join(cacheDirectory, SUPPLY_CHAIN_CACHE_SUBDIR, `${purlHash}.json`);
+};
+const readCachedSocketBody = (cacheFile) => {
+	try {
+		const entry = JSON.parse(NFS.readFileSync(cacheFile, "utf-8"));
+		if (typeof entry === "object" && entry !== null && "fetchedAtMs" in entry && "body" in entry && typeof entry.fetchedAtMs === "number" && typeof entry.body === "string" && Date.now() - entry.fetchedAtMs <= 864e5) return entry.body;
+	} catch {}
+	return null;
+};
+const writeCachedSocketBody = (cacheFile, body) => {
+	try {
+		NFS.mkdirSync(Path.dirname(cacheFile), { recursive: true });
+		NFS.writeFileSync(cacheFile, JSON.stringify({
+			fetchedAtMs: Date.now(),
+			body
+		}));
+	} catch {}
+};
+const fetchSocketArtifact = (dependency, cacheDirectory) => tryPromise(async (signal) => {
+	const cacheFile = cacheDirectory === null ? null : supplyChainCacheFile(cacheDirectory, dependency);
+	if (cacheFile !== null) {
+		const cachedBody = readCachedSocketBody(cacheFile);
+		if (cachedBody !== null) return parseArtifactFromBody(cachedBody);
+	}
 	const requestUrl = `${SOCKET_FREE_PURL_API_BASE}/${encodeURIComponent(toPurl(dependency))}`;
 	const response = await fetch(requestUrl, {
 		headers: { "User-Agent": SOCKET_FREE_USER_AGENT },
 		signal
 	});
 	if (!response.ok) return null;
-	return parseArtifactFromBody(await response.text());
+	const body = await response.text();
+	const artifact = parseArtifactFromBody(body);
+	if (artifact !== null && cacheFile !== null) writeCachedSocketBody(cacheFile, body);
+	return artifact;
 }).pipe(timeout(FETCH_TIMEOUT_MS), orElseSucceed(() => null), tap$1((artifact) => {
 	const scoreAttributes = {};
 	if (artifact !== null) {
@@ -42974,7 +43757,8 @@ const checkSupplyChain = (input) => gen(function* () {
 	const packageJsonPath = Path.join(input.rootDirectory, "package.json");
 	const dependencies = collectDependenciesToScore(readPackageJson$1(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies);
 	if (dependencies.length === 0) return [];
-	const artifacts = yield* forEach$1(dependencies, fetchSocketArtifact, { concurrency: 8 });
+	const cacheDirectory = isSupplyChainCacheDisabled() ? null : resolveReactDoctorCacheDir(input.rootDirectory);
+	const artifacts = yield* forEach$1(dependencies, (dependency) => fetchSocketArtifact(dependency, cacheDirectory), { concurrency: 8 }).pipe(timeoutOption(input.totalTimeoutMs ?? 9e4), map$3((maybeArtifacts) => getOrElse$1(maybeArtifacts, () => [])));
 	const diagnostics = [];
 	for (let index = 0; index < dependencies.length; index += 1) {
 		const artifact = artifacts[index];
@@ -42999,6 +43783,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * The underlying `checkSupplyChain` Effect is total/fail-open — per-package
 * timeouts and network failures recover to "skip" — so the stream never
 * fails, mirroring `DeadCode`'s stream shape so the two compose the same way.
+* The orchestrator (`run-inspect.ts`) consumes this stream on a background
+* fiber whose network time overlaps the lint pass, joined under a generous
+* wall-clock budget; a budget expiry is the same fail-open outcome as a Socket
+* outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
 	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(checkSupplyChain(input).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
@@ -43057,18 +43845,42 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *
 * Phases:
 *
-*   1. Config.resolve(directory) → Project.discover → Git metadata
+*   1. Config.resolve(directory) → Project.discover → Git metadata.
+*      The GitHub viewer-permission lookup is forked onto a background
+*      fiber here and joined late (it feeds score metadata, not
+*      diagnostics).
 *   2. beforeLint hook (e.g. CLI renders the project-detection block)
 *   3. environment checks (reduced-motion + pnpm hardening +
-*      expo/react-native + security scan)
-*   4. Linter.run + DeadCode.run — forked as concurrent fibers so
-*      their wall-clock times overlap. Progress spinners stay
-*      sequential (lint first, then dead-code) for clean terminal
-*      output. GitHub viewer permission also runs as a background
-*      fiber during this phase.
-*   5. afterLint hook
-*   6. Reporter.finalize
-*   7. Score.compute against the surface-filtered diagnostic set
+*      expo/react-native + security scan), collected synchronously
+*   4. The supply-chain check (Socket.dev) is forked onto a background
+*      fiber so its ~100% network-bound time overlaps the ~100%
+*      CPU/subprocess-bound lint pass below, collapsing two serial
+*      phases into roughly `max(supplyChain, lint)`. It is capped by
+*      `SupplyChainOverlapTimeoutMs` (measured from fork) so a hung
+*      socket can't drag out its join; on timeout it fails open to no
+*      diagnostics — the same outcome class as a Socket outage.
+*   5. Linter.run runs; DeadCode.run runs concurrently (forked child
+*      fiber) ONLY when the memory gate has headroom to run the 8 GB
+*      dead-code child alongside the oxlint workers — or when overlap is
+*      forced via REACT_DOCTOR_DEAD_CODE_OVERLAP. Otherwise dead-code
+*      runs sequentially after lint, exactly as it did pre-overlap. The
+*      fiber is joined (or interrupted, SIGKILLing its worker, on lint
+*      failure) before diagnostics are concatenated. The afterLint hook
+*      fires between lint and dead-code. Progress spinner labels AND the
+*      final diagnostic / score order stay independent of execution
+*      order, so terminal output is identical either way; supply-chain
+*      rides alongside without a spinner.
+*   6. Join the supply-chain fiber, then assemble the diagnostics in a
+*      FIXED order (env, supply-chain, lint, dead-code) so the output is
+*      byte-identical regardless of which fiber settled first. The
+*      viewer-permission fiber is joined later, during score-metadata
+*      assembly (it feeds score metadata, not diagnostics). The per-element
+*      `Reporter.emit` side-channel now interleaves supply-chain with lint
+*      emits, so capture-order assertions must target the deterministic
+*      concat below, not emit order (production `Reporter.layerNoop` makes
+*      emit a no-op).
+*   7. Reporter.finalize
+*   8. Score.compute against the surface-filtered diagnostic set
 *
 * The orchestrator owns spinner lifecycle via `Progress`; callers
 * choose `Progress.layerOra(...)` for CLI feedback or
@@ -43126,10 +43938,21 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 			ignoredTags: input.ignoredTags
 		})
 	])));
-	const supplyChainCollected = !isDiffMode || (input.supplyChainManifestChanged ?? false) ? yield* runCollect(applyPerElementPipeline(supplyChainService.run({
+	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
+	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
+	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
 		rootDirectory: scanDirectory,
 		userConfig: resolvedConfig.config
-	}))) : [];
+	}))).pipe(map$3((diagnostics) => ({
+		diagnostics,
+		timedOut: false
+	})), timeout(supplyChainOverlapTimeout), orElseSucceed(() => ({
+		diagnostics: [],
+		timedOut: true
+	}))) : succeed$2({
+		diagnostics: [],
+		timedOut: false
+	}));
 	const lintFailure = yield* make$13({
 		didFail: false,
 		reason: null,
@@ -43140,12 +43963,49 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		didFail: false,
 		reason: null
 	});
-	const scanConcurrency = yield* OxlintConcurrency;
+	const scanConcurrency = resolveScanConcurrency(yield* OxlintConcurrency);
+	const lintPhaseTimeoutMs = yield* LintPhaseTimeoutMs;
+	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
+	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
+	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
+	const deadCodeOverlapMode = yield* DeadCodeOverlap;
+	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
+	const deadCodeParseConcurrency = shouldOverlapDeadCode ? Math.max(1, Math.floor(scanConcurrency * DEAD_CODE_OVERLAP_PARSE_SHARE)) : void 0;
+	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
+	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
+		rootDirectory: scanDirectory,
+		userConfig: resolvedConfig.config,
+		parseConcurrency: deadCodeParseConcurrency,
+		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs
+	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
+		yield* set(deadCodeFailure, {
+			didFail: true,
+			reason: error.message
+		});
+		return empty$4;
+	})))))).pipe(timeoutOption(deadCodeTimeout.phaseTimeoutMs), flatMap$2(match$3({
+		onNone: () => set(deadCodeFailure, {
+			didFail: true,
+			reason: `Dead-code analysis exceeded ${Math.round(deadCodeTimeout.phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
+		}).pipe(as([])),
+		onSome: succeed$2
+	})));
+	const overlapDeadCodeTimeout = resolveDeadCodeTimeout({
+		sourceFileCount: project.sourceFileCount,
+		deadCodeConcurrency: deadCodeParseConcurrency ?? scanConcurrency,
+		fullConcurrency: scanConcurrency
+	});
+	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
+		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
+		phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs)
+	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
 	let lastReportedTotalFileCount = 0;
-	const lintCollected = yield* runCollect(applyPerElementPipeline(linterService.run({
+	let lintCacheHitFileCount = null;
+	let lintCacheTotalFileCount = null;
+	const baseLintStream = linterService.run({
 		rootDirectory: scanDirectory,
 		project,
 		includePaths: lintIncludePaths ?? void 0,
@@ -43159,6 +44019,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		onFileProgress: (scannedFileCount, totalFileCount) => {
 			lastReportedTotalFileCount = totalFileCount;
 			runSync(scanProgress.update(`Scanning files (${scannedFileCount}/${totalFileCount})${workerCountSuffix}...`));
+		},
+		onCacheStats: (cacheHitFileCount, totalConsideredFileCount) => {
+			lintCacheHitFileCount = cacheHitFileCount;
+			lintCacheTotalFileCount = totalConsideredFileCount;
 		}
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
 		yield* set(lintFailure, {
@@ -43168,36 +44032,54 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 			reasonKind: error.reason._tag === "OxlintUnavailable" ? error.reason.kind : null
 		});
 		return empty$4;
-	}))))));
+	}))));
+	const lintCollected = yield* runCollect(applyPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream)).pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
+		onNone: () => set(lintFailure, {
+			didFail: true,
+			reason: `Lint analysis exceeded ${lintPhaseTimeoutMs / MILLISECONDS_PER_SECOND}s and was skipped.`,
+			reasonTag: "OxlintBatchExceeded",
+			reasonKind: null
+		}).pipe(as([])),
+		onSome: succeed$2
+	})));
 	const lintFailureState = yield* get$2(lintFailure);
 	yield* afterLint(lintFailureState.didFail);
 	if (lintFailureState.didFail) yield* scanProgress.fail(formatLintFailText(lintFailureState.reasonTag, process.version));
 	const totalFileCount = lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
 	const scannedFilesLabel = `${totalFileCount} ${totalFileCount === 1 ? "file" : "files"}`;
-	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
-	const deadCodeCollected = lintFailureState.didFail || !shouldRunDeadCode ? [] : yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`).pipe(andThen(runCollect(applyPerElementPipeline(deadCodeService.run({
-		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
-	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
-		yield* set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
+	let deadCodeCollected = [];
+	if (lintFailureState.didFail) {
+		if (deadCodeFiber !== null) yield* interrupt(deadCodeFiber);
+	} else if (shouldRunDeadCode) {
+		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
+		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
+			sourceFileCount: totalFileCount,
+			deadCodeConcurrency: scanConcurrency,
+			fullConcurrency: scanConcurrency
 		});
-		return empty$4;
-	}))))))));
-	const deadCodeFailureState = yield* get$2(deadCodeFailure);
+		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
+			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
+			phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs)
+		});
+	}
+	const deadCodeFailureState = lintFailureState.didFail ? {
+		didFail: false,
+		reason: null
+	} : yield* get$2(deadCodeFailure);
 	const scanElapsedMilliseconds = Date.now() - scanStartTime;
-	const scanElapsedSeconds = (scanElapsedMilliseconds / 1e3).toFixed(1);
+	const scanElapsedSeconds = (scanElapsedMilliseconds / MILLISECONDS_PER_SECOND).toFixed(1);
 	if (!lintFailureState.didFail) if (deadCodeFailureState.didFail) yield* scanProgress.fail(DEAD_CODE_FAIL_TEXT);
 	else if (input.suppressScanSummary) yield* scanProgress.stop();
 	else yield* scanProgress.succeed(`Scanned ${scannedFilesLabel} in ${scanElapsedSeconds}s${workerCountSuffix}`);
+	const supplyChainResult = yield* join(supplyChainFiber);
+	const supplyChainCollected = supplyChainResult.diagnostics;
 	yield* reporterService.finalize;
-	const finalDiagnostics = [
+	const finalDiagnostics = sortDiagnosticsStable(assignFixGroups([
 		...envCollected,
 		...supplyChainCollected,
 		...lintCollected,
 		...deadCodeCollected
-	];
+	]));
 	const githubViewerPermission = yield* join(githubViewerPermissionFiber);
 	const scoreMetadata = {
 		...repo !== null ? { repo } : {},
@@ -43233,9 +44115,14 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		lintPartialFailures,
 		didDeadCodeFail: deadCodeFailureState.didFail,
 		deadCodeFailureReason: deadCodeFailureState.reason,
+		deadCodeOverlapped: shouldOverlapDeadCode,
 		scannedFileCount: totalFileCount,
 		scannedFilePaths,
-		scanElapsedMilliseconds
+		scanElapsedMilliseconds,
+		scanConcurrency,
+		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
+		lintCacheHitFileCount,
+		lintCacheTotalFileCount
 	};
 }).pipe(withSpan("runInspect", { attributes: {
 	"inspect.directory": input.directory,
@@ -43243,7 +44130,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	"inspect.runDeadCode": input.runDeadCode,
 	"inspect.isCi": input.isCi,
 	"inspect.scoreSurface": input.scoreSurface ?? "score"
-} }));
+} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })))));
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -43424,7 +44311,7 @@ var StagedFiles = class StagedFiles extends Service()("react-doctor/StagedFiles"
 	static layerNode = effect(StagedFiles, gen(function* () {
 		const git = yield* Git;
 		return StagedFiles.of({
-			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(map$3((entries) => entries.filter(isLintableSourceFile))),
+			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(map$3((entries) => entries.filter(isLintableSourceFile)), withSpan("StagedFiles.discoverSourceFiles")),
 			materialize: ({ directory, stagedFiles, tempDirectory }) => materializeSourceTree({
 				directory,
 				files: stagedFiles,
@@ -43434,7 +44321,7 @@ var StagedFiles = class StagedFiles extends Service()("react-doctor/StagedFiles"
 				tempDirectory: tree.tempDirectory,
 				stagedFiles: tree.materializedFiles,
 				cleanup: tree.cleanup
-			})))
+			})), withSpan("StagedFiles.materialize"))
 		});
 	}));
 	/**
@@ -43567,6 +44454,7 @@ const buildJsonReport = (input) => {
 		score: result.score,
 		skippedChecks: result.skippedChecks,
 		...result.skippedCheckReasons ? { skippedCheckReasons: result.skippedCheckReasons } : {},
+		...typeof result.scannedFileCount === "number" ? { scannedFileCount: result.scannedFileCount } : {},
 		elapsedMilliseconds: result.elapsedMilliseconds
 	}));
 	const flattenedDiagnostics = projects.flatMap((entry) => entry.diagnostics);
@@ -43841,7 +44729,7 @@ const FALSY_CI_FLAG_VALUES = new Set([
 	"false"
 ]);
 const isCiFlagSet = (value) => value !== void 0 && !FALSY_CI_FLAG_VALUES.has(value.toLowerCase());
-const isCiEnvironment = () => CI_ENVIRONMENT_VARIABLES.some((environmentVariable) => Boolean(process.env[environmentVariable])) || isCiFlagSet(process.env.CI);
+const isCiEnvironment = (env = process.env) => CI_ENVIRONMENT_VARIABLES.some((environmentVariable) => Boolean(env[environmentVariable])) || isCiFlagSet(env.CI);
 const detectCiProvider = () => {
 	for (const [environmentVariable, provider] of CI_PROVIDER_BY_ENVIRONMENT_VARIABLE) if (process.env[environmentVariable]) return provider;
 	return isCiFlagSet(process.env.CI) ? "unknown" : null;
@@ -43866,6 +44754,53 @@ const detectCodingAgent = () => {
 const isCodingAgentEnvironment = () => detectCodingAgent() !== null;
 const isCiOrCodingAgentEnvironment = () => isCiEnvironment() || isCodingAgentEnvironment();
 //#endregion
+//#region src/cli/utils/detect-terminal-kind.ts
+const TERMINAL_BY_TERM_PROGRAM = [
+	["vscode", "vscode"],
+	["iTerm.app", "iterm"],
+	["Apple_Terminal", "apple-terminal"],
+	["WezTerm", "wezterm"],
+	["ghostty", "ghostty"],
+	["Hyper", "hyper"],
+	["Tabby", "tabby"],
+	["rio", "rio"]
+];
+/**
+* Best-effort label for the terminal emulator / editor hosting the CLI,
+* derived from terminal-identity env vars. Recorded as the `terminalKind` run
+* tag so we can see where React Doctor is actually run (nvim, VS Code, iTerm,
+* …) — the split Sentry can't otherwise see. Low-cardinality and free of any
+* username/path/secret, so it's safe as a tag. Editor terminals (nvim/vim)
+* win over the outer emulator because that's the surface a user is reading in;
+* "ci" marks a run with no interactive terminal; "unknown" when nothing matches.
