react-doctor 0.5.7 → 0.5.8-dev.f4e8e4b

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="80f0c020-6340-5bba-86a5-7cdbaecdf52d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6a2c86b6-c3a8-5e50-8e7b-daef840df200")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -9,7 +9,7 @@ import * as NFS from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
 import process$1 from "node:process";
 import * as ts from "typescript";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
 import os, { tmpdir } from "node:os";
 import { parseJSON5 } from "confbox";
@@ -10277,7 +10277,7 @@ const provideContext$1 = /* @__PURE__ */ dual(2, (self, context) => {
 	return updateContext$1(self, merge$3(context));
 });
 /** @internal */
-const provideService$1 = function() {
+const provideService$3 = function() {
 	if (arguments.length === 1) return dual(2, (self, impl) => provideServiceImpl(self, arguments[0], impl));
 	return dual(3, (self, service, impl) => provideServiceImpl(self, service, impl)).apply(this, arguments);
 };
@@ -10508,7 +10508,7 @@ const constScopeEmpty = { _tag: "Empty" };
 /** @internal */
 const scope = scopeTag;
 /** @internal */
-const provideScope = /* @__PURE__ */ provideService$1(scopeTag);
+const provideScope = /* @__PURE__ */ provideService$3(scopeTag);
 /** @internal */
 const scoped$1 = (self) => withFiber$1((fiber) => {
 	const prev = fiber.context;
@@ -10949,9 +10949,9 @@ const makeLatchUnsafe = (open) => new Latch(open ?? false);
 /** @internal */
 const makeLatch = (open) => sync$2(() => makeLatchUnsafe(open));
 /** @internal */
-const withTracer$1 = /* @__PURE__ */ dual(2, (effect, tracer) => provideService$1(effect, Tracer, tracer));
+const withTracer$1 = /* @__PURE__ */ dual(2, (effect, tracer) => provideService$3(effect, Tracer, tracer));
 /** @internal */
-const withTracerEnabled$1 = /* @__PURE__ */ provideService$1(TracerEnabled);
+const withTracerEnabled$1 = /* @__PURE__ */ provideService$3(TracerEnabled);
 const bigint0 = /* @__PURE__ */ BigInt(0);
 const NoopSpanProto = {
 	_tag: "Span",
@@ -11032,7 +11032,7 @@ const useSpan$1 = (name, ...args) => {
 		}));
 	});
 };
-const provideParentSpan = /* @__PURE__ */ provideService$1(ParentSpan);
+const provideParentSpan = /* @__PURE__ */ provideService$3(ParentSpan);
 /** @internal */
 const withParentSpan$1 = function() {
 	const dataFirst = isEffect$1(arguments[0]);
@@ -12599,7 +12599,7 @@ var CurrentMemoMap = class extends Service()("effect/Layer/CurrentMemoMap") {
 * @category memo map
 * @since 2.0.0
 */
-const buildWithMemoMap = /* @__PURE__ */ dual(3, (self, memoMap, scope) => provideService$1(map$4(self.build(memoMap, scope), add(CurrentMemoMap, memoMap)), CurrentMemoMap, memoMap));
+const buildWithMemoMap = /* @__PURE__ */ dual(3, (self, memoMap, scope) => provideService$3(map$4(self.build(memoMap, scope), add(CurrentMemoMap, memoMap)), CurrentMemoMap, memoMap));
 /**
 * Builds a layer into an `Effect` value. Any resources associated with this
 * layer will be released when the specified scope is closed unless their scope
@@ -13952,7 +13952,7 @@ const provide$1 = /* @__PURE__ */ dual((args) => isEffect$1(args[0]), (self, sou
 /** @internal */
 const repeatOrElse = /* @__PURE__ */ dual(3, (self, schedule, orElse) => flatMap$4(toStepWithMetadata(schedule), (step) => {
 	let meta = CurrentMetadata.defaultValue();
-	return catch_$2(forever$2(tap$2(flatMap$4(suspend$3(() => provideService$1(self, CurrentMetadata, meta)), step), (meta_) => sync$2(() => {
+	return catch_$2(forever$2(tap$2(flatMap$4(suspend$3(() => provideService$3(self, CurrentMetadata, meta)), step), (meta_) => sync$2(() => {
 		meta = meta_;
 	})), { disableYield: true }), (error) => isDone$2(error) ? succeed$5(error.value) : orElse(error, meta.attempt === 0 ? none() : some(meta)));
 }));
@@ -13960,7 +13960,7 @@ const repeatOrElse = /* @__PURE__ */ dual(3, (self, schedule, orElse) => flatMap
 const retryOrElse = /* @__PURE__ */ dual(3, (self, policy, orElse) => flatMap$4(toStepWithMetadata(policy), (step) => {
 	let meta = CurrentMetadata.defaultValue();
 	let lastError;
-	const loop = catch_$2(suspend$3(() => provideService$1(self, CurrentMetadata, meta)), (error) => {
+	const loop = catch_$2(suspend$3(() => provideService$3(self, CurrentMetadata, meta)), (error) => {
 		lastError = error;
 		return flatMap$4(step(error), (meta_) => {
 			meta = meta_;
@@ -16076,7 +16076,7 @@ const updateContext = updateContext$1;
 * @category Context
 * @since 2.0.0
 */
-const provideService = provideService$1;
+const provideService$2 = provideService$3;
 /**
 * Scopes all resources used in this workflow to the lifetime of the workflow,
 * ensuring that their finalizers are run as soon as this workflow completes
@@ -21091,6 +21091,20 @@ function decodeUnknownOption$1(schema, options) {
 	return asOption(decodeUnknownEffect(schema, options));
 }
 /**
+* Creates a synchronous decoder for `unknown` input.
+*
+* **Details**
+*
+* The returned function returns the decoded `Type` on success and throws an
+* `Error` with the `SchemaIssue.Issue` in its `cause` on decoding failure.
+*
+* @category decoding
+* @since 3.10.0
+*/
+function decodeUnknownSync$1(schema, options) {
+	return asSync(decodeUnknownEffect(schema, options));
+}
+/**
 * Creates an effectful encoder for `unknown` input.
 *
 * **Details**
@@ -21392,6 +21406,40 @@ function isSchemaError(u) {
 */
 const decodeUnknownOption = decodeUnknownOption$1;
 /**
+* Decodes an `unknown` input against a schema synchronously, returning the
+* decoded value or throwing an `Error` whose cause contains the schema issue.
+* Use this when you want to validate data at a boundary and treat a schema
+* mismatch as an exception. For typed input use `decodeSync`.
+*
+* **Details**
+*
+* Only service-free schemas can be decoded synchronously. For non-throwing
+* alternatives see `decodeUnknownOption`, `decodeUnknownExit`, or
+* `decodeUnknownEffect`. Options may be provided either when creating the
+* decoder or when applying it; application options override creation options.
+*
+* **Example** (Decoding with a transformation schema)
+*
+* ```ts
+* import { Schema } from "effect"
+*
+* const NumberFromString = Schema.NumberFromString
+*
+* console.log(Schema.decodeUnknownSync(NumberFromString)("42"))
+* // Output: 42
+*
+* Schema.decodeUnknownSync(NumberFromString)("not a number")
+* // throws SchemaError: NumberFromString
+* //   └─ Encoded side transformation failure
+* //      └─ NumberFromString
+* //         └─ Expected a numeric string, actual "not a number"
+* ```
+*
+* @category decoding
+* @since 4.0.0
+*/
+const decodeUnknownSync = decodeUnknownSync$1;
+/**
 * Encodes an `unknown` input against a schema synchronously, throwing a
 * {@link SchemaError} on failure. Use this when you want to serialize data at a
 * boundary and treat a schema mismatch as an unrecoverable error. For
@@ -28271,6 +28319,14 @@ const runWith = (self, f, onHalt) => suspend$2(() => {
 	return catchDone(flatMap$2(toTransform(self)(done$1(), scope), f), onHalt ? onHalt : succeed$2).pipe(onExit$2((exit) => close(scope, exit)));
 });
 /**
+* Provides a concrete service for a context key, removing that service
+* requirement from the returned channel.
+*
+* @category services
+* @since 2.0.0
+*/
+const provideService$1 = /* @__PURE__ */ dual(3, (self, key, service) => fromTransform$1((upstream, scope) => map$3(provideService$2(toTransform(self)(upstream, scope), key, service), provideService$2(key, service))));
+/**
 * Runs a channel and applies an effect to each output element.
 *
 * **Example** (Running effects for each output)
@@ -29659,6 +29715,44 @@ const splitLines = (self) => self.channel.pipe(pipeTo(splitLines$1()), fromChann
 */
 const ensuring = /* @__PURE__ */ dual(2, (self, finalizer) => fromChannel(ensuring$1(self.channel, finalizer)));
 /**
+* Provides the stream with a single required service, eliminating that
+* requirement from its environment.
+*
+* **Example** (Providing a stream service)
+*
+* ```ts
+* import { Console, Context, Effect, Stream } from "effect"
+*
+* class Greeter extends Context.Service<Greeter, {
+*   greet: (name: string) => string
+* }>()("Greeter") {}
+*
+* const stream = Stream.fromEffect(
+*   Effect.service(Greeter).pipe(
+*     Effect.map((greeter) => greeter.greet("Ada"))
+*   )
+* )
+*
+* const program = Effect.gen(function*() {
+*   const collected = yield* Stream.runCollect(
+*     stream.pipe(
+*       Stream.provideService(Greeter, {
+*         greet: (name) => `Hello, ${name}`
+*       })
+*     )
+*   )
+*   yield* Console.log(collected)
+* })
+*
+* Effect.runPromise(program)
+* //=> ["Hello, Ada"]
+* ```
+*
+* @category services
+* @since 2.0.0
+*/
+const provideService = /* @__PURE__ */ dual(3, (self, key, service) => fromChannel(provideService$1(self.channel, key, service)));
+/**
 * Runs a stream with a sink and returns the sink result.
 *
 * **Example** (Running a stream with a sink)
@@ -33088,7 +33182,7 @@ const make$8 = /* @__PURE__ */ fnUntraced(function* (options) {
 	const runFork = runForkWith(services);
 	const exportInterval = max(fromInputUnsafe(options.exportInterval), zero);
 	let disabledUntil = void 0;
-	const client = filterStatusOk(get$4(services, HttpClient)).pipe(transformResponse(provideService(TracerPropagationEnabled, false)), retryTransient({
+	const client = filterStatusOk(get$4(services, HttpClient)).pipe(transformResponse(provideService$2(TracerPropagationEnabled, false)), retryTransient({
 		schedule: policy,
 		times: 3
 	}));
@@ -35885,15 +35979,21 @@ const isMinifiedSource = (absolutePath) => {
 		if (fileDescriptor !== void 0) NFS.closeSync(fileDescriptor);
 	}
 };
-const isLargeMinifiedFile = (absolutePath) => {
-	let sizeBytes;
+const cachedIsLargeMinifiedByPath = /* @__PURE__ */ new Map();
+const statSourceFileSize = (absolutePath) => {
 	try {
-		sizeBytes = NFS.statSync(absolutePath).size;
+		return NFS.statSync(absolutePath).size;
 	} catch {
-		return false;
+		return null;
 	}
-	if (sizeBytes < 2e4) return false;
-	return isMinifiedSource(absolutePath);
+};
+const isLargeMinifiedFile = (absolutePath, knownSizeBytes) => {
+	const cached = cachedIsLargeMinifiedByPath.get(absolutePath);
+	if (cached !== void 0) return cached;
+	const sizeBytes = knownSizeBytes === void 0 ? statSourceFileSize(absolutePath) : knownSizeBytes;
+	const result = sizeBytes !== null && sizeBytes >= 2e4 && isMinifiedSource(absolutePath);
+	cachedIsLargeMinifiedByPath.set(absolutePath, result);
+	return result;
 };
 const isErrnoException = (error) => error instanceof Error && "code" in error;
 const IGNORABLE_READDIR_ERROR_CODES = new Set([
@@ -36762,6 +36862,7 @@ const DOCS_URL = "https://react.doctor/docs";
 const DOCS_RULES_BASE_URL = `${DOCS_URL}/rules`;
 const FETCH_TIMEOUT_MS = 1e4;
 const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
+const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
 const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
 const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
 const OXLINT_NODE_REQUIREMENT = "^20.19.0 || >=22.12.0";
@@ -36838,7 +36939,16 @@ const CANONICAL_DISCORD_URL = "https://react.doctor/discord";
 const SKILL_NAME = "react-doctor";
 const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
 const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
+const NODE_COMPILE_CACHE_DIR_NAME = "node-compile-cache";
+const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
+const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
+const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
+const LINT_PHASE_TIMEOUT_MS = 3e5;
+const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
+const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
+const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
+const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const REACT_SERVER_DOM_PACKAGES = [
 	"react-server-dom-webpack",
@@ -36873,9 +36983,13 @@ const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 const SOCKET_FREE_PURL_API_BASE = "https://firewall-api.socket.dev/purl";
 const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
 const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
+const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
+const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SUPPLY_CHAIN_PLUGIN = "socket";
 const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
 const SUPPLY_CHAIN_CATEGORY = "Security";
+const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
+const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
 const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
 const TSCONFIG_FILENAME = "tsconfig.json";
 const isRelativeExtendsValue = (extendsValue) => extendsValue.startsWith("./") || extendsValue.startsWith("../") || Path.isAbsolute(extendsValue);
@@ -38227,6 +38341,11 @@ var OxlintBatchExceeded = class extends TaggedErrorClass()("OxlintBatchExceeded"
 		}
 	}
 };
+var ScanDeadlineExceeded = class extends TaggedErrorClass()("ScanDeadlineExceeded", { detail: String$1 }) {
+	get message() {
+		return `Scan exceeded its overall time budget: ${this.detail}`;
+	}
+};
 var OxlintSpawnFailed = class extends TaggedErrorClass()("OxlintSpawnFailed", { cause: Unknown }) {
 	get message() {
 		return `Failed to run oxlint: ${pretty(fail$6(this.cause))}`;
@@ -38290,6 +38409,7 @@ var GitBaseBranchInvalid = class extends TaggedErrorClass()("GitBaseBranchInvali
 const ReactDoctorErrorReason = Union([
 	OxlintUnavailable,
 	OxlintBatchExceeded,
+	ScanDeadlineExceeded,
 	OxlintSpawnFailed,
 	OxlintOutputUnparseable,
 	ConfigParseFailed,
@@ -38362,15 +38482,105 @@ const layerOtlp = unwrap$3(gen(function* () {
 	}).pipe(provide$2(layer$9));
 }).pipe(orDie));
 /**
-* Resolves a requested lint worker count to a clamped integer within
-* `[MIN_SCAN_CONCURRENCY, MAX_SCAN_CONCURRENCY]`. `"auto"` uses the
-* machine's CPU cores; out-of-range or non-finite requests degrade to
+* Read a positive-millisecond timeout from an env var, falling back to
+* `defaultMs` when the var is unset, non-finite, or not strictly positive.
