react-doctor 0.5.8-dev.80e3093 → 0.5.8-dev.8232e96

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="38109950-d718-564f-8c23-83e407ef77e9")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="56ca0cbd-9f70-5a50-8496-43abdf078431")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -22465,6 +22465,15 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	ok: Boolean$1,
 	directory: String$1,
 	mode: JsonReportMode,
+	/**
+	* True when a `changed` (compare) run was intended but the base couldn't be
+	* resolved — a shallow CI checkout with no merge base, or a failed base/head
+	* lint. The report then lists every finding in the changed files (mode
+	* downgrades to `diff`, the `baseline` block is dropped, the CI gate is
+	* skipped) rather than only the ones the change introduced. Absent on a
+	* successful `baseline` run (`schemaVersion: 2`) and on non-compare scopes.
+	*/
+	baselineDegraded: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
 	diagnostics: ArraySchema(Diagnostic),
@@ -35948,12 +35957,31 @@ const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 const IGNORED_DIRECTORIES = new Set([
+	".angular",
+	".astro",
+	".cache",
+	".contentlayer",
+	".direnv",
+	".docusaurus",
+	".expo",
+	".firebase",
 	".git",
+	".gradle",
+	".hg",
 	".next",
 	".nuxt",
+	".nx",
 	".output",
+	".parcel-cache",
+	".serverless",
 	".svelte-kit",
+	".svn",
+	".terraform",
 	".turbo",
+	".venv",
+	".vercel",
+	".wrangler",
+	".yarn",
 	"build",
 	"coverage",
 	"dist",
@@ -35961,6 +35989,152 @@ const IGNORED_DIRECTORIES = new Set([
 	"out",
 	"storybook-static"
 ]);
+const JSX_FILE_PATTERN = /\.(tsx|jsx)$/;
+const MILLISECONDS_PER_SECOND = 1e3;
+const SCORE_API_URL = "https://www.react.doctor/api/score";
+const ENTERPRISE_CONTACT_URL = "https://react.doctor/enterprise";
+const SHARE_BASE_URL = "https://react.doctor/share";
+const CI_URL = "https://react.doctor/ci";
+const GITHUB_ACTIONS_SETUP_URL = "https://www.react.doctor/docs/ci-and-prs/github-actions-setup";
+const DOCS_URL = "https://react.doctor/docs";
+const DOCS_RULES_BASE_URL = `${DOCS_URL}/rules`;
+const FETCH_TIMEOUT_MS = 1e4;
+const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
+const SPAWN_ARGS_MAX_LENGTH_CHARS = 24e3;
+const SPAWN_ARGS_MAX_LENGTH_CHARS_POSIX = 15e5;
+const SPAWN_ARGS_MAX_LENGTH_CHARS_DARWIN = 8e5;
+const NODE_VERSION_PROBE_TIMEOUT_MS = 5e3;
+const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
+const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
+const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
+const OXLINT_NODE_REQUIREMENT = "^20.19.0 || >=22.12.0";
+const GIT_SHOW_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
+const ES_TARGET_YEAR_BY_NAME = {
+	es3: 1999,
+	es5: 2009,
+	es6: 2015,
+	es2015: 2015,
+	es2016: 2016,
+	es2017: 2017,
+	es2018: 2018,
+	es2019: 2019,
+	es2020: 2020,
+	es2021: 2021,
+	es2022: 2022,
+	es2023: 2023,
+	es2024: 2024,
+	es2025: 2025,
+	esnext: 9999
+};
+/**
+* tsconfig filenames probed when resolving a project's TypeScript
+* compiler options — the root config first, then a monorepo base config.
+*/
+const TSCONFIG_FILENAMES = ["tsconfig.json", "tsconfig.base.json"];
+/**
+* Project-config files that `StagedFiles.materialize` copies into
+* the temp directory alongside staged sources so oxlint resolves
+* `tsconfig` / `package.json` / lint configs the same way it would
+* in the working tree. Hoisted out of the staged-files helper so
+* the constant lives next to the rest of the IO budget knobs.
+*/
+const STAGED_FILES_PROJECT_CONFIG_FILENAMES = [
+	"tsconfig.json",
+	"tsconfig.base.json",
+	"package.json",
+	"doctor.config.ts",
+	"doctor.config.mts",
+	"doctor.config.cts",
+	"doctor.config.js",
+	"doctor.config.mjs",
+	"doctor.config.cjs",
+	"doctor.config.json",
+	"doctor.config.jsonc",
+	"oxlint.json",
+	".oxlintrc.json"
+];
+const CONFIG_FINGERPRINT_FILENAMES = [
+	"doctor.config.ts",
+	"doctor.config.mts",
+	"doctor.config.cts",
+	"doctor.config.js",
+	"doctor.config.mjs",
+	"doctor.config.cjs",
+	"doctor.config.json",
+	"doctor.config.jsonc",
+	"react-doctor.config.json",
+	"package.json",
+	"pnpm-workspace.yaml",
+	"tsconfig.json",
+	"tsconfig.base.json",
+	".oxlintrc.json",
+	".eslintrc.json",
+	"pnpm-lock.yaml",
+	"package-lock.json",
+	"yarn.lock",
+	"bun.lock",
+	"bun.lockb",
+	".gitignore"
+];
+const CANONICAL_GITHUB_URL = "https://github.com/millionco/react-doctor";
+const CANONICAL_DISCORD_URL = "https://react.doctor/discord";
+const SKILL_NAME = "react-doctor";
+const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
+const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
+const NODE_COMPILE_CACHE_DIR_NAME = "node-compile-cache";
+const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
+const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
+const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
+const LINT_PHASE_TIMEOUT_MS = 3e5;
+const SCAN_TOTAL_DEADLINE_MS = 9e5;
+const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
+const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
+const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
+const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
+const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
+const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
+const REACT_SERVER_DOM_PACKAGES = [
+	"react-server-dom-webpack",
+	"react-server-dom-parcel",
+	"react-server-dom-turbopack"
+];
+const REACT_BLOG_RSC_ADVISORY_URL = "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components";
+const VERCEL_NEXTJS_SECURITY_RELEASE_URL = "https://vercel.com/changelog/next-js-may-2026-security-release";
+const DIAGNOSTIC_CATEGORY_BUCKETS = [
+	"Security",
+	"Bugs",
+	"Performance",
+	"Accessibility",
+	"Maintainability"
+];
+const APP_ONLY_RULE_KEYS = new Set([
+	"react-hooks-js/static-components",
+	"react-doctor/no-render-prop-children",
+	"react-doctor/prefer-explicit-variants"
+]);
+const COMPILER_CLEANUP_BUCKET = "compiler-cleanup";
+const COMPILER_CLEANUP_RULE_KEYS = new Set(["react-doctor/react-compiler-no-manual-memoization"]);
+const ROOT_CAUSE_GROUPABLE_RULE_KEYS = new Set([
+	"react-doctor/no-derived-state",
+	"react-doctor/no-derived-state-effect",
+	"react-doctor/no-derived-useState",
+	"react-doctor/no-adjust-state-on-prop-change",
+	"react-doctor/no-reset-all-state-on-prop-change"
+]);
+const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
+const CONFIG_CACHE_TTL_MS = 300 * 1e3;
+const SOCKET_FREE_PURL_API_BASE = "https://firewall-api.socket.dev/purl";
+const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
+const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
+const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
+const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
+const SUPPLY_CHAIN_PLUGIN = "socket";
+const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
+const SUPPLY_CHAIN_CATEGORY = "Security";
+const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
+const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
+const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
+const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => IGNORED_DIRECTORIES.has(segment));
 const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath);
 const isMinifiedSource = (absolutePath) => {
 	let fileDescriptor;
@@ -36014,23 +36188,38 @@ const readDirectoryEntries = (directoryPath) => {
 		throw error;
 	}
 };
-const countSourceFilesViaFilesystem = (rootDirectory) => {
-	let count = 0;
+function* walkSourceTreeFiles(rootDirectory) {
 	const stack = [rootDirectory];
 	while (stack.length > 0) {
 		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
+		if (currentDirectory === void 0) continue;
+		for (const entry of readDirectoryEntries(currentDirectory)) {
+			const absolutePath = Path.join(currentDirectory, entry.name);
 			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(Path.join(currentDirectory, entry.name));
+				if (!IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
 				continue;
 			}
-			if (entry.isFile() && isLintableSourceFile(entry.name) && !isLargeMinifiedFile(Path.join(currentDirectory, entry.name))) count++;
+			if (entry.isFile()) yield {
+				absolutePath,
+				name: entry.name
+			};
 		}
 	}
-	return count;
+}
+const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
+	const entries = [];
+	for (const relativePath of relativePaths) {
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (isLargeMinifiedFile(absolutePath, sizeBytes)) continue;
+		entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+	}
+	return entries;
 };
-const countSourceFilesViaGit = (rootDirectory) => {
+const listSourceFilesViaGit = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
 		"-z",
@@ -36043,9 +36232,16 @@ const countSourceFilesViaGit = (rootDirectory) => {
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !isLargeMinifiedFile(Path.resolve(rootDirectory, filePath))).length;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath));
+};
+const listSourceFilesViaFilesystem = (rootDirectory) => {
+	const filePaths = [];
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+	return filePaths;
 };
-const countSourceFiles = (rootDirectory) => countSourceFilesViaGit(rootDirectory) ?? countSourceFilesViaFilesystem(rootDirectory);
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
+const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
+const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const readPackageJsonUncached = (packageJsonPath) => {
 	try {
@@ -36851,151 +37047,6 @@ const resolveEffectiveReactMajor = (reactVersion, packageJson) => {
 	if (peerFloor === null) return hasUpperBoundOnlyPeerRange(peerReactRange) ? null : installedReactMajor;
 	return installedReactMajor !== null ? Math.min(installedReactMajor, peerFloor) : peerFloor;
 };
-const JSX_FILE_PATTERN = /\.(tsx|jsx)$/;
-const MILLISECONDS_PER_SECOND = 1e3;
-const SCORE_API_URL = "https://www.react.doctor/api/score";
-const ENTERPRISE_CONTACT_URL = "https://react.doctor/enterprise";
-const SHARE_BASE_URL = "https://react.doctor/share";
-const CI_URL = "https://react.doctor/ci";
-const GITHUB_ACTIONS_SETUP_URL = "https://www.react.doctor/docs/ci-and-prs/github-actions-setup";
-const DOCS_URL = "https://react.doctor/docs";
-const DOCS_RULES_BASE_URL = `${DOCS_URL}/rules`;
-const FETCH_TIMEOUT_MS = 1e4;
-const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
-const SPAWN_ARGS_MAX_LENGTH_CHARS = 24e3;
-const SPAWN_ARGS_MAX_LENGTH_CHARS_POSIX = 15e5;
-const SPAWN_ARGS_MAX_LENGTH_CHARS_DARWIN = 8e5;
-const NODE_VERSION_PROBE_TIMEOUT_MS = 5e3;
-const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
-const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
-const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
-const OXLINT_NODE_REQUIREMENT = "^20.19.0 || >=22.12.0";
-const GIT_SHOW_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
-const ES_TARGET_YEAR_BY_NAME = {
-	es3: 1999,
-	es5: 2009,
-	es6: 2015,
-	es2015: 2015,
-	es2016: 2016,
-	es2017: 2017,
-	es2018: 2018,
-	es2019: 2019,
-	es2020: 2020,
-	es2021: 2021,
-	es2022: 2022,
-	es2023: 2023,
-	es2024: 2024,
-	es2025: 2025,
-	esnext: 9999
-};
-/**
-* tsconfig filenames probed when resolving a project's TypeScript
-* compiler options — the root config first, then a monorepo base config.