+*/
+const detectTerminalKind = (env = process.env) => {
+	if (env.NVIM) return "neovim";
+	if (env.VIM_TERMINAL) return "vim";
+	const termProgram = env.TERM_PROGRAM;
+	if (termProgram) {
+		for (const [marker, label] of TERMINAL_BY_TERM_PROGRAM) if (termProgram === marker) return label;
+	}
+	if (env.KITTY_WINDOW_ID || env.TERM === "xterm-kitty") return "kitty";
+	if (env.WT_SESSION) return "windows-terminal";
+	if (env.ALACRITTY_WINDOW_ID || env.TERM === "alacritty") return "alacritty";
+	if (env.VTE_VERSION) return "vte";
+	if (env.TMUX) return "tmux";
+	if (isCiEnvironment(env)) return "ci";
+	return "unknown";
+};
+//#endregion
+//#region src/cli/utils/is-debug-flag.ts
+/**
+* Whether the user passed `--debug` (surface the run's Sentry trace id, and
+* force performance tracing on so there's a trace to surface). Read straight
+* from argv rather than Commander's parsed flags because `initializeSentry()`
+* runs before Commander parses — the same reason `shouldEnableSentry()` reads
+* `--no-score` from argv. Sharing this one reader keeps the init-time sampling
+* override and the end-of-run print in agreement.
+*/
+const isDebugFlagEnabled = (argv = process.argv) => argv.includes("--debug");
+//#endregion
 //#region src/cli/utils/is-git-hook-environment.ts
 const isGitHookEnvironment = () => Boolean(process.env.GIT_DIR);
 //#endregion
@@ -43888,6 +44823,7 @@ const NON_INTERACTIVE_ENVIRONMENT_VARIABLES = [
 const isNonInteractiveEnvironment = () => NON_INTERACTIVE_ENVIRONMENT_VARIABLES.some((envVariable) => Boolean(process.env[envVariable])) || isCodingAgentEnvironment();
 //#endregion
 //#region src/cli/utils/constants.ts
+const REACT_DOCTOR_CONFIG_PROJECT_NAME = "react-doctor";
 const STAGED_FILES_TEMP_DIR_PREFIX = "react-doctor-staged-";
 const BASELINE_FILES_TEMP_DIR_PREFIX = "react-doctor-baseline-";
 const GH_DEFAULT_BRANCH_PROBE_TIMEOUT_MS = 5e3;
@@ -43972,7 +44908,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.5.6";
+const VERSION = "0.5.7-dev.2cadd3f";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -44122,8 +45058,11 @@ const buildRunContext = () => {
 		viaAction: isOfficialGithubAction(),
 		codingAgent: detectCodingAgent(),
 		interactive: !isNonInteractiveEnvironment(),
+		terminalKind: detectTerminalKind(),
 		jsonMode: isJsonModeActive(),
-		invokedVia: detectInvokedVia()
+		debug: isDebugFlagEnabled(),
+		invokedVia: detectInvokedVia(),
+		lintBatchOrdering: resolveLintBatchOrdering()
 	};
 };
 //#endregion
@@ -44192,9 +45131,12 @@ const buildSentryScope = (runContext = buildRunContext()) => {
 		viaAction: runContext.viaAction,
 		codingAgent: runContext.codingAgent,
 		interactive: runContext.interactive,
+		terminalKind: runContext.terminalKind,
 		jsonMode: runContext.jsonMode,
+		debug: runContext.debug,
 		invokedVia: runContext.invokedVia,
-		nodeMajor: runContext.nodeMajor
+		nodeMajor: runContext.nodeMajor,
+		lintBatchOrdering: runContext.lintBatchOrdering
 	};
 	const contexts = { run: { ...runContext } };
 	const projectInfo = getSentryProjectInfo();
@@ -44330,13 +45272,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.6`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.7-dev.2cadd3f`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.6") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.7-dev.2cadd3f") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -44400,7 +45342,7 @@ const flushSentry = async () => {
 const initializeSentry = () => {
 	if (isInitialized || !shouldEnableSentry()) return;
 	isInitialized = true;
-	resolvedTracesSampleRate = resolveTracesSampleRate();
+	resolvedTracesSampleRate = isDebugFlagEnabled() ? 1 : resolveTracesSampleRate();
 	const { tags, contexts } = buildSentryScope();
 	Sentry.init({
 		dsn: process.env.SENTRY_DSN || "https://f253d570240a59b8dbd77b7a548ef133@o4510226365743104.ingest.us.sentry.io/4511487817809920",
@@ -44539,7 +45481,7 @@ const externalSpanFrom = (sentrySpan) => {
 *    in-memory tracer — identical to the prior default behavior.
 */
 const applyObservability = (program, rootSentrySpan) => {
-	if (isOtlpExportConfigured()) return (rootSentrySpan ? program.pipe(provideService(ParentSpan, externalSpanFrom(rootSentrySpan))) : program).pipe(provide(layerOtlp));
+	if (isOtlpExportConfigured()) return (rootSentrySpan ? program.pipe(provideService$2(ParentSpan, externalSpanFrom(rootSentrySpan))) : program).pipe(provide(layerOtlp));
 	if (rootSentrySpan) return program.pipe(withTracer(makeSentryTracer(rootSentrySpan)));
 	return program.pipe(provide(layerOtlp));
 };
@@ -47616,6 +48558,11 @@ const setActiveRunTrace = (trace) => {
 	activeRunTrace = trace;
 };
 const getActiveRunTrace = () => activeRunTrace;
+let lastRunTraceId = null;
+const recordRunTraceId = (traceId) => {
+	lastRunTraceId = traceId;
+};
+const getLastRunTraceId = () => lastRunTraceId;
 //#endregion
 //#region src/cli/utils/to-span-attributes.ts
 /**
@@ -47678,14 +48625,13 @@ const withSentryRunSpan = (run, options = {}) => {
 		op: "cli.inspect",
 		attributes: toSpanAttributes(tags)
 	}, (rootSpan) => {
-		if (options.concurrentScan !== true) {
-			const spanContext = rootSpan.spanContext();
-			setActiveRunTrace({
-				traceId: spanContext.traceId,
-				spanId: spanContext.spanId,
-				sampled: (spanContext.traceFlags & 1) === 1
-			});
-		}
+		const spanContext = rootSpan.spanContext();
+		recordRunTraceId(spanContext.traceId);
+		if (options.concurrentScan !== true) setActiveRunTrace({
+			traceId: spanContext.traceId,
+			spanId: spanContext.spanId,
+			sampled: (spanContext.traceFlags & 1) === 1
+		});
 		return run(rootSpan);
 	});
 };
@@ -47825,6 +48771,42 @@ const recordScanMetrics = (input) => {
 	});
 };
 //#endregion
+//#region src/cli/utils/diagnostic-grouping.ts
+const buildRulePriorityMap = (scores) => {
+	const rulePriority = /* @__PURE__ */ new Map();
+	for (const score of scores) {
+		if (!score?.rules) continue;
+		for (const [ruleKey, info] of Object.entries(score.rules)) if (typeof info.priority === "number") rulePriority.set(ruleKey, info.priority);
+	}
+	return rulePriority;
+};
+const compareByRulePriority = (ruleKeyA, ruleKeyB, rulePriority) => {
+	const priorityA = rulePriority?.get(ruleKeyA);
+	const priorityB = rulePriority?.get(ruleKeyB);
+	if (priorityA === void 0 && priorityB === void 0) return 0;
+	if (priorityA === void 0) return 1;
+	if (priorityB === void 0) return -1;
+	return priorityB - priorityA;
+};
+const sortRuleGroupsByImportance = (diagnosticGroups, rulePriority) => diagnosticGroups.toSorted(([ruleKeyA], [ruleKeyB]) => compareByRulePriority(ruleKeyA, ruleKeyB, rulePriority));
+const buildSortedRuleGroups = (diagnostics, rulePriority) => sortRuleGroupsByImportance([...groupBy([...diagnostics], (diagnostic) => `${diagnostic.plugin}/${diagnostic.rule}`)], rulePriority);
+const getSharedFixSiteCount = (diagnostics) => {
+	if (diagnostics.length < 2) return 0;
+	const firstFixGroupId = diagnostics[0]?.fixGroupId;
+	if (!firstFixGroupId) return 0;
+	return diagnostics.every((diagnostic) => diagnostic.fixGroupId === firstFixGroupId) ? diagnostics.length : 0;
+};
+const FIX_RECIPE_DIRECTIVE_LABEL = "Curl with no cache & follow the canonical fix and false positive check recipe before fixing";
+const formatFixRecipeLine = (diagnostic) => hasPublishedFixRecipe(diagnostic) ? `${FIX_RECIPE_DIRECTIVE_LABEL}: ${buildRuleDocsUrl(diagnostic.plugin, diagnostic.rule)}` : null;
+const formatLearnMoreLine = (diagnostic) => hasPublishedFixRecipe(diagnostic) ? `Learn more: ${buildRuleDocsUrl(diagnostic.plugin, diagnostic.rule)}` : null;
+const buildRuleBlastRadii = (diagnostics) => buildSortedRuleGroups(diagnostics).map(([ruleKey, ruleDiagnostics]) => ({
+	ruleKey,
+	title: ruleDiagnostics[0].title ?? ruleKey,
+	siteCount: ruleDiagnostics.length,
+	fileCount: new Set(ruleDiagnostics.map((diagnostic) => diagnostic.filePath)).size
+})).toSorted((left, right) => right.fileCount - left.fileCount);
+const findMigrationScaleBuckets = (diagnostics) => buildRuleBlastRadii(diagnostics).filter((bucket) => bucket.fileCount >= 40);
+//#endregion
 //#region src/cli/utils/cli-logger.ts
 /**
 * Thin synchronous façade over Effect's `Console` module. Used by
@@ -47941,12 +48923,17 @@ const buildOutcomeAttributes = (input) => {
 		topRule = rule;
 		topRuleCount = count;
 	}
+	const largestRuleBucket = buildRuleBlastRadii(result.diagnostics)[0] ?? null;
 	let diagnosticsInTestFiles = 0;
 	let diagnosticsInStoryFiles = 0;
+	const findingsPerFixGroup = /* @__PURE__ */ new Map();
 	for (const diagnostic of result.diagnostics) {
 		if (diagnostic.fileContext === "test") diagnosticsInTestFiles += 1;
 		if (diagnostic.fileContext === "story") diagnosticsInStoryFiles += 1;
+		if (diagnostic.fixGroupId) findingsPerFixGroup.set(diagnostic.fixGroupId, (findingsPerFixGroup.get(diagnostic.fixGroupId) ?? 0) + 1);
 	}
+	let fixGroupedFindings = 0;
+	for (const count of findingsPerFixGroup.values()) fixGroupedFindings += count;
 	const attributes = {
 		outcome,
 		exitCode: wouldBlock ? 1 : 0,
@@ -47960,8 +48947,16 @@ const buildOutcomeAttributes = (input) => {
 		diagnosticsInTestFiles,
 		diagnosticsInStoryFiles,
 		distinctRulesFired: countByRule.size,
+		"diag.fixGroups": findingsPerFixGroup.size,
+		"diag.fixGroupedFindings": fixGroupedFindings,
 		topRule,
+		"migration.largestRuleBucketFiles": largestRuleBucket ? largestRuleBucket.fileCount : null,
+		"migration.largestRuleBucketSites": largestRuleBucket ? largestRuleBucket.siteCount : null,
+		"migration.largestRuleBucketRule": largestRuleBucket ? largestRuleBucket.ruleKey : null,
 		scannedFileCount: result.scannedFileCount ?? null,
+		lintCacheHitFiles: result.lintCacheHitFileCount ?? null,
+		lintCacheTotalFiles: result.lintCacheTotalFileCount ?? null,
+		lintCacheHitRatio: result.lintCacheTotalFileCount != null && result.lintCacheTotalFileCount > 0 ? (result.lintCacheHitFileCount ?? 0) / result.lintCacheTotalFileCount : null,
 		elapsedMs: result.elapsedMilliseconds,
 		scanPhaseMs: result.scanElapsedMilliseconds ?? null,
 		score: result.score ? result.score.score : null,
@@ -47971,7 +48966,10 @@ const buildOutcomeAttributes = (input) => {
 		didLintFail: input.didLintFail ?? null,
 		lintFailureReasonKind: input.lintFailureReasonKind ?? null,
 		lintPartialFailureCount: input.lintPartialFailureCount ?? null,
-		didDeadCodeFail: input.didDeadCodeFail ?? null
+		lintDroppedFileCount: input.lintDroppedFileCount ?? null,
+		didDeadCodeFail: input.didDeadCodeFail ?? null,
+		supplyChainOverlapTimedOut: input.supplyChainOverlapTimedOut ?? null,
+		deadCodeOverlapped: input.deadCodeOverlapped ?? null
 	};
 	for (const [category, count] of countByCategory) attributes[`diag.category.${toCategoryKey(category)}`] = count;
 	if (result.baselineDelta) {
@@ -48040,6 +49038,32 @@ const recordRunEvent = (rootSpan, input) => {
 	} catch {}
 };
 //#endregion
+//#region src/cli/utils/resolve-worker-telemetry.ts
+/**
+* Projects the resolved lint worker count into the `(workerCount, parallel)`
+* telemetry pair. `resolvedWorkerCount` is the count the scan actually fanned
+* out to (`InspectOutput.scanConcurrency`); `pinnedConcurrency` is the caller's
+* `inspect({ concurrency })` pin, used as the fallback when no scan resolved a
+* count (the pre-scan failure path, or a cache entry persisted before the
+* resolved count was tracked). `parallel` is derived from the count — NOT from
+* whether a count was pinned — so the common auto path (no pin) still reports
+* parallelism correctly instead of always reading `false`.