+*/
+const readPositiveEnvMs = (envVarName, defaultMs) => {
+	const rawValue = process.env[envVarName];
+	if (rawValue === void 0) return defaultMs;
+	const parsedValue = Number(rawValue);
+	if (!Number.isFinite(parsedValue) || parsedValue <= 0) return defaultMs;
+	return parsedValue;
+};
+const CGROUP_V2_MEMORY_MAX_PATH = "/sys/fs/cgroup/memory.max";
+const CGROUP_V1_MEMORY_LIMIT_PATH = "/sys/fs/cgroup/memory/memory.limit_in_bytes";
+const CGROUP_UNLIMITED_SENTINEL_BYTES = Number.MAX_SAFE_INTEGER;
+/**
+* Parses one raw cgroup memory-limit file value into a positive byte count, or
+* `undefined` when it represents "no limit" (the v2 `"max"` literal, an empty
+* read, a non-positive / non-finite value, or v1's near-2^63 unlimited
+* sentinel). Pure and exported so the classification is unit-testable without
+* touching the filesystem.
+*/
+const parseCgroupMemoryLimitBytes = (raw) => {
+	if (raw === void 0) return void 0;
+	const trimmed = raw.trim();
+	if (trimmed === "" || trimmed === "max") return void 0;
+	const parsed = Number(trimmed);
+	if (!Number.isFinite(parsed) || parsed <= 0 || parsed >= CGROUP_UNLIMITED_SENTINEL_BYTES) return;
+	return parsed;
+};
+const CGROUP_MEMORY_LIMIT_PATHS = [CGROUP_V2_MEMORY_MAX_PATH, CGROUP_V1_MEMORY_LIMIT_PATH];
+/**
+* Reads this process's cgroup memory limit in bytes from the first candidate
+* path that yields a real limit, or `undefined` when none does — no cgroup, no
+* limit, or the files are unreadable (e.g. macOS / Windows dev machines).
+* `os.totalmem()` reports the HOST total and ignores cgroup memory limits, so a
+* memory-constrained container over-reports total memory; `resolveAutoScan-
+* Concurrency` takes `min(totalmem, this)` to honor the limit.
+*
+* The cgroup v2 read is the mount-root `memory.max`, which IS the container's
+* limit under the standard cgroup-namespace setup CI runners use (the
+* container's own cgroup is the root of its namespaced view). A process in a
+* non-namespaced nested/delegated cgroup whose root reads `"max"` is not
+* detected here and falls back to the host total; the EAGAIN/ENOMEM serial
+* replay in `spawnLintBatches` remains the runtime backstop for that case.
+*
+* `candidatePaths` is injectable so tests exercise the v2-wins-over-v1
+* precedence, the skip-unreadable fallback, and the all-missing case without a
+* real `/sys/fs/cgroup`.
+*/
+const readCgroupMemoryLimitBytes = (candidatePaths = CGROUP_MEMORY_LIMIT_PATHS) => {
+	for (const limitPath of candidatePaths) {
+		let raw;
+		try {
+			raw = fs.readFileSync(limitPath, "utf8");
+		} catch {
+			continue;
+		}
+		const limitBytes = parseCgroupMemoryLimitBytes(raw);
+		if (limitBytes !== void 0) return limitBytes;
+	}
+};
+/**
+* Clamps a requested lint worker count to `[MIN_SCAN_CONCURRENCY,
+* HARD_MAX_SCAN_CONCURRENCY]` as a finite integer. This is the explicit-pin and
+* spawn-boundary clamp — the memory-and-core-budgeted auto count comes from
+* `resolveAutoScanConcurrency`. Out-of-range or non-finite requests degrade to
 * `MIN_SCAN_CONCURRENCY` rather than oversubscribing or running zero workers.
 */
 const resolveScanConcurrency = (requested) => {
-	const desired = requested === "auto" ? os.availableParallelism() : requested;
-	if (!Number.isFinite(desired) || desired < 1) return 1;
-	return Math.max(1, Math.min(Math.floor(desired), 16));
+	if (!Number.isFinite(requested) || requested < 1) return 1;
+	return Math.min(Math.floor(requested), 32);
+};
+const readSystemFacts = () => ({
+	availableCores: os.availableParallelism(),
+	totalMemoryBytes: os.totalmem(),
+	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
+});
+/**
+* Auto lint-worker count: the smaller of the (cgroup-CPU-aware) core count and
+* the number of `PER_WORKER_MEM_BUDGET_BYTES` workers that fit in available
+* memory, then clamped to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
+*
+* `os.availableParallelism()` already respects cgroup CPU quotas, so the core
+* term needs no help. Available memory is `os.totalmem()` floored by the cgroup
+* memory limit — `os.freemem()` is deliberately NOT used: it excludes
+* reclaimable page cache and reads near-zero on macOS / cache-heavy Linux, which
+* would collapse the auto path to a single worker. `os.totalmem()` reports the
+* host total even inside a container, so the cgroup limit (read directly,
+* because Node doesn't fold it into `totalmem()`) is the real ceiling there.
+*
+* `facts` is injectable so tests exercise core-bound, memory-bound, cgroup-
+* limited, and ceiling cases without mocking `os` or the filesystem.
+*/
+const resolveAutoScanConcurrency = (facts = readSystemFacts()) => {
+	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
+	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
+	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
+};
+const resolveLintBatchOrdering = () => {
+	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "cost" ? "cost" : "arrival";
 };
 /**
 * Per-batch oxlint wall-clock budget. Reads from the env var on
@@ -38378,11 +38588,38 @@ const resolveScanConcurrency = (requested) => {
 * microVMs without recompiling react-doctor. Tests override via
 * `Layer.succeed(OxlintSpawnTimeoutMs, ...)`.
 */
-var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => {
-	const raw = process.env["REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS"];
-	if (raw === void 0) return OXLINT_SPAWN_TIMEOUT_MS;
+var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS", OXLINT_SPAWN_TIMEOUT_MS) }) {};
+/**
+* Effect-side cap on the lint phase. The env var lets CI / eval runners
+* raise the phase budget for slow large repos without recompiling.
+* Tests override via `Layer.succeed(LintPhaseTimeoutMs, ...)`.
+*/
+var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", LINT_PHASE_TIMEOUT_MS) }) {};
+/**
+* Effect-side cap on the dead-code phase, sitting above the in-worker
+* timeout as a runtime-independent backstop. The env var raises it for
+* type-heavy projects; tests override via
+* `Layer.succeed(DeadCodePhaseTimeoutMs, ...)`.
+*/
+var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", DEAD_CODE_PHASE_TIMEOUT_MS) }) {};
+/**
+* Overall scan deadline backstop, bounding everything the per-phase
+* timeouts don't (wedged git / IO). The env var raises it for very
+* large repos; tests override via `Layer.succeed(ScanDeadlineMs, ...)`.
+*/
+var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", SCAN_TOTAL_DEADLINE_MS) }) {};
+/**
+* Wall-clock budget for the supply-chain check when it runs on a background
+* fiber overlapping the lint pass. Reads from the env var on startup so the
+* eval harness can raise the budget under sandbox microVMs (slower network)
+* without recompiling react-doctor. Tests override via
+* `Layer.succeed(SupplyChainOverlapTimeoutMs, ...)`.
+*/
+var SupplyChainOverlapTimeoutMs = class extends Reference("react-doctor/SupplyChainOverlapTimeoutMs", { defaultValue: () => {
+	const raw = process.env["REACT_DOCTOR_SUPPLY_CHAIN_TIMEOUT_MS"];
+	if (raw === void 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
 	const parsed = Number(raw);
-	if (!Number.isFinite(parsed) || parsed <= 0) return OXLINT_SPAWN_TIMEOUT_MS;
+	if (!Number.isFinite(parsed) || parsed <= 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
 	return parsed;
 } }) {};
 /**
@@ -38393,31 +38630,93 @@ var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTime
 */
 var OxlintOutputMaxBytes = class extends Reference("react-doctor/OxlintOutputMaxBytes", { defaultValue: () => OXLINT_OUTPUT_MAX_BYTES }) {};
 /**
-* Number of oxlint subprocesses the lint pass runs in parallel. Defaults
-* to auto-detected CPU cores (parallel) so large repos scan fast out of
-* the box; `spawnLintBatches` transparently falls back to a single worker
-* if a parallel run exhausts system resources. The CLI's `--no-parallel`
-* flag forces serial via `Layer.succeed`; the `REACT_DOCTOR_PARALLEL` env
-* var seeds the default for programmatic / CI callers that never touch the
-* flag — parallelism is opt-OUT, so only the explicit serial values pin
-* one worker:
-*
-*   - unset / `auto` / `true` / `on`  → available CPU cores (clamped)
+* Number of oxlint subprocesses the lint pass runs in parallel. Defaults to a
+* memory-and-core-budgeted auto count (`resolveAutoScanConcurrency`) so large
+* repos scan fast out of the box without OOMing the native binding on a
+* high-core / low-memory box; `spawnLintBatches` transparently falls back to a
+* single worker if a parallel run still exhausts system resources. The CLI's
+* `--no-parallel` flag forces serial via `Layer.succeed`; the
+* `REACT_DOCTOR_PARALLEL` env var seeds the default for programmatic / CI
+* callers that never touch the flag — parallelism is opt-OUT, so only the
+* explicit serial values pin one worker:
+*
+*   - unset / `auto` / `true` / `on`  → memory-and-core-budgeted auto count
 *   - `0` / `false` / `off`           → `1` (serial)
 *   - a positive integer              → that many workers (clamped)
-*   - any other value                 → available CPU cores (clamped)
+*   - any other value                 → memory-and-core-budgeted auto count
 *
 * The resolved value is always within
-* `[MIN_SCAN_CONCURRENCY, MAX_SCAN_CONCURRENCY]`.
+* `[MIN_SCAN_CONCURRENCY, HARD_MAX_SCAN_CONCURRENCY]`.
 */
 var OxlintConcurrency = class extends Reference("react-doctor/OxlintConcurrency", { defaultValue: () => {
 	const raw = process.env["REACT_DOCTOR_PARALLEL"];
-	if (raw === void 0) return resolveScanConcurrency("auto");
+	if (raw === void 0) return resolveAutoScanConcurrency();
 	const normalized = raw.trim().toLowerCase();
 	if (normalized === "0" || normalized === "false" || normalized === "off") return 1;
 	const parsed = Number.parseInt(normalized, 10);
 	if (Number.isInteger(parsed) && parsed > 0) return resolveScanConcurrency(parsed);
-	return resolveScanConcurrency("auto");
+	return resolveAutoScanConcurrency();
+} }) {};
+/**
+* Three-state control for overlapping the dead-code pass with the lint pass —
+* forking dead-code as a child fiber that runs DURING lint instead of strictly
+* after it.
+*
+*   - `"auto"` (default) / `"off"` → strictly SEQUENTIAL: dead-code runs after
+*     lint with the full core budget. Both deslop's parse pool and the oxlint
+*     pool are CPU-bound and each size themselves to all cores, so overlapping
+*     them only oversubscribes (~2x the cores) and starves the parse pass past
+*     its timeout — for no wall-clock win, since there are no spare cores to
+*     absorb the second pass. Sequential is both faster per-phase and safe.
+*   - `"on"` → force the overlap anyway. The orchestrator then SPLITS the core
+*     budget (`DEAD_CODE_OVERLAP_PARSE_SHARE`): deslop's parse pool is capped
+*     and lint shrinks to the remainder, so the two sum to the cores instead of
+*     doubling them, and the dead-code timeout scales up for the reduced share.
+*
+* Seeded from `REACT_DOCTOR_DEAD_CODE_OVERLAP` so operators get a redeploy-free
+* switch; tests pin it via `Layer.succeed(DeadCodeOverlap, ...)`.
+*/
+var DeadCodeOverlap = class extends Reference("react-doctor/DeadCodeOverlap", { defaultValue: () => {
+	const raw = process.env["REACT_DOCTOR_DEAD_CODE_OVERLAP"]?.trim().toLowerCase();
+	if (raw === "on" || raw === "true" || raw === "1") return "on";
+	if (raw === "off" || raw === "false" || raw === "0") return "off";
+	return "auto";
+} }) {};
+/**
+* How the full-scan lint pass orders its file batches. `"arrival"` (the
+* default) keeps `git ls-files` discovery order. `"cost"` opts into LPT (feed
+* the largest files first); set `REACT_DOCTOR_LINT_BATCH_ORDERING=cost`. NOTE:
+* `cost` is OFF by default because the current sort-desc-then-chunk-100 packs
+* the heaviest files into one wave-1 batch — on size-skewed repos that mega-
+* batch is a straggler (and can trip the per-batch timeout + split), measurably
+* regressing the common full-scan case. LPT needs the heavy files SPREAD across
+* batches before `cost` earns the default. Tests override via
+* `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans never reach this
+* — they pass user-scoped `includePaths` that skip discovery and stay in
+* arrival order; only the full-scan branch reads it.
+*/
+var LintBatchOrdering = class extends Reference("react-doctor/LintBatchOrdering", { defaultValue: resolveLintBatchOrdering }) {};
+const CACHE_DISABLED_VALUES$1 = new Set(["1", "true"]);
+/**
+* Whether the per-file lint cache (`runners/oxlint/file-lint-cache.ts`) is
+* active. Defaults ON — repeat scans re-lint only the files whose content
+* changed, and correctness is guaranteed byte-identical to a cold scan by the
+* always-fresh cross-file sidecar. Opt-OUT, two knobs (matching the whole-repo
+* scan cache's `REACT_DOCTOR_NO_CACHE`):
+*
+*   - `REACT_DOCTOR_NO_CACHE` — the global off-switch; disables BOTH the
+*     whole-repo scan cache and this per-file cache.
+*   - `REACT_DOCTOR_NO_FILE_CACHE` — granular: bust only the per-file cache
+*     while keeping the whole-repo short-circuit.
+*
+* Tests override via `Layer.succeed(PerFileLintCacheEnabled, false)`.