-*/
-const TSCONFIG_FILENAMES = ["tsconfig.json", "tsconfig.base.json"];
-/**
-* Project-config files that `StagedFiles.materialize` copies into
-* the temp directory alongside staged sources so oxlint resolves
-* `tsconfig` / `package.json` / lint configs the same way it would
-* in the working tree. Hoisted out of the staged-files helper so
-* the constant lives next to the rest of the IO budget knobs.
-*/
-const STAGED_FILES_PROJECT_CONFIG_FILENAMES = [
-	"tsconfig.json",
-	"tsconfig.base.json",
-	"package.json",
-	"doctor.config.ts",
-	"doctor.config.mts",
-	"doctor.config.cts",
-	"doctor.config.js",
-	"doctor.config.mjs",
-	"doctor.config.cjs",
-	"doctor.config.json",
-	"doctor.config.jsonc",
-	"oxlint.json",
-	".oxlintrc.json"
-];
-const CONFIG_FINGERPRINT_FILENAMES = [
-	"doctor.config.ts",
-	"doctor.config.mts",
-	"doctor.config.cts",
-	"doctor.config.js",
-	"doctor.config.mjs",
-	"doctor.config.cjs",
-	"doctor.config.json",
-	"doctor.config.jsonc",
-	"react-doctor.config.json",
-	"package.json",
-	"pnpm-workspace.yaml",
-	"tsconfig.json",
-	"tsconfig.base.json",
-	".oxlintrc.json",
-	".eslintrc.json",
-	"pnpm-lock.yaml",
-	"package-lock.json",
-	"yarn.lock",
-	"bun.lock",
-	"bun.lockb",
-	".gitignore"
-];
-const CANONICAL_GITHUB_URL = "https://github.com/millionco/react-doctor";
-const CANONICAL_DISCORD_URL = "https://react.doctor/discord";
-const SKILL_NAME = "react-doctor";
-const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
-const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
-const NODE_COMPILE_CACHE_DIR_NAME = "node-compile-cache";
-const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
-const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
-const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
-const LINT_PHASE_TIMEOUT_MS = 3e5;
-const SCAN_TOTAL_DEADLINE_MS = 9e5;
-const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
-const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
-const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
-const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
-const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
-const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
-const REACT_SERVER_DOM_PACKAGES = [
-	"react-server-dom-webpack",
-	"react-server-dom-parcel",
-	"react-server-dom-turbopack"
-];
-const REACT_BLOG_RSC_ADVISORY_URL = "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components";
-const VERCEL_NEXTJS_SECURITY_RELEASE_URL = "https://vercel.com/changelog/next-js-may-2026-security-release";
-const DIAGNOSTIC_CATEGORY_BUCKETS = [
-	"Security",
-	"Bugs",
-	"Performance",
-	"Accessibility",
-	"Maintainability"
-];
-const APP_ONLY_RULE_KEYS = new Set([
-	"react-hooks-js/static-components",
-	"react-doctor/no-render-prop-children",
-	"react-doctor/prefer-explicit-variants"
-]);
-const COMPILER_CLEANUP_BUCKET = "compiler-cleanup";
-const COMPILER_CLEANUP_RULE_KEYS = new Set(["react-doctor/react-compiler-no-manual-memoization"]);
-const ROOT_CAUSE_GROUPABLE_RULE_KEYS = new Set([
-	"react-doctor/no-derived-state",
-	"react-doctor/no-derived-state-effect",
-	"react-doctor/no-derived-useState",
-	"react-doctor/no-adjust-state-on-prop-change",
-	"react-doctor/no-reset-all-state-on-prop-change"
-]);
-const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
-const CONFIG_CACHE_TTL_MS = 300 * 1e3;
-const SOCKET_FREE_PURL_API_BASE = "https://firewall-api.socket.dev/purl";
-const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
-const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
-const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
-const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
-const SUPPLY_CHAIN_PLUGIN = "socket";
-const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
-const SUPPLY_CHAIN_CATEGORY = "Security";
-const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
-const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
-const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
 const TSCONFIG_FILENAME = "tsconfig.json";
 const isRelativeExtendsValue = (extendsValue) => extendsValue.startsWith("./") || extendsValue.startsWith("../") || Path.isAbsolute(extendsValue);
 const ensureJsonExtension = (filePath) => Path.extname(filePath) === "" ? `${filePath}.json` : filePath;
@@ -39975,14 +40026,17 @@ const checkReactServerComponentsAdvisory = (scanDirectory, project) => {
 	return diagnostics;
 };
 const REDUCED_MOTION_GREP_PATTERN = "prefers-reduced-motion|useReducedMotion|MotionConfig|reducedMotion";
-const REDUCED_MOTION_FILE_GLOBS = [
-	"*.ts",
-	"*.tsx",
-	"*.js",
-	"*.jsx",
-	"*.css",
-	"*.scss"
-];
+const REDUCED_MOTION_PATTERN = new RegExp(REDUCED_MOTION_GREP_PATTERN);
+const REDUCED_MOTION_FILE_EXTENSIONS = new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".css",
+	".scss"
+]);
+const REDUCED_MOTION_FILE_GLOBS = [...REDUCED_MOTION_FILE_EXTENSIONS].map((extension) => `*${extension}`);
+const GIT_GREP_NO_MATCH_STATUS = 1;
 const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
 	filePath: "package.json",
 	plugin: "react-doctor",
@@ -39994,6 +40048,19 @@ const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
 	column: 0,
 	category: "Accessibility"
 };
+const hasReducedMotionHandlingViaFilesystem = (rootDirectory) => {
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) {
+		if (!REDUCED_MOTION_FILE_EXTENSIONS.has(Path.extname(name))) continue;
+		let content;
+		try {
+			content = NFS.readFileSync(absolutePath, "utf-8");
+		} catch {
+			continue;
+		}
+		if (REDUCED_MOTION_PATTERN.test(content)) return true;
+	}
+	return false;
+};
 const checkReducedMotion = (rootDirectory) => {
 	const packageJsonPath = Path.join(rootDirectory, "package.json");
 	if (!isFile(packageJsonPath)) return [];
@@ -40012,22 +40079,21 @@ const checkReducedMotion = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"grep",
 		"--untracked",
-		"-ql",
-		"-E",
+		"-lE",
 		REDUCED_MOTION_GREP_PATTERN,
 		"--",
 		...REDUCED_MOTION_FILE_GLOBS
 	], {
 		cwd: rootDirectory,
+		encoding: "utf-8",
 		stdio: [
 			"ignore",
 			"pipe",
 			"pipe"
 		]
 	});
-	if (result.error) return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
-	if (result.status === 0) return [];
-	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+	if (!(!result.error && (result.status === 0 || result.status === GIT_GREP_NO_MATCH_STATUS))) return hasReducedMotionHandlingViaFilesystem(rootDirectory) ? [] : [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+	return result.status === 0 && result.stdout.split("\n").some((filePath) => filePath.length > 0 && !hasIgnoredPathSegment(filePath)) ? [] : [MISSING_REDUCED_MOTION_DIAGNOSTIC];
 };
 const buildSecurityScanDiagnostic = (finding, entry, relativePath) => ({
 	filePath: relativePath,
@@ -40411,7 +40477,7 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
-const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const KNIP_JSON_FILENAME = "knip.json";
 const readJsonFileSafe = (filePath) => {
 	let rawContents;
@@ -40428,10 +40494,10 @@ const readJsonFileSafe = (filePath) => {
 };
 const readKnipConfig = (rootDirectory) => {
 	const knipJson = readJsonFileSafe(path.join(rootDirectory, KNIP_JSON_FILENAME));
-	if (isRecord$2(knipJson)) return knipJson;
+	if (isRecord$1(knipJson)) return knipJson;
 	const packageJson = readJsonFileSafe(path.join(rootDirectory, "package.json"));
-	const packageKnipConfig = isRecord$2(packageJson) ? packageJson.knip : null;
-	return isRecord$2(packageKnipConfig) ? packageKnipConfig : null;
+	const packageKnipConfig = isRecord$1(packageJson) ? packageJson.knip : null;
+	return isRecord$1(packageKnipConfig) ? packageKnipConfig : null;
 };
 const normalizePatternList = (value) => {
 	if (typeof value === "string" && value.length > 0) return [value];
@@ -40443,10 +40509,10 @@ const prefixWorkspacePatterns = (workspacePattern, patterns) => {
 	return patterns.map((pattern) => pattern.startsWith("!") ? `!${normalizedWorkspacePattern}/${pattern.slice(1)}` : `${normalizedWorkspacePattern}/${pattern}`);
 };
 const collectKnipWorkspacePatterns = (workspaces, settingName) => {
-	if (!isRecord$2(workspaces)) return [];
+	if (!isRecord$1(workspaces)) return [];
 	const patterns = [];
 	for (const [workspacePattern, workspaceConfig] of Object.entries(workspaces)) {
-		if (!isRecord$2(workspaceConfig)) continue;
+		if (!isRecord$1(workspaceConfig)) continue;
 		patterns.push(...prefixWorkspacePatterns(workspacePattern, normalizePatternList(workspaceConfig[settingName])));