+*/
+const resolveWorkerTelemetry = (resolvedWorkerCount, pinnedConcurrency) => {
+	const workerCount = resolvedWorkerCount ?? pinnedConcurrency;
+	return {
+		workerCount,
+		parallel: workerCount !== void 0 && workerCount > 1
+	};
+};
+//#endregion
+//#region src/cli/utils/count-dropped-lint-files.ts
+const DROPPED_FILES_MESSAGE_PATTERN = /^(\d+) file\(s\) failed to lint and were skipped/;
+const countDroppedLintFiles = (lintPartialFailures) => lintPartialFailures.reduce((total, message) => {
+	const match = DROPPED_FILES_MESSAGE_PATTERN.exec(message);
+	return match ? total + Number(match[1]) : total;
+}, 0);
+//#endregion
 //#region src/cli/utils/path-format.ts
 const toForwardSlashes = (filePath) => filePath.replaceAll("\\", "/");
 //#endregion
@@ -48118,9 +49142,10 @@ const AGENT_GUIDANCE_LINES = [
 	"Investigate deeply where relevant: race conditions, security-sensitive flows, state propagation, multi-file refactors, and downstream dependency chains.",
 	"Ignore pure style preferences, theoretical issues without real impact, missing features, and unrelated pre-existing code.",
 	"Start with high-confidence fixes that preserve behavior. Leave low-confidence or product-dependent changes as notes.",
-	"Run `npx react-doctor@latest --verbose --diff` before and after changes, plus relevant tests after each focused batch.",
+	"Run `npx react-doctor@latest --verbose --scope changed` before and after changes, plus relevant tests after each focused batch.",
 	"When available, spawn subagents or isolated worktrees for independent rule families, then review and merge only the best safe fixes.",
 	"Split unrelated, broad, or behavior-changing work into separate PRs/branches instead of one large cleanup.",
+	"When one rule spans dozens of files (a migration-scale change), fix a representative sample first, confirm the recipe holds, and get the code owner's sign-off before changing the rest. Don't mass-fix a broad pattern in one unreviewed pass.",
 	"For confirmed issues that cannot be fixed now, create GitHub issues with the rule, file/line, confidence, impact, and proposed fix.",
 	"If a fix needs an API, UX, or architecture decision, stop and ask before editing."
 ];
@@ -48130,29 +49155,6 @@ const printAgentGuidance = () => gen(function* () {
 	yield* log("");
 });
 //#endregion
-//#region src/cli/utils/diagnostic-grouping.ts
-const buildRulePriorityMap = (scores) => {
-	const rulePriority = /* @__PURE__ */ new Map();
-	for (const score of scores) {
-		if (!score?.rules) continue;
-		for (const [ruleKey, info] of Object.entries(score.rules)) if (typeof info.priority === "number") rulePriority.set(ruleKey, info.priority);
-	}
-	return rulePriority;
-};
-const compareByRulePriority = (ruleKeyA, ruleKeyB, rulePriority) => {
-	const priorityA = rulePriority?.get(ruleKeyA);
-	const priorityB = rulePriority?.get(ruleKeyB);
-	if (priorityA === void 0 && priorityB === void 0) return 0;
-	if (priorityA === void 0) return 1;
-	if (priorityB === void 0) return -1;
-	return priorityB - priorityA;
-};
-const sortRuleGroupsByImportance = (diagnosticGroups, rulePriority) => diagnosticGroups.toSorted(([ruleKeyA], [ruleKeyB]) => compareByRulePriority(ruleKeyA, ruleKeyB, rulePriority));
-const buildSortedRuleGroups = (diagnostics, rulePriority) => sortRuleGroupsByImportance([...groupBy([...diagnostics], (diagnostic) => `${diagnostic.plugin}/${diagnostic.rule}`)], rulePriority);
-const FIX_RECIPE_DIRECTIVE_LABEL = "Curl with no cache & follow the canonical fix and false positive check recipe before fixing";
-const formatFixRecipeLine = (diagnostic) => hasPublishedFixRecipe(diagnostic) ? `${FIX_RECIPE_DIRECTIVE_LABEL}: ${buildRuleDocsUrl(diagnostic.plugin, diagnostic.rule)}` : null;
-const formatLearnMoreLine = (diagnostic) => hasPublishedFixRecipe(diagnostic) ? `Learn more: ${buildRuleDocsUrl(diagnostic.plugin, diagnostic.rule)}` : null;
-//#endregion
 //#region src/cli/utils/box-text.ts
 const ESCAPE = String.fromCharCode(27);
 const ANSI_ESCAPE_PATTERN = new RegExp(`${ESCAPE}\\[[0-9;]*m`, "g");
@@ -48193,6 +49195,15 @@ const boxText = (content, innerWidth) => {
 	].join("\n");
 };
 //#endregion
+//#region src/cli/utils/resolve-absolute-path.ts
+/**
+* Resolves a diagnostic's `filePath` (relative to its project root, or
+* already absolute) to an absolute path. Shared by the code-frame reader and
+* the terminal hyperlink builder so both turn a relative path into the same
+* on-disk location.
+*/
+const resolveAbsolutePath = (filePath, rootDirectory) => Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory || ".", filePath);
+//#endregion
 //#region src/cli/utils/build-code-frame.ts
 /**
 * Renders a syntax-highlighted source excerpt around a diagnostic site
@@ -48203,7 +49214,7 @@ const boxText = (content, innerWidth) => {
 */
 const buildCodeFrame = (input) => {
 	if (input.line <= 0) return null;
-	const absolutePath = Path.isAbsolute(input.filePath) ? input.filePath : Path.resolve(input.rootDirectory || ".", input.filePath);
+	const absolutePath = resolveAbsolutePath(input.filePath, input.rootDirectory);
 	let source;
 	try {
 		source = NFS.readFileSync(absolutePath, "utf8");
@@ -48243,6 +49254,16 @@ const resolveMeasureWidth = (reservedColumns = 0) => resolveClampedWidth({
 const DIVIDER_INDENT = "  ";
 const buildSectionDivider = () => highlighter.dim(`${DIVIDER_INDENT}${"─".repeat(resolveMeasureWidth(2))}`);
 //#endregion
+//#region src/cli/utils/format-hyperlink.ts
+const OSC = "\x1B]";
+const ST = "\x1B\\";
+/**
+* Wraps `text` in an OSC 8 hyperlink pointing at `uri`. The visible characters
+* are exactly `text`; the link is carried in escape sequences a capable
+* terminal turns into a click target.
+*/
+const formatHyperlink = (text, uri) => `${OSC}8;;${uri}${ST}${text}${OSC}8;;${ST}`;
+//#endregion
 //#region src/cli/utils/indent-multiline-text.ts
 const indentMultilineText = (text, linePrefix) => text.split("\n").map((lineText) => `${linePrefix}${lineText}`).join("\n");
 //#endregion
@@ -48396,17 +49417,23 @@ const clusterNearbyDiagnostics = (diagnostics) => {
 	}
 	return clusters;
 };
-const formatClusterLocation = (cluster) => {
+const formatClusterLocationText = (cluster) => {
+	const { filePath } = cluster.diagnostics[0];
+	if (cluster.startLine <= 0) return filePath;
+	if (cluster.endLine > cluster.startLine) return `${filePath}:${cluster.startLine}-${cluster.endLine}`;
+	return `${filePath}:${cluster.startLine}`;
+};
+const formatClusterLocation = (cluster, resolveSourceRoot, hyperlinks) => {
 	const lead = cluster.diagnostics[0];
 	const contextTag = formatFileContextTag(lead);
-	if (cluster.startLine <= 0) return `${lead.filePath}${contextTag}`;
-	if (cluster.endLine > cluster.startLine) return `${lead.filePath}:${cluster.startLine}-${cluster.endLine}${contextTag}`;
-	return `${lead.filePath}:${cluster.startLine}${contextTag}`;
+	const location = formatClusterLocationText(cluster);
+	if (!hyperlinks) return `${location}${contextTag}`;
+	return `${formatHyperlink(location, pathToFileURL(resolveAbsolutePath(lead.filePath, resolveSourceRoot(lead))).href)}${contextTag}`;
 };
-const buildDiagnosticClusterLines = (cluster, resolveSourceRoot, renderCodeFrame) => {
+const buildDiagnosticClusterLines = (cluster, resolveSourceRoot, renderCodeFrame, hyperlinks) => {
 	const lead = cluster.diagnostics[0];
 	const isMultiSite = cluster.diagnostics.length > 1;
-	const lines = ["", highlighter.gray(`${TOP_ERROR_DETAIL_INDENT}${formatClusterLocation(cluster)}`)];
+	const lines = ["", highlighter.gray(`${TOP_ERROR_DETAIL_INDENT}${formatClusterLocation(cluster, resolveSourceRoot, hyperlinks)}`)];
 	const codeFrame = renderCodeFrame ? buildCodeFrame({
 		filePath: lead.filePath,
 		line: cluster.startLine,
@@ -48425,7 +49452,7 @@ const buildDiagnosticClusterLines = (cluster, resolveSourceRoot, renderCodeFrame
 	}
 	return lines;
 };
-const buildRuleDetailBlock = (ruleKey, ruleDiagnostics, resolveSourceRoot, renderEverySite, isAgentEnvironment) => {
+const buildRuleDetailBlock = (ruleKey, ruleDiagnostics, resolveSourceRoot, renderEverySite, isAgentEnvironment, hyperlinks) => {
 	const representative = pickRepresentativeDiagnostic(ruleDiagnostics);
 	const { severity } = representative;
 	const trailingBadge = formatTrailingSiteBadge(ruleDiagnostics.length);
@@ -48439,13 +49466,15 @@ const buildRuleDetailBlock = (ruleKey, ruleDiagnostics, resolveSourceRoot, rende
 	const impactMessages = isCollapsedWarningGroup ? [...new Set(ruleDiagnostics.map((diagnostic) => diagnostic.message))] : [representative.message];
 	for (const impactMessage of impactMessages) for (const explanationLine of wrapTextToWidth(impactMessage, resolveMeasureWidth(4), { breakLongWords: false })) lines.push(`${TOP_ERROR_DETAIL_INDENT}${explanationLine}`);
 	if (representative.help) for (const fixLine of wrapTextToWidth(`→ ${representative.help}`, resolveMeasureWidth(4), { breakLongWords: false })) lines.push(highlighter.dim(`${TOP_ERROR_DETAIL_INDENT}${fixLine}`));
+	const sharedFixSiteCount = getSharedFixSiteCount(ruleDiagnostics);
+	if (sharedFixSiteCount > 0) lines.push(highlighter.dim(`${TOP_ERROR_DETAIL_INDENT}↳ One fix clears all ${sharedFixSiteCount} findings.`));
 	if (renderEverySite && isAgentEnvironment) {
 		const fixRecipeLine = formatFixRecipeLine(representative);
 		if (fixRecipeLine) lines.push(highlighter.gray(`${TOP_ERROR_DETAIL_INDENT}${fixRecipeLine}`));
 	}
 	const renderCodeFrame = severity === "error";
 	const sites = renderEverySite ? ruleDiagnostics : [representative];
-	if (!(isCollapsedWarningGroup && representative.help.includes(representative.filePath))) for (const cluster of clusterNearbyDiagnostics(sites)) lines.push(...buildDiagnosticClusterLines(cluster, resolveSourceRoot, renderCodeFrame));
+	if (!(isCollapsedWarningGroup && representative.help.includes(representative.filePath))) for (const cluster of clusterNearbyDiagnostics(sites)) lines.push(...buildDiagnosticClusterLines(cluster, resolveSourceRoot, renderCodeFrame, hyperlinks));
 	return lines;
 };
 const selectErrorRuleGroups = (diagnostics, rulePriority) => buildSortedRuleGroups(diagnostics.filter((diagnostic) => diagnostic.severity === "error"), rulePriority);
@@ -48457,8 +49486,21 @@ const buildOverflowSummaryLine = (diagnostics, rulePriority) => {
 	const command = highlighter.bold(highlighter.info("npx react-doctor@latest --verbose"));
 	return `  ${highlighter.dim("Run")} ${command} ${highlighter.dim("to list every error and warning")}`;
 };
+const formatMigrationBucketLine = (bucket) => `${TOP_ERROR_DETAIL_INDENT}${bucket.title} ${highlighter.gray(`×${bucket.siteCount} across ${bucket.fileCount} files`)}`;
+const buildMigrationScaleAdvisoryLines = (diagnostics) => {
+	const buckets = findMigrationScaleBuckets(diagnostics);
+	if (buckets.length === 0) return [];
+	const shownBuckets = buckets.slice(0, 3);
+	const lines = [`  ${highlighter.warn("⚠")} ${highlighter.bold("Migration-scale change")}${highlighter.dim(": sample before you sweep")}`, ...shownBuckets.map(formatMigrationBucketLine)];
+	const remainingBuckets = buckets.length - shownBuckets.length;
+	if (remainingBuckets > 0) lines.push(highlighter.gray(`${TOP_ERROR_DETAIL_INDENT}+${remainingBuckets} more ${remainingBuckets === 1 ? "rule" : "rules"} at this scale`));
+	for (const guidanceLine of wrapTextToWidth("Fixing all of them at once is hard to review and prone to subtle mistakes across the whole repo. Fix a representative few first and confirm the recipe holds. Then get the code owner's sign-off before changing the rest.", resolveMeasureWidth(4), { breakLongWords: false })) lines.push(highlighter.dim(`${TOP_ERROR_DETAIL_INDENT}${guidanceLine}`));
+	const command = highlighter.info("npx react-doctor@latest <path>");
+	lines.push(`${TOP_ERROR_DETAIL_INDENT}${highlighter.dim("Scope it down one area at a time:")} ${command}`);
+	return lines;
+};
 const getTopErrorRuleKeys = (diagnostics, limit, rulePriority) => new Set(selectTopErrorRuleGroups(diagnostics, limit, rulePriority).map(([ruleKey]) => ruleKey));
-const buildTopErrorsSection = (diagnostics, resolveSourceRoot, rulePriority) => {
+const buildTopErrorsSection = (diagnostics, resolveSourceRoot, hyperlinks, rulePriority) => {
 	const topRuleGroups = selectErrorRuleGroups(diagnostics, rulePriority).slice(0, 3);
 	if (topRuleGroups.length === 0) return {
 		lines: [],
@@ -48468,7 +49510,7 @@ const buildTopErrorsSection = (diagnostics, resolveSourceRoot, rulePriority) =>
 	const blockOffsets = [];
 	for (const [ruleKey, ruleDiagnostics] of topRuleGroups) {
 		blockOffsets.push(lines.length);
-		lines.push(...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, false, false));
+		lines.push(...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, false, false, hyperlinks));
 		lines.push("");
 	}
 	return {
@@ -48506,24 +49548,24 @@ const buildOverviewHeaderLines = (diagnostics) => {
 * single Effect.forEach over Console.log so failures or fiber
 * interruption produce predictable partial output.