+*/
+var PerFileLintCacheEnabled = class extends Reference("react-doctor/PerFileLintCacheEnabled", { defaultValue: () => {
+	const noCache = process.env["REACT_DOCTOR_NO_CACHE"]?.toLowerCase() ?? "";
+	const noFileCache = process.env["REACT_DOCTOR_NO_FILE_CACHE"]?.toLowerCase() ?? "";
+	if (CACHE_DISABLED_VALUES$1.has(noCache)) return false;
+	if (CACHE_DISABLED_VALUES$1.has(noFileCache)) return false;
+	return true;
 } }) {};
 const DIAGNOSTIC_SURFACES = [
 	"cli",
@@ -38851,6 +39150,8 @@ const assignFixGroups = (diagnostics) => {
 		};
 	});
 };
+const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const sortDiagnosticsStable = (diagnostics) => [...diagnostics].sort((left, right) => compareStrings(left.filePath, right.filePath) || left.line - right.line || left.column - right.column || compareStrings(left.plugin, right.plugin) || compareStrings(left.rule, right.rule) || compareStrings(left.severity, right.severity) || compareStrings(left.message, right.message));
 const getDirectDependencyNames = (packageJson) => new Set([...Object.keys(packageJson.dependencies ?? {}), ...Object.keys(packageJson.devDependencies ?? {})]);
 const buildExpoCheckContext = (rootDirectory, expoVersion) => {
 	const packageJson = readPackageJson$1(Path.join(rootDirectory, "package.json"));
@@ -39357,10 +39658,15 @@ const buildHardeningDiagnostic = (input) => ({
 	column: input.column ?? 0,
 	category: "Security"
 });
-const checkPnpmHardening = (rootDirectory) => {
-	if (!isPnpmManagedProject(rootDirectory)) return [];
-	const workspacePath = Path.join(rootDirectory, PNPM_WORKSPACE_FILE);
-	const settings = parseHardeningSettings(isFile(workspacePath) ? NFS.readFileSync(workspacePath, "utf-8") : "");
+const checkPnpmHardening = (scanDirectory) => {
+	if (!isPnpmManagedProject(scanDirectory)) return [];
+	const workspacePath = Path.join(scanDirectory, PNPM_WORKSPACE_FILE);
+	const hasWorkspaceFile = isFile(workspacePath);
+	if (!hasWorkspaceFile) {
+		const monorepoRoot = findMonorepoRoot(scanDirectory);
+		if (monorepoRoot !== null && isFile(Path.join(monorepoRoot, PNPM_WORKSPACE_FILE))) return [];
+	}
+	const settings = parseHardeningSettings(hasWorkspaceFile ? NFS.readFileSync(workspacePath, "utf-8") : "");
 	const diagnostics = [];
 	if (settings.minimumReleaseAge === null) diagnostics.push(buildHardeningDiagnostic({
 		message: "pnpm-workspace.yaml is missing `minimumReleaseAge` — newly published versions can ship malware that gets caught and unpublished within hours",
@@ -40161,6 +40467,22 @@ process.stdin.on("end", () => {
         ...(workerInput.ignorePatterns.length > 0
           ? { ignorePatterns: workerInput.ignorePatterns }
           : {}),
+        // We consume only deslop's GRAPH-based findings (unusedFiles, unusedExports,
+        // unusedDependencies, circularDependencies). Everything else deslop can compute
+        // is pure wasted work for us, and it's the bulk of the runtime:
+        //   - semantic: a full TS Program for unusedTypes/enum/class-members/
+        //     misclassifiedDependencies (~37-45% of the phase).
+        //   - reportCodeQuality: the duplicate-block, complexity, feature-flag,
+        //     TypeScript-smell, private-type-leak and re-export-cycle detectors. These
+        //     are the single most expensive pass — duplicate-block detection alone was
+        //     ~83s of a ~130s Sentry scan — so skipping them is an ~8.5x dead-code
+        //     speedup on a large repo.
+        // Both are provably safe: the consumed graph findings are computed by their own
+        // detectors, independent of these passes (confirmed byte-identical on
+        // excalidraw + mui-material + sentry). tsConfigPath stays — the module resolver
+        // needs it for path-alias resolution in the import graph.
+        semantic: { enabled: false },
+        reportCodeQuality: false,
       };
       const result = await analyze(defineConfig(config));
       emit({ ok: true, result: normalizeResult(result) });
@@ -40290,7 +40612,11 @@ const createDeadCodeWorker = (input) => {
 			"pipe",
 			"pipe"
 		],
-		windowsHide: true
+		windowsHide: true,
+		env: input.parseConcurrency === void 0 ? process.env : {
+			...process.env,
+			DESLOP_PARSE_CONCURRENCY: String(input.parseConcurrency)
+		}
 	});
 	const stdoutChunks = [];
 	const stderrChunks = [];
@@ -40335,28 +40661,25 @@ const createDeadCodeWorker = (input) => {
 		}
 	};
 };
-const runDeadCodeWorkerWithTimeout = (handle, timeoutMs) => new Promise((resolve, reject) => {
+const runDeadCodeWorkerWithTimeout = (handle, timeoutMs, abortSignal) => new Promise((resolve, reject) => {
 	let didSettle = false;
-	const timeoutHandle = setTimeout(() => {
-		if (didSettle) return;
-		didSettle = true;
-		handle.terminate?.();
-		reject(/* @__PURE__ */ new Error(`Dead-code worker timed out after ${timeoutMs / MILLISECONDS_PER_SECOND}s.`));
-	}, timeoutMs);
-	timeoutHandle.unref?.();
-	handle.result.then((value) => {
-		if (didSettle) return;
-		didSettle = true;
-		clearTimeout(timeoutHandle);
-		handle.terminate?.();
-		resolve(value);
-	}, (error) => {
+	const settle = (finish) => {
 		if (didSettle) return;
 		didSettle = true;
 		clearTimeout(timeoutHandle);
+		abortSignal?.removeEventListener("abort", onAbort);
 		handle.terminate?.();
-		reject(error);
-	});
+		finish();
+	};
+	const onAbort = () => settle(() => reject(/* @__PURE__ */ new Error("Dead-code worker aborted.")));
+	const timeoutHandle = setTimeout(() => settle(() => reject(/* @__PURE__ */ new Error(`Dead-code worker timed out after ${timeoutMs / MILLISECONDS_PER_SECOND}s.`))), timeoutMs);
+	timeoutHandle.unref?.();
+	if (abortSignal?.aborted) {
+		onAbort();
+		return;
+	}
+	abortSignal?.addEventListener("abort", onAbort, { once: true });
+	handle.result.then((value) => settle(() => resolve(value)), (error) => settle(() => reject(error)));
 });
 const checkDeadCode = async (options) => {
 	const rootDirectory = toCanonicalPath(options.rootDirectory);
@@ -40368,8 +40691,9 @@ const checkDeadCode = async (options) => {
 		entryPatterns,
 		tsConfigPath: resolveTsConfigPath(rootDirectory),
 		ignorePatterns,
-		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js")
-	}), options.workerTimeoutMs ?? 12e4));
+		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
+		parseConcurrency: options.parseConcurrency
+	}), options.workerTimeoutMs ?? 12e4, options.abortSignal));
 	const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -40467,7 +40791,37 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const excludeMinifiedFiles = (rootDirectory, relativePaths) => relativePaths.filter((relativePath) => !isLargeMinifiedFile(Path.resolve(rootDirectory, relativePath)));
+/**
+* Budget for the dead-code phase, scaled to the work. deslop's graph build is
+* CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
+* for a large repo (where the pass legitimately runs that long) and is then
+* tipped over by any concurrent load — silently dropping every dead-code
+* finding. Scaling the budget with file count (and inversely with the core
+* share when overlapped) lets the pass complete, while the ceiling still
+* reclaims a genuinely wedged worker. Returns the in-worker SIGKILL deadline
+* and the Effect-side phase backstop that sits a margin above it.
+*/
+const resolveDeadCodeTimeout = (input) => {
+	const coreShareFactor = Math.max(1, input.fullConcurrency / Math.max(1, input.deadCodeConcurrency));
+	const workerTimeoutMs = Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor)));
+	return {
+		workerTimeoutMs,
+		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
+	};
+};
+const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
+	const entries = [];
+	for (const relativePath of relativePaths) {
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (isLargeMinifiedFile(absolutePath, sizeBytes)) continue;
+		entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+	}
+	return entries;
+};
 const listSourceFilesViaGit = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
@@ -40500,7 +40854,8 @@ const listSourceFilesViaFilesystem = (rootDirectory) => {
 	}
 	return filePaths;
 };
-const listSourceFiles = (rootDirectory) => excludeMinifiedFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
+const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const resolveLintIncludePaths = (rootDirectory, userConfig, project) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
@@ -40543,9 +40898,12 @@ var Config = class Config extends Service()("react-doctor/Config") {
 var DeadCode = class DeadCode extends Service()("react-doctor/DeadCode") {
 	static layerNode = succeed$3(DeadCode, DeadCode.of({ run: (input) => unwrap(fn("DeadCode.run")(function* () {
 		return yield* tryPromise({
-			try: () => checkDeadCode({
+			try: (signal) => checkDeadCode({
 				rootDirectory: input.rootDirectory,
-				userConfig: input.userConfig
+				userConfig: input.userConfig,
+				parseConcurrency: input.parseConcurrency,
+				workerTimeoutMs: input.workerTimeoutMs,
+				abortSignal: signal
 			}),
 			catch: (cause) => new ReactDoctorError({ reason: new DeadCodeAnalysisFailed({ cause }) })
 		}).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)));
@@ -41258,6 +41616,14 @@ const neutralizeDisableDirectives = async (rootDirectory, includePaths) => {
 		process.removeListener("exit", onExit);
 	};
 };
+const ROOT_DIRECTORY_PLACEHOLDER = "<root>";
+const normalizeConfigForHash = (config) => {
+	const clone = JSON.parse(JSON.stringify(config));
+	if (clone?.settings?.["react-doctor"]) clone.settings["react-doctor"].rootDirectory = ROOT_DIRECTORY_PLACEHOLDER;
+	if (Array.isArray(clone?.jsPlugins)) clone.jsPlugins = clone.jsPlugins.map((_, index) => `<plugin:${index}>`);
+	return clone;
+};
+const computeRulesetHash = (input) => crypto.createHash("sha1").update(JSON.stringify(normalizeConfigForHash(input.config))).update("\0").update([...input.toolchainVersions].join("\0")).update("\0").update([...input.ignorePatterns].join("\n")).update(" ").update(input.tsconfigContent ?? "").digest("hex");
 /**
 * Loads a plugin module via the local require resolver and extracts
 * `(name, ruleNames)` from either `module.exports.meta + rules` or
@@ -41412,8 +41778,8 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false }) => {
-	const reactHooksJsPlugin = disableReactHooksJsPlugin ? null : resolveReactHooksJsPlugin(project.hasReactCompiler, customRulesOnly);
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection }) => {
+	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" ? null : resolveReactHooksJsPlugin(project.hasReactCompiler, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
 	const jsPlugins = [];
 	if (reactHooksJsPlugin) jsPlugins.push(reactHooksJsPlugin.entry);
@@ -41422,6 +41788,8 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 	for (const registryEntry of REACT_DOCTOR_RULES) {
 		const rule = reactDoctorPlugin.rules[registryEntry.id];
 		if (!rule) continue;
+		if (ruleSelection === "cacheable" && CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
+		if (ruleSelection === "sidecar" && !CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
 		if (rule.scan !== void 0) continue;
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
@@ -41436,7 +41804,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		enabledReactDoctorRules[registryEntry.key] = severity;
 	}
 	const userPluginRules = {};
-	for (const userPlugin of userPlugins) {
+	if (ruleSelection !== "sidecar") for (const userPlugin of userPlugins) {
 		Object.assign(userPluginRules, buildUserPluginRules(userPlugin, severityControls));
 		jsPlugins.push(userPlugin.entry);
 	}
@@ -41466,6 +41834,100 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		}
 	};
 };
+const atomicWriteJson = (filePath, value) => {
+	try {
+		NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
+		const temporaryPath = `${filePath}.${process.pid}.tmp`;
+		NFS.writeFileSync(temporaryPath, JSON.stringify(value));
+		NFS.renameSync(temporaryPath, filePath);
+	} catch {
+		return;
+	}
+};
+const failOpenReadJson = (filePath, fallback) => {
+	try {
+		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
+	} catch {
+		return fallback;
+	}
+};
+const validateDiagnostic = decodeUnknownSync(Diagnostic);
+const decodeFileDiagnostics = (raw) => {
+	if (!Array.isArray(raw)) return null;
+	try {
+		for (const entry of raw) validateDiagnostic(entry);
+		return raw;
+	} catch {
+		return null;
+	}
+};
+const emptyCache = () => ({
+	version: 1,
+	rulesets: {}
+});
+const loadRulesetEntries = (cacheFilePath, rulesetHash) => {
+	const entries = /* @__PURE__ */ new Map();
+	const persisted = failOpenReadJson(cacheFilePath, emptyCache());
+	if (persisted.version !== 1 || !isRecord$2(persisted.rulesets)) return entries;
+	const bucket = persisted.rulesets[rulesetHash];
+	if (!isRecord$2(bucket) || !isRecord$2(bucket.files)) return entries;
+	for (const [fileKey, rawDiagnostics] of Object.entries(bucket.files)) {
+		const decoded = decodeFileDiagnostics(rawDiagnostics);
+		if (decoded !== null) entries.set(fileKey, decoded);
+	}
+	return entries;
+};
+const createFileLintCache = (cacheDirectory, rulesetHash) => {
+	const cacheFilePath = Path.join(cacheDirectory, FILE_LINT_CACHE_FILENAME);
+	const entries = loadRulesetEntries(cacheFilePath, rulesetHash);
+	return {
+		lookup: (fileKey) => entries.get(fileKey) ?? null,
+		store: (fileKey, diagnostics) => {
+			entries.delete(fileKey);
+			entries.set(fileKey, diagnostics);
+		},
+		persist: () => {
+			const onDisk = failOpenReadJson(cacheFilePath, emptyCache());
+			const rulesets = onDisk.version === 1 && isRecord$2(onDisk.rulesets) ? { ...onDisk.rulesets } : {};
+			const existingBucket = rulesets[rulesetHash];
+			const existingFiles = isRecord$2(existingBucket) && isRecord$2(existingBucket.files) ? existingBucket.files : {};
+			const ourFiles = {};
+			for (const [fileKey, diagnostics] of entries) ourFiles[fileKey] = diagnostics;
+			const cappedEntries = Object.entries({
+				...existingFiles,
+				...ourFiles
+			}).slice(-FILE_LINT_CACHE_MAX_FILE_COUNT);
+			rulesets[rulesetHash] = {
+				updatedAtMs: Date.now(),
+				files: Object.fromEntries(cappedEntries)
+			};
+			const keptHashes = Object.entries(rulesets).sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8).map(([hash]) => hash);
+			const prunedRulesets = {};
+			for (const hash of keptHashes) prunedRulesets[hash] = rulesets[hash];
+			atomicWriteJson(cacheFilePath, {
+				version: 1,
+				rulesets: prunedRulesets
+			});
+		}
+	};
+};
+const bundledRequire$2 = createRequire(import.meta.url);
+const TOOLCHAIN_PACKAGE_SPECIFIERS$1 = [
+	"oxlint/package.json",
+	"oxlint-plugin-react-doctor/package.json",
+	"eslint-plugin-react-hooks/package.json"
+];
+const resolveOxlintToolchainVersions = () => {
+	const versions = [`node=${process.version}`];
+	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS$1) try {
+		const packageJson = bundledRequire$2(specifier);
+		const version = typeof packageJson.version === "string" ? packageJson.version : "unknown";
+		versions.push(`${specifier}=${version}`);
+	} catch {
+		versions.push(`${specifier}=missing`);
+	}
+	return versions;
+};
 const esmRequire = createRequire(import.meta.url);
 const resolveOxlintBinary = () => {
 	const oxlintMainPath = esmRequire.resolve("oxlint");
@@ -42147,15 +42609,19 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		};
 	});
 };
-const SANITIZED_ENV = (() => {
-	const sanitized = {};
-	for (const [name, value] of Object.entries(process.env)) {
+const buildOxlintChildEnv = (sourceEnv) => {
+	const childEnv = {};
+	for (const [name, value] of Object.entries(sourceEnv)) {
 		if (name === "NODE_OPTIONS" || name === "NODE_DEBUG") continue;
 		if (name.startsWith("npm_config_")) continue;
-		sanitized[name] = value;
+		childEnv[name] = value;
 	}
-	return sanitized;
-})();
+	const isCompileCacheDisabled = Boolean(sourceEnv.NODE_DISABLE_COMPILE_CACHE);
+	const isCompileCacheAlreadySet = childEnv.NODE_COMPILE_CACHE !== void 0;
+	if (!isCompileCacheDisabled && !isCompileCacheAlreadySet) childEnv.NODE_COMPILE_CACHE = Path.join(os.tmpdir(), NODE_COMPILE_CACHE_DIR_NAME);
+	return childEnv;
+};
+const SANITIZED_ENV = buildOxlintChildEnv(process.env);
 /**
 * Spawn one oxlint subprocess with hard ceilings on wall time and
 * output size. Returns stdout on success; raises a tagged
@@ -42172,7 +42638,11 @@ const SANITIZED_ENV = (() => {
 * The first three are splittable (the caller's binary-split retry
 * shrinks the batch and re-spawns); the fourth isn't.