 	}
 	return patterns;
@@ -40669,7 +40735,7 @@ const parseUnusedFiles = (value) => {
 	const values = parseArray(value, "unusedFiles");
 	const unusedFiles = [];
 	for (const [index, entry] of values.entries()) {
-		if (!isRecord$2(entry)) throw new Error(`Dead-code worker returned invalid unusedFiles[${index}].`);
+		if (!isRecord$1(entry)) throw new Error(`Dead-code worker returned invalid unusedFiles[${index}].`);
 		unusedFiles.push({ path: parseString(entry.path, `unusedFiles[${index}].path`) });
 	}
 	return unusedFiles;
@@ -40678,7 +40744,7 @@ const parseUnusedExports = (value) => {
 	const values = parseArray(value, "unusedExports");
 	const unusedExports = [];
 	for (const [index, entry] of values.entries()) {
-		if (!isRecord$2(entry)) throw new Error(`Dead-code worker returned invalid unusedExports[${index}].`);
+		if (!isRecord$1(entry)) throw new Error(`Dead-code worker returned invalid unusedExports[${index}].`);
 		unusedExports.push({
 			path: parseString(entry.path, `unusedExports[${index}].path`),
 			name: parseString(entry.name, `unusedExports[${index}].name`),
@@ -40693,7 +40759,7 @@ const parseUnusedDependencies = (value) => {
 	const values = parseArray(value, "unusedDependencies");
 	const unusedDependencies = [];
 	for (const [index, entry] of values.entries()) {
-		if (!isRecord$2(entry)) throw new Error(`Dead-code worker returned invalid unusedDependencies[${index}].`);
+		if (!isRecord$1(entry)) throw new Error(`Dead-code worker returned invalid unusedDependencies[${index}].`);
 		unusedDependencies.push({
 			name: parseString(entry.name, `unusedDependencies[${index}].name`),
 			isDevDependency: parseBoolean$1(entry.isDevDependency, `unusedDependencies[${index}].isDevDependency`)
@@ -40705,13 +40771,13 @@ const parseCircularDependencies = (value) => {
 	const values = parseArray(value, "circularDependencies");
 	const circularDependencies = [];
 	for (const [index, entry] of values.entries()) {
-		if (!isRecord$2(entry)) throw new Error(`Dead-code worker returned invalid circularDependencies[${index}].`);
+		if (!isRecord$1(entry)) throw new Error(`Dead-code worker returned invalid circularDependencies[${index}].`);
 		circularDependencies.push({ files: parseStringArray(entry.files, `circularDependencies[${index}].files`) });
 	}
 	return circularDependencies;
 };
 const parseDeadCodeWorkerResult = (value) => {
-	if (!isRecord$2(value)) throw new Error("Dead-code worker returned an invalid result.");
+	if (!isRecord$1(value)) throw new Error("Dead-code worker returned an invalid result.");
 	return {
 		unusedFiles: parseUnusedFiles(value.unusedFiles),
 		unusedExports: parseUnusedExports(value.unusedExports),
@@ -40720,7 +40786,7 @@ const parseDeadCodeWorkerResult = (value) => {
 	};
 };
 const parseDeadCodeWorkerError = (value) => {
-	if (!isRecord$2(value) || typeof value.message !== "string") return { message: "Dead-code worker failed." };
+	if (!isRecord$1(value) || typeof value.message !== "string") return { message: "Dead-code worker failed." };
 	return {
 		...typeof value.name === "string" ? { name: value.name } : {},
 		message: value.message,
@@ -40728,7 +40794,7 @@ const parseDeadCodeWorkerError = (value) => {
 	};
 };
 const parseDeadCodeWorkerMessage = (value) => {
-	if (!isRecord$2(value)) throw new Error("Dead-code worker returned an invalid message.");
+	if (!isRecord$1(value)) throw new Error("Dead-code worker returned an invalid message.");
 	if (value.ok === true) return {
 		ok: true,
 		result: value.result
@@ -40939,6 +41005,7 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
+const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 /**
 * Budget for the dead-code phase, scaled to the work. deslop's graph build is
 * CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
@@ -40957,53 +41024,6 @@ const resolveDeadCodeTimeout = (input) => {
 		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
 	};
 };
-const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
-	const entries = [];
-	for (const relativePath of relativePaths) {
-		const absolutePath = Path.resolve(rootDirectory, relativePath);
-		const sizeBytes = statSourceFileSize(absolutePath);
-		if (isLargeMinifiedFile(absolutePath, sizeBytes)) continue;
-		entries.push({
-			path: relativePath,
-			sizeBytes: sizeBytes ?? 0
-		});
-	}
-	return entries;
-};
-const listSourceFilesViaGit = (rootDirectory) => {
-	const result = spawnSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd: rootDirectory,
-		encoding: "utf-8",
-		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
-	});
-	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
-};
-const listSourceFilesViaFilesystem = (rootDirectory) => {
-	const filePaths = [];
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
-			const absolutePath = Path.join(currentDirectory, entry.name);
-			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
-				continue;
-			}
-			if (entry.isFile() && isLintableSourceFile(entry.name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
-		}
-	}
-	return filePaths;
-};
-const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
-const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const resolveLintIncludePaths = (rootDirectory, userConfig, project) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
@@ -41700,12 +41720,12 @@ const findFilesWithDisableDirectivesViaGit = async (rootDirectory, includePaths)
 		return null;
 	}
 	if (grepResult === null) return null;
-	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
+	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath));
 };
 const findFilesWithDisableDirectivesViaFilesystem = (rootDirectory, includePaths) => {
 	const matches = [];
 	const checkFile = (relativePath) => {
-		if (!isLintableSourceFile(relativePath)) return;
+		if (!isLintableSourceFile(relativePath) || hasIgnoredPathSegment(relativePath)) return;
 		const absolutePath = Path.join(rootDirectory, relativePath);
 		let content;
 		try {
@@ -41719,22 +41739,7 @@ const findFilesWithDisableDirectivesViaFilesystem = (rootDirectory, includePaths
 		for (const candidate of includePaths) checkFile(candidate);
 		return matches;
 	}
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const current = stack.pop();
-		if (current === void 0) continue;
-		const entries = readDirectoryEntries(current);
-		for (const entry of entries) {
-			if (entry.isDirectory()) {
-				if (entry.name.startsWith(".") || IGNORED_DIRECTORIES.has(entry.name)) continue;
-				stack.push(Path.join(current, entry.name));
-				continue;
-			}
-			if (!entry.isFile()) continue;
-			const absolute = Path.join(current, entry.name);
-			checkFile(Path.relative(rootDirectory, absolute));
-		}
-	}
+	for (const { absolutePath } of walkSourceTreeFiles(rootDirectory)) checkFile(Path.relative(rootDirectory, absolutePath));
 	return matches;
 };
 const findFilesWithDisableDirectives = async (rootDirectory, includePaths) => await findFilesWithDisableDirectivesViaGit(rootDirectory, includePaths) ?? findFilesWithDisableDirectivesViaFilesystem(rootDirectory, includePaths);
@@ -41951,12 +41956,12 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
 		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledBy)) continue;
-		const explicitSeverity = resolveRuleSeverityOverride({
+		const explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey: registryEntry.key }, severityControls);
+		if (rule.defaultEnabled === false && explicitRuleOverride === void 0) continue;
+		const severity = resolveRuleSeverityOverride({
 			ruleKey: registryEntry.key,
 			category: rule.category
-		}, severityControls);
-		if (rule.defaultEnabled === false && explicitSeverity === void 0) continue;
-		const severity = explicitSeverity ?? resolveCompilerCleanupBucketSeverity(registryEntry.key, severityControls) ?? rule.severity;
+		}, severityControls) ?? resolveCompilerCleanupBucketSeverity(registryEntry.key, severityControls) ?? rule.severity;
 		if (severity === "off") continue;
 		enabledReactDoctorRules[registryEntry.key] = severity;
 	}
@@ -42025,9 +42030,9 @@ const emptyCache = () => ({
 const loadRulesetEntries = (cacheFilePath, rulesetHash) => {
 	const entries = /* @__PURE__ */ new Map();
 	const persisted = failOpenReadJson(cacheFilePath, emptyCache());
-	if (persisted.version !== 1 || !isRecord$2(persisted.rulesets)) return entries;
+	if (persisted.version !== 1 || !isRecord$1(persisted.rulesets)) return entries;