 */
-const printDiagnostics = (diagnostics, isVerbose, sourceRoot, rulePriority, isAgentEnvironment = false, onboarding = {}) => gen(function* () {
+const printDiagnostics = (diagnostics, isVerbose, sourceRoot, rulePriority, isAgentEnvironment = false, onboarding = {}, hyperlinks = false) => gen(function* () {
 	const sectionPause = onboarding.sectionPause ?? void_;
 	const animateCountUp = onboarding.animateCountUp ?? false;
 	const resolveSourceRoot = typeof sourceRoot === "function" ? sourceRoot : () => sourceRoot;
 	let detailLines;
 	let topErrorBlockOffsets = [];
 	if (!isVerbose) {
-		const topErrors = buildTopErrorsSection(diagnostics, resolveSourceRoot, rulePriority);
+		const topErrors = buildTopErrorsSection(diagnostics, resolveSourceRoot, hyperlinks, rulePriority);
 		detailLines = topErrors.lines;
 		topErrorBlockOffsets = topErrors.blockOffsets;
 	} else detailLines = buildSortedRuleGroups(diagnostics, rulePriority).flatMap(([ruleKey, ruleDiagnostics]) => {
-		return [...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, true, isAgentEnvironment), ""];
+		return [...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, true, isAgentEnvironment, hyperlinks), ""];
 	});
 	const overflowLine = isVerbose ? void 0 : buildOverflowSummaryLine(diagnostics, rulePriority);
 	const categoryTallies = buildCategoryDiagnosticGroups(diagnostics, rulePriority).map(buildCategoryTally);
 	const categoryLines = buildCategoryTallyLines(categoryTallies);
 	const overviewDividerLines = detailLines.length > 0 && categoryLines.length > 0 ? [buildSectionDivider()] : [];
-	const { lines, sectionStarts } = joinSections(detailLines, overviewDividerLines, buildOverviewHeaderLines(diagnostics), categoryLines, overflowLine ? [overflowLine] : []);
+	const { lines, sectionStarts } = joinSections(detailLines, overviewDividerLines, buildOverviewHeaderLines(diagnostics), categoryLines, overflowLine ? [overflowLine] : [], buildMigrationScaleAdvisoryLines(diagnostics));
 	const [detailStart, , , categoryStart] = sectionStarts;
 	const pauseBeforeLineIndices = detailStart == null ? /* @__PURE__ */ new Set() : new Set(topErrorBlockOffsets.map((offset) => detailStart + offset));
 	let lineIndex = 0;
@@ -48578,6 +49620,48 @@ const computeProjectedScore = async (topErrorSource, rescoreSource, currentScore
 //#endregion
 //#region src/cli/utils/filter-diagnostics-by-categories.ts
 const filterDiagnosticsByCategories = (diagnostics, categories) => categories.size === 0 ? [...diagnostics] : diagnostics.filter((diagnostic) => categories.has(diagnostic.category));
+//#endregion
+//#region src/cli/utils/supports-hyperlinks.ts
+const HYPERLINK_CAPABLE_TERM_PROGRAMS = new Set([
+	"iTerm.app",
+	"WezTerm",
+	"vscode",
+	"Hyper",
+	"ghostty",
+	"Tabby",
+	"rio"
+]);
+const parseVteVersion = (raw) => {
+	const parsed = Number.parseInt(raw ?? "", 10);
+	return Number.isNaN(parsed) ? 0 : parsed;
+};
+/**
+* Whether `stream` is a terminal that renders OSC 8 hyperlinks. Auto-detected
+* from terminal-identity env vars; the de-facto `FORCE_HYPERLINK` env var
+* overrides detection (`FORCE_HYPERLINK=0`/`false` forces off, any other value
+* forces on), mirroring how the ecosystem's terminal libraries gate the same
+* feature. Off for non-TTYs, `TERM=dumb`, and CI (whose log viewers render the
+* raw escape rather than a link). Unknown terminals default to off.
+*/
+const supportsHyperlinks = (stream = process.stdout, env = process.env) => {
+	const forced = env.FORCE_HYPERLINK;
+	if (forced !== void 0 && forced !== "") return forced !== "0" && forced.toLowerCase() !== "false";
+	if (stream.isTTY !== true) return false;
+	if (env.TERM === "dumb") return false;
+	if (isCiEnvironment(env)) return false;
+	if (env.WT_SESSION) return true;
+	if (env.KITTY_WINDOW_ID || env.TERM === "xterm-kitty") return true;
+	if (parseVteVersion(env.VTE_VERSION) >= 5e3) return true;
+	return Boolean(env.TERM_PROGRAM && HYPERLINK_CAPABLE_TERM_PROGRAMS.has(env.TERM_PROGRAM));
+};
+//#endregion
+//#region src/cli/utils/should-render-hyperlinks.ts
+/**
+* Whether to emit OSC 8 clickable `file:line` locations for this run: a
+* hyperlink-capable terminal AND not a coding agent (whose output parsers
+* would choke on the escape sequences).
+*/
+const shouldRenderHyperlinks = (stream = process.stdout) => supportsHyperlinks(stream) && !isCodingAgentEnvironment();
 const FORCE_ONBOARDING_ENV_VAR = "REACT_DOCTOR_FORCE_ONBOARDING";
 const FALSY_FLAG_VALUES = new Set([
 	"",
@@ -48596,26 +49680,182 @@ const canAnimateOnboarding = (stream = process.stdout) => {
 	return !isGitHookEnvironment() && !isCiEnvironment();
 };
 //#endregion
-//#region src/cli/utils/onboarding-state.ts
-const GLOBAL_CONFIG_PROJECT_NAME$2 = "react-doctor";
-const ONBOARDED_AT_KEY = "onboardedAt";
-const getOnboardingStore = (options = {}) => new Conf({
-	projectName: GLOBAL_CONFIG_PROJECT_NAME$2,
-	cwd: options.cwd
+//#region src/cli/utils/now-iso.ts
+const nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
+const ONBOARDING_EVENT = "onboarding";
+const CI_PITCH_EVENT = "ci-pitch";
+const ACTION_UPGRADE_EVENT = "action-upgrade-v2";
+const SETUP_HINT_EVENT = "setup-hint";
+const foldLegacyDecisions = (projects, legacy, eventId) => {
+	for (const [hash, record] of Object.entries(legacy ?? {})) {
+		const existing = projects[hash] ?? { rootDirectory: record.rootDirectory ?? "" };
+		projects[hash] = {
+			...existing,
+			events: {
+				...existing.events,
+				[eventId]: {
+					firedAt: record.at ?? nowIso(),
+					version: 1,
+					...record.outcome ? { outcome: record.outcome } : {}
+				}
+			}
+		};
+	}
+};
+const migrateCliState = (state) => {
+	if (state.schemaVersion === 2) return state;
+	const projects = {};
+	for (const [hash, record] of Object.entries(state.projects ?? {})) {
+		const carried = {
+			rootDirectory: record.rootDirectory,
+			...record.events ? { events: record.events } : {},
+			...record.migrations ? { migrations: record.migrations } : {}
+		};
+		projects[hash] = record.setupPrompt === false ? {
+			...carried,
+			events: {
+				...carried.events,
+				[SETUP_HINT_EVENT]: {
+					firedAt: nowIso(),
+					version: 1,
+					outcome: "declined"
+				}
+			}
+		} : carried;
+	}
+	foldLegacyDecisions(projects, state.ciPrompts, CI_PITCH_EVENT);
+	foldLegacyDecisions(projects, state.actionUpgrades, ACTION_UPGRADE_EVENT);
+	return {
+		schemaVersion: 2,
+		global: typeof state.onboardedAt === "string" ? { events: { [ONBOARDING_EVENT]: {
+			firedAt: state.onboardedAt,
+			version: 1
+		} } } : {},
+		projects
+	};
+};
+const resolveConfigDir = (options) => options.cwd ?? (process.env["REACT_DOCTOR_CONFIG_DIR"] || void 0);
+const openStore = (options = {}) => new Conf({
+	projectName: REACT_DOCTOR_CONFIG_PROJECT_NAME,
+	cwd: resolveConfigDir(options)
 });
-const hasCompletedOnboarding = (options = {}) => {
+const openMigratedStore = (options) => {
+	const store = openStore(options);
+	if (store.store.schemaVersion !== 2) store.store = migrateCliState(store.store);
+	return store;
+};
+const readCliState = (select, fallback, options = {}) => {
 	try {
-		return typeof getOnboardingStore(options).get(ONBOARDED_AT_KEY) === "string";
+		return select(openMigratedStore(options).store);
 	} catch {
+		return fallback;
+	}
+};
+const updateCliState = (update, options = {}) => {
+	try {
+		const store = openMigratedStore(options);
+		store.store = update(store.store);
 		return true;
+	} catch {
+		return false;
 	}
 };
+//#endregion
+//#region src/cli/utils/hash-project-root.ts
+const hashProjectRoot = (projectRoot) => createHash("sha256").update(Path.resolve(projectRoot)).digest("hex");
+//#endregion
+//#region src/cli/utils/cli-lifecycle.ts
+const versionOf = (item) => item.version ?? 1;
+const selectScope = (state, scoped, projectRoot) => scoped.scope === "global" ? state.global : projectRoot === void 0 ? void 0 : state.projects?.[hashProjectRoot(projectRoot)];
+const updateScope = (state, scoped, projectRoot, updateScopeState) => {
+	if (scoped.scope === "global") return {
+		...state,
+		global: updateScopeState(state.global ?? {})
+	};
+	if (projectRoot === void 0) return state;
+	const projectKey = hashProjectRoot(projectRoot);
+	const base = state.projects?.[projectKey] ?? { rootDirectory: Path.resolve(projectRoot) };
+	return {
+		...state,
+		projects: {
+			...state.projects,
+			[projectKey]: {
+				...base,
+				...updateScopeState(base)
+			}
+		}
+	};
+};
+const isGatePending = (gate, target = {}, options = {}) => {
+	if (gate.scope === "project" && target.projectRoot === void 0) return false;
+	return readCliState((state) => {
+		const record = selectScope(state, gate, target.projectRoot)?.events?.[gate.id];
+		return !record || record.version < versionOf(gate);
+	}, gate.fireWhenUnknown ?? false, options);
+};
+const recordGate = (gate, target = {}, options = {}) => updateCliState((state) => updateScope(state, gate, target.projectRoot, (scope) => ({
+	...scope,
+	events: {
+		...scope.events,
+		[gate.id]: {
+			firedAt: nowIso(),
+			version: versionOf(gate),
+			...target.outcome ? { outcome: target.outcome } : {}
+		}
+	}
+})), options);
+const isMigrationPending = (migration, target = {}, options = {}) => {
+	if (migration.scope === "project" && target.projectRoot === void 0) return false;
+	return readCliState((state) => {
+		const record = selectScope(state, migration, target.projectRoot)?.migrations?.[migration.id];
+		return !record || record.version < versionOf(migration);
+	}, false, options);
+};
+const recordMigration = (migration, projectRoot, record, options) => updateCliState((state) => updateScope(state, migration, projectRoot, (scope) => ({
+	...scope,
+	migrations: {
+		...scope.migrations,
+		[migration.id]: record
+	}
+})), options);
+const runMigrations = async (migrations, target = {}, options = {}) => {
+	const results = [];
+	for (const migration of migrations) {
+		if (!isMigrationPending(migration, target, options)) {
+			results.push({
+				id: migration.id,
+				ran: false,
+				applied: true
+			});
+			continue;
+		}
+		let applied = false;
+		try {
+			applied = await migration.run({ projectRoot: target.projectRoot });
+		} catch {
+			applied = false;
+		}
+		if (applied) recordMigration(migration, target.projectRoot, {
+			ranAt: nowIso(),
+			version: versionOf(migration)
+		}, options);
+		results.push({
+			id: migration.id,
+			ran: true,
+			applied
+		});
+	}
+	return results;
+};
+//#endregion
+//#region src/cli/utils/onboarding-state.ts
+const ONBOARDING_GATE = {
+	id: ONBOARDING_EVENT,
+	scope: "global"
+};
+const hasCompletedOnboarding = (options = {}) => !isGatePending(ONBOARDING_GATE, {}, options);
 const markOnboardingComplete = (options = {}) => {
-	try {
-		const store = getOnboardingStore(options);
-		if (typeof store.get(ONBOARDED_AT_KEY) === "string") return;
-		store.set(ONBOARDED_AT_KEY, (/* @__PURE__ */ new Date()).toISOString());
-	} catch {}
+	if (isGatePending(ONBOARDING_GATE, {}, options)) recordGate(ONBOARDING_GATE, {}, options);
 };
 //#endregion
 //#region src/cli/utils/render-project-detection.ts
@@ -49056,6 +50296,78 @@ const resolveCliCategories = (categoryFlag) => {
 	return resolvedCategories.length > 0 ? resolvedCategories : void 0;
 };
 //#endregion
+//#region src/cli/utils/git-hook-shared.ts
+const HOOK_FILE_NAME = "pre-commit";
+const HOOK_RELATIVE_PATH = "hooks/pre-commit";
+const LEGACY_HOOK_RUNNER_RELATIVE_PATH = ".react-doctor/hooks/pre-commit";
+const HUSKY_HOOKS_PATH = ".husky";
+const VITE_PLUS_HOOKS_PATH = ".vite-hooks";
+const LEFTHOOK_CONFIG_FILES = ["lefthook.yml", "lefthook.yaml"];
+const PRE_COMMIT_CONFIG_FILE = ".pre-commit-config.yaml";
+const OVERCOMMIT_CONFIG_FILE = ".overcommit.yml";
+const REACT_DOCTOR_COMMAND = "react-doctor --staged --blocking warning";
+const NON_BLOCKING_REACT_DOCTOR_COMMAND = [
+	"react_doctor_output=$(mktemp \"${TMPDIR:-/tmp}/react-doctor-hook.XXXXXX\");",
+	`if ${REACT_DOCTOR_COMMAND} > "$react_doctor_output" 2>&1; then`,
+	"rm -f \"$react_doctor_output\";",
+	"else",
+	"rm -f \"$react_doctor_output\";",
+	`printf "%s\\n" "React Doctor found staged regressions." "Run ${REACT_DOCTOR_COMMAND} to inspect." "Want them fixed? Ask your agent to run that command and resolve the findings." >&2;`,
+	"fi"
+].join(" ");
+const PACKAGE_JSON_FILE_NAME = "package.json";
+const runGit = (projectRoot, args) => {
+	try {
+		return execFileSync("git", [...args], {
+			cwd: projectRoot,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+};
+const resolveGitPath = (baseDirectory, value) => Path.isAbsolute(value) ? value : Path.resolve(baseDirectory, value);
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const getPackageJsonPath = (projectRoot) => Path.join(projectRoot, PACKAGE_JSON_FILE_NAME);
+const readPackageJson = (projectRoot) => {
+	try {
+		return JSON.parse(NFS.readFileSync(getPackageJsonPath(projectRoot), "utf8"));
+	} catch {
+		return null;
+	}
+};
+const writeJsonFile$1 = (filePath, value) => {
+	NFS.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
+};
+const packageHasDependency = (projectRoot, dependencyName) => {
+	const packageJson = readPackageJson(projectRoot);
+	if (!isRecord$1(packageJson)) return false;
+	return [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies"
+	].some((fieldName) => {
+		const dependencies = packageJson[fieldName];
+		return isRecord$1(dependencies) && typeof dependencies[dependencyName] === "string";
+	});
+};
+const packageHasRecordKey = (projectRoot, key) => {