 */
-const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLINT_SPAWN_TIMEOUT_MS, outputMaxBytes = OXLINT_OUTPUT_MAX_BYTES) => new Promise((resolve, reject) => {
+const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLINT_SPAWN_TIMEOUT_MS, outputMaxBytes = OXLINT_OUTPUT_MAX_BYTES, abortSignal) => new Promise((resolve, reject) => {
+	if (abortSignal?.aborted) {
+		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
+		return;
+	}
 	const child = spawn(nodeBinaryPath, args, {
 		cwd: rootDirectory,
 		env: SANITIZED_ENV,
@@ -42182,7 +42652,14 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 			"pipe"
 		]
 	});
+	const onAbort = () => {
+		child.kill("SIGKILL");
+		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
+	};
+	abortSignal?.addEventListener("abort", onAbort, { once: true });
+	const clearAbortListener = () => abortSignal?.removeEventListener("abort", onAbort);
 	const timeoutHandle = setTimeout(() => {
+		clearAbortListener();
 		child.kill("SIGKILL");
 		reject(new ReactDoctorError({ reason: new OxlintBatchExceeded({
 			kind: "timeout",
@@ -42217,10 +42694,12 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 	});
 	child.on("error", (error) => {
 		clearTimeout(timeoutHandle);
+		clearAbortListener();
 		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: error }) }));
 	});
 	child.on("close", (_code, signal) => {
 		clearTimeout(timeoutHandle);
+		clearAbortListener();
 		if (didKillForSize) {
 			reject(new ReactDoctorError({ reason: new OxlintBatchExceeded({
 				kind: "output-too-large",
@@ -42287,26 +42766,28 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal } = input;
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	const totalFileCount = fileBatches.reduce((sum, batch) => sum + batch.length, 0);
 	const runBatchPass = async (concurrency) => {
 		const allDiagnostics = [];
 		const droppedFiles = [];
 		let firstDropReason = null;
-		const spawnLintBatch = async (batch) => {
+		const splitDeadlineMs = Date.now() + splitTotalBudgetMs;
+		const spawnLintBatch = async (batch, depth) => {
 			const batchArgs = [...baseArgs, ...batch];
 			try {
-				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes), project, rootDirectory);
+				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory);
 			} catch (error) {
 				if (!isSplittableReactDoctorError(error)) throw error;
-				if (batch.length <= 1) {
+				const splitBudgetExhausted = Date.now() >= splitDeadlineMs || depth >= splitMaxDepth;
+				if (batch.length <= 1 || splitBudgetExhausted) {
 					droppedFiles.push(...batch);
-					if (firstDropReason === null) firstDropReason = error.message;
+					if (firstDropReason === null) firstDropReason = splitBudgetExhausted && batch.length > 1 ? `${error.message} (split budget exhausted after ${splitMaxDepth} levels / ${splitTotalBudgetMs / MILLISECONDS_PER_SECOND}s)` : error.message;
 					return [];
 				}
 				const splitIndex = Math.ceil(batch.length / 2);
-				return [...await spawnLintBatch(batch.slice(0, splitIndex)), ...await spawnLintBatch(batch.slice(splitIndex))];
+				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1)];
 			}
 		};
 		let startedFileCount = 0;
@@ -42323,7 +42804,7 @@ const spawnLintBatches = async (input) => {
 		try {
 			const batchResults = await mapWithConcurrency(fileBatches, concurrency, async (batch) => {
 				startedFileCount += batch.length;
-				const batchDiagnostics = await spawnLintBatch(batch);
+				const batchDiagnostics = await spawnLintBatch(batch, 0);
 				scannedFileCount += batch.length;
 				if (onFileProgress) {
 					displayedFileCount = Math.min(Math.max(displayedFileCount, scannedFileCount), totalFileCount);
@@ -42384,6 +42865,22 @@ const validateRuleRegistration = () => {
 	].filter((entry) => entry !== null).join("; ");
 	console.warn(`[react-doctor] rule-registration drift: ${detail}`);
 };
+const hashFileContents = (filePath) => {
+	try {
+		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
+	} catch {
+		return null;
+	}
+};
+const projectCacheSubdir = (projectDirectory) => crypto.createHash("sha256").update(projectDirectory).digest("hex").slice(0, 16);
+const resolveReactDoctorCacheDir = (projectDirectory) => {
+	const cacheDirOverride = process.env["REACT_DOCTOR_CACHE_DIR"]?.trim();
+	if (cacheDirOverride) return Path.join(cacheDirOverride, projectCacheSubdir(projectDirectory));
+	const nodeModulesDirectory = Path.join(projectDirectory, "node_modules");
+	if (NFS.existsSync(nodeModulesDirectory)) return Path.join(nodeModulesDirectory, ".cache", "react-doctor");
+	return Path.join(os.tmpdir(), "react-doctor-cache", projectCacheSubdir(projectDirectory));
+};
+const sortSourceFilesByCost = (entries) => [...entries].sort((left, right) => right.sizeBytes - left.sizeBytes).map((entry) => entry.path);
 /**
 * Atomically (re)writes the generated oxlintrc.json. Used twice in
 * the runner: once for the primary scan, once for the
@@ -42442,7 +42939,7 @@ const reactHooksJsPluginDropNote = (error) => {
 *   6. always restore disable directives + clean up the temp dir
 */
 const runOxlint = async (options) => {
-	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, spawnTimeoutMs, outputMaxBytes } = options;
+	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, perFileLintCacheEnabled = false, onCacheStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "arrival" } = options;
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
@@ -42459,30 +42956,156 @@ const runOxlint = async (options) => {
 		serverAuthFunctionNames,
 		severityControls,
 		userPlugins,
-		disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin
+		disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
+		ruleSelection: overrides.ruleSelection
 	});
 	const restoreDisableDirectives = respectInlineDisables ? () => {} : await neutralizeDisableDirectives(rootDirectory, includePaths);
 	const configDirectory = NFS.mkdtempSync(Path.join(os.tmpdir(), "react-doctor-oxlintrc-"));
 	const configPath = Path.join(configDirectory, "oxlintrc.json");
 	try {
-		const baseArgs = [
-			resolveOxlintBinary(),
-			"-c",
-			configPath,
-			"--format",
-			"json"
-		];
+		const oxlintBinary = resolveOxlintBinary();
+		const sharedArgs = [];
+		let tsconfigContent = null;
 		if (project.hasTypeScript) {
 			const tsconfigRelativePath = resolveTsConfigRelativePath(rootDirectory);
-			if (tsconfigRelativePath) baseArgs.push("--tsconfig", tsconfigRelativePath);
+			if (tsconfigRelativePath) {
+				sharedArgs.push("--tsconfig", tsconfigRelativePath);
+				try {
+					tsconfigContent = NFS.readFileSync(Path.resolve(rootDirectory, tsconfigRelativePath), "utf8");
+				} catch {
+					tsconfigContent = null;
+				}
+			}
 		}
 		const combinedPatterns = collectIgnorePatterns(rootDirectory);
 		if (combinedPatterns.length > 0) {
 			const combinedIgnorePath = Path.join(configDirectory, "combined.ignore");
 			NFS.writeFileSync(combinedIgnorePath, `${combinedPatterns.join("\n")}\n`);
-			baseArgs.push("--ignore-path", combinedIgnorePath);
+			sharedArgs.push("--ignore-path", combinedIgnorePath);
+		}
+		const makeBaseArgs = (oxlintConfigPath) => [
+			oxlintBinary,
+			"-c",
+			oxlintConfigPath,
+			"--format",
+			"json",
+			...sharedArgs
+		];
+		const discoverScanFiles = () => lintBatchOrdering === "cost" ? sortSourceFilesByCost(listSourceFilesWithSize(rootDirectory)) : listSourceFiles(rootDirectory);
+		const candidateFiles = includePaths !== void 0 ? includePaths : discoverScanFiles();
+		const runConfigOverFiles = async (buildConfigForPass, configFileName, files, fileProgress) => {
+			if (files.length === 0) return {
+				diagnostics: [],
+				didDropReactHooksJsPlugin: false,
+				hadPartialFailure: false
+			};
+			let hadPartialFailure = false;
+			const reportPartialFailure = (reason) => {
+				hadPartialFailure = true;
+				onPartialFailure?.(reason);
+			};
+			const passConfigPath = Path.join(configDirectory, configFileName);
+			const passBaseArgs = makeBaseArgs(passConfigPath);
+			const passFileBatches = batchIncludePaths(passBaseArgs, files);
+			const spawnPass = () => spawnLintBatches({
+				baseArgs: passBaseArgs,
+				fileBatches: passFileBatches,
+				rootDirectory,
+				nodeBinaryPath,
+				project,
+				onPartialFailure: reportPartialFailure,
+				onFileProgress: fileProgress,
+				spawnTimeoutMs,
+				outputMaxBytes,
+				concurrency: options.concurrency,
+				signal: options.signal
+			});
+			writeOxlintConfig(passConfigPath, buildConfigForPass({}));
+			try {
+				return {
+					diagnostics: await spawnPass(),
+					didDropReactHooksJsPlugin: false,
+					hadPartialFailure
+				};
+			} catch (error) {
+				const reactHooksJsDropNote = reactHooksJsPluginDropNote(error);
+				if (reactHooksJsDropNote === null) throw error;
+				writeOxlintConfig(passConfigPath, buildConfigForPass({ disableReactHooksJsPlugin: true }));
+				const diagnostics = await spawnPass();
+				reportPartialFailure(reactHooksJsDropNote);
+				return {
+					diagnostics,
+					didDropReactHooksJsPlugin: true,
+					hadPartialFailure
+				};
+			}
+		};
+		if (perFileLintCacheEnabled && respectInlineDisables && !project.hasReactCompiler && extendsPaths.length === 0 && userPlugins.length === 0) {
+			const rulesetHash = computeRulesetHash({
+				config: buildConfig({
+					extendsPaths: [],
+					ruleSelection: "cacheable"
+				}),
+				toolchainVersions: resolveOxlintToolchainVersions(),
+				ignorePatterns: combinedPatterns,
+				tsconfigContent
+			});
+			const cache = createFileLintCache(resolveReactDoctorCacheDir(rootDirectory), rulesetHash);
+			const cacheKeyByFile = /* @__PURE__ */ new Map();
+			const missFiles = [];
+			const replayedDiagnostics = [];
+			for (const candidateFile of candidateFiles) {
+				const contentHash = hashFileContents(Path.resolve(rootDirectory, candidateFile));
+				if (contentHash === null) {
+					missFiles.push(candidateFile);
+					continue;
+				}
+				const cacheKey = `${candidateFile.replaceAll("\\", "/")}${contentHash}`;
+				cacheKeyByFile.set(candidateFile, cacheKey);
+				const cachedDiagnostics = cache.lookup(cacheKey);
+				if (cachedDiagnostics === null) missFiles.push(candidateFile);
+				else replayedDiagnostics.push(...cachedDiagnostics);
+			}
+			const cacheHitFileCount = candidateFiles.length - missFiles.length;
+			const cacheableResult = await runConfigOverFiles((overrides) => buildConfig({
+				extendsPaths: [],
+				ruleSelection: "cacheable",
+				disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin
+			}), "oxlintrc.cacheable.json", missFiles, void 0);
+			const sidecarResult = await runConfigOverFiles(() => buildConfig({
+				extendsPaths: [],
+				ruleSelection: "sidecar"
+			}), "oxlintrc.sidecar.json", candidateFiles, options.onFileProgress);
+			onCacheStats?.(cacheHitFileCount, candidateFiles.length);
+			const missFileByNormalizedPath = /* @__PURE__ */ new Map();
+			for (const missFile of missFiles) missFileByNormalizedPath.set(missFile.replaceAll("\\", "/"), missFile);
+			const freshDiagnosticsByFile = /* @__PURE__ */ new Map();
+			let isAttributionSound = true;
+			for (const diagnostic of cacheableResult.diagnostics) {
+				const missFile = missFileByNormalizedPath.get(diagnostic.filePath);
+				if (missFile === void 0) {
+					isAttributionSound = false;
+					break;
+				}
+				const fileDiagnostics = freshDiagnosticsByFile.get(missFile) ?? [];
+				fileDiagnostics.push(diagnostic);
+				freshDiagnosticsByFile.set(missFile, fileDiagnostics);
+			}
+			if (!cacheableResult.didDropReactHooksJsPlugin && !cacheableResult.hadPartialFailure && isAttributionSound) {
+				for (const missFile of missFiles) {
+					const cacheKey = cacheKeyByFile.get(missFile);
+					if (cacheKey !== void 0) cache.store(cacheKey, freshDiagnosticsByFile.get(missFile) ?? []);
+				}
+				cache.persist();
+			}
+			return dedupeDiagnostics([
+				...replayedDiagnostics,
+				...cacheableResult.diagnostics,
+				...sidecarResult.diagnostics
+			]);
 		}
-		const fileBatches = batchIncludePaths(baseArgs, includePaths !== void 0 ? includePaths : listSourceFiles(rootDirectory));
+		const baseArgs = makeBaseArgs(configPath);
+		const fileBatches = batchIncludePaths(baseArgs, candidateFiles);
 		const runBatches = () => spawnLintBatches({
 			baseArgs,
 			fileBatches,
@@ -42493,7 +43116,8 @@ const runOxlint = async (options) => {
 			onFileProgress: options.onFileProgress,
 			spawnTimeoutMs,
 			outputMaxBytes,
-			concurrency: options.concurrency
+			concurrency: options.concurrency,
+			signal: options.signal
 		});
 		writeOxlintConfig(configPath, buildConfig({ extendsPaths }));
 		try {
@@ -42572,9 +43196,11 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 		const spawnTimeoutMs = yield* OxlintSpawnTimeoutMs;
 		const outputMaxBytes = yield* OxlintOutputMaxBytes;
 		const concurrency = yield* OxlintConcurrency;
+		const lintBatchOrdering = yield* LintBatchOrdering;
+		const perFileLintCacheEnabled = yield* PerFileLintCacheEnabled;
 		const collectedFailures = [];
 		const diagnostics = yield* tryPromise({
-			try: () => runOxlint({
+			try: (signal) => runOxlint({
 				rootDirectory: input.rootDirectory,
 				project: input.project,
 				includePaths: input.includePaths ? [...input.includePaths] : void 0,
@@ -42589,9 +43215,13 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 					collectedFailures.push(reason);
 				},
 				onFileProgress: input.onFileProgress,
+				perFileLintCacheEnabled,
+				onCacheStats: input.onCacheStats,
 				spawnTimeoutMs,
 				outputMaxBytes,
-				concurrency
+				concurrency,
+				signal,
+				lintBatchOrdering
 			}),
 			catch: ensureReactDoctorError
 		});
@@ -42983,14 +43613,49 @@ const parseArtifactFromBody = (body) => {
 	}
 	return null;
 };
-const fetchSocketArtifact = (dependency) => tryPromise(async (signal) => {
+const isSupplyChainCacheDisabled = () => {
+	const noCache = process.env["REACT_DOCTOR_NO_CACHE"]?.toLowerCase() ?? "";
+	return noCache === "1" || noCache === "true";
+};
+const supplyChainCacheFile = (cacheDirectory, dependency) => {
+	const purlHash = crypto.createHash("sha256").update(toPurl(dependency)).digest("hex").slice(0, 16);
+	return Path.join(cacheDirectory, SUPPLY_CHAIN_CACHE_SUBDIR, `${purlHash}.json`);
+};
+const readCachedSocketBody = (cacheFile) => {
+	try {
+		const entry = JSON.parse(NFS.readFileSync(cacheFile, "utf-8"));
+		if (typeof entry === "object" && entry !== null && "fetchedAtMs" in entry && "body" in entry && typeof entry.fetchedAtMs === "number" && typeof entry.body === "string" && Date.now() - entry.fetchedAtMs <= 864e5) return entry.body;
+	} catch {}
+	return null;
+};
+const writeCachedSocketBody = (cacheFile, body) => {
+	try {
+		NFS.mkdirSync(Path.dirname(cacheFile), { recursive: true });
+		NFS.writeFileSync(cacheFile, JSON.stringify({
+			fetchedAtMs: Date.now(),
+			body
+		}));
+	} catch {}
+};