 	const bucket = persisted.rulesets[rulesetHash];
-	if (!isRecord$2(bucket) || !isRecord$2(bucket.files)) return entries;
+	if (!isRecord$1(bucket) || !isRecord$1(bucket.files)) return entries;
 	for (const [fileKey, rawDiagnostics] of Object.entries(bucket.files)) {
 		const decoded = decodeFileDiagnostics(rawDiagnostics);
 		if (decoded !== null) entries.set(fileKey, decoded);
@@ -42045,9 +42050,9 @@ const createFileLintCache = (cacheDirectory, rulesetHash) => {
 		},
 		persist: () => {
 			const onDisk = failOpenReadJson(cacheFilePath, emptyCache());
-			const rulesets = onDisk.version === 1 && isRecord$2(onDisk.rulesets) ? { ...onDisk.rulesets } : {};
+			const rulesets = onDisk.version === 1 && isRecord$1(onDisk.rulesets) ? { ...onDisk.rulesets } : {};
 			const existingBucket = rulesets[rulesetHash];
-			const existingFiles = isRecord$2(existingBucket) && isRecord$2(existingBucket.files) ? existingBucket.files : {};
+			const existingFiles = isRecord$1(existingBucket) && isRecord$1(existingBucket.files) ? existingBucket.files : {};
 			const ourFiles = {};
 			for (const [fileKey, diagnostics] of entries) ourFiles[fileKey] = diagnostics;
 			const cappedEntries = Object.entries({
@@ -42060,7 +42065,7 @@ const createFileLintCache = (cacheDirectory, rulesetHash) => {
 			};
 			atomicWriteJson(cacheFilePath, {
 				version: 1,
-				rulesets: Object.fromEntries(Object.entries(rulesets).filter(([, bucket]) => isRecord$2(bucket) && typeof bucket.updatedAtMs === "number").sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8))
+				rulesets: Object.fromEntries(Object.entries(rulesets).filter(([, bucket]) => isRecord$1(bucket) && typeof bucket.updatedAtMs === "number").sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8))
 			});
 		}
 	};
@@ -42938,21 +42943,33 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	const totalFileCount = fileBatches.reduce((sum, batch) => sum + batch.length, 0);
 	const runBatchPass = async (concurrency) => {
 		const allDiagnostics = [];
 		const droppedFiles = [];
+		const deadlineSkippedFiles = [];
+		const isPastDeadline = () => deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(deadlineEpochMs) === 0;
 		let firstDropReason = null;
-		const spawnLintBatch = async (batch, depth, splitBudget) => {
+		const spawnLintBatch = async (batch, depth, batchState) => {
+			if (isPastDeadline()) {
+				deadlineSkippedFiles.push(...batch);
+				batchState.deadlineSkippedFileCount += batch.length;
+				return [];
+			}
 			const batchArgs = [...baseArgs, ...batch];
 			try {
 				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory);
 			} catch (error) {
 				if (!isSplittableReactDoctorError(error)) throw error;
-				splitBudget.deadlineMs ??= Date.now() + splitTotalBudgetMs;
-				const isBudgetElapsed = Date.now() >= splitBudget.deadlineMs;
+				if (isPastDeadline()) {
+					deadlineSkippedFiles.push(...batch);
+					batchState.deadlineSkippedFileCount += batch.length;
+					return [];
+				}
+				batchState.deadlineMs ??= Date.now() + splitTotalBudgetMs;
+				const isBudgetElapsed = Date.now() >= batchState.deadlineMs;
 				const isDepthCapReached = depth >= splitMaxDepth;
 				if (batch.length <= 1 || isBudgetElapsed || isDepthCapReached) {
 					droppedFiles.push(...batch);
@@ -42965,7 +42982,7 @@ const spawnLintBatches = async (input) => {
 					return [];
 				}
 				const splitIndex = Math.ceil(batch.length / 2);
-				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1, splitBudget), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1, splitBudget)];
+				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1, batchState), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1, batchState)];
 			}
 		};
 		let startedFileCount = 0;
@@ -42981,9 +42998,17 @@ const spawnLintBatches = async (input) => {
 		progressTimer?.unref?.();
 		try {
 			const batchResults = await mapWithConcurrency(fileBatches, concurrency, async (batch) => {
+				if (isPastDeadline()) {
+					deadlineSkippedFiles.push(...batch);
+					return [];
+				}
 				startedFileCount += batch.length;
-				const batchDiagnostics = await spawnLintBatch(batch, 0, { deadlineMs: null });
-				scannedFileCount += batch.length;
+				const batchState = {
+					deadlineMs: null,
+					deadlineSkippedFileCount: 0
+				};
+				const batchDiagnostics = await spawnLintBatch(batch, 0, batchState);
+				scannedFileCount += batch.length - batchState.deadlineSkippedFileCount;
 				if (onFileProgress) {
 					displayedFileCount = Math.min(Math.max(displayedFileCount, scannedFileCount), totalFileCount);
 					onFileProgress(displayedFileCount, totalFileCount);
@@ -42994,12 +43019,13 @@ const spawnLintBatches = async (input) => {
 		} finally {
 			if (progressTimer !== null) clearInterval(progressTimer);
 		}
-		if (droppedFiles.length > 0 && onPartialFailure) {
-			const previewFiles = droppedFiles.slice(0, 3).join(", ");
-			const remainderHint = droppedFiles.length > 3 ? `, +${droppedFiles.length - 3} more` : "";
-			const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
-			onPartialFailure(`${droppedFiles.length} file(s) failed to lint and were skipped (${previewFiles}${remainderHint})${reasonHint}`);
-		}
+		const reportSkippedFiles = (skippedFiles, buildMessage) => {
+			if (skippedFiles.length === 0 || !onPartialFailure) return;
+			onPartialFailure(buildMessage(`${skippedFiles.slice(0, 3).join(", ")}${skippedFiles.length > 3 ? `, +${skippedFiles.length - 3} more` : ""}`));
+		};
+		const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
+		reportSkippedFiles(droppedFiles, (fileListPreview) => `${droppedFiles.length} file(s) failed to lint and were skipped (${fileListPreview})${reasonHint}`);
+		reportSkippedFiles(deadlineSkippedFiles, (fileListPreview) => `${deadlineSkippedFiles.length} file(s) skipped — max scan duration reached before they were linted (${fileListPreview})`);
 		return allDiagnostics;
 	};
 	let diagnostics;
@@ -43203,7 +43229,8 @@ const runOxlint = async (options) => {
 				spawnTimeoutMs,
 				outputMaxBytes,
 				concurrency: options.concurrency,
-				signal: options.signal
+				signal: options.signal,
+				deadlineEpochMs: options.deadlineEpochMs
 			});
 			writeOxlintConfig(passConfigPath, buildConfigForPass({}));
 			try {
@@ -43302,7 +43329,8 @@ const runOxlint = async (options) => {
 			spawnTimeoutMs,
 			outputMaxBytes,
 			concurrency: options.concurrency,
-			signal: options.signal
+			signal: options.signal,
+			deadlineEpochMs: options.deadlineEpochMs
 		});
 		writeOxlintConfig(configPath, buildConfig({ extendsPaths }));
 		try {
@@ -43406,7 +43434,8 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 				outputMaxBytes,
 				concurrency,
 				signal,
-				lintBatchOrdering
+				lintBatchOrdering,
+				deadlineEpochMs: input.deadlineEpochMs
 			}),
 			catch: ensureReactDoctorError
 		});
@@ -44166,6 +44195,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
 	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
+	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
 	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeOverlapMode = yield* DeadCodeOverlap;
 	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
@@ -44195,7 +44225,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	});
 	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
 		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
-		phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs)
+		phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs))
 	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
@@ -44220,7 +44250,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		onCacheStats: (cacheHitFileCount, totalConsideredFileCount) => {
 			lintCacheHitFileCount = cacheHitFileCount;
 			lintCacheTotalFileCount = totalConsideredFileCount;
-		}
+		},
+		deadlineEpochMs: input.deadlineEpochMs
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
 		yield* set(lintFailure, {
 			didFail: true,
@@ -44247,7 +44278,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	let deadCodeCollected = [];
 	if (lintFailureState.didFail) {
 		if (deadCodeFiber !== null) yield* interrupt(deadCodeFiber);
-	} else if (shouldRunDeadCode) {
+	} else if (shouldRunDeadCode) if (input.deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(input.deadlineEpochMs) === 0) {
+		if (deadCodeFiber !== null) yield* interrupt(deadCodeFiber);
+		yield* set(deadCodeFailure, {
+			didFail: true,
+			reason: "Dead-code analysis skipped — max scan duration reached."