+	const packageJson = readPackageJson(projectRoot);
+	return isRecord$1(packageJson) && isRecord$1(packageJson[key]);
+};
+const packageHasNestedRecordKey = (projectRoot, key, nestedKey) => {
+	const packageJson = readPackageJson(projectRoot);
+	if (!isRecord$1(packageJson)) return false;
+	const value = packageJson[key];
+	return isRecord$1(value) && isRecord$1(value[nestedKey]);
+};
+const ensureTrailingNewline = (content) => content.endsWith("\n") ? content : `${content}\n`;
+//#endregion
 //#region src/cli/utils/scan-result-cache.ts
 const CACHE_DISABLED_VALUES = new Set(["1", "true"]);
 const TOOLCHAIN_PACKAGE_SPECIFIERS = [
@@ -49066,7 +50378,7 @@ const TOOLCHAIN_PACKAGE_SPECIFIERS = [
 	"eslint-plugin-react-hooks/package.json"
 ];
 const bundledRequire = createRequire(import.meta.url);
-const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const normalizeForStableJson = (value) => {
 	if (value === null) return null;
 	if (value === void 0) return void 0;
@@ -49095,24 +50407,9 @@ const stringifyStableJson = (value) => {
 	}
 };
 const hashString = (value) => crypto.createHash("sha1").update(value).digest("hex");
-const runGit$1 = (directory, args) => {
-	try {
-		return execFileSync("git", [...args], {
-			cwd: directory,
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {
-		return null;
-	}
-};
-const readHeadSha = (projectDirectory) => runGit$1(projectDirectory, ["rev-parse", "HEAD"]);
+const readHeadSha = (projectDirectory) => runGit(projectDirectory, ["rev-parse", "HEAD"]);
 const isWorktreeClean = (projectDirectory) => {
-	const status = runGit$1(projectDirectory, [
+	const status = runGit(projectDirectory, [
 		"status",
 		"--porcelain=v1",
 		"--untracked-files=normal"
@@ -49120,7 +50417,7 @@ const isWorktreeClean = (projectDirectory) => {
 	return status !== null && status.length === 0;
 };
 const hasHiddenTrackedFileState = (projectDirectory) => {
-	const output = runGit$1(projectDirectory, ["ls-files", "-v"]);
+	const output = runGit(projectDirectory, ["ls-files", "-v"]);
 	if (output === null) return true;
 	return output.split("\n").some((line) => line.length > 0 && line[0] !== "H");
 };
@@ -49133,27 +50430,27 @@ const resolveCacheFilePath = (projectDirectory) => {
 const readPersistedCache = (cacheFilePath) => {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord$1(parsed) || parsed.version !== 1) return {
-			version: 1,
+		if (!isRecord(parsed) || parsed.version !== 2) return {
+			version: 2,
 			entries: []
 		};
 		if (!Array.isArray(parsed.entries)) return {
-			version: 1,
+			version: 2,
 			entries: []
 		};
 		const entries = [];
 		for (const entry of parsed.entries) {
-			if (!isRecord$1(entry) || typeof entry.key !== "string" || typeof entry.createdAtMs !== "number") continue;
-			if (!isRecord$1(entry.payload) || !Array.isArray(entry.payload.diagnostics)) continue;
+			if (!isRecord(entry) || typeof entry.key !== "string" || typeof entry.createdAtMs !== "number") continue;
+			if (!isRecord(entry.payload) || !Array.isArray(entry.payload.diagnostics)) continue;
 			entries.push(entry);
 		}
 		return {
-			version: 1,
+			version: 2,
 			entries
 		};
 	} catch {
 		return {
-			version: 1,
+			version: 2,
 			entries: []
 		};
 	}
@@ -49206,7 +50503,7 @@ const buildScanResultCacheKey = (input) => {
 	if (headSha === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 1,
+		schemaVersion: 2,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha,
 		reactDoctorVersion: input.version,
@@ -49226,6 +50523,7 @@ const buildScanResultCacheKey = (input) => {
 			adoptExistingLintConfig: input.options.adoptExistingLintConfig,
 			ignoredTags: [...input.options.ignoredTags].sort(),
 			concurrency: input.options.concurrency,
+			lintBatchOrdering: resolveLintBatchOrdering(),
 			baselineRef: input.options.baseline?.ref,
 			changedLineRanges: input.options.changedLineRanges ?? void 0,
 			noScore: input.options.noScore,
@@ -49243,7 +50541,7 @@ const createScanResultCache = (projectDirectory) => {
 	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
 	const persist = () => {
 		writePersistedCache(cacheFilePath, {
-			version: 1,
+			version: 2,
 			entries: [...entries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
 	};
@@ -49259,7 +50557,7 @@ const createScanResultCache = (projectDirectory) => {
 		}
 	};
 };
-const shouldStoreScanPayload = (payload) => !payload.didLintFail && !payload.didDeadCodeFail && payload.lintPartialFailures.length === 0;
+const shouldStoreScanPayload = (payload) => !payload.didLintFail && !payload.didDeadCodeFail && payload.lintPartialFailures.length === 0 && !payload.supplyChainOverlapTimedOut;
 //#endregion
 //#region src/inspect.ts
 const silentConsole = makeNoopConsole();
@@ -49323,21 +50621,24 @@ const deriveScope = (options) => {
 	if (options.changedLineRanges !== null) return "lines";
 	return options.includePaths.length > 0 ? "files" : "full";
 };
-const buildRunEventConfig = (options, userConfig, hasCustomConfig) => ({
-	scope: deriveScope(options),
-	parallel: options.concurrency !== void 0,
-	workerCount: options.concurrency,
-	lint: options.lint,
-	deadCode: options.deadCode,
-	scoreOnly: options.scoreOnly,
-	noScore: options.noScore,
-	respectInlineDisables: options.respectInlineDisables,
-	showWarnings: options.warnings,
-	usedOutputDir: options.outputDirectory !== null,
-	ignoredTagCount: options.ignoredTags.size,
-	hasCustomConfig,
-	userConfig
-});
+const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorkerCount) => {
+	const { workerCount, parallel } = resolveWorkerTelemetry(resolvedWorkerCount, options.concurrency);
+	return {
+		scope: deriveScope(options),
+		parallel,
+		workerCount,
+		lint: options.lint,
+		deadCode: options.deadCode,
+		scoreOnly: options.scoreOnly,
+		noScore: options.noScore,
+		respectInlineDisables: options.respectInlineDisables,
+		showWarnings: options.warnings,
+		usedOutputDir: options.outputDirectory !== null,
+		ignoredTagCount: options.ignoredTags.size,
+		hasCustomConfig,
+		userConfig
+	};
+};
 const inspect = async (directory, inputOptions = {}) => {
 	const startTime = performance$1.now();
 	const isConcurrentScan = inputOptions.concurrentScan === true;
@@ -49429,7 +50730,7 @@ const runBaselineComparison = async (params) => {
 			resolveLocalGithubViewerPermission: false,
 			suppressScanSummary: true,
 			supplyChainManifestChanged: params.options.supplyChainManifestChanged
-		}, {}).pipe(provide(baseLayers), provideService(Console, silentConsole))));
+		}, {}).pipe(provide(baseLayers), provideService$2(Console, silentConsole))));
 		if (baseOutput.didLintFail) return null;
 		const delta = computeDiagnosticDelta({
 			headDiagnostics: params.headDiagnostics,
@@ -49514,7 +50815,8 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		runId: getRunId(),
 		resolveLocalGithubViewerPermission: !options.noScore,
 		suppressScanSummary: options.suppressRendering,
-		supplyChainManifestChanged: options.supplyChainManifestChanged
+		supplyChainManifestChanged: options.supplyChainManifestChanged,
+		concurrentScan: options.concurrentScan
 	}, { beforeLint: (projectInfo, lintIncludePaths) => gen(function* () {
 		recordSentryProjectContext(projectInfo, rootSentrySpan, { concurrentScan: options.concurrentScan });
 		recordCount(METRIC.projectDetected, 1);
@@ -49528,7 +50830,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 			lintSourceFileCount
 		});
 	}) });
-	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)));
+	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService$2(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)));
 	const didLintFail = lintBindingMissing || output.didLintFail;
 	const lintFailureReason = lintBindingMissing ? `oxlint native binding not found for Node ${process.version}; expected one matching ${OXLINT_NODE_REQUIREMENT}` : output.lintFailureReason;
 	if (!options.scoreOnly && !lintBindingMissing && output.didLintFail && lintFailureReason !== null) if (output.lintFailureReasonKind === "native-binding-missing") runConsole(log(highlighter.gray(`  Upgrade to Node ${OXLINT_NODE_REQUIREMENT} or run: npx -p oxlint@latest react-doctor@latest`)));
@@ -49565,12 +50867,15 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		lintPartialFailures: output.lintPartialFailures,
 		didDeadCodeFail: output.didDeadCodeFail,
 		deadCodeFailureReason: output.deadCodeFailureReason,
+		deadCodeOverlapped: output.deadCodeOverlapped,
 		directory: output.resolvedDirectory,
 		scannedFileCount: output.scannedFileCount,
 		scannedFilePaths: output.scannedFilePaths,
 		scanElapsedMilliseconds: output.scanElapsedMilliseconds,
+		scanConcurrency: output.scanConcurrency,
 		baselineDelta,
-		lintFailureReasonKind: lintBindingMissing ? "native-binding-missing" : output.lintFailureReasonKind
+		lintFailureReasonKind: lintBindingMissing ? "native-binding-missing" : output.lintFailureReasonKind,
+		supplyChainOverlapTimedOut: output.supplyChainOverlapTimedOut
 	};
 	if (cacheKey !== null && scanResultCache !== null && shouldStoreScanPayload(payload)) scanResultCache.store(cacheKey, payload);
 	const result = await renderAndRecordScan({
@@ -49581,12 +50886,14 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		startTime,
 		rootSentrySpan,
 		scanMode: baselineDelta ? "baseline" : isDiffMode ? "diff" : "full",
-		baselineDegraded
+		baselineDegraded,
+		lintCacheHitFileCount: output.lintCacheHitFileCount,
+		lintCacheTotalFileCount: output.lintCacheTotalFileCount
 	});
 	recordOnboardingCompletion(options);
 	return result;
 };
-const runMaybeSilent = (effect, silent) => silent ? effect.pipe(provideService(Console, silentConsole)) : effect;
+const runMaybeSilent = (effect, silent) => silent ? effect.pipe(provideService$2(Console, silentConsole)) : effect;
 const renderCachedProjectDetection = async (input) => {
 	if (input.options.scoreOnly || input.options.suppressRendering) return;
 	await runPromise(runMaybeSilent(printProjectDetection({
@@ -49614,14 +50921,17 @@ const renderAndRecordScan = async (input) => {
 		scannedFileCount: input.payload.scannedFileCount,
 		scannedFilePaths: input.payload.scannedFilePaths,
 		scanElapsedMilliseconds: input.payload.scanElapsedMilliseconds,
+		lintCacheHitFileCount: input.lintCacheHitFileCount ?? null,
+		lintCacheTotalFileCount: input.lintCacheTotalFileCount ?? null,
 		baselineDelta: input.payload.baselineDelta
 	}), input.options.silent));
+	const { workerCount: resolvedWorkerCount, parallel } = resolveWorkerTelemetry(input.payload.scanConcurrency, input.options.concurrency);
 	recordScanMetrics({
 		result,
 		mode: input.scanMode,
 		baselineDegraded: input.baselineDegraded,
-		parallel: input.options.concurrency !== void 0,
-		workerCount: input.options.concurrency,
+		parallel,
+		workerCount: resolvedWorkerCount,
 		lint: input.options.lint,
 		deadCode: input.options.deadCode,
 		scoreOnly: input.options.scoreOnly,
@@ -49631,19 +50941,22 @@ const renderAndRecordScan = async (input) => {
 		didDeadCodeFail: input.payload.didDeadCodeFail
 	});
 	recordRunEvent(input.rootSentrySpan, {
-		...buildRunEventConfig(input.options, input.userConfig, input.hasCustomConfig),
+		...buildRunEventConfig(input.options, input.userConfig, input.hasCustomConfig, resolvedWorkerCount),
 		result,
 		mode: input.scanMode,
 		gateExempt: input.baselineDegraded,
 		didLintFail: input.payload.didLintFail,
 		lintFailureReasonKind: input.payload.lintFailureReasonKind,
 		lintPartialFailureCount: input.payload.lintPartialFailures.length,
-		didDeadCodeFail: input.payload.didDeadCodeFail
+		lintDroppedFileCount: countDroppedLintFiles(input.payload.lintPartialFailures),
+		didDeadCodeFail: input.payload.didDeadCodeFail,
+		supplyChainOverlapTimedOut: input.payload.supplyChainOverlapTimedOut,
+		deadCodeOverlapped: input.payload.deadCodeOverlapped
 	});
 	return result;
 };
 const finalizeAndRender = (input) => gen(function* () {
-	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, directory, scannedFileCount, scannedFilePaths, scanElapsedMilliseconds, baselineDelta } = input;
+	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, directory, scannedFileCount, scannedFilePaths, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, baselineDelta } = input;
 	const { skippedChecks, skippedCheckReasons } = buildSkippedChecks({
 		didLintFail,
 		lintFailureReason,
@@ -49663,6 +50976,10 @@ const finalizeAndRender = (input) => gen(function* () {
 		scannedFileCount,
 		scannedFilePaths,
 		scanElapsedMilliseconds,
+		...lintCacheTotalFileCount !== null ? {
+			lintCacheHitFileCount,
+			lintCacheTotalFileCount
+		} : {},
 		...baselineDelta ? { baselineDelta } : {}
 	});
 	if (options.suppressRendering) return buildResult();
@@ -49676,6 +50993,7 @@ const finalizeAndRender = (input) => gen(function* () {
 	}
 	const animateRender = !options.silent && !options.verbose && canAnimateOnboarding(process.stdout);
 	const pause = onboardingSectionPause(animateRender);
+	const useHyperlinks = shouldRenderHyperlinks(process.stdout);
 	const demotedDiagnosticCount = diagnostics.length - surfaceDiagnostics.length;
 	const lintSourceFileCount = options.includePaths.length > 0 ? options.includePaths.length : project.sourceFileCount;
 	if (printedDiagnostics.length === 0) {
@@ -49701,7 +51019,7 @@ const finalizeAndRender = (input) => gen(function* () {
 	yield* printDiagnostics([...printedDiagnostics], options.verbose, directory, buildRulePriorityMap([score]), isCodingAgentEnvironment(), {
 		sectionPause: pause,
 		animateCountUp: animateRender