+const fetchSocketArtifact = (dependency, cacheDirectory) => tryPromise(async (signal) => {
+	const cacheFile = cacheDirectory === null ? null : supplyChainCacheFile(cacheDirectory, dependency);
+	if (cacheFile !== null) {
+		const cachedBody = readCachedSocketBody(cacheFile);
+		if (cachedBody !== null) {
+			const cachedArtifact = parseArtifactFromBody(cachedBody);
+			if (cachedArtifact !== null) return cachedArtifact;
+		}
+	}
 	const requestUrl = `${SOCKET_FREE_PURL_API_BASE}/${encodeURIComponent(toPurl(dependency))}`;
 	const response = await fetch(requestUrl, {
 		headers: { "User-Agent": SOCKET_FREE_USER_AGENT },
 		signal
 	});
 	if (!response.ok) return null;
-	return parseArtifactFromBody(await response.text());
+	const body = await response.text();
+	const artifact = parseArtifactFromBody(body);
+	if (artifact !== null && cacheFile !== null) writeCachedSocketBody(cacheFile, body);
+	return artifact;
 }).pipe(timeout(FETCH_TIMEOUT_MS), orElseSucceed(() => null), tap$1((artifact) => {
 	const scoreAttributes = {};
 	if (artifact !== null) {
@@ -43095,7 +43760,8 @@ const checkSupplyChain = (input) => gen(function* () {
 	const packageJsonPath = Path.join(input.rootDirectory, "package.json");
 	const dependencies = collectDependenciesToScore(readPackageJson$1(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies);
 	if (dependencies.length === 0) return [];
-	const artifacts = yield* forEach$1(dependencies, fetchSocketArtifact, { concurrency: 8 });
+	const cacheDirectory = isSupplyChainCacheDisabled() ? null : resolveReactDoctorCacheDir(input.rootDirectory);
+	const artifacts = yield* forEach$1(dependencies, (dependency) => fetchSocketArtifact(dependency, cacheDirectory), { concurrency: 8 }).pipe(timeoutOption(input.totalTimeoutMs ?? 9e4), map$3((maybeArtifacts) => getOrElse$1(maybeArtifacts, () => [])));
 	const diagnostics = [];
 	for (let index = 0; index < dependencies.length; index += 1) {
 		const artifact = artifacts[index];
@@ -43120,6 +43786,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * The underlying `checkSupplyChain` Effect is total/fail-open — per-package
 * timeouts and network failures recover to "skip" — so the stream never
 * fails, mirroring `DeadCode`'s stream shape so the two compose the same way.
+* The orchestrator (`run-inspect.ts`) consumes this stream on a background
+* fiber whose network time overlaps the lint pass, joined under a generous
+* wall-clock budget; a budget expiry is the same fail-open outcome as a Socket
+* outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
 	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(checkSupplyChain(input).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
@@ -43178,18 +43848,42 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *
 * Phases:
 *
-*   1. Config.resolve(directory) → Project.discover → Git metadata
+*   1. Config.resolve(directory) → Project.discover → Git metadata.
+*      The GitHub viewer-permission lookup is forked onto a background
+*      fiber here and joined late (it feeds score metadata, not
+*      diagnostics).
 *   2. beforeLint hook (e.g. CLI renders the project-detection block)
 *   3. environment checks (reduced-motion + pnpm hardening +
-*      expo/react-native + security scan)
-*   4. Linter.run + DeadCode.run — forked as concurrent fibers so
-*      their wall-clock times overlap. Progress spinners stay
-*      sequential (lint first, then dead-code) for clean terminal
-*      output. GitHub viewer permission also runs as a background
-*      fiber during this phase.
-*   5. afterLint hook
-*   6. Reporter.finalize
-*   7. Score.compute against the surface-filtered diagnostic set
+*      expo/react-native + security scan), collected synchronously
+*   4. The supply-chain check (Socket.dev) is forked onto a background
+*      fiber so its ~100% network-bound time overlaps the ~100%
+*      CPU/subprocess-bound lint pass below, collapsing two serial
+*      phases into roughly `max(supplyChain, lint)`. It is capped by
+*      `SupplyChainOverlapTimeoutMs` (measured from fork) so a hung
+*      socket can't drag out its join; on timeout it fails open to no
+*      diagnostics — the same outcome class as a Socket outage.
+*   5. Linter.run runs; DeadCode.run runs concurrently (forked child
+*      fiber) ONLY when the memory gate has headroom to run the 8 GB
+*      dead-code child alongside the oxlint workers — or when overlap is
+*      forced via REACT_DOCTOR_DEAD_CODE_OVERLAP. Otherwise dead-code
+*      runs sequentially after lint, exactly as it did pre-overlap. The
+*      fiber is joined (or interrupted, SIGKILLing its worker, on lint
+*      failure) before diagnostics are concatenated. The afterLint hook
+*      fires between lint and dead-code. Progress spinner labels AND the
+*      final diagnostic / score order stay independent of execution
+*      order, so terminal output is identical either way; supply-chain
+*      rides alongside without a spinner.
+*   6. Join the supply-chain fiber, then assemble the diagnostics in a
+*      FIXED order (env, supply-chain, lint, dead-code) so the output is
+*      byte-identical regardless of which fiber settled first. The
+*      viewer-permission fiber is joined later, during score-metadata
+*      assembly (it feeds score metadata, not diagnostics). The per-element
+*      `Reporter.emit` side-channel now interleaves supply-chain with lint
+*      emits, so capture-order assertions must target the deterministic
+*      concat below, not emit order (production `Reporter.layerNoop` makes
+*      emit a no-op).
+*   7. Reporter.finalize
+*   8. Score.compute against the surface-filtered diagnostic set
 *
 * The orchestrator owns spinner lifecycle via `Progress`; callers
 * choose `Progress.layerOra(...)` for CLI feedback or
@@ -43247,10 +43941,21 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 			ignoredTags: input.ignoredTags
 		})
 	])));
-	const supplyChainCollected = !isDiffMode || (input.supplyChainManifestChanged ?? false) ? yield* runCollect(applyPerElementPipeline(supplyChainService.run({
+	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
+	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
+	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
 		rootDirectory: scanDirectory,
 		userConfig: resolvedConfig.config
-	}))) : [];
+	}))).pipe(map$3((diagnostics) => ({
+		diagnostics,
+		timedOut: false
+	})), timeout(supplyChainOverlapTimeout), orElseSucceed(() => ({
+		diagnostics: [],
+		timedOut: true
+	}))) : succeed$2({
+		diagnostics: [],
+		timedOut: false
+	}));
 	const lintFailure = yield* make$13({
 		didFail: false,
 		reason: null,
@@ -43261,12 +43966,49 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		didFail: false,
 		reason: null
 	});
-	const scanConcurrency = yield* OxlintConcurrency;
+	const scanConcurrency = resolveScanConcurrency(yield* OxlintConcurrency);
+	const lintPhaseTimeoutMs = yield* LintPhaseTimeoutMs;
+	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
+	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
+	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
+	const deadCodeOverlapMode = yield* DeadCodeOverlap;
+	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
+	const deadCodeParseConcurrency = shouldOverlapDeadCode ? Math.max(1, Math.floor(scanConcurrency * DEAD_CODE_OVERLAP_PARSE_SHARE)) : void 0;
+	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
+	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
+		rootDirectory: scanDirectory,
+		userConfig: resolvedConfig.config,
+		parseConcurrency: deadCodeParseConcurrency,
+		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs
+	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
+		yield* set(deadCodeFailure, {
+			didFail: true,
+			reason: error.message
+		});
+		return empty$4;
+	})))))).pipe(timeoutOption(deadCodeTimeout.phaseTimeoutMs), flatMap$2(match$3({
+		onNone: () => set(deadCodeFailure, {
+			didFail: true,
+			reason: `Dead-code analysis exceeded ${Math.round(deadCodeTimeout.phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
+		}).pipe(as([])),
+		onSome: succeed$2
+	})));
+	const overlapDeadCodeTimeout = resolveDeadCodeTimeout({
+		sourceFileCount: project.sourceFileCount,
+		deadCodeConcurrency: deadCodeParseConcurrency ?? scanConcurrency,
+		fullConcurrency: scanConcurrency
+	});
+	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
+		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
+		phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs)
+	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
 	let lastReportedTotalFileCount = 0;
-	const lintCollected = yield* runCollect(applyPerElementPipeline(linterService.run({
+	let lintCacheHitFileCount = null;
+	let lintCacheTotalFileCount = null;
+	const baseLintStream = linterService.run({
 		rootDirectory: scanDirectory,
 		project,
 		includePaths: lintIncludePaths ?? void 0,
@@ -43280,6 +44022,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		onFileProgress: (scannedFileCount, totalFileCount) => {
 			lastReportedTotalFileCount = totalFileCount;
 			runSync(scanProgress.update(`Scanning files (${scannedFileCount}/${totalFileCount})${workerCountSuffix}...`));
+		},
+		onCacheStats: (cacheHitFileCount, totalConsideredFileCount) => {
+			lintCacheHitFileCount = cacheHitFileCount;
+			lintCacheTotalFileCount = totalConsideredFileCount;
 		}
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
 		yield* set(lintFailure, {
@@ -43289,36 +44035,54 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 			reasonKind: error.reason._tag === "OxlintUnavailable" ? error.reason.kind : null
 		});
 		return empty$4;
-	}))))));
+	}))));
+	const lintCollected = yield* runCollect(applyPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream)).pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
+		onNone: () => set(lintFailure, {
+			didFail: true,
+			reason: `Lint analysis exceeded ${lintPhaseTimeoutMs / MILLISECONDS_PER_SECOND}s and was skipped.`,
+			reasonTag: "OxlintBatchExceeded",
+			reasonKind: null
+		}).pipe(as([])),
+		onSome: succeed$2
+	})));
 	const lintFailureState = yield* get$2(lintFailure);
 	yield* afterLint(lintFailureState.didFail);
 	if (lintFailureState.didFail) yield* scanProgress.fail(formatLintFailText(lintFailureState.reasonTag, process.version));
 	const totalFileCount = lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
 	const scannedFilesLabel = `${totalFileCount} ${totalFileCount === 1 ? "file" : "files"}`;
-	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
-	const deadCodeCollected = lintFailureState.didFail || !shouldRunDeadCode ? [] : yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`).pipe(andThen(runCollect(applyPerElementPipeline(deadCodeService.run({
-		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
-	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
-		yield* set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
+	let deadCodeCollected = [];
+	if (lintFailureState.didFail) {
+		if (deadCodeFiber !== null) yield* interrupt(deadCodeFiber);
+	} else if (shouldRunDeadCode) {
+		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
+		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
+			sourceFileCount: totalFileCount,
+			deadCodeConcurrency: scanConcurrency,
+			fullConcurrency: scanConcurrency
 		});
-		return empty$4;
-	}))))))));
-	const deadCodeFailureState = yield* get$2(deadCodeFailure);
+		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
+			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
+			phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs)
+		});
+	}
+	const deadCodeFailureState = lintFailureState.didFail ? {
+		didFail: false,
+		reason: null
+	} : yield* get$2(deadCodeFailure);
 	const scanElapsedMilliseconds = Date.now() - scanStartTime;
 	const scanElapsedSeconds = (scanElapsedMilliseconds / MILLISECONDS_PER_SECOND).toFixed(1);
 	if (!lintFailureState.didFail) if (deadCodeFailureState.didFail) yield* scanProgress.fail(DEAD_CODE_FAIL_TEXT);
 	else if (input.suppressScanSummary) yield* scanProgress.stop();
 	else yield* scanProgress.succeed(`Scanned ${scannedFilesLabel} in ${scanElapsedSeconds}s${workerCountSuffix}`);
+	const supplyChainResult = yield* join(supplyChainFiber);
+	const supplyChainCollected = supplyChainResult.diagnostics;
 	yield* reporterService.finalize;
-	const finalDiagnostics = assignFixGroups([
+	const finalDiagnostics = sortDiagnosticsStable(assignFixGroups([
 		...envCollected,
 		...supplyChainCollected,
 		...lintCollected,
 		...deadCodeCollected
-	]);
+	]));
 	const githubViewerPermission = yield* join(githubViewerPermissionFiber);
 	const scoreMetadata = {
 		...repo !== null ? { repo } : {},
@@ -43354,9 +44118,14 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		lintPartialFailures,
 		didDeadCodeFail: deadCodeFailureState.didFail,
 		deadCodeFailureReason: deadCodeFailureState.reason,
+		deadCodeOverlapped: shouldOverlapDeadCode,
 		scannedFileCount: totalFileCount,
 		scannedFilePaths,
-		scanElapsedMilliseconds
+		scanElapsedMilliseconds,
+		scanConcurrency,
+		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
+		lintCacheHitFileCount,
+		lintCacheTotalFileCount
 	};
 }).pipe(withSpan("runInspect", { attributes: {
 	"inspect.directory": input.directory,
@@ -43364,7 +44133,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	"inspect.runDeadCode": input.runDeadCode,
 	"inspect.isCi": input.isCi,
 	"inspect.scoreSurface": input.scoreSurface ?? "score"
-} }));
+} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })))));
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -44142,7 +44911,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.5.7";
+const VERSION = "0.5.8-dev.f4e8e4b";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -44295,7 +45064,8 @@ const buildRunContext = () => {
 		terminalKind: detectTerminalKind(),
 		jsonMode: isJsonModeActive(),
 		debug: isDebugFlagEnabled(),
-		invokedVia: detectInvokedVia()
+		invokedVia: detectInvokedVia(),
+		lintBatchOrdering: resolveLintBatchOrdering()
 	};
 };
 //#endregion
@@ -44368,7 +45138,8 @@ const buildSentryScope = (runContext = buildRunContext()) => {
 		jsonMode: runContext.jsonMode,
 		debug: runContext.debug,
 		invokedVia: runContext.invokedVia,
-		nodeMajor: runContext.nodeMajor
+		nodeMajor: runContext.nodeMajor,
+		lintBatchOrdering: runContext.lintBatchOrdering
 	};
 	const contexts = { run: { ...runContext } };
 	const projectInfo = getSentryProjectInfo();
@@ -44504,13 +45275,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.7`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.8-dev.f4e8e4b`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.7") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.8-dev.f4e8e4b") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -44713,7 +45484,7 @@ const externalSpanFrom = (sentrySpan) => {
 *    in-memory tracer — identical to the prior default behavior.