+		});
+	} else {
 		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
 		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
 			sourceFileCount: totalFileCount,
@@ -44256,7 +44293,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		});
 		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
 			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
-			phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs)
+			phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs))
 		});
 	}
 	const deadCodeFailureState = lintFailureState.didFail ? {
@@ -44294,7 +44331,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	};
 	const scoreSurface = input.scoreSurface ?? "score";
 	const scoreDiagnostics = filterDiagnosticsForSurface([...finalDiagnostics], scoreSurface, resolvedConfig.config);
-	const score = lintFailureState.didFail ? null : yield* scoreService.compute({
+	const score = lintFailureState.didFail || deadCodeFailureState.didFail ? null : yield* scoreService.compute({
 		diagnostics: scoreDiagnostics,
 		isCi: input.isCi,
 		metadata: scoreMetadata
@@ -44687,6 +44724,7 @@ const buildJsonReport = (input) => {
 	return {
 		schemaVersion: 1,
 		mode: input.mode,
+		...input.baselineDegraded ? { baselineDegraded: true } : {},
 		...shared
 	};
 };
@@ -45194,7 +45232,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.5.8-dev.80e3093";
+const VERSION = "0.5.8-dev.8232e96";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -45563,13 +45601,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.8-dev.80e3093`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.8-dev.8232e96`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.8-dev.80e3093") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.8-dev.8232e96") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -45777,7 +45815,7 @@ const runGit = (projectRoot, args) => {
 	}
 };
 const resolveGitPath = (baseDirectory, value) => Path.isAbsolute(value) ? value : Path.resolve(baseDirectory, value);
-const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const getPackageJsonPath = (projectRoot) => Path.join(projectRoot, PACKAGE_JSON_FILE_NAME);
 const readPackageJson = (projectRoot) => {
 	try {
@@ -45791,25 +45829,25 @@ const writeJsonFile = (filePath, value) => {
 };
 const packageHasDependency = (projectRoot, dependencyName) => {
 	const packageJson = readPackageJson(projectRoot);
-	if (!isRecord$1(packageJson)) return false;
+	if (!isRecord(packageJson)) return false;
 	return [
 		"dependencies",
 		"devDependencies",
 		"optionalDependencies"
 	].some((fieldName) => {
 		const dependencies = packageJson[fieldName];
-		return isRecord$1(dependencies) && typeof dependencies[dependencyName] === "string";
+		return isRecord(dependencies) && typeof dependencies[dependencyName] === "string";
 	});
 };
 const packageHasRecordKey = (projectRoot, key) => {
 	const packageJson = readPackageJson(projectRoot);
-	return isRecord$1(packageJson) && isRecord$1(packageJson[key]);
+	return isRecord(packageJson) && isRecord(packageJson[key]);
 };
 const packageHasNestedRecordKey = (projectRoot, key, nestedKey) => {
 	const packageJson = readPackageJson(projectRoot);
-	if (!isRecord$1(packageJson)) return false;
+	if (!isRecord(packageJson)) return false;
 	const value = packageJson[key];
-	return isRecord$1(value) && isRecord$1(value[nestedKey]);
+	return isRecord(value) && isRecord(value[nestedKey]);
 };
 const ensureTrailingNewline = (content) => content.endsWith("\n") ? content : `${content}\n`;
 //#endregion
@@ -48849,31 +48887,31 @@ const findNearestPackageDirectory = (startDirectory, stopDirectory) => {
 };
 const hasDoctorScript = (projectRoot) => {
 	const packageJson = readPackageJson(findNearestPackageDirectory(projectRoot) ?? projectRoot);
-	if (!isRecord$1(packageJson)) return false;
+	if (!isRecord(packageJson)) return false;
 	const scripts = packageJson.scripts;
-	if (!isRecord$1(scripts)) return false;
+	if (!isRecord(scripts)) return false;
 	return isReactDoctorScriptCommand(scripts[DOCTOR_SCRIPT_NAME]) || isReactDoctorScriptCommand(scripts[FALLBACK_DOCTOR_SCRIPT_NAME]);
 };
 const hasDoctorDependency = (packageJson) => DEPENDENCY_FIELD_NAMES.some((fieldName) => {
 	const dependencies = packageJson[fieldName];
-	return isRecord$1(dependencies) && Object.hasOwn(dependencies, "react-doctor");
+	return isRecord(dependencies) && Object.hasOwn(dependencies, "react-doctor");
 });
 const installDoctorScript = (options) => {
 	const packageDirectory = findNearestPackageDirectory(options.projectRoot) ?? options.projectRoot;
 	const packageJsonPath = getPackageJsonPath(packageDirectory);
 	const packageJson = readPackageJson(packageDirectory);
-	if (!isRecord$1(packageJson)) return {
+	if (!isRecord(packageJson)) return {
 		packageJsonPath,
 		scriptStatus: "skipped",
 		scriptReason: "missing-or-invalid-package-json"
 	};
 	const scripts = packageJson.scripts;
 	const scriptTarget = (() => {
-		if (scripts !== void 0 && !isRecord$1(scripts)) return {
+		if (scripts !== void 0 && !isRecord(scripts)) return {
 			status: "skipped",
 			reason: "invalid-scripts"
 		};
-		const scriptRecord = isRecord$1(scripts) ? scripts : {};
+		const scriptRecord = isRecord(scripts) ? scripts : {};
 		if (isReactDoctorScriptCommand(scriptRecord[DOCTOR_SCRIPT_NAME])) return {
 			scriptName: DOCTOR_SCRIPT_NAME,
 			status: "existing"
@@ -48907,7 +48945,7 @@ const installDoctorScript = (options) => {
 	if (scriptStatus === "created") writeJsonFile(packageJsonPath, {
 		...packageJson,
 		scripts: {
-			...isRecord$1(scripts) ? scripts : {},
+			...isRecord(scripts) ? scripts : {},
 			[scriptTarget.scriptName ?? DOCTOR_SCRIPT_NAME]: DOCTOR_SCRIPT_COMMAND
 		}
 	});
@@ -55991,7 +56029,10 @@ jobs:
   react-doctor:
     runs-on: ubuntu-latest
     steps:
+      # fetch-depth: 0 gives React Doctor the full git history it needs to find the merge base with the target branch. Without it a shallow checkout has no merge base, so PR runs can't compare against the base and fall back to reporting every issue in the changed files (pre-existing ones included) instead of only the ones the PR introduced.
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
 
       - uses: millionco/react-doctor@${actionRef}
         # Advisory by default: React Doctor reports findings on every PR — a
@@ -56289,7 +56330,10 @@ jobs:
   react-doctor:
     runs-on: ubuntu-latest
     steps:
+      # fetch-depth: 0 gives React Doctor the full git history it needs to find the merge base with the target branch. Without it a shallow checkout has no merge base, so PR runs can't compare against the base and fall back to reporting every issue in the changed files (pre-existing ones included) instead of only the ones the PR introduced.
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
 
       - uses: millionco/react-doctor@${actionRef}
 ${WITH_INDENT}with:
@@ -56332,12 +56376,8 @@ const parseGate$1 = (content) => {
 	};
 };
 const surgicalApplyGate = (content, gate) => {
-	let doc;
-	try {
-		doc = import_dist.parseDocument(content);
-	} catch {
-		return null;
-	}
+	const doc = import_dist.parseDocument(content);
+	if (doc.errors.length > 0) return null;
 	const located = findReactDoctorStep(doc);
 	if (located === null) return null;
 	let withMap = located.withMap;
@@ -56745,23 +56785,20 @@ const promptForGate = async (provider, currentGate, prompt) => {
 const openCiPullRequest = async (params) => {
 	const pullRequestSpinner = spinner("Opening a pull request for review...").start();
 	const result = await openWorkflowPullRequest(params);
-	if (result.status === "pr-opened") {
-		pullRequestSpinner.succeed(`Opened pull request for review: ${highlighter.info(result.url)}`);
-		return "pr";
-	}
-	if (result.status === "pr-exists") {
-		pullRequestSpinner.succeed(`A React Doctor pull request is already open: ${highlighter.info(result.url)}`);
-		return "pr";
-	}
-	if (result.status === "branch-pushed") {
-		pullRequestSpinner.warn(`Pushed ${highlighter.bold(result.branch)} but couldn't open a PR. Open one with: gh pr create --head ${result.branch}`);
-		return "pr";
+	if (result.status === "pr-opened") pullRequestSpinner.succeed(`Opened pull request for review: ${highlighter.info(result.url)}`);
+	else if (result.status === "pr-exists") pullRequestSpinner.succeed(`A React Doctor pull request is already open: ${highlighter.info(result.url)}`);
+	else if (result.status === "branch-pushed") pullRequestSpinner.warn(`Pushed ${highlighter.bold(result.branch)} but couldn't open a PR. Open one with: gh pr create --head ${result.branch}`);
+	else {
+		pullRequestSpinner.stop();
+		const didStage = await stageWorkflowFile({
+			workflowPath: params.workflowPath,
+			run: params.run
+		});
+		cliLogger.dim(didStage ? "  Staged the change. Commit it to apply." : "  Review and commit the change to apply it.");
 	}
-	pullRequestSpinner.stop();
-	const didStage = await stageWorkflowFile({ workflowPath: params.workflowPath });
-	cliLogger.dim(didStage ? "  Staged the change. Commit it to apply." : "  Review and commit the change to apply it.");
-	return "tree";
+	return result.status;
 };
+const pullRequestMode = (status) => status === "not-attempted" ? "tree" : "pr";
 const runCiInstall = async (options = {}) => {
 	const projectRoot = resolveProjectRoot$1(options);
 	const prompt = options.prompt ?? prompts;
@@ -56800,10 +56837,12 @@ const runCiInstall = async (options = {}) => {
 	}
 	scaffoldSpinner.succeed(`Added ${provider.fileLabel}.`);