-	});
+	}, useHyperlinks);
 	if (options.isNonInteractiveEnvironment && options.outputSurface !== "prComment") yield* printAgentGuidance();
 	if (options.categoryFilters.size === 0 && demotedDiagnosticCount > 0) {
 		yield* log(highlighter.gray(`  ${demotedDiagnosticCount} demoted from the ${options.outputSurface} surface (e.g. design cleanup) — run \`npx react-doctor@latest .\` locally for the full list.`));
@@ -49890,24 +51208,18 @@ const isExpectedUserError = (error) => error instanceof CliInputError || isProje
 //#region src/cli/utils/build-handoff-payload.ts
 const buildHandoffPayload = (input) => {
 	const topGroups = buildSortedRuleGroups(input.diagnostics).slice(0, 3);
+	const migrationScaleBuckets = new Map(findMigrationScaleBuckets(input.diagnostics).map((bucket) => [bucket.ruleKey, bucket]));
 	let outputDirectory = null;
 	try {
 		outputDirectory = writeDiagnosticsDirectory([...input.diagnostics], input.outputDirectory);
 	} catch {}
-	const lines = [
-		"Before fixing anything, first ask me whether I'd like to add React Doctor to CI so every pull request is scanned automatically. Explain that:",
-		`- It's used by teams at ${CI_TRUST_COMPANIES}.`,
-		"- I don't have to fix everything at once; CI keeps new PRs clean while I incrementally pay down the existing issues.",
-		`- Setup guide: ${CI_URL}`,
-		"If I say yes, run `npx react-doctor install` (or add the GitHub Actions workflow). Either way, then continue with the fixes below.",
-		"",
-		`Fix the top ${topGroups.length} React Doctor ${topGroups.length === 1 ? "issue" : "issues"} in ${input.projectName} on this pass — leave the rest for a follow-up.`,
-		""
-	];
+	const lines = [`Fix the top ${topGroups.length} React Doctor ${topGroups.length === 1 ? "issue" : "issues"} in ${input.projectName} on this pass — leave the rest for a follow-up.`, ""];
 	topGroups.forEach(([ruleKey, ruleDiagnostics], index) => {
 		const representative = ruleDiagnostics[0];
 		const severityLabel = representative.severity === "error" ? "ERROR" : "WARN";
-		lines.push(`${index + 1}. ${severityLabel} ${representative.category}: ${representative.title ?? ruleKey} (×${ruleDiagnostics.length})`, `   ${representative.message}`);
+		const sharedFixSiteCount = getSharedFixSiteCount(ruleDiagnostics);
+		const countBadge = sharedFixSiteCount > 0 ? `one fix · ${sharedFixSiteCount} sites` : `×${ruleDiagnostics.length}`;
+		lines.push(`${index + 1}. ${severityLabel} ${representative.category}: ${representative.title ?? ruleKey} (${countBadge})`, `   ${representative.message}`);
 		const fixRecipeLine = formatFixRecipeLine(representative);
 		if (fixRecipeLine) lines.push(`   ${fixRecipeLine}`);
 		const uniqueFiles = [...new Set(ruleDiagnostics.map((diagnostic) => diagnostic.filePath))];
@@ -49917,10 +51229,19 @@ const buildHandoffPayload = (input) => {
 		}
 		const remainingFiles = uniqueFiles.length - 3;
 		if (remainingFiles > 0) lines.push(`   - +${remainingFiles} more files`);
+		const migrationBucket = migrationScaleBuckets.get(ruleKey);
+		if (migrationBucket) lines.push(`   Migration-scale (${migrationBucket.fileCount} files): fix a representative sample, confirm the recipe holds, and get the code owner's sign-off before changing the rest in one pass.`);
 	});
 	lines.push("");
 	if (outputDirectory) lines.push(`Full results for all ${input.diagnostics.length} issues (diagnostics.json + a .txt per rule): ${outputDirectory}`, "");
-	lines.push("Read each file and fix the root cause — don't suppress or silence the rule.", "", "Verify against the real thing, don't assume: confirm each change matches the canonical fix recipe you fetched for that rule, then re-run `npx react-doctor@latest --verbose` and check the issue is actually gone against the real tool before moving on.", "", "Teach me as you go: for every issue you touch, explain it in plain language (no jargon) — what the problem is, why it's a problem, and how serious it is in human terms. Describe the real-world impact and severity concretely (e.g. \"this crashes the page for users on Safari\" vs. \"this is a minor cleanup with no user impact\") so I understand why it matters, not just what changed.", "", "Then work through the rest from the full results above.");
+	lines.push("Read each file and fix the root cause — don't suppress or silence the rule.", "", "Findings that share a `fixGroupId` (in diagnostics.json) are one root cause — a single fix clears all of them, so treat each `fixGroupId` as ONE task, not one per site.", "", "Verify against the real thing, don't assume: confirm each change matches the canonical fix recipe you fetched for that rule, then re-run `npx react-doctor@latest --verbose` and check the issue is actually gone against the real tool before moving on.", "", "Teach me as you go: for every issue you touch, explain it in plain language (no jargon) — what the problem is, why it's a problem, and how serious it is in human terms. Describe the real-world impact and severity concretely (e.g. \"this crashes the page for users on Safari\" vs. \"this is a minor cleanup with no user impact\") so I understand why it matters, not just what changed.", "");
+	const shownRuleKeys = new Set(topGroups.map(([ruleKey]) => ruleKey));
+	const deferredMigrationBuckets = [...migrationScaleBuckets.values()].filter((bucket) => !shownRuleKeys.has(bucket.ruleKey));
+	if (deferredMigrationBuckets.length > 0) {
+		const ruleSummaries = deferredMigrationBuckets.map((bucket) => `${bucket.title} (${bucket.fileCount} files)`).join(", ");
+		lines.push(`Some of the rest are migration-scale (span dozens of files): ${ruleSummaries}. For each, fix a representative sample, confirm the recipe holds, and get the code owner's sign-off before changing the rest in one pass.`, "");
+	}
+	lines.push("Then work through the rest from the full results above.");
 	return lines.join("\n");
 };
 //#endregion
@@ -49964,78 +51285,6 @@ const detectAvailableAgents = async () => {
 	return getSkillAgentTypes().filter((agent) => agent !== "universal" && detected.has(agent));
 };
 //#endregion
-//#region src/cli/utils/git-hook-shared.ts
-const HOOK_FILE_NAME = "pre-commit";
-const HOOK_RELATIVE_PATH = "hooks/pre-commit";
-const LEGACY_HOOK_RUNNER_RELATIVE_PATH = ".react-doctor/hooks/pre-commit";
-const HUSKY_HOOKS_PATH = ".husky";
-const VITE_PLUS_HOOKS_PATH = ".vite-hooks";
-const LEFTHOOK_CONFIG_FILES = ["lefthook.yml", "lefthook.yaml"];
-const PRE_COMMIT_CONFIG_FILE = ".pre-commit-config.yaml";
-const OVERCOMMIT_CONFIG_FILE = ".overcommit.yml";
-const REACT_DOCTOR_COMMAND = "react-doctor --staged --blocking warning";
-const NON_BLOCKING_REACT_DOCTOR_COMMAND = [
-	"react_doctor_output=$(mktemp \"${TMPDIR:-/tmp}/react-doctor-hook.XXXXXX\");",
-	`if ${REACT_DOCTOR_COMMAND} > "$react_doctor_output" 2>&1; then`,
-	"rm -f \"$react_doctor_output\";",
-	"else",
-	"rm -f \"$react_doctor_output\";",
-	`printf "%s\\n" "React Doctor found staged regressions." "Run ${REACT_DOCTOR_COMMAND} to inspect." "Want them fixed? Ask your agent to run that command and resolve the findings." >&2;`,
-	"fi"
-].join(" ");
-const PACKAGE_JSON_FILE_NAME = "package.json";
-const runGit = (projectRoot, args) => {
-	try {
-		return execFileSync("git", [...args], {
-			cwd: projectRoot,
-			encoding: "utf8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {
-		return null;
-	}
-};
-const resolveGitPath = (baseDirectory, value) => Path.isAbsolute(value) ? value : Path.resolve(baseDirectory, value);
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const getPackageJsonPath = (projectRoot) => Path.join(projectRoot, PACKAGE_JSON_FILE_NAME);
-const readPackageJson = (projectRoot) => {
-	try {
-		return JSON.parse(NFS.readFileSync(getPackageJsonPath(projectRoot), "utf8"));
-	} catch {
-		return null;
-	}
-};
-const writeJsonFile$1 = (filePath, value) => {
-	NFS.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
-};
-const packageHasDependency = (projectRoot, dependencyName) => {
-	const packageJson = readPackageJson(projectRoot);
-	if (!isRecord(packageJson)) return false;
-	return [
-		"dependencies",
-		"devDependencies",
-		"optionalDependencies"
-	].some((fieldName) => {
-		const dependencies = packageJson[fieldName];
-		return isRecord(dependencies) && typeof dependencies[dependencyName] === "string";
-	});
-};
-const packageHasRecordKey = (projectRoot, key) => {
-	const packageJson = readPackageJson(projectRoot);
-	return isRecord(packageJson) && isRecord(packageJson[key]);
-};
-const packageHasNestedRecordKey = (projectRoot, key, nestedKey) => {
-	const packageJson = readPackageJson(projectRoot);
-	if (!isRecord(packageJson)) return false;
-	const value = packageJson[key];
-	return isRecord(value) && isRecord(value[nestedKey]);
-};
-const ensureTrailingNewline = (content) => content.endsWith("\n") ? content : `${content}\n`;
-//#endregion
 //#region src/cli/utils/install-doctor-script.ts
 const DOCTOR_SCRIPT_NAME = "doctor";
 const FALLBACK_DOCTOR_SCRIPT_NAME = "react-doctor";
@@ -50061,31 +51310,31 @@ const findNearestPackageDirectory = (startDirectory, stopDirectory) => {
 };
 const hasDoctorScript = (projectRoot) => {
 	const packageJson = readPackageJson(findNearestPackageDirectory(projectRoot) ?? projectRoot);
-	if (!isRecord(packageJson)) return false;
+	if (!isRecord$1(packageJson)) return false;
 	const scripts = packageJson.scripts;
-	if (!isRecord(scripts)) return false;
+	if (!isRecord$1(scripts)) return false;
 	return isReactDoctorScriptCommand(scripts[DOCTOR_SCRIPT_NAME]) || isReactDoctorScriptCommand(scripts[FALLBACK_DOCTOR_SCRIPT_NAME]);
 };
 const hasDoctorDependency = (packageJson) => DEPENDENCY_FIELD_NAMES.some((fieldName) => {
 	const dependencies = packageJson[fieldName];
-	return isRecord(dependencies) && Object.hasOwn(dependencies, "react-doctor");
+	return isRecord$1(dependencies) && Object.hasOwn(dependencies, "react-doctor");
 });
 const installDoctorScript = (options) => {
 	const packageDirectory = findNearestPackageDirectory(options.projectRoot) ?? options.projectRoot;
 	const packageJsonPath = getPackageJsonPath(packageDirectory);
 	const packageJson = readPackageJson(packageDirectory);
-	if (!isRecord(packageJson)) return {
+	if (!isRecord$1(packageJson)) return {
 		packageJsonPath,
 		scriptStatus: "skipped",
 		scriptReason: "missing-or-invalid-package-json"
 	};
 	const scripts = packageJson.scripts;
 	const scriptTarget = (() => {
-		if (scripts !== void 0 && !isRecord(scripts)) return {
+		if (scripts !== void 0 && !isRecord$1(scripts)) return {
 			status: "skipped",
 			reason: "invalid-scripts"
 		};
-		const scriptRecord = isRecord(scripts) ? scripts : {};
+		const scriptRecord = isRecord$1(scripts) ? scripts : {};
 		if (isReactDoctorScriptCommand(scriptRecord[DOCTOR_SCRIPT_NAME])) return {
 			scriptName: DOCTOR_SCRIPT_NAME,
 			status: "existing"
@@ -50119,7 +51368,7 @@ const installDoctorScript = (options) => {
 	if (scriptStatus === "created") writeJsonFile$1(packageJsonPath, {
 		...packageJson,
 		scripts: {
-			...isRecord(scripts) ? scripts : {},
+			...isRecord$1(scripts) ? scripts : {},
 			[scriptTarget.scriptName ?? DOCTOR_SCRIPT_NAME]: DOCTOR_SCRIPT_COMMAND
 		}
 	});
@@ -50270,40 +51519,27 @@ const upgradeReactDoctorWorkflowInPlace = (projectRoot) => {
 	}
 };
 //#endregion
-//#region src/cli/utils/hash-project-root.ts
-const hashProjectRoot = (projectRoot) => createHash("sha256").update(Path.resolve(projectRoot)).digest("hex");
-//#endregion
 //#region src/cli/utils/action-upgrade-prompt.ts
-const GLOBAL_CONFIG_PROJECT_NAME$1 = "react-doctor";
-const getActionUpgradeStore = (options = {}) => new Conf({
-	projectName: GLOBAL_CONFIG_PROJECT_NAME$1,
-	cwd: options.cwd
-});
-const hasHandledActionUpgrade = (projectRoot, storeOptions = {}) => {
-	try {
-		const upgrades = getActionUpgradeStore(storeOptions).get("actionUpgrades", {});
-		return Boolean(upgrades[hashProjectRoot(projectRoot)]);
-	} catch {
-		return true;
-	}
-};
-const recordActionUpgradeDecision = (projectRoot, outcome, storeOptions = {}) => {
-	try {
-		const store = getActionUpgradeStore(storeOptions);
-		const upgrades = store.get("actionUpgrades", {});
-		store.set("actionUpgrades", {
-			...upgrades,
-			[hashProjectRoot(projectRoot)]: {
-				rootDirectory: Path.resolve(projectRoot),
-				outcome,
-				at: (/* @__PURE__ */ new Date()).toISOString()
-			}
-		});
-		return true;
-	} catch {
-		return false;
-	}
-};
+const ACTION_UPGRADE_GATE = {
+	id: ACTION_UPGRADE_EVENT,
+	scope: "project"
+};
+const hasHandledActionUpgrade = (projectRoot, options = {}) => !isGatePending(ACTION_UPGRADE_GATE, { projectRoot }, options);
+const recordActionUpgradeDecision = (projectRoot, outcome, options = {}) => recordGate(ACTION_UPGRADE_GATE, {
+	projectRoot,
+	outcome
+}, options);
+//#endregion
+//#region src/cli/utils/ci-prompt-decision.ts
+const CI_PITCH_GATE = {
+	id: CI_PITCH_EVENT,
+	scope: "project"
+};
+const hasHandledCiPrompt = (projectRoot, options = {}) => !isGatePending(CI_PITCH_GATE, { projectRoot }, options);
+const recordCiPromptDecision = (projectRoot, outcome, options = {}) => recordGate(CI_PITCH_GATE, {
+	projectRoot,
+	outcome
+}, options);
 //#endregion
 //#region src/cli/utils/open-url.ts
 const resolveOpenCommand = (url) => {
@@ -50469,39 +51705,80 @@ const DEFAULT_PR_TITLE = "Add React Doctor to GitHub Actions";
 const DEFAULT_PR_BODY = `Adds a [React Doctor](https://www.react.doctor) scan to every pull request and every push to the default branch. The workflow file is documented inline.