 */
 const applyObservability = (program, rootSentrySpan) => {
-	if (isOtlpExportConfigured()) return (rootSentrySpan ? program.pipe(provideService(ParentSpan, externalSpanFrom(rootSentrySpan))) : program).pipe(provide(layerOtlp));
+	if (isOtlpExportConfigured()) return (rootSentrySpan ? program.pipe(provideService$2(ParentSpan, externalSpanFrom(rootSentrySpan))) : program).pipe(provide(layerOtlp));
 	if (rootSentrySpan) return program.pipe(withTracer(makeSentryTracer(rootSentrySpan)));
 	return program.pipe(provide(layerOtlp));
 };
@@ -48186,6 +48957,9 @@ const buildOutcomeAttributes = (input) => {
 		"migration.largestRuleBucketSites": largestRuleBucket ? largestRuleBucket.siteCount : null,
 		"migration.largestRuleBucketRule": largestRuleBucket ? largestRuleBucket.ruleKey : null,
 		scannedFileCount: result.scannedFileCount ?? null,
+		lintCacheHitFiles: result.lintCacheHitFileCount ?? null,
+		lintCacheTotalFiles: result.lintCacheTotalFileCount ?? null,
+		lintCacheHitRatio: result.lintCacheTotalFileCount != null && result.lintCacheTotalFileCount > 0 ? (result.lintCacheHitFileCount ?? 0) / result.lintCacheTotalFileCount : null,
 		elapsedMs: result.elapsedMilliseconds,
 		scanPhaseMs: result.scanElapsedMilliseconds ?? null,
 		score: result.score ? result.score.score : null,
@@ -48195,7 +48969,10 @@ const buildOutcomeAttributes = (input) => {
 		didLintFail: input.didLintFail ?? null,
 		lintFailureReasonKind: input.lintFailureReasonKind ?? null,
 		lintPartialFailureCount: input.lintPartialFailureCount ?? null,
-		didDeadCodeFail: input.didDeadCodeFail ?? null
+		lintDroppedFileCount: input.lintDroppedFileCount ?? null,
+		didDeadCodeFail: input.didDeadCodeFail ?? null,
+		supplyChainOverlapTimedOut: input.supplyChainOverlapTimedOut ?? null,
+		deadCodeOverlapped: input.deadCodeOverlapped ?? null
 	};
 	for (const [category, count] of countByCategory) attributes[`diag.category.${toCategoryKey(category)}`] = count;
 	if (result.baselineDelta) {
@@ -48264,6 +49041,32 @@ const recordRunEvent = (rootSpan, input) => {
 	} catch {}
 };
 //#endregion
+//#region src/cli/utils/resolve-worker-telemetry.ts
+/**
+* Projects the resolved lint worker count into the `(workerCount, parallel)`
+* telemetry pair. `resolvedWorkerCount` is the count the scan actually fanned
+* out to (`InspectOutput.scanConcurrency`); `pinnedConcurrency` is the caller's
+* `inspect({ concurrency })` pin, used as the fallback when no scan resolved a
+* count (the pre-scan failure path, or a cache entry persisted before the
+* resolved count was tracked). `parallel` is derived from the count — NOT from
+* whether a count was pinned — so the common auto path (no pin) still reports
+* parallelism correctly instead of always reading `false`.
+*/
+const resolveWorkerTelemetry = (resolvedWorkerCount, pinnedConcurrency) => {
+	const workerCount = resolvedWorkerCount ?? pinnedConcurrency;
+	return {
+		workerCount,
+		parallel: workerCount !== void 0 && workerCount > 1
+	};
+};
+//#endregion
+//#region src/cli/utils/count-dropped-lint-files.ts
+const DROPPED_FILES_MESSAGE_PATTERN = /^(\d+) file\(s\) failed to lint and were skipped/;
+const countDroppedLintFiles = (lintPartialFailures) => lintPartialFailures.reduce((total, message) => {
+	const match = DROPPED_FILES_MESSAGE_PATTERN.exec(message);
+	return match ? total + Number(match[1]) : total;
+}, 0);
+//#endregion
 //#region src/cli/utils/path-format.ts
 const toForwardSlashes = (filePath) => filePath.replaceAll("\\", "/");
 //#endregion
@@ -48880,25 +49683,182 @@ const canAnimateOnboarding = (stream = process.stdout) => {
 	return !isGitHookEnvironment() && !isCiEnvironment();
 };
 //#endregion
-//#region src/cli/utils/onboarding-state.ts
-const ONBOARDED_AT_KEY = "onboardedAt";
-const getOnboardingStore = (options = {}) => new Conf({
+//#region src/cli/utils/now-iso.ts
+const nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
+const ONBOARDING_EVENT = "onboarding";
+const CI_PITCH_EVENT = "ci-pitch";
+const ACTION_UPGRADE_EVENT = "action-upgrade-v2";
+const SETUP_HINT_EVENT = "setup-hint";
+const foldLegacyDecisions = (projects, legacy, eventId) => {
+	for (const [hash, record] of Object.entries(legacy ?? {})) {
+		const existing = projects[hash] ?? { rootDirectory: record.rootDirectory ?? "" };
+		projects[hash] = {
+			...existing,
+			events: {
+				...existing.events,
+				[eventId]: {
+					firedAt: record.at ?? nowIso(),
+					version: 1,
+					...record.outcome ? { outcome: record.outcome } : {}
+				}
+			}
+		};
+	}
+};
+const migrateCliState = (state) => {
+	if (state.schemaVersion === 2) return state;
+	const projects = {};
+	for (const [hash, record] of Object.entries(state.projects ?? {})) {
+		const carried = {
+			rootDirectory: record.rootDirectory,
+			...record.events ? { events: record.events } : {},
+			...record.migrations ? { migrations: record.migrations } : {}
+		};
+		projects[hash] = record.setupPrompt === false ? {
+			...carried,
+			events: {
+				...carried.events,
+				[SETUP_HINT_EVENT]: {
+					firedAt: nowIso(),
+					version: 1,
+					outcome: "declined"
+				}
+			}
+		} : carried;
+	}
+	foldLegacyDecisions(projects, state.ciPrompts, CI_PITCH_EVENT);
+	foldLegacyDecisions(projects, state.actionUpgrades, ACTION_UPGRADE_EVENT);
+	return {
+		schemaVersion: 2,
+		global: typeof state.onboardedAt === "string" ? { events: { [ONBOARDING_EVENT]: {
+			firedAt: state.onboardedAt,
+			version: 1
+		} } } : {},
+		projects
+	};
+};
+const resolveConfigDir = (options) => options.cwd ?? (process.env["REACT_DOCTOR_CONFIG_DIR"] || void 0);
+const openStore = (options = {}) => new Conf({
 	projectName: REACT_DOCTOR_CONFIG_PROJECT_NAME,
-	cwd: options.cwd
+	cwd: resolveConfigDir(options)
 });
-const hasCompletedOnboarding = (options = {}) => {
+const openMigratedStore = (options) => {
+	const store = openStore(options);
+	if (store.store.schemaVersion !== 2) store.store = migrateCliState(store.store);
+	return store;
+};
+const readCliState = (select, fallback, options = {}) => {
 	try {
-		return typeof getOnboardingStore(options).get(ONBOARDED_AT_KEY) === "string";
+		return select(openMigratedStore(options).store);
 	} catch {
+		return fallback;
+	}
+};
+const updateCliState = (update, options = {}) => {
+	try {
+		const store = openMigratedStore(options);
+		store.store = update(store.store);
 		return true;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+//#region src/cli/utils/hash-project-root.ts
+const hashProjectRoot = (projectRoot) => createHash("sha256").update(Path.resolve(projectRoot)).digest("hex");
+//#endregion
+//#region src/cli/utils/cli-lifecycle.ts
+const versionOf = (item) => item.version ?? 1;
+const selectScope = (state, scoped, projectRoot) => scoped.scope === "global" ? state.global : projectRoot === void 0 ? void 0 : state.projects?.[hashProjectRoot(projectRoot)];
+const updateScope = (state, scoped, projectRoot, updateScopeState) => {
+	if (scoped.scope === "global") return {
+		...state,
+		global: updateScopeState(state.global ?? {})
+	};
+	if (projectRoot === void 0) return state;
+	const projectKey = hashProjectRoot(projectRoot);
+	const base = state.projects?.[projectKey] ?? { rootDirectory: Path.resolve(projectRoot) };
+	return {
+		...state,
+		projects: {
+			...state.projects,
+			[projectKey]: {
+				...base,
+				...updateScopeState(base)
+			}
+		}
+	};
+};
+const isGatePending = (gate, target = {}, options = {}) => {
+	if (gate.scope === "project" && target.projectRoot === void 0) return false;
+	return readCliState((state) => {
+		const record = selectScope(state, gate, target.projectRoot)?.events?.[gate.id];
+		return !record || record.version < versionOf(gate);
+	}, gate.fireWhenUnknown ?? false, options);
+};
+const recordGate = (gate, target = {}, options = {}) => updateCliState((state) => updateScope(state, gate, target.projectRoot, (scope) => ({
+	...scope,
+	events: {
+		...scope.events,
+		[gate.id]: {
+			firedAt: nowIso(),
+			version: versionOf(gate),
+			...target.outcome ? { outcome: target.outcome } : {}
+		}
+	}
+})), options);
+const isMigrationPending = (migration, target = {}, options = {}) => {
+	if (migration.scope === "project" && target.projectRoot === void 0) return false;
+	return readCliState((state) => {
+		const record = selectScope(state, migration, target.projectRoot)?.migrations?.[migration.id];
+		return !record || record.version < versionOf(migration);
+	}, false, options);
+};
+const recordMigration = (migration, projectRoot, record, options) => updateCliState((state) => updateScope(state, migration, projectRoot, (scope) => ({
+	...scope,
+	migrations: {
+		...scope.migrations,
+		[migration.id]: record
+	}
+})), options);
+const runMigrations = async (migrations, target = {}, options = {}) => {
+	const results = [];
+	for (const migration of migrations) {
+		if (!isMigrationPending(migration, target, options)) {
+			results.push({
+				id: migration.id,
+				ran: false,
+				applied: true
+			});
+			continue;
+		}
+		let applied = false;
+		try {
+			applied = await migration.run({ projectRoot: target.projectRoot });
+		} catch {
+			applied = false;
+		}
+		if (applied) recordMigration(migration, target.projectRoot, {
+			ranAt: nowIso(),
+			version: versionOf(migration)
+		}, options);
+		results.push({
+			id: migration.id,
+			ran: true,
+			applied
+		});
 	}
+	return results;
+};
+//#endregion
+//#region src/cli/utils/onboarding-state.ts
+const ONBOARDING_GATE = {
+	id: ONBOARDING_EVENT,
+	scope: "global"
 };
+const hasCompletedOnboarding = (options = {}) => !isGatePending(ONBOARDING_GATE, {}, options);
 const markOnboardingComplete = (options = {}) => {
-	try {
-		const store = getOnboardingStore(options);
-		if (typeof store.get(ONBOARDED_AT_KEY) === "string") return;
-		store.set(ONBOARDED_AT_KEY, (/* @__PURE__ */ new Date()).toISOString());
-	} catch {}
+	if (isGatePending(ONBOARDING_GATE, {}, options)) recordGate(ONBOARDING_GATE, {}, options);
 };
 //#endregion
 //#region src/cli/utils/render-project-detection.ts
@@ -49473,12 +50433,12 @@ const resolveCacheFilePath = (projectDirectory) => {
 const readPersistedCache = (cacheFilePath) => {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord(parsed) || parsed.version !== 1) return {
-			version: 1,
+		if (!isRecord(parsed) || parsed.version !== 2) return {
+			version: 2,
 			entries: []
 		};
 		if (!Array.isArray(parsed.entries)) return {
-			version: 1,
+			version: 2,
 			entries: []
 		};
 		const entries = [];
@@ -49488,12 +50448,12 @@ const readPersistedCache = (cacheFilePath) => {
 			entries.push(entry);
 		}
 		return {
-			version: 1,
+			version: 2,
 			entries
 		};
 	} catch {
 		return {
-			version: 1,
+			version: 2,
 			entries: []
 		};
 	}
@@ -49546,7 +50506,7 @@ const buildScanResultCacheKey = (input) => {
 	if (headSha === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 1,
+		schemaVersion: 2,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha,
 		reactDoctorVersion: input.version,
@@ -49566,6 +50526,7 @@ const buildScanResultCacheKey = (input) => {
 			adoptExistingLintConfig: input.options.adoptExistingLintConfig,
 			ignoredTags: [...input.options.ignoredTags].sort(),
 			concurrency: input.options.concurrency,
+			lintBatchOrdering: resolveLintBatchOrdering(),
 			baselineRef: input.options.baseline?.ref,
 			changedLineRanges: input.options.changedLineRanges ?? void 0,
 			noScore: input.options.noScore,