 	let mode = "tree";
-	if (provider.supportsPullRequest && options.pr) mode = await openCiPullRequest({
+	if (provider.supportsPullRequest && options.pr) mode = pullRequestMode(await openCiPullRequest({
 		workflowPath: result.path,
-		baseBranch: defaultBranch
-	});
+		baseBranch: defaultBranch,
+		run: options.run,
+		checkCommandAvailable: options.checkCommandAvailable
+	}));
 	else cliLogger.dim("  Review and commit it to start scanning every pull request.");
 	printGateSummary(provider, gate);
 	cliLogger.log(`  Learn more: ${highlighter.info(setupDocsUrl(provider))}`);
@@ -56849,11 +56888,28 @@ const runCiUpgrade = async (options = {}) => {
 			process.exitCode = 1;
 			return;
 		}
-		mode = await openCiPullRequest({
+		const status = await openCiPullRequest({
 			workflowPath: workflow.path,
 			baseBranch: await detectDefaultBranch(projectRoot, run) ?? "main",
-			...upgradeCopy
+			...upgradeCopy,
+			run: options.run,
+			checkCommandAvailable: options.checkCommandAvailable
 		});
+		if (status === "pr-exists") {
+			try {
+				NFS.writeFileSync(workflow.path, workflow.content);
+			} catch {
+				cliLogger.dim("  The upgrade edit is still in your working tree — review and commit it.");
+				return;
+			}
+			cliLogger.dim(`  Merge or close that PR, then re-run ${highlighter.info("react-doctor ci upgrade")} if the workflow still needs it.`);
+			recordCount(METRIC.ciUpgraded, 1, {
+				provider: provider.id,
+				mode: "pr-exists"
+			});
+			return;
+		}
+		mode = pullRequestMode(status);
 	} else {
 		const upgradeSpinner = spinner("Upgrading workflow to @v2...").start();
 		try {
@@ -56951,7 +57007,6 @@ const runCiConfig = async (options = {}) => {
 };
 //#endregion
 //#region src/cli/utils/is-environment-error.ts
-const isNodeSystemError = (error) => error instanceof Error && typeof error.code === "string";
 const ENVIRONMENT_ERROR_CODES = new Set([
 	"ENOSPC",
 	"EIO",
@@ -56961,12 +57016,12 @@ const ENVIRONMENT_ERROR_CODES = new Set([
 	"ENOTDIR"
 ]);
 const isEnvironmentError = (error) => {
-	if (!isNodeSystemError(error)) return false;
+	if (!isErrnoException(error) || typeof error.code !== "string") return false;
 	if (error.code === "ENOENT") return error.syscall?.startsWith("spawn") ?? false;
-	return error.code !== void 0 && ENVIRONMENT_ERROR_CODES.has(error.code);
+	return ENVIRONMENT_ERROR_CODES.has(error.code);
 };
 const formatEnvironmentError = (error) => {
-	if (!isNodeSystemError(error)) return error instanceof Error ? error.message : String(error);
+	if (!isErrnoException(error)) return messageFromUnknown(error);
 	switch (error.code) {
 		case "ENOSPC": return "No space left on device. Free up disk space and try again.";
 		case "EIO": return "I/O error: the filesystem or disk may be failing. Check your system logs.";
@@ -57069,7 +57124,7 @@ const handleError = (error, options = {}) => {
 */
 const handleUserError = (error, options = {}) => {
 	const isEnvError = isEnvironmentError(error);
-	if (isEnvError) recordCount(METRIC.cliEnvironmentError, 1, { code: error.code ?? "unknown" });
+	if (isEnvError) recordCount(METRIC.cliEnvironmentError, 1, { code: (isErrnoException(error) ? error.code : void 0) ?? "unknown" });
 	const message = isEnvError ? formatEnvironmentError(error) : formatErrorForReport(error);
 	runSync(gen(function* () {
 		yield* error$1("");
@@ -57583,7 +57638,7 @@ const recordScanMetrics = (input) => {
 	});
 	if (result.diagnostics.length === 0 && !hasSkippedChecks) recordCount(METRIC.scanClean, 1, { mode: input.mode });
 	if (result.score) recordDistribution(METRIC.scanScore, result.score.score, { attributes: { mode: input.mode } });
-	else if (!input.noScore && !input.didLintFail) recordCount(METRIC.scoreUnavailable, 1, { mode: input.mode });
+	else if (!input.noScore && !input.didLintFail && !input.didDeadCodeFail) recordCount(METRIC.scoreUnavailable, 1, { mode: input.mode });
 	if (input.baselineDegraded) recordCount(METRIC.baselineDegraded, 1);
 	if (input.didLintFail) recordCount(METRIC.lintFailed, 1, { reasonKind: input.lintFailureReasonKind });
 	if (input.didDeadCodeFail) recordCount(METRIC.deadCodeFailed, 1);
@@ -57772,6 +57827,7 @@ const buildOutcomeAttributes = (input) => {
 			failureReasonKind: input.lintFailureReasonKind ?? null,
 			partialFailureCount: input.lintPartialFailureCount ?? null,
 			droppedFileCount: input.lintDroppedFileCount ?? null,
+			deadlineSkippedFileCount: input.lintDeadlineSkippedFileCount ?? null,
 			cacheHitFiles: result.lintCacheHitFileCount ?? null,
 			cacheTotalFiles: result.lintCacheTotalFileCount ?? null,
 			cacheHitRatio: result.lintCacheTotalFileCount != null && result.lintCacheTotalFileCount > 0 ? (result.lintCacheHitFileCount ?? 0) / result.lintCacheTotalFileCount : null
@@ -57819,6 +57875,7 @@ const buildScanAttributes = (input) => {
 		scope: input.scope,
 		parallel: input.parallel,
 		workerCount: input.workerCount ?? null,
+		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
 		deadCode: input.deadCode,
 		scoreOnly: input.scoreOnly,
@@ -57884,13 +57941,20 @@ const resolveWorkerTelemetry = (resolvedWorkerCount, pinnedConcurrency) => {
 	};
 };
 //#endregion
-//#region src/cli/utils/count-dropped-lint-files.ts
-const DROPPED_FILES_MESSAGE_PATTERN = /^(\d+) file\(s\) failed to lint and were skipped/;
-const countDroppedLintFiles = (lintPartialFailures) => lintPartialFailures.reduce((total, message) => {
-	const match = DROPPED_FILES_MESSAGE_PATTERN.exec(message);
+//#region src/cli/utils/sum-file-counts-matching.ts
+const sumFileCountsMatching = (messages, countPattern) => messages.reduce((total, message) => {
+	const match = countPattern.exec(message);
 	return match ? total + Number(match[1]) : total;
 }, 0);
 //#endregion
+//#region src/cli/utils/count-deadline-skipped-files.ts
+const DEADLINE_SKIPPED_MESSAGE_PATTERN = /^(\d+) file\(s\) skipped — max scan duration reached/;
+const countDeadlineSkippedFiles = (lintPartialFailures) => sumFileCountsMatching(lintPartialFailures, DEADLINE_SKIPPED_MESSAGE_PATTERN);
+//#endregion
+//#region src/cli/utils/count-dropped-lint-files.ts
+const DROPPED_FILES_MESSAGE_PATTERN = /^(\d+) file\(s\) failed to lint and were skipped/;
+const countDroppedLintFiles = (lintPartialFailures) => sumFileCountsMatching(lintPartialFailures, DROPPED_FILES_MESSAGE_PATTERN);
+//#endregion
 //#region src/cli/utils/materialize-baseline-files.ts
 /**
 * Materializes the `ref` version of `files` into `tempDirectory` (via
@@ -58529,7 +58593,7 @@ const foldLegacyDecisions = (projects, legacy, eventId) => {
 	}
 };
 const migrateCliState = (state) => {
-	if (state.schemaVersion === 2) return state;
+	if (typeof state.schemaVersion === "number" && state.schemaVersion >= 2) return state;
 	const projects = {};
 	for (const [hash, record] of Object.entries(state.projects ?? {})) {
 		const carried = {
@@ -58567,7 +58631,9 @@ const openStore = (options = {}) => new Conf({
 });
 const openMigratedStore = (options) => {
 	const store = openStore(options);
-	if (store.store.schemaVersion !== 2) store.store = migrateCliState(store.store);
+	const state = store.store;
+	const migrated = migrateCliState(state);
+	if (migrated !== state) store.store = migrated;
 	return store;
 };
 const readCliState = (select, fallback, options = {}) => {
@@ -59062,7 +59128,6 @@ const TOOLCHAIN_PACKAGE_SPECIFIERS = [
 	"eslint-plugin-react-hooks/package.json"
 ];
 const bundledRequire = createRequire(import.meta.url);
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const normalizeForStableJson = (value) => {
 	if (value === null) return null;
 	if (value === void 0) return void 0;
@@ -59075,10 +59140,10 @@ const normalizeForStableJson = (value) => {
 	});
 	const prototype = Object.getPrototypeOf(value);
 	if (prototype !== Object.prototype && prototype !== null) throw new Error("Unsupported cache key object");
-	const record = value;
+	if (!isRecord(value)) throw new Error("Unsupported cache key object");
 	const normalizedRecord = {};
-	for (const key of Object.keys(record).sort()) {
-		const normalized = normalizeForStableJson(record[key]);
+	for (const key of Object.keys(value).sort()) {
+		const normalized = normalizeForStableJson(value[key]);
 		if (normalized !== void 0) normalizedRecord[key] = normalized;
 	}
 	return normalizedRecord;
@@ -59296,6 +59361,7 @@ const mergeInspectOptions = (inputOptions, userConfig) => ({
 	suppressRendering: inputOptions.suppressRendering ?? false,
 	concurrentScan: inputOptions.concurrentScan ?? false,
 	concurrency: inputOptions.concurrency,
+	maxDurationMs: inputOptions.maxDurationMs ?? null,
 	baseline: inputOptions.baseline ?? null,
 	changedLineRanges: inputOptions.changedLineRanges ?? null,
 	supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false
@@ -59311,6 +59377,7 @@ const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorke
 		scope: deriveScope(options),
 		parallel,
 		workerCount,
+		maxDurationMs: options.maxDurationMs,
 		lint: options.lint,
 		deadCode: options.deadCode,
 		scoreOnly: options.scoreOnly,
@@ -59325,6 +59392,7 @@ const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorke
 };
 const inspect = async (directory, inputOptions = {}) => {
 	const startTime = performance$1.now();
+	const deadlineEpochMs = inputOptions.deadlineEpochMs ?? (inputOptions.maxDurationMs != null ? Date.now() + inputOptions.maxDurationMs : null);
 	const isConcurrentScan = inputOptions.concurrentScan === true;
 	if (!isConcurrentScan) resetSentryRunState();