 
 Docs: https://www.react.doctor/ci`;
-const findUniqueBranchName = async (cwd) => {
-	if (!(await runCommand("git", [
+const findUniqueBranchName = async (cwd, run) => {
+	if (!(await run("git", [
 		"rev-parse",
 		"--verify",
 		NEW_BRANCH_PREFIX
 	], cwd)).success) return NEW_BRANCH_PREFIX;
 	return `${NEW_BRANCH_PREFIX}-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace(/[-:T]/g, "")}`;
 };
+const findExistingSetupPullRequest = async (cwd, run) => {
+	const prList = await run("gh", [
+		"pr",
+		"list",
+		"--state",
+		"open",
+		"--json",
+		"headRefName,url",
+		"--limit",
+		String(100)
+	], cwd);
+	if (!prList.success) return null;
+	try {
+		return JSON.parse(prList.stdout).find((pullRequest) => (pullRequest.headRefName ?? "").startsWith(NEW_BRANCH_PREFIX)) ?? null;
+	} catch {
+		return null;
+	}
+};
+const hasUnrelatedTrackedChanges = async (cwd, workflowRelative, run) => {
+	const statusProbe = await run("git", [
+		"status",
+		"--porcelain",
+		"--",
+		".",
+		`:!${workflowRelative}`
+	], cwd);
+	if (!statusProbe.success) return true;
+	return statusProbe.stdout.split(/\r?\n/).filter(Boolean).some((statusLine) => !statusLine.startsWith("??"));
+};
 const openWorkflowPullRequest = async (params) => {
 	const workflowPath = Path.resolve(params.workflowPath);
 	const commitMessage = params.commitMessage ?? DEFAULT_COMMIT_MESSAGE;
 	const prTitle = params.prTitle ?? DEFAULT_PR_TITLE;
 	const prBody = params.prBody ?? DEFAULT_PR_BODY;
-	const repoRootProbe = await runCommand("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
+	const run = params.run ?? runCommand;
+	const checkCommandAvailable = params.checkCommandAvailable ?? isCommandAvailable;
+	const repoRootProbe = await run("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
 	if (!repoRootProbe.success) return {
 		status: "not-attempted",
 		reason: "not-a-git-repo"
 	};
 	const cwd = repoRootProbe.stdout;
-	if (!isCommandAvailable("gh")) return {
+	const workflowRelative = toForwardSlashes(Path.relative(cwd, workflowPath));
+	if (!checkCommandAvailable("gh")) return {
 		status: "not-attempted",
 		reason: "gh-not-installed"
 	};
-	if (!(await runCommand("gh", ["auth", "status"], cwd)).success) return {
+	if (!(await run("gh", ["auth", "status"], cwd)).success) return {
 		status: "not-attempted",
 		reason: "gh-not-authenticated"
 	};
-	const defaultBranch = params.baseBranch ?? await detectDefaultBranch(cwd);
+	const existingSetupPullRequest = await findExistingSetupPullRequest(cwd, run);
+	if (existingSetupPullRequest) return {
+		status: "pr-exists",
+		url: existingSetupPullRequest.url ?? ""
+	};
+	if (await hasUnrelatedTrackedChanges(cwd, workflowRelative, run)) return {
+		status: "not-attempted",
+		reason: "working-tree-dirty"
+	};
+	const defaultBranch = params.baseBranch ?? await detectDefaultBranch(cwd, run);
 	if (!defaultBranch) return {
 		status: "not-attempted",
 		reason: "no-default-branch"
 	};
-	const previousBranchProbe = await runCommand("git", [
+	const previousBranchProbe = await run("git", [
 		"rev-parse",
 		"--abbrev-ref",
 		"HEAD"
@@ -50511,13 +51788,13 @@ const openWorkflowPullRequest = async (params) => {
 		reason: "detached-head"
 	};
 	const previousBranch = previousBranchProbe.stdout;
-	await runCommand("git", [
+	await run("git", [
 		"fetch",
 		"origin",
 		defaultBranch
 	], cwd);
-	const newBranch = await findUniqueBranchName(cwd);
-	if (!(await runCommand("git", [
+	const newBranch = await findUniqueBranchName(cwd, run);
+	if (!(await run("git", [
 		"checkout",
 		"-b",
 		newBranch,
@@ -50527,17 +51804,17 @@ const openWorkflowPullRequest = async (params) => {
 		reason: "checkout-failed"
 	};
 	const restoreToPreviousBranch = async (deleteNewBranch) => {
-		await runCommand("git", ["checkout", previousBranch], cwd);
-		if (deleteNewBranch) await runCommand("git", [
+		await run("git", ["checkout", previousBranch], cwd);
+		if (deleteNewBranch) await run("git", [
 			"branch",
 			"-D",
 			newBranch
 		], cwd);
 	};
-	if (!(await runCommand("git", [
+	if (!(await run("git", [
 		"add",
 		"--",
-		Path.relative(cwd, workflowPath)
+		workflowRelative
 	], cwd)).success) {
 		await restoreToPreviousBranch(true);
 		return {
@@ -50545,7 +51822,7 @@ const openWorkflowPullRequest = async (params) => {
 			reason: "git-add-failed"
 		};
 	}
-	if (!(await runCommand("git", [
+	if (!(await run("git", [
 		"commit",
 		"-m",
 		commitMessage
@@ -50556,7 +51833,7 @@ const openWorkflowPullRequest = async (params) => {
 			reason: "git-commit-failed"
 		};
 	}
-	if (!(await runCommand("git", [
+	if (!(await run("git", [
 		"push",
 		"-u",
 		"origin",
@@ -50568,7 +51845,7 @@ const openWorkflowPullRequest = async (params) => {
 			reason: "git-push-failed"
 		};
 	}
-	const prCreate = await runCommand("gh", [
+	const prCreate = await run("gh", [
 		"pr",
 		"create",
 		"--title",
@@ -50592,12 +51869,13 @@ const openWorkflowPullRequest = async (params) => {
 };
 const stageWorkflowFile = async (params) => {
 	const workflowPath = Path.resolve(params.workflowPath);
-	const repoRootProbe = await runCommand("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
+	const run = params.run ?? runCommand;
+	const repoRootProbe = await run("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
 	if (!repoRootProbe.success) return false;
-	return (await runCommand("git", [
+	return (await run("git", [
 		"add",
 		"--",
-		Path.relative(repoRootProbe.stdout, workflowPath)
+		toForwardSlashes(Path.relative(repoRootProbe.stdout, workflowPath))
 	], repoRootProbe.stdout)).success;
 };
 //#endregion
@@ -50638,6 +51916,7 @@ const setUpGitHubActions = async (options) => {
 			baseBranch: defaultBranch
 		});
 		if (pullRequestResult.status === "pr-opened") pullRequestSpinner.succeed(`Opened pull request for review: ${highlighter.info(pullRequestResult.url)}`);
+		else if (pullRequestResult.status === "pr-exists") pullRequestSpinner.succeed(`A React Doctor setup pull request is already open: ${highlighter.info(pullRequestResult.url)}`);
 		else if (pullRequestResult.status === "branch-pushed") pullRequestSpinner.warn(`Pushed branch ${highlighter.bold(pullRequestResult.branch)} but couldn't open a PR. Open one with: gh pr create --head ${pullRequestResult.branch}`);
 		else {
 			pullRequestSpinner.stop();
@@ -50760,22 +52039,22 @@ const buildAgentHookScript = () => [
 	"",
 	"run_react_doctor() {",
 	"  if [ -x ./node_modules/.bin/react-doctor ]; then",
-	"    ./node_modules/.bin/react-doctor --verbose --diff --blocking warning --no-score",
+	"    ./node_modules/.bin/react-doctor --verbose --scope changed --blocking warning --no-score",
 	"    return",
 	"  fi",
 	"",
 	"  if command -v react-doctor >/dev/null 2>&1; then",
-	"    react-doctor --verbose --diff --blocking warning --no-score",
+	"    react-doctor --verbose --scope changed --blocking warning --no-score",
 	"    return",
 	"  fi",
 	"",
 	"  if command -v pnpm >/dev/null 2>&1; then",
-	"    pnpm dlx react-doctor@latest --verbose --diff --blocking warning --no-score",
+	"    pnpm dlx react-doctor@latest --verbose --scope changed --blocking warning --no-score",
 	"    return",
 	"  fi",
 	"",
 	"  if command -v npx >/dev/null 2>&1; then",
-	"    npx --yes react-doctor@latest --verbose --diff --blocking warning --no-score",
+	"    npx --yes react-doctor@latest --verbose --scope changed --blocking warning --no-score",
 	"    return",
 	"  fi",
 	"",
@@ -50933,13 +52212,13 @@ const installPackageJsonHook = (options, strategy) => {
 	const packageJsonPath = getPackageJsonPath(options.projectRoot);
 	const didHookExist = NFS.existsSync(packageJsonPath);
 	const packageJson = readPackageJson(options.projectRoot);
-	const nextPackageJson = isRecord(packageJson) ? { ...packageJson } : {};
+	const nextPackageJson = isRecord$1(packageJson) ? { ...packageJson } : {};
 	const parentKeys = strategy.path.slice(0, -1);
 	const leafKey = strategy.path[strategy.path.length - 1];
 	let parent = nextPackageJson;
 	for (const key of parentKeys) {
 		const existing = parent[key];
-		const cloned = isRecord(existing) ? { ...existing } : {};
+		const cloned = isRecord$1(existing) ? { ...existing } : {};
 		parent[key] = cloned;
 		parent = cloned;
 	}
@@ -51110,7 +52389,7 @@ const isHuskyProject = (projectRoot) => NFS.existsSync(Path.join(projectRoot, ".
 const isVitePlusProject = (projectRoot) => packageHasDependency(projectRoot, "vite-plus");
 const isSimpleGitHooksProject = (projectRoot) => {
 	const packageJson = readPackageJson(projectRoot);
-	return isRecord(packageJson) && isRecord(packageJson["simple-git-hooks"]) || packageHasDependency(projectRoot, "simple-git-hooks") || NFS.existsSync(Path.join(projectRoot, ".simple-git-hooks.cjs"));
+	return isRecord$1(packageJson) && isRecord$1(packageJson["simple-git-hooks"]) || packageHasDependency(projectRoot, "simple-git-hooks") || NFS.existsSync(Path.join(projectRoot, ".simple-git-hooks.cjs"));
 };
 const getLefthookConfigPath = (projectRoot) => {
 	for (const fileName of LEFTHOOK_CONFIG_FILES) {
@@ -51276,7 +52555,7 @@ const detectPackageManager = (projectRoot) => {
 	let currentDirectory = Path.resolve(projectRoot);
 	while (true) {
 		const packageJson = readPackageJson(currentDirectory);
-		if (isRecord(packageJson) && typeof packageJson.packageManager === "string") {
+		if (isRecord$1(packageJson) && typeof packageJson.packageManager === "string") {
 			const packageManagerName = packageJson.packageManager.split("@")[0];
 			if (packageManagerName === "pnpm" || packageManagerName === "yarn" || packageManagerName === "bun" || packageManagerName === "npm") return packageManagerName;
 		}
@@ -51352,12 +52631,12 @@ const isSupplyChainTrustError = (error) => {
 const formatInstallCommand = (input) => [input.command, ...input.args].join(" ");
 const installReactDoctorDependency = async (options) => {
 	const packageJson = readPackageJson(options.projectRoot);
-	if (!isRecord(packageJson)) return {
+	if (!isRecord$1(packageJson)) return {
 		dependencyStatus: "skipped",
 		dependencyReason: "missing-or-invalid-package-json"
 	};
 	if (hasDoctorDependency(packageJson)) return { dependencyStatus: "existing" };
-	if (packageJson.devDependencies !== void 0 && !isRecord(packageJson.devDependencies)) return {
+	if (packageJson.devDependencies !== void 0 && !isRecord$1(packageJson.devDependencies)) return {
 		dependencyStatus: "skipped",
 		dependencyReason: "invalid-dev-dependencies"
 	};
@@ -51521,10 +52800,12 @@ const runInstallReactDoctor = async (options = {}) => {
 	const existingWorkflow = readReactDoctorWorkflow(projectRoot);
 	const canInstallWorkflow = !NFS.existsSync(workflowTargetPath);
 	const canUpgradeWorkflow = existingWorkflow !== null && workflowUsesV1Action(existingWorkflow.content) && !hasHandledActionUpgrade(projectRoot);
-	const shouldInstallWorkflow = canInstallWorkflow && (Boolean(options.yes) || !skipPrompts && await askAddToGitHubActions(prompt) === "yes");
+	const ciPromptOutcome = canInstallWorkflow && !options.yes && !skipPrompts && !hasHandledCiPrompt(projectRoot) ? await askAddToGitHubActions(prompt) : null;
+	const shouldInstallWorkflow = canInstallWorkflow && (Boolean(options.yes) || ciPromptOutcome === "yes");
 	const upgradePromptOutcome = canUpgradeWorkflow && !options.yes && !skipPrompts ? await askUpgradeActionVersion(prompt) : null;
 	const shouldUpgradeWorkflow = canUpgradeWorkflow && (Boolean(options.yes) || upgradePromptOutcome === "yes");
 	if (upgradePromptOutcome === "no" && !options.dryRun) recordActionUpgradeDecision(projectRoot, "declined");
+	if ((ciPromptOutcome === "yes" || ciPromptOutcome === "no") && !options.dryRun) recordCiPromptDecision(projectRoot, ciPromptOutcome === "yes" ? "accepted" : "declined");
 	const selectedAgents = skipPrompts ? detectedAgents : (await prompt({
 		type: "multiselect",
 		name: "agents",
@@ -51736,7 +53017,12 @@ const upgradeGitHubActionsWorkflow = async (workflow) => {
 		prBody: UPGRADE_PR_BODY
 	});
 	if (pullRequestResult.status === "pr-opened") upgradeSpinner.succeed(`Opened pull request for review: ${highlighter.info(pullRequestResult.url)}`);
-	else if (pullRequestResult.status === "branch-pushed") upgradeSpinner.warn(`Pushed branch ${highlighter.bold(pullRequestResult.branch)} but couldn't open a PR. Open one with: gh pr create --head ${pullRequestResult.branch}`);
+	else if (pullRequestResult.status === "pr-exists") {
+		try {
+			NFS.writeFileSync(workflow.workflowPath, workflow.content);
+		} catch {}
+		upgradeSpinner.succeed(`A React Doctor pull request is already open: ${highlighter.info(pullRequestResult.url)}`);
+	} else if (pullRequestResult.status === "branch-pushed") upgradeSpinner.warn(`Pushed branch ${highlighter.bold(pullRequestResult.branch)} but couldn't open a PR. Open one with: gh pr create --head ${pullRequestResult.branch}`);
 	else {
 		upgradeSpinner.stop();
 		try {
@@ -51771,18 +53057,24 @@ const handoffToAgent = async (input) => {
 	if (!input.interactive || input.diagnostics.length === 0) return;
 	cliLogger.break();
 	const projectRootForCi = findNearestPackageDirectory(input.rootDirectory) ?? input.rootDirectory;
-	if (!isReactDoctorWorkflowInstalled(projectRootForCi)) {
+	const isGitHubActionsConfigured = isReactDoctorWorkflowInstalled(projectRootForCi);
+	if (!isGitHubActionsConfigured && !hasHandledCiPrompt(projectRootForCi)) {
 		const ciOutcome = await askAddToGitHubActions();
 		recordCount(METRIC.agentHandoff, 1, {
 			outcome: `ci-${ciOutcome}`,
 			diagnosticsCount: input.diagnostics.length
 		});
 		if (ciOutcome === "cancel") return;
+		recordCiPromptDecision(projectRootForCi, ciOutcome === "yes" ? "accepted" : "declined");
 		if (ciOutcome === "yes") {
 			await setUpGitHubActions({ rootDirectory: input.rootDirectory });
 			cliLogger.break();
 		}
-	} else await maybeOfferActionUpgrade(projectRootForCi);
+	} else if (isGitHubActionsConfigured) await maybeOfferActionUpgrade(projectRootForCi);
+	else recordCount(METRIC.agentHandoff, 1, {
+		outcome: "ci-suppressed",
+		diagnosticsCount: input.diagnostics.length
+	});
 	const { handoffTarget } = await prompts({
 		type: "select",
 		name: "handoffTarget",
@@ -51844,6 +53136,47 @@ const handoffToAgent = async (input) => {
 	}
 };
 //#endregion
+//#region src/cli/utils/migrate-action-pin.ts
+const WORKFLOWS_DIRECTORY = Path.join(".github", "workflows");
+const RECOMMENDED_ACTION_REF = "v2";
+const MUTABLE_ACTION_REF = /(uses:\s*[\w.-]+\/react-doctor@)(?:main|master)\b/g;
+const isWorkflowFile = (fileName) => /\.ya?ml$/.test(fileName);
+/**
+* Rewrites mutable `@main` / `@master` React Doctor GitHub Action references in
+* the repo's `.github/workflows/*.yml` to the recommended floating major
+* (`@v2`) — a supply-chain hardening (#299) that also moves the workflow onto
+* the current (install- and scan-cached) action release. Pinned tags / SHAs are
+* deliberate and left untouched. Returns the absolute paths of the workflow
+* files it rewrote — empty when there's nothing to migrate.