@@ -49583,7 +50544,7 @@ const createScanResultCache = (projectDirectory) => {
 	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
 	const persist = () => {
 		writePersistedCache(cacheFilePath, {
-			version: 1,
+			version: 2,
 			entries: [...entries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
 	};
@@ -49599,7 +50560,7 @@ const createScanResultCache = (projectDirectory) => {
 		}
 	};
 };
-const shouldStoreScanPayload = (payload) => !payload.didLintFail && !payload.didDeadCodeFail && payload.lintPartialFailures.length === 0;
+const shouldStoreScanPayload = (payload) => !payload.didLintFail && !payload.didDeadCodeFail && payload.lintPartialFailures.length === 0 && !payload.supplyChainOverlapTimedOut;
 //#endregion
 //#region src/inspect.ts
 const silentConsole = makeNoopConsole();
@@ -49663,21 +50624,24 @@ const deriveScope = (options) => {
 	if (options.changedLineRanges !== null) return "lines";
 	return options.includePaths.length > 0 ? "files" : "full";
 };
-const buildRunEventConfig = (options, userConfig, hasCustomConfig) => ({
-	scope: deriveScope(options),
-	parallel: options.concurrency !== void 0,
-	workerCount: options.concurrency,
-	lint: options.lint,
-	deadCode: options.deadCode,
-	scoreOnly: options.scoreOnly,
-	noScore: options.noScore,
-	respectInlineDisables: options.respectInlineDisables,
-	showWarnings: options.warnings,
-	usedOutputDir: options.outputDirectory !== null,
-	ignoredTagCount: options.ignoredTags.size,
-	hasCustomConfig,
-	userConfig
-});
+const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorkerCount) => {
+	const { workerCount, parallel } = resolveWorkerTelemetry(resolvedWorkerCount, options.concurrency);
+	return {
+		scope: deriveScope(options),
+		parallel,
+		workerCount,
+		lint: options.lint,
+		deadCode: options.deadCode,
+		scoreOnly: options.scoreOnly,
+		noScore: options.noScore,
+		respectInlineDisables: options.respectInlineDisables,
+		showWarnings: options.warnings,
+		usedOutputDir: options.outputDirectory !== null,
+		ignoredTagCount: options.ignoredTags.size,
+		hasCustomConfig,
+		userConfig
+	};
+};
 const inspect = async (directory, inputOptions = {}) => {
 	const startTime = performance$1.now();
 	const isConcurrentScan = inputOptions.concurrentScan === true;
@@ -49769,7 +50733,7 @@ const runBaselineComparison = async (params) => {
 			resolveLocalGithubViewerPermission: false,
 			suppressScanSummary: true,
 			supplyChainManifestChanged: params.options.supplyChainManifestChanged
-		}, {}).pipe(provide(baseLayers), provideService(Console, silentConsole))));
+		}, {}).pipe(provide(baseLayers), provideService$2(Console, silentConsole))));
 		if (baseOutput.didLintFail) return null;
 		const delta = computeDiagnosticDelta({
 			headDiagnostics: params.headDiagnostics,
@@ -49854,7 +50818,8 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		runId: getRunId(),
 		resolveLocalGithubViewerPermission: !options.noScore,
 		suppressScanSummary: options.suppressRendering,
-		supplyChainManifestChanged: options.supplyChainManifestChanged
+		supplyChainManifestChanged: options.supplyChainManifestChanged,
+		concurrentScan: options.concurrentScan
 	}, { beforeLint: (projectInfo, lintIncludePaths) => gen(function* () {
 		recordSentryProjectContext(projectInfo, rootSentrySpan, { concurrentScan: options.concurrentScan });
 		recordCount(METRIC.projectDetected, 1);
@@ -49868,7 +50833,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 			lintSourceFileCount
 		});
 	}) });
-	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)));
+	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService$2(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)));
 	const didLintFail = lintBindingMissing || output.didLintFail;
 	const lintFailureReason = lintBindingMissing ? `oxlint native binding not found for Node ${process.version}; expected one matching ${OXLINT_NODE_REQUIREMENT}` : output.lintFailureReason;
 	if (!options.scoreOnly && !lintBindingMissing && output.didLintFail && lintFailureReason !== null) if (output.lintFailureReasonKind === "native-binding-missing") runConsole(log(highlighter.gray(`  Upgrade to Node ${OXLINT_NODE_REQUIREMENT} or run: npx -p oxlint@latest react-doctor@latest`)));
@@ -49905,12 +50870,15 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		lintPartialFailures: output.lintPartialFailures,
 		didDeadCodeFail: output.didDeadCodeFail,
 		deadCodeFailureReason: output.deadCodeFailureReason,
+		deadCodeOverlapped: output.deadCodeOverlapped,
 		directory: output.resolvedDirectory,
 		scannedFileCount: output.scannedFileCount,
 		scannedFilePaths: output.scannedFilePaths,
 		scanElapsedMilliseconds: output.scanElapsedMilliseconds,
+		scanConcurrency: output.scanConcurrency,
 		baselineDelta,
-		lintFailureReasonKind: lintBindingMissing ? "native-binding-missing" : output.lintFailureReasonKind
+		lintFailureReasonKind: lintBindingMissing ? "native-binding-missing" : output.lintFailureReasonKind,
+		supplyChainOverlapTimedOut: output.supplyChainOverlapTimedOut
 	};
 	if (cacheKey !== null && scanResultCache !== null && shouldStoreScanPayload(payload)) scanResultCache.store(cacheKey, payload);
 	const result = await renderAndRecordScan({
@@ -49921,12 +50889,14 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		startTime,
 		rootSentrySpan,
 		scanMode: baselineDelta ? "baseline" : isDiffMode ? "diff" : "full",
-		baselineDegraded
+		baselineDegraded,
+		lintCacheHitFileCount: output.lintCacheHitFileCount,
+		lintCacheTotalFileCount: output.lintCacheTotalFileCount
 	});
 	recordOnboardingCompletion(options);
 	return result;
 };
-const runMaybeSilent = (effect, silent) => silent ? effect.pipe(provideService(Console, silentConsole)) : effect;
+const runMaybeSilent = (effect, silent) => silent ? effect.pipe(provideService$2(Console, silentConsole)) : effect;
 const renderCachedProjectDetection = async (input) => {
 	if (input.options.scoreOnly || input.options.suppressRendering) return;
 	await runPromise(runMaybeSilent(printProjectDetection({
@@ -49954,14 +50924,17 @@ const renderAndRecordScan = async (input) => {
 		scannedFileCount: input.payload.scannedFileCount,
 		scannedFilePaths: input.payload.scannedFilePaths,
 		scanElapsedMilliseconds: input.payload.scanElapsedMilliseconds,
+		lintCacheHitFileCount: input.lintCacheHitFileCount ?? null,
+		lintCacheTotalFileCount: input.lintCacheTotalFileCount ?? null,
 		baselineDelta: input.payload.baselineDelta
 	}), input.options.silent));
+	const { workerCount: resolvedWorkerCount, parallel } = resolveWorkerTelemetry(input.payload.scanConcurrency, input.options.concurrency);
 	recordScanMetrics({
 		result,
 		mode: input.scanMode,
 		baselineDegraded: input.baselineDegraded,
-		parallel: input.options.concurrency !== void 0,
-		workerCount: input.options.concurrency,
+		parallel,
+		workerCount: resolvedWorkerCount,
 		lint: input.options.lint,
 		deadCode: input.options.deadCode,
 		scoreOnly: input.options.scoreOnly,
@@ -49971,19 +50944,22 @@ const renderAndRecordScan = async (input) => {
 		didDeadCodeFail: input.payload.didDeadCodeFail
 	});
 	recordRunEvent(input.rootSentrySpan, {
-		...buildRunEventConfig(input.options, input.userConfig, input.hasCustomConfig),
+		...buildRunEventConfig(input.options, input.userConfig, input.hasCustomConfig, resolvedWorkerCount),
 		result,
 		mode: input.scanMode,
 		gateExempt: input.baselineDegraded,
 		didLintFail: input.payload.didLintFail,
 		lintFailureReasonKind: input.payload.lintFailureReasonKind,
 		lintPartialFailureCount: input.payload.lintPartialFailures.length,
-		didDeadCodeFail: input.payload.didDeadCodeFail
+		lintDroppedFileCount: countDroppedLintFiles(input.payload.lintPartialFailures),
+		didDeadCodeFail: input.payload.didDeadCodeFail,
+		supplyChainOverlapTimedOut: input.payload.supplyChainOverlapTimedOut,
+		deadCodeOverlapped: input.payload.deadCodeOverlapped
 	});
 	return result;
 };
 const finalizeAndRender = (input) => gen(function* () {
-	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, directory, scannedFileCount, scannedFilePaths, scanElapsedMilliseconds, baselineDelta } = input;
+	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, directory, scannedFileCount, scannedFilePaths, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, baselineDelta } = input;
 	const { skippedChecks, skippedCheckReasons } = buildSkippedChecks({
 		didLintFail,
 		lintFailureReason,
@@ -50003,6 +50979,10 @@ const finalizeAndRender = (input) => gen(function* () {
 		scannedFileCount,
 		scannedFilePaths,
 		scanElapsedMilliseconds,
+		...lintCacheTotalFileCount !== null ? {
+			lintCacheHitFileCount,
+			lintCacheTotalFileCount
+		} : {},
 		...baselineDelta ? { baselineDelta } : {}
 	});
 	if (options.suppressRendering) return buildResult();
@@ -50542,54 +51522,27 @@ const upgradeReactDoctorWorkflowInPlace = (projectRoot) => {
 	}
 };
 //#endregion
-//#region src/cli/utils/hash-project-root.ts
-const hashProjectRoot = (projectRoot) => createHash("sha256").update(Path.resolve(projectRoot)).digest("hex");
-//#endregion
-//#region src/cli/utils/project-decision-store.ts
-const createProjectDecisionStore = (storeKey) => {
-	const getStore = (options = {}) => new Conf({
-		projectName: REACT_DOCTOR_CONFIG_PROJECT_NAME,
-		cwd: options.cwd
-	});
-	return {
-		getConfigPath: (options = {}) => getStore(options).path,
-		hasHandled: (projectRoot, options = {}) => {
-			try {
-				return Boolean(getStore(options).get(storeKey, {})[hashProjectRoot(projectRoot)]);
-			} catch {
-				return true;
-			}
-		},
-		record: (projectRoot, outcome, options = {}) => {
-			try {
-				const store = getStore(options);
-				store.set(storeKey, {
-					...store.get(storeKey, {}),
-					[hashProjectRoot(projectRoot)]: {
-						rootDirectory: Path.resolve(projectRoot),
-						outcome,
-						at: (/* @__PURE__ */ new Date()).toISOString()
-					}
-				});
-				return true;
-			} catch {
-				return false;
-			}
-		}
-	};
-};
-//#endregion
 //#region src/cli/utils/action-upgrade-prompt.ts
-const store$1 = createProjectDecisionStore("actionUpgrades");
-store$1.getConfigPath;
-const hasHandledActionUpgrade = store$1.hasHandled;
-const recordActionUpgradeDecision = store$1.record;
+const ACTION_UPGRADE_GATE = {
+	id: ACTION_UPGRADE_EVENT,
+	scope: "project"
+};
+const hasHandledActionUpgrade = (projectRoot, options = {}) => !isGatePending(ACTION_UPGRADE_GATE, { projectRoot }, options);
+const recordActionUpgradeDecision = (projectRoot, outcome, options = {}) => recordGate(ACTION_UPGRADE_GATE, {
+	projectRoot,
+	outcome
+}, options);
 //#endregion
 //#region src/cli/utils/ci-prompt-decision.ts
-const store = createProjectDecisionStore("ciPrompts");
-store.getConfigPath;
-const hasHandledCiPrompt = store.hasHandled;
-const recordCiPromptDecision = store.record;
+const CI_PITCH_GATE = {
+	id: CI_PITCH_EVENT,
+	scope: "project"
+};
+const hasHandledCiPrompt = (projectRoot, options = {}) => !isGatePending(CI_PITCH_GATE, { projectRoot }, options);
+const recordCiPromptDecision = (projectRoot, outcome, options = {}) => recordGate(CI_PITCH_GATE, {
+	projectRoot,
+	outcome
+}, options);
 //#endregion
 //#region src/cli/utils/open-url.ts
 const resolveOpenCommand = (url) => {
@@ -50755,39 +51708,80 @@ const DEFAULT_PR_TITLE = "Add React Doctor to GitHub Actions";
 const DEFAULT_PR_BODY = `Adds a [React Doctor](https://www.react.doctor) scan to every pull request and every push to the default branch. The workflow file is documented inline.