 	const hasConfigOverride = inputOptions.configOverride !== void 0;
@@ -59348,7 +59416,7 @@ const inspect = async (directory, inputOptions = {}) => {
 	try {
 		const result = await withSentryRunSpan(async (rootSentrySpan) => {
 			try {
-				return await runInspectWithRuntime(scanDirectory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, rootSentrySpan);
+				return await runInspectWithRuntime(scanDirectory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, deadlineEpochMs, rootSentrySpan);
 			} catch (error) {
 				recordRunEvent(rootSentrySpan, {
 					...buildRunEventConfig(options, userConfig, userConfig !== null),
@@ -59364,6 +59432,7 @@ const inspect = async (directory, inputOptions = {}) => {
 		if (ownsSpinnerSilence) setSpinnerSilent(wasSpinnerSilent);
 	}
 };
+const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(lintPartialFailures) + countDeadlineSkippedFiles(lintPartialFailures);
 /**
 * Runs a second, lint-only scan over the changed files as they existed at the
 * baseline ref (materialized into a temp tree with head's config) and diffs it
@@ -59390,7 +59459,7 @@ const runBaselineComparison = async (params) => {
 			directory: snapshot.tempDirectory,
 			hasConfigOverride: true,
 			userConfig: params.userConfig,
-			configSourceDirectory: null,
+			configSourceDirectory: params.configSourceDirectory,
 			projectInfoOverride: params.headProjectInfo,
 			shouldSkipLint: !params.options.lint || !params.resolvedNodeBinaryPath,
 			shouldRunDeadCode: false,
@@ -59413,9 +59482,10 @@ const runBaselineComparison = async (params) => {
 			runId: getRunId(),
 			resolveLocalGithubViewerPermission: false,
 			suppressScanSummary: true,
-			supplyChainManifestChanged: params.options.supplyChainManifestChanged
+			supplyChainManifestChanged: params.options.supplyChainManifestChanged,
+			deadlineEpochMs: params.deadlineEpochMs ?? void 0
 		}, {}).pipe(provide(baseLayers), provideService$2(Console, silentConsole))));
-		if (baseOutput.didLintFail) return null;
+		if (baseOutput.didLintFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
 		const delta = computeDiagnosticDelta({
 			headDiagnostics: params.headDiagnostics,
 			baseDiagnostics: baseOutput.diagnostics,
@@ -59434,7 +59504,7 @@ const runBaselineComparison = async (params) => {
 		snapshot.cleanup();
 	}
 };
-const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, rootSentrySpan) => {
+const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, deadlineEpochMs, rootSentrySpan) => {
 	const isDiffMode = options.includePaths.length > 0;
 	const resolvedNodeBinaryPath = await resolveOxlintNode(options.lint, options.scoreOnly || options.silent);
 	const lintBindingMissing = options.lint && !resolvedNodeBinaryPath;
@@ -59500,7 +59570,8 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		resolveLocalGithubViewerPermission: !options.noScore,
 		suppressScanSummary: options.suppressRendering,
 		supplyChainManifestChanged: options.supplyChainManifestChanged,
-		concurrentScan: options.concurrentScan
+		concurrentScan: options.concurrentScan,
+		deadlineEpochMs: deadlineEpochMs ?? void 0
 	}, { beforeLint: (projectInfo, lintIncludePaths) => gen(function* () {
 		recordSentryProjectContext(projectInfo, rootSentrySpan, { concurrentScan: options.concurrentScan });
 		recordCount(METRIC.projectDetected, 1);
@@ -59521,15 +59592,17 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	else runConsole(error$1(highlighter.error(lintFailureReason)));
 	let inspectDiagnostics = output.diagnostics;
 	let baselineDelta;
-	if (options.baseline && isDiffMode && !didLintFail) {
+	if (options.baseline && isDiffMode && !didLintFail && countIncompleteLintFiles(output.lintPartialFailures) === 0) {
 		const comparison = await runBaselineComparison({
 			directory,
 			options,
 			userConfig,
+			configSourceDirectory,
 			headProjectInfo: output.project,
 			headDiagnostics: output.diagnostics,
 			resolvedNodeBinaryPath,
-			baselineRef: options.baseline.ref
+			baselineRef: options.baseline.ref,
+			deadlineEpochMs
 		});
 		if (comparison) {
 			inspectDiagnostics = comparison.displayDiagnostics;
@@ -59563,7 +59636,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		securityScanFailed: output.securityScanFailed,
 		suppressedRuleCounts: output.suppressedRuleCounts
 	};
-	if (cacheKey !== null && scanResultCache !== null && shouldStoreScanPayload(payload)) scanResultCache.store(cacheKey, payload);
+	if (cacheKey !== null && scanResultCache !== null && shouldStoreScanPayload(payload) && !baselineDegraded) scanResultCache.store(cacheKey, payload);
 	const result = await renderAndRecordScan({
 		payload,
 		options,
@@ -59637,6 +59710,7 @@ const renderAndRecordScan = async (input) => {
 		lintFailureReasonKind: input.payload.lintFailureReasonKind,
 		lintPartialFailureCount: input.payload.lintPartialFailures.length,
 		lintDroppedFileCount: countDroppedLintFiles(input.payload.lintPartialFailures),
+		lintDeadlineSkippedFileCount: countDeadlineSkippedFiles(input.payload.lintPartialFailures),
 		didDeadCodeFail: input.payload.didDeadCodeFail,
 		supplyChainOverlapTimedOut: input.payload.supplyChainOverlapTimedOut,
 		securityScanFailed: input.payload.securityScanFailed,
@@ -59752,7 +59826,7 @@ const getStagedSourceFiles = async (directory) => {
 			return yield* (yield* StagedFiles).discoverSourceFiles(directory);
 		}).pipe(provide(stagedFilesLayer)))];
 	} catch (error) {
-		cliLogger.warn(`Failed to discover staged files: ${error instanceof Error ? error.message : String(error)}`);
+		cliLogger.warn(`Failed to discover staged files: ${messageFromUnknown(error)}`);
 		return [];
 	}
 };
@@ -59771,6 +59845,9 @@ const materializeStagedFiles = async (directory, stagedFiles, tempDirectory) =>
 	};
 };
 //#endregion
+//#region src/cli/utils/is-share-opted-out.ts
+const isShareOptedOut = (scans, flagNoScore) => Boolean(flagNoScore) || scans.some((scan) => Boolean(scan.config?.noScore) || scan.config?.share === false);
+//#endregion
 //#region src/cli/utils/build-handoff-payload.ts
 const buildHandoffPayload = (input) => {
 	const topGroups = buildSortedRuleGroups(input.diagnostics).slice(0, 3);
@@ -60053,6 +60130,8 @@ const CURSOR_HOOK_RELATIVE_PATH = ".cursor/hooks/react-doctor.mjs";
 const CURSOR_HOOK_COMMAND = "node .cursor/hooks/react-doctor.mjs";
 const CURSOR_HOOK_MATCHER = "Write|Edit|MultiEdit|ApplyPatch";
 const CURSOR_HOOKS_SCHEMA_VERSION = 1;
+const LEGACY_HOOK_SCRIPT_PATHS = [".claude/hooks/react-doctor.sh", ".cursor/hooks/react-doctor.sh"];
+const isLegacyHookCommand = (command) => typeof command === "string" && LEGACY_HOOK_SCRIPT_PATHS.some((legacyPath) => command.includes(legacyPath));
 const isSupportedAgent = (agent) => agent === CLAUDE_AGENT || agent === CURSOR_AGENT;
 const readJsonFile = (filePath, fallback) => {
 	if (!NFS.existsSync(filePath)) return fallback;
@@ -60065,11 +60144,24 @@ const readJsonFile = (filePath, fallback) => {
 		throw error;
 	}
 };
+const readJsonFileSafely = (filePath, fallback) => {
+	try {
+		return readJsonFile(filePath, fallback);
+	} catch {
+		return fallback;
+	}
+};
+const findAgentsWithLegacyShellHooks = (projectRoot) => {
+	const agents = [];
+	if ((readJsonFileSafely(Path.join(projectRoot, CLAUDE_SETTINGS_RELATIVE_PATH), {}).hooks?.PostToolBatch ?? []).some((group) => (group.hooks ?? []).some((hook) => isLegacyHookCommand(hook.command)))) agents.push(CLAUDE_AGENT);
+	if ((readJsonFileSafely(Path.join(projectRoot, CURSOR_HOOKS_RELATIVE_PATH), {}).hooks?.postToolUse ?? []).some((handler) => isLegacyHookCommand(handler.command))) agents.push(CURSOR_AGENT);
+	return agents;
+};
 const ensureDirectoryExists = (directoryPath) => {
 	try {
 		NFS.mkdirSync(directoryPath, { recursive: true });
 	} catch (error) {
-		const code = error.code;
+		const code = isErrnoException(error) ? error.code : void 0;
 		if (code === "EACCES" || code === "EPERM") throw new CliInputError(`Could not create directory ${directoryPath}: permission denied. Ensure you have write permissions for this location and re-run the install command.`);
 		if (code === "ENOTDIR" || code === "EEXIST") throw new CliInputError(`Could not create directory ${directoryPath}: a file exists at this path or one of its parent paths. Remove the conflicting file and re-run the install command.`);
 		throw error;
@@ -60082,6 +60174,9 @@ const writeJsonFileWithDirectoryCheck = (filePath, value) => {
 const writeHookScript = (filePath) => {
 	ensureDirectoryExists(Path.dirname(filePath));
 	NFS.writeFileSync(filePath, buildAgentHookScript());
+	try {
+		NFS.rmSync(filePath.replace(/\.mjs$/, ".sh"), { force: true });
+	} catch {}
 };
 const hasClaudeHookCommand = (groups) => groups.some((group) => (group.hooks ?? []).some((hook) => hook.command === CLAUDE_HOOK_COMMAND));
 const installClaudeHook = (projectRoot) => {
@@ -60089,7 +60184,15 @@ const installClaudeHook = (projectRoot) => {
 	const hookPath = Path.join(projectRoot, CLAUDE_HOOK_RELATIVE_PATH);
 	const settings = readJsonFile(settingsPath, {});
 	const hooks = { ...settings.hooks ?? {} };
-	const postToolBatchHooks = [...hooks.PostToolBatch ?? []];
+	const postToolBatchHooks = (hooks.PostToolBatch ?? []).flatMap((group) => {
+		const groupHooks = group.hooks ?? [];
+		const keptHooks = groupHooks.filter((hook) => !isLegacyHookCommand(hook.command));
+		if (keptHooks.length === groupHooks.length) return [group];
+		return keptHooks.length > 0 ? [{
+			...group,
+			hooks: keptHooks
+		}] : [];