+*/
+const migrateActionPin = (projectRoot) => {
+	const workflowsDirectory = Path.join(projectRoot, WORKFLOWS_DIRECTORY);
+	let entries;
+	try {
+		entries = NFS.readdirSync(workflowsDirectory, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const rewrittenFiles = [];
+	for (const entry of entries) {
+		if (!entry.isFile() || !isWorkflowFile(entry.name)) continue;
+		const workflowPath = Path.join(workflowsDirectory, entry.name);
+		let contents;
+		try {
+			contents = NFS.readFileSync(workflowPath, "utf-8");
+		} catch {
+			continue;
+		}
+		const updated = contents.replace(MUTABLE_ACTION_REF, `$1${RECOMMENDED_ACTION_REF}`);
+		if (updated === contents) continue;
+		try {
+			NFS.writeFileSync(workflowPath, updated);
+			rewrittenFiles.push(workflowPath);
+		} catch {}
+	}
+	return rewrittenFiles;
+};
+//#endregion
 //#region src/cli/utils/read-object-file.ts
 /**
 * Reads a JSON / JSONC file as a plain object, or `null` when it is missing,
@@ -51908,6 +53241,35 @@ export default ${serializeTsObjectLiteral(config)} satisfies ReactDoctorConfig;
 	NFS.rmSync(legacy.legacyFilePath, { force: true });
 	return targetPath;
 };
+const PROJECT_MIGRATIONS = [{
+	id: "config-json-to-ts",
+	scope: "project",
+	run: ({ projectRoot }) => {
+		if (projectRoot === void 0) return false;
+		const legacyConfig = findLegacyConfig(projectRoot);
+		if (!legacyConfig) return false;
+		const migratedPath = migrateLegacyConfig(legacyConfig);
+		if (!migratedPath) return false;
+		cliLogger.success("Migrated react-doctor.config.json → doctor.config.ts");
+		cliLogger.dim(`  Your settings were preserved. Review ${toRelativePath(migratedPath, projectRoot)} and commit it.`);
+		cliLogger.break();
+		return true;
+	}
+}, {
+	id: "action-pin-main-to-v2",
+	scope: "project",
+	run: ({ projectRoot }) => {
+		if (projectRoot === void 0) return false;
+		const rewrittenFiles = migrateActionPin(projectRoot);
+		if (rewrittenFiles.length === 0) return false;
+		const relativeFiles = rewrittenFiles.map((file) => toRelativePath(file, projectRoot)).join(", ");
+		cliLogger.success(`Pinned the React Doctor action to @v2 in ${relativeFiles}`);
+		cliLogger.dim("  An unpinned @main reference runs whatever the action's HEAD points to (a supply-chain risk). Review and commit the change — or revert it if you intentionally track main.");
+		cliLogger.break();
+		return true;
+	}
+}];
+const runProjectMigrations = (projectRoot, options = {}) => runMigrations(PROJECT_MIGRATIONS, { projectRoot }, options);
 //#endregion
 //#region src/cli/utils/print-branded-header.ts
 /**
@@ -52005,6 +53367,7 @@ const reportErrorToSentry = async (error) => {
 				sampled: runTrace.sampled,
 				sampleRand: Math.random()
 			});
+			recordRunTraceId(scope.getPropagationContext().traceId);
 			return Sentry.captureException(error);
 		});
 		await Sentry.flush(SENTRY_FLUSH_TIMEOUT_MS);
@@ -52088,7 +53451,7 @@ const printMultiProjectSummary = (input) => gen(function* () {
 	yield* log(`${highlighter.success("✔")} Scanned ${totalScannedFileCount} ${totalScannedFileCount === 1 ? "file" : "files"} in ${formatElapsedTime(totalElapsedMilliseconds)}`);
 	if (displayDiagnostics.length > 0) {
 		yield* log("");
-		yield* printDiagnostics(displayDiagnostics, verbose, resolveDiagnosticSourceRoot, buildRulePriorityMap(completedScans.map((scan) => scan.result.score)), isCodingAgentEnvironment(), { animateCountUp: animateRender });
+		yield* printDiagnostics(displayDiagnostics, verbose, resolveDiagnosticSourceRoot, buildRulePriorityMap(completedScans.map((scan) => scan.result.score)), isCodingAgentEnvironment(), { animateCountUp: animateRender }, shouldRenderHyperlinks(process.stdout));
 	}
 	const lowestScoredScan = findLowestScoredScan(completedScans);
 	const aggregateScore = lowestScoredScan?.result.score ?? null;
@@ -52126,19 +53489,16 @@ const printMultiProjectSummary = (input) => gen(function* () {
 });
 //#endregion
 //#region src/cli/utils/prompt-install-setup.ts
-const GLOBAL_CONFIG_PROJECT_NAME = "react-doctor";
-const getSetupPromptStore = (options = {}) => new Conf({
-	projectName: GLOBAL_CONFIG_PROJECT_NAME,
-	cwd: options.cwd
-});
-const getSetupPromptProjectKey = (projectRoot) => hashProjectRoot(projectRoot);
-const hasDisabledSetupPrompt = (projectRoot, storeOptions = {}) => {
-	try {
-		return getSetupPromptStore(storeOptions).get("projects", {})[getSetupPromptProjectKey(projectRoot)]?.setupPrompt === false;
-	} catch {
-		return false;
-	}
-};
+const SETUP_HINT_GATE = {
+	id: SETUP_HINT_EVENT,
+	scope: "project",
+	fireWhenUnknown: true
+};
+const hasDisabledSetupPrompt = (projectRoot, options = {}) => !isGatePending(SETUP_HINT_GATE, { projectRoot }, options);
+const disableSetupPrompt = (projectRoot, options = {}) => recordGate(SETUP_HINT_GATE, {
+	projectRoot,
+	outcome: "declined"
+}, options);
 const resolveInstallSetupProjectRoot = (options) => {
 	if (options.scanDirectories.length === 0) return findNearestPackageDirectory(options.scanRoot) ?? options.scanRoot;
 	const packageDirectories = /* @__PURE__ */ new Set();
@@ -52545,6 +53905,14 @@ const runExplain = async (fileLineArgument, context) => {
 		const colorizedRule = colorizeRuleByDiagnostic(ruleIdentifier, diagnostic.severity);
 		const severityLabel = colorizeRuleByDiagnostic(diagnostic.severity, diagnostic.severity);
 		cliLogger.log(`${severitySymbol} ${colorizedRule} ${highlighter.dim(`(${severityLabel})`)} — ${diagnostic.message}`);
+		const codeFrame = buildCodeFrame({
+			filePath: diagnostic.filePath,
+			line: diagnostic.line,
+			column: diagnostic.column,
+			endLine: diagnostic.endLine,
+			rootDirectory: targetDirectory
+		});
+		if (codeFrame) cliLogger.log(indentMultilineText(codeFrame, "  "));
 		if (diagnostic.category) cliLogger.dim(`  Category: ${diagnostic.category}`);
 		if (diagnostic.help) cliLogger.dim(`  ${diagnostic.help}`);
 		cliLogger.dim(`  If this needs follow-up or looks like a false positive, open: ${buildDiagnosticIssueUrl({
@@ -52594,6 +53962,10 @@ const validateModeFlags = (flags) => {
 	if (flags.staged && (flags.scope === "full" || flags.scope === "changed")) throw new CliInputError(`Cannot combine --staged with --scope ${flags.scope}; use --scope files or --scope lines, or drop --scope.`);
 	if (flags.score && flags.json) throw new CliInputError("Cannot combine --score and --json; pick one output mode.");
 	if (flags.score && flags.telemetry === false) throw new CliInputError("Cannot combine --score with --no-telemetry; --score prints the score that --no-telemetry disables.");
+	if (flags.debug && (flags.score === false || flags.telemetry === false)) {
+		const disablingFlag = flags.score === false ? "--no-score" : "--no-telemetry";
+		throw new CliInputError(`Cannot combine --debug with ${disablingFlag}; ${disablingFlag} disables the Sentry reporting --debug needs to capture a trace.`);
+	}
 };
 //#endregion
 //#region src/cli/commands/inspect.ts
@@ -52654,15 +54026,9 @@ const buildChangedFilesDiffInfo = (changedFiles) => ({
 * are left untouched — the loader still reads the legacy file as a deprecated
 * fallback and warns — so a scan never mutates the repo unattended.
 */
-const maybeMigrateLegacyConfig = (requestedDirectory, { isQuiet, isStaged }) => {
+const maybeMigrateLegacyConfig = async (requestedDirectory, { isQuiet, isStaged }) => {
 	if (!(!isQuiet && !isStaged && process.stdout.isTTY === true && !isCiOrCodingAgentEnvironment())) return;
-	const legacyConfig = findLegacyConfig(requestedDirectory);
-	if (!legacyConfig) return;
-	const migratedPath = migrateLegacyConfig(legacyConfig);
-	if (!migratedPath) return;
-	cliLogger.success("Migrated react-doctor.config.json → doctor.config.ts");
-	cliLogger.dim(`  Your settings were preserved. Review ${toRelativePath(migratedPath, requestedDirectory)} and commit it.`);
-	cliLogger.break();
+	await runProjectMigrations(requestedDirectory);
 };
 const inspectAction = async (directory, flags) => {
 	const isScoreOnly = Boolean(flags.score);
@@ -52677,7 +54043,7 @@ const inspectAction = async (directory, flags) => {
 	recordCount(METRIC.cliInvoked, 1, { command: "inspect" });
 	try {
 		validateModeFlags(flags);
-		maybeMigrateLegacyConfig(requestedDirectory, {
+		await maybeMigrateLegacyConfig(requestedDirectory, {
 			isQuiet,
 			isStaged: Boolean(flags.staged)
 		});
@@ -52941,11 +54307,13 @@ const inspectAction = async (directory, flags) => {
 			})) {
 				printAgentInstallHint();
 				recordCount(METRIC.agentInstallHintShown, 1);
+				disableSetupPrompt(setupProjectRoot);
 			}
 		}
 	} catch (error) {
 		const isUserError = isExpectedUserError(error);
 		const sentryEventId = isUserError ? void 0 : await reportErrorToSentry(error);
+		if (isDebugFlagEnabled()) await flushSentry();
 		if (isJsonMode) {
 			writeJsonErrorReport(error, sentryEventId);
 			process.exitCode = 1;
@@ -53668,6 +55036,33 @@ const normalizeHelpInvocation = (argv, knownCommands) => {
 	return [...nodeArguments, "--help"];
 };
 //#endregion
+//#region src/cli/utils/print-debug-trace.ts
+/**
+* The `--debug` end-of-run line, pure so it's testable without the Sentry SDK.
+* Mirrors the crash-reference phrasing in `handle-error.ts` ("mention this when
+* reporting") so users learn one habit for both paths. A `null` trace says why,
+* so `--debug` never silently does nothing.
+*/
+const buildDebugTraceMessage = (traceId) => traceId === null ? "Sentry trace unavailable for this run (no trace was recorded)." : `Sentry trace (mention this when reporting): ${traceId}`;
+/**
+* Prints the run's Sentry trace id to stderr at the end of a `--debug` run, so
+* maintainers can pull the full trace from a pasted id. Runs from the process
+* `exit` handler, so it's the last line on both the success path and the error
+* funnels (which `process.exit()` before the promise chain could resume).
+*
+* Writes straight to `process.stderr` (not `Console`) for three reasons: the
+* exit handler is synchronous, JSON mode patches the global console to no-ops —
+* a diagnostic the user explicitly asked for must survive that — and stderr
+* keeps `--json` / `--score` stdout machine-clean. The write is wrapped because
+* a diagnostic must never throw out of an exit handler.
+*/
+const printDebugTrace = () => {
+	if (!Sentry.isInitialized()) return;
+	try {
+		process.stderr.write(`${highlighter.dim(buildDebugTraceMessage(getLastRunTraceId()))}\n`);
+	} catch {}
+};
+//#endregion
 //#region src/cli/utils/removed-cli-flags.ts
 const REMOVED_FLAGS = new Map([
 	["--full", "use `--diff false` to force a full scan"],
@@ -53694,6 +55089,7 @@ const ROOT_FLAG_SPEC = {
 	longOptionsWithoutValues: new Set([
 		"--color",
 		"--dead-code",
+		"--debug",
 		"--help",
 		"--json",
 		"--json-compact",
@@ -53861,6 +55257,9 @@ const stripUnknownCliFlags = (argv) => {
 initializeSentry();
 process.on("SIGINT", exitGracefully);
 process.on("SIGTERM", exitGracefully);
+process.on("exit", () => {
+	if (isDebugFlagEnabled()) printDebugTrace();
+});
 unrefStdin();
 guardStdin();
 const formatExampleLines = (examples) => {
@@ -53872,7 +55271,7 @@ ${highlighter.dim("Examples:")}
 ${formatExampleLines([
 	["react-doctor", "scan the current project"],
 	["react-doctor ./apps/web", "scan a specific directory"],
-	["react-doctor --diff main", "scan only files changed vs. main"],
+	["react-doctor --scope changed --base main", "scan only new issues vs. main"],
 	["react-doctor --project modules/a,modules/b", "score each module separately (names or paths)"],
 	["react-doctor --staged", "scan staged files (pre-commit hook)"],
 	["react-doctor --category Security", "show only one diagnostic category"],
@@ -53905,7 +55304,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CANONICAL_GITHUB_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -53948,4 +55347,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=79c9f922-1713-5894-a0aa-142d0cd9c7ba
+//# debugId=fc85ab90-476c-5c45-bfa1-cfead22c445d