 
 Docs: https://www.react.doctor/ci`;
-const findUniqueBranchName = async (cwd) => {
-	if (!(await runCommand("git", [
+const findUniqueBranchName = async (cwd, run) => {
+	if (!(await run("git", [
 		"rev-parse",
 		"--verify",
 		NEW_BRANCH_PREFIX
 	], cwd)).success) return NEW_BRANCH_PREFIX;
 	return `${NEW_BRANCH_PREFIX}-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 16).replace(/[-:T]/g, "")}`;
 };
+const findExistingSetupPullRequest = async (cwd, run) => {
+	const prList = await run("gh", [
+		"pr",
+		"list",
+		"--state",
+		"open",
+		"--json",
+		"headRefName,url",
+		"--limit",
+		String(100)
+	], cwd);
+	if (!prList.success) return null;
+	try {
+		return JSON.parse(prList.stdout).find((pullRequest) => (pullRequest.headRefName ?? "").startsWith(NEW_BRANCH_PREFIX)) ?? null;
+	} catch {
+		return null;
+	}
+};
+const hasUnrelatedTrackedChanges = async (cwd, workflowRelative, run) => {
+	const statusProbe = await run("git", [
+		"status",
+		"--porcelain",
+		"--",
+		".",
+		`:!${workflowRelative}`
+	], cwd);
+	if (!statusProbe.success) return true;
+	return statusProbe.stdout.split(/\r?\n/).filter(Boolean).some((statusLine) => !statusLine.startsWith("??"));
+};
 const openWorkflowPullRequest = async (params) => {
 	const workflowPath = Path.resolve(params.workflowPath);
 	const commitMessage = params.commitMessage ?? DEFAULT_COMMIT_MESSAGE;
 	const prTitle = params.prTitle ?? DEFAULT_PR_TITLE;
 	const prBody = params.prBody ?? DEFAULT_PR_BODY;
-	const repoRootProbe = await runCommand("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
+	const run = params.run ?? runCommand;
+	const checkCommandAvailable = params.checkCommandAvailable ?? isCommandAvailable;
+	const repoRootProbe = await run("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
 	if (!repoRootProbe.success) return {
 		status: "not-attempted",
 		reason: "not-a-git-repo"
 	};
 	const cwd = repoRootProbe.stdout;
-	if (!isCommandAvailable("gh")) return {
+	const workflowRelative = toForwardSlashes(Path.relative(cwd, workflowPath));
+	if (!checkCommandAvailable("gh")) return {
 		status: "not-attempted",
 		reason: "gh-not-installed"
 	};
-	if (!(await runCommand("gh", ["auth", "status"], cwd)).success) return {
+	if (!(await run("gh", ["auth", "status"], cwd)).success) return {
 		status: "not-attempted",
 		reason: "gh-not-authenticated"
 	};
-	const defaultBranch = params.baseBranch ?? await detectDefaultBranch(cwd);
+	const existingSetupPullRequest = await findExistingSetupPullRequest(cwd, run);
+	if (existingSetupPullRequest) return {
+		status: "pr-exists",
+		url: existingSetupPullRequest.url ?? ""
+	};
+	if (await hasUnrelatedTrackedChanges(cwd, workflowRelative, run)) return {
+		status: "not-attempted",
+		reason: "working-tree-dirty"
+	};
+	const defaultBranch = params.baseBranch ?? await detectDefaultBranch(cwd, run);
 	if (!defaultBranch) return {
 		status: "not-attempted",
 		reason: "no-default-branch"
 	};
-	const previousBranchProbe = await runCommand("git", [
+	const previousBranchProbe = await run("git", [
 		"rev-parse",
 		"--abbrev-ref",
 		"HEAD"
@@ -50797,13 +51791,13 @@ const openWorkflowPullRequest = async (params) => {
 		reason: "detached-head"
 	};
 	const previousBranch = previousBranchProbe.stdout;
-	await runCommand("git", [
+	await run("git", [
 		"fetch",
 		"origin",
 		defaultBranch
 	], cwd);
-	const newBranch = await findUniqueBranchName(cwd);
-	if (!(await runCommand("git", [
+	const newBranch = await findUniqueBranchName(cwd, run);
+	if (!(await run("git", [
 		"checkout",
 		"-b",
 		newBranch,
@@ -50813,17 +51807,17 @@ const openWorkflowPullRequest = async (params) => {
 		reason: "checkout-failed"
 	};
 	const restoreToPreviousBranch = async (deleteNewBranch) => {
-		await runCommand("git", ["checkout", previousBranch], cwd);
-		if (deleteNewBranch) await runCommand("git", [
+		await run("git", ["checkout", previousBranch], cwd);
+		if (deleteNewBranch) await run("git", [
 			"branch",
 			"-D",
 			newBranch
 		], cwd);
 	};
-	if (!(await runCommand("git", [
+	if (!(await run("git", [
 		"add",
 		"--",
-		Path.relative(cwd, workflowPath)
+		workflowRelative
 	], cwd)).success) {
 		await restoreToPreviousBranch(true);
 		return {
@@ -50831,7 +51825,7 @@ const openWorkflowPullRequest = async (params) => {
 			reason: "git-add-failed"
 		};
 	}
-	if (!(await runCommand("git", [
+	if (!(await run("git", [
 		"commit",
 		"-m",
 		commitMessage
@@ -50842,7 +51836,7 @@ const openWorkflowPullRequest = async (params) => {
 			reason: "git-commit-failed"
 		};
 	}
-	if (!(await runCommand("git", [
+	if (!(await run("git", [
 		"push",
 		"-u",
 		"origin",
@@ -50854,7 +51848,7 @@ const openWorkflowPullRequest = async (params) => {
 			reason: "git-push-failed"
 		};
 	}
-	const prCreate = await runCommand("gh", [
+	const prCreate = await run("gh", [
 		"pr",
 		"create",
 		"--title",
@@ -50878,12 +51872,13 @@ const openWorkflowPullRequest = async (params) => {
 };
 const stageWorkflowFile = async (params) => {
 	const workflowPath = Path.resolve(params.workflowPath);
-	const repoRootProbe = await runCommand("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
+	const run = params.run ?? runCommand;
+	const repoRootProbe = await run("git", ["rev-parse", "--show-toplevel"], Path.dirname(workflowPath));
 	if (!repoRootProbe.success) return false;
-	return (await runCommand("git", [
+	return (await run("git", [
 		"add",
 		"--",
-		Path.relative(repoRootProbe.stdout, workflowPath)
+		toForwardSlashes(Path.relative(repoRootProbe.stdout, workflowPath))
 	], repoRootProbe.stdout)).success;
 };
 //#endregion
@@ -50924,6 +51919,7 @@ const setUpGitHubActions = async (options) => {
 			baseBranch: defaultBranch
 		});
 		if (pullRequestResult.status === "pr-opened") pullRequestSpinner.succeed(`Opened pull request for review: ${highlighter.info(pullRequestResult.url)}`);
+		else if (pullRequestResult.status === "pr-exists") pullRequestSpinner.succeed(`A React Doctor setup pull request is already open: ${highlighter.info(pullRequestResult.url)}`);
 		else if (pullRequestResult.status === "branch-pushed") pullRequestSpinner.warn(`Pushed branch ${highlighter.bold(pullRequestResult.branch)} but couldn't open a PR. Open one with: gh pr create --head ${pullRequestResult.branch}`);
 		else {
 			pullRequestSpinner.stop();
@@ -52024,7 +53020,12 @@ const upgradeGitHubActionsWorkflow = async (workflow) => {
 		prBody: UPGRADE_PR_BODY
 	});
 	if (pullRequestResult.status === "pr-opened") upgradeSpinner.succeed(`Opened pull request for review: ${highlighter.info(pullRequestResult.url)}`);
-	else if (pullRequestResult.status === "branch-pushed") upgradeSpinner.warn(`Pushed branch ${highlighter.bold(pullRequestResult.branch)} but couldn't open a PR. Open one with: gh pr create --head ${pullRequestResult.branch}`);
+	else if (pullRequestResult.status === "pr-exists") {
+		try {
+			NFS.writeFileSync(workflow.workflowPath, workflow.content);
+		} catch {}
+		upgradeSpinner.succeed(`A React Doctor pull request is already open: ${highlighter.info(pullRequestResult.url)}`);
+	} else if (pullRequestResult.status === "branch-pushed") upgradeSpinner.warn(`Pushed branch ${highlighter.bold(pullRequestResult.branch)} but couldn't open a PR. Open one with: gh pr create --head ${pullRequestResult.branch}`);
 	else {
 		upgradeSpinner.stop();
 		try {
@@ -52138,6 +53139,47 @@ const handoffToAgent = async (input) => {
 	}
 };
 //#endregion
+//#region src/cli/utils/migrate-action-pin.ts
+const WORKFLOWS_DIRECTORY = Path.join(".github", "workflows");
+const RECOMMENDED_ACTION_REF = "v2";
+const MUTABLE_ACTION_REF = /(uses:\s*[\w.-]+\/react-doctor@)(?:main|master)\b/g;
+const isWorkflowFile = (fileName) => /\.ya?ml$/.test(fileName);
+/**
+* Rewrites mutable `@main` / `@master` React Doctor GitHub Action references in
+* the repo's `.github/workflows/*.yml` to the recommended floating major
+* (`@v2`) — a supply-chain hardening (#299) that also moves the workflow onto
+* the current (install- and scan-cached) action release. Pinned tags / SHAs are
+* deliberate and left untouched. Returns the absolute paths of the workflow
+* files it rewrote — empty when there's nothing to migrate.
+*/
+const migrateActionPin = (projectRoot) => {
+	const workflowsDirectory = Path.join(projectRoot, WORKFLOWS_DIRECTORY);
+	let entries;
+	try {
+		entries = NFS.readdirSync(workflowsDirectory, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+	const rewrittenFiles = [];
+	for (const entry of entries) {
+		if (!entry.isFile() || !isWorkflowFile(entry.name)) continue;
+		const workflowPath = Path.join(workflowsDirectory, entry.name);
+		let contents;
+		try {
+			contents = NFS.readFileSync(workflowPath, "utf-8");
+		} catch {
+			continue;
+		}
+		const updated = contents.replace(MUTABLE_ACTION_REF, `$1${RECOMMENDED_ACTION_REF}`);
+		if (updated === contents) continue;
+		try {
+			NFS.writeFileSync(workflowPath, updated);
+			rewrittenFiles.push(workflowPath);
+		} catch {}
+	}
+	return rewrittenFiles;
+};
+//#endregion
 //#region src/cli/utils/read-object-file.ts
 /**
 * Reads a JSON / JSONC file as a plain object, or `null` when it is missing,
@@ -52202,6 +53244,35 @@ export default ${serializeTsObjectLiteral(config)} satisfies ReactDoctorConfig;
 	NFS.rmSync(legacy.legacyFilePath, { force: true });
 	return targetPath;
 };
+const PROJECT_MIGRATIONS = [{
+	id: "config-json-to-ts",
+	scope: "project",
+	run: ({ projectRoot }) => {
+		if (projectRoot === void 0) return false;
+		const legacyConfig = findLegacyConfig(projectRoot);
+		if (!legacyConfig) return false;
+		const migratedPath = migrateLegacyConfig(legacyConfig);
+		if (!migratedPath) return false;
+		cliLogger.success("Migrated react-doctor.config.json → doctor.config.ts");
+		cliLogger.dim(`  Your settings were preserved. Review ${toRelativePath(migratedPath, projectRoot)} and commit it.`);
+		cliLogger.break();
+		return true;
+	}
+}, {
+	id: "action-pin-main-to-v2",
+	scope: "project",
+	run: ({ projectRoot }) => {
+		if (projectRoot === void 0) return false;
+		const rewrittenFiles = migrateActionPin(projectRoot);
+		if (rewrittenFiles.length === 0) return false;
+		const relativeFiles = rewrittenFiles.map((file) => toRelativePath(file, projectRoot)).join(", ");
+		cliLogger.success(`Pinned the React Doctor action to @v2 in ${relativeFiles}`);
+		cliLogger.dim("  An unpinned @main reference runs whatever the action's HEAD points to (a supply-chain risk). Review and commit the change — or revert it if you intentionally track main.");
+		cliLogger.break();
+		return true;
+	}
+}];
+const runProjectMigrations = (projectRoot, options = {}) => runMigrations(PROJECT_MIGRATIONS, { projectRoot }, options);
 //#endregion
 //#region src/cli/utils/print-branded-header.ts
 /**
@@ -52421,36 +53492,16 @@ const printMultiProjectSummary = (input) => gen(function* () {
 });
 //#endregion
 //#region src/cli/utils/prompt-install-setup.ts
-const getSetupPromptStore = (options = {}) => new Conf({
-	projectName: REACT_DOCTOR_CONFIG_PROJECT_NAME,
-	cwd: options.cwd
-});
-const getSetupPromptProjectKey = (projectRoot) => hashProjectRoot(projectRoot);
-const hasDisabledSetupPrompt = (projectRoot, storeOptions = {}) => {
-	try {
-		return getSetupPromptStore(storeOptions).get("projects", {})[getSetupPromptProjectKey(projectRoot)]?.setupPrompt === false;
-	} catch {
-		return false;
-	}
-};
-const disableSetupPrompt = (projectRoot, storeOptions = {}) => {
-	try {
-		const store = getSetupPromptStore(storeOptions);
-		const projects = store.get("projects", {});
-		const projectKey = getSetupPromptProjectKey(projectRoot);
-		store.set("projects", {
-			...projects,
-			[projectKey]: {
-				...projects[projectKey] ?? {},
-				rootDirectory: Path.resolve(projectRoot),
-				setupPrompt: false
-			}
-		});
-		return true;
-	} catch {
-		return false;
-	}
-};
+const SETUP_HINT_GATE = {
+	id: SETUP_HINT_EVENT,
+	scope: "project",
+	fireWhenUnknown: true
+};
+const hasDisabledSetupPrompt = (projectRoot, options = {}) => !isGatePending(SETUP_HINT_GATE, { projectRoot }, options);
+const disableSetupPrompt = (projectRoot, options = {}) => recordGate(SETUP_HINT_GATE, {
+	projectRoot,
+	outcome: "declined"
+}, options);
 const resolveInstallSetupProjectRoot = (options) => {
 	if (options.scanDirectories.length === 0) return findNearestPackageDirectory(options.scanRoot) ?? options.scanRoot;
 	const packageDirectories = /* @__PURE__ */ new Set();
@@ -52978,15 +54029,9 @@ const buildChangedFilesDiffInfo = (changedFiles) => ({
 * are left untouched — the loader still reads the legacy file as a deprecated
 * fallback and warns — so a scan never mutates the repo unattended.
 */
-const maybeMigrateLegacyConfig = (requestedDirectory, { isQuiet, isStaged }) => {
+const maybeMigrateLegacyConfig = async (requestedDirectory, { isQuiet, isStaged }) => {
 	if (!(!isQuiet && !isStaged && process.stdout.isTTY === true && !isCiOrCodingAgentEnvironment())) return;
-	const legacyConfig = findLegacyConfig(requestedDirectory);
-	if (!legacyConfig) return;
-	const migratedPath = migrateLegacyConfig(legacyConfig);
-	if (!migratedPath) return;
-	cliLogger.success("Migrated react-doctor.config.json → doctor.config.ts");
-	cliLogger.dim(`  Your settings were preserved. Review ${toRelativePath(migratedPath, requestedDirectory)} and commit it.`);
-	cliLogger.break();
+	await runProjectMigrations(requestedDirectory);
 };
 const inspectAction = async (directory, flags) => {
 	const isScoreOnly = Boolean(flags.score);
@@ -53001,7 +54046,7 @@ const inspectAction = async (directory, flags) => {
 	recordCount(METRIC.cliInvoked, 1, { command: "inspect" });
 	try {
 		validateModeFlags(flags);
-		maybeMigrateLegacyConfig(requestedDirectory, {
+		await maybeMigrateLegacyConfig(requestedDirectory, {
 			isQuiet,
 			isStaged: Boolean(flags.staged)
 		});
@@ -54305,4 +55350,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=80f0c020-6340-5bba-86a5-7cdbaecdf52d
+//# debugId=6a2c86b6-c3a8-5e50-8e7b-daef840df200