+	});
 	if (!hasClaudeHookCommand(postToolBatchHooks)) postToolBatchHooks.push({ hooks: [{
 		type: "command",
 		command: CLAUDE_HOOK_COMMAND
@@ -60108,7 +60211,7 @@ const installCursorHook = (projectRoot) => {
 	const hookPath = Path.join(projectRoot, CURSOR_HOOK_RELATIVE_PATH);
 	const config = readJsonFile(configPath, {});
 	const hooks = { ...config.hooks ?? {} };
-	const postToolUseHooks = [...hooks.postToolUse ?? []];
+	const postToolUseHooks = (hooks.postToolUse ?? []).filter((handler) => !isLegacyHookCommand(handler.command));
 	if (!hasCursorHookCommand(postToolUseHooks)) postToolUseHooks.push({
 		command: CURSOR_HOOK_COMMAND,
 		matcher: CURSOR_HOOK_MATCHER,
@@ -60124,7 +60227,7 @@ const installCursorHook = (projectRoot) => {
 	return [configPath, hookPath];
 };
 const buildAgentHookScript = () => [
-	"import { readFileSync, writeFileSync, unlinkSync } from 'node:fs';",
+	"import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';",
 	"import { tmpdir } from 'node:os';",
 	"import { join, dirname } from 'node:path';",
 	"import { fileURLToPath } from 'node:url';",
@@ -60133,11 +60236,14 @@ const buildAgentHookScript = () => [
 	"const __filename = fileURLToPath(import.meta.url);",
 	"const __dirname = dirname(__filename);",
 	"",
+	"// --verbose scans on large diffs can exceed spawnSync's 1 MiB default.",
+	"const SPAWN_MAX_BUFFER_BYTES = 16 * 1024 * 1024;",
+	"",
 	"const EDIT_TOOL_NAMES = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'ApplyPatch']);",
 	"",
-	"const readStdin = () => {",
+	"const readFileOrEmpty = (source) => {",
 	"  try {",
-	"    return readFileSync(0, 'utf8');",
+	"    return readFileSync(source, 'utf8');",
 	"  } catch {",
 	"    return '';",
 	"  }",
@@ -60157,18 +60263,25 @@ const buildAgentHookScript = () => [
 	"  // Each candidate is a single shell command string (not an args array):",
 	"  // `shell: true` is required to run the Windows `.cmd` shims, and an args",
 	"  // array with `shell: true` trips Node's DEP0190. A missing command exits",
-	"  // 127 via the shell (no ENOENT error), so fall through on that. With no",
-	"  // runner found, exit 0 silently — stdout is parsed as the hook's JSON.",
+	"  // 127 via a POSIX shell (no ENOENT error) and 9009 via cmd.exe, so fall",
+	"  // through on those. The local bin is probed with existsSync (its `./`",
+	"  // prefix form is not runnable by cmd.exe at all). With no runner found,",
+	"  // exit 0 silently — stdout is parsed as the hook's JSON.",
+	"  const localBin = process.platform === 'win32'",
+	"    ? 'node_modules\\\\.bin\\\\react-doctor.cmd'",
+	"    : './node_modules/.bin/react-doctor';",
 	"  const commands = [",
-	"    './node_modules/.bin/react-doctor --verbose --scope changed --blocking warning --no-score',",
+	"    ...(existsSync(localBin)",
+	"      ? [localBin + ' --verbose --scope changed --blocking warning --no-score']",
+	"      : []),",
 	"    'react-doctor --verbose --scope changed --blocking warning --no-score',",
 	"    'pnpm dlx react-doctor@latest --verbose --scope changed --blocking warning --no-score',",
 	"    'npx --yes react-doctor@latest --verbose --scope changed --blocking warning --no-score',",
 	"  ];",
 	"",
 	"  for (const command of commands) {",
-	"    const result = spawnSync(command, { encoding: 'utf8', shell: true });",
-	"    if (result.error?.code === 'ENOENT' || result.status === 127) continue;",
+	"    const result = spawnSync(command, { encoding: 'utf8', shell: true, maxBuffer: SPAWN_MAX_BUFFER_BYTES });",
+	"    if (result.error?.code === 'ENOENT' || result.status === 127 || result.status === 9009) continue;",
 	"    try {",
 	"      writeFileSync(outputPath, (result.stdout || '') + (result.stderr || ''));",
 	"    } catch {}",
@@ -60187,8 +60300,7 @@ const buildAgentHookScript = () => [
 	"const main = () => {",
 	"  let input;",
 	"  try {",
-	"    const stdinContent = readStdin();",
-	"    input = JSON.parse(stdinContent || '{}');",
+	"    input = JSON.parse(readFileOrEmpty(0) || '{}');",
 	"  } catch {",
 	"    input = {};",
 	"  }",
@@ -60212,7 +60324,9 @@ const buildAgentHookScript = () => [
 	"    process.exit(0);",
 	"  }",
 	"",
-	"  const scanOutput = readFileSync(outputPath, 'utf8').trim();",
+	"  // The write above is best-effort (unwritable tmpdir), so the read is too",
+	"  // — a hook must never crash the agent loop with a stack trace.",
+	"  const scanOutput = readFileOrEmpty(outputPath).trim();",
 	"  cleanup(outputPath);",
 	"",
 	"  if (!scanOutput) {",
@@ -60253,7 +60367,9 @@ const installReactDoctorAgentHooks = (options) => {
 //#region src/cli/utils/install-git-hook-file.ts
 const REACT_DOCTOR_BLOCK_START = "# react-doctor hook start";
 const REACT_DOCTOR_BLOCK_END = "# react-doctor hook end";
-const REACT_DOCTOR_BLOCK_PATTERN = new RegExp(`(?:${REACT_DOCTOR_BLOCK_START}[\\s\\S]*?${REACT_DOCTOR_BLOCK_END}\\n?|# react-doctor hook launcher start[\\s\\S]*?# react-doctor hook launcher end\\n?)`);
+const REACT_DOCTOR_BLOCK_PATTERN_SOURCE = `(?:${REACT_DOCTOR_BLOCK_START}[\\s\\S]*?${REACT_DOCTOR_BLOCK_END}\\n?|# react-doctor hook launcher start[\\s\\S]*?# react-doctor hook launcher end\\n?)`;
+const REACT_DOCTOR_BLOCK_PATTERN = new RegExp(REACT_DOCTOR_BLOCK_PATTERN_SOURCE);
+const ALL_REACT_DOCTOR_BLOCKS_PATTERN = new RegExp(REACT_DOCTOR_BLOCK_PATTERN_SOURCE, "g");
 const SHEBANG = "#!/bin/sh";
 const SHEBANG_PREFIX = "#!";
 const LOCAL_REACT_DOCTOR_BIN = "./node_modules/.bin/react-doctor";
@@ -60297,7 +60413,16 @@ const buildReactDoctorHookBlock = () => [
 ].join("\n");
 const mergeHookContent = (existingContent) => {
 	const hookBlock = `${buildReactDoctorHookBlock()}\n`;
-	if (REACT_DOCTOR_BLOCK_PATTERN.test(existingContent)) return ensureTrailingNewline(existingContent.replace(REACT_DOCTOR_BLOCK_PATTERN, hookBlock));
+	if (REACT_DOCTOR_BLOCK_PATTERN.test(existingContent)) {
+		let isFirstManagedBlock = true;
+		return ensureTrailingNewline(existingContent.replace(ALL_REACT_DOCTOR_BLOCKS_PATTERN, () => {
+			if (isFirstManagedBlock) {
+				isFirstManagedBlock = false;
+				return hookBlock;
+			}
+			return "";
+		}));
+	}
 	if (existingContent.length === 0) return `${SHEBANG}\n\n${hookBlock}`;
 	const normalizedExistingContent = ensureTrailingNewline(existingContent);
 	if (normalizedExistingContent.startsWith(SHEBANG_PREFIX)) {
@@ -60350,13 +60475,13 @@ const installPackageJsonHook = (options, strategy) => {
 	const packageJsonPath = getPackageJsonPath(options.projectRoot);
 	const didHookExist = NFS.existsSync(packageJsonPath);
 	const packageJson = readPackageJson(options.projectRoot);
-	const nextPackageJson = isRecord$1(packageJson) ? { ...packageJson } : {};
+	const nextPackageJson = isRecord(packageJson) ? { ...packageJson } : {};
 	const parentKeys = strategy.path.slice(0, -1);
 	const leafKey = strategy.path[strategy.path.length - 1];
 	let parent = nextPackageJson;
 	for (const key of parentKeys) {
 		const existing = parent[key];
-		const cloned = isRecord$1(existing) ? { ...existing } : {};
+		const cloned = isRecord(existing) ? { ...existing } : {};
 		parent[key] = cloned;
 		parent = cloned;
 	}
@@ -60527,7 +60652,7 @@ const isHuskyProject = (projectRoot) => NFS.existsSync(Path.join(projectRoot, ".
 const isVitePlusProject = (projectRoot) => packageHasDependency(projectRoot, "vite-plus");
 const isSimpleGitHooksProject = (projectRoot) => {
 	const packageJson = readPackageJson(projectRoot);
-	return isRecord$1(packageJson) && isRecord$1(packageJson["simple-git-hooks"]) || packageHasDependency(projectRoot, "simple-git-hooks") || NFS.existsSync(Path.join(projectRoot, ".simple-git-hooks.cjs"));
+	return isRecord(packageJson) && isRecord(packageJson["simple-git-hooks"]) || packageHasDependency(projectRoot, "simple-git-hooks") || NFS.existsSync(Path.join(projectRoot, ".simple-git-hooks.cjs"));
 };
 const getLefthookConfigPath = (projectRoot) => {
 	for (const fileName of LEFTHOOK_CONFIG_FILES) {
@@ -60690,7 +60815,7 @@ const detectPackageManager = (projectRoot) => {
 	let currentDirectory = Path.resolve(projectRoot);
 	while (true) {
 		const packageJson = readPackageJson(currentDirectory);
-		if (isRecord$1(packageJson) && typeof packageJson.packageManager === "string") {
+		if (isRecord(packageJson) && typeof packageJson.packageManager === "string") {
 			const packageManagerName = packageJson.packageManager.split("@")[0];
 			if (packageManagerName === "pnpm" || packageManagerName === "yarn" || packageManagerName === "bun" || packageManagerName === "npm") return packageManagerName;
 		}
@@ -60766,12 +60891,12 @@ const isSupplyChainTrustError = (error) => {
 const formatInstallCommand = (input) => [input.command, ...input.args].join(" ");
 const installReactDoctorDependency = async (options) => {
 	const packageJson = readPackageJson(options.projectRoot);
-	if (!isRecord$1(packageJson)) return {
+	if (!isRecord(packageJson)) return {
 		dependencyStatus: "skipped",
 		dependencyReason: "missing-or-invalid-package-json"
 	};
 	if (hasDoctorDependency(packageJson)) return { dependencyStatus: "existing" };
-	if (packageJson.devDependencies !== void 0 && !isRecord$1(packageJson.devDependencies)) return {
+	if (packageJson.devDependencies !== void 0 && !isRecord(packageJson.devDependencies)) return {
 		dependencyStatus: "skipped",
 		dependencyReason: "invalid-dev-dependencies"
 	};
@@ -61310,7 +61435,7 @@ const handoffToAgent = async (input) => {
 //#region src/cli/utils/migrate-action-pin.ts
 const WORKFLOWS_DIRECTORY = Path.join(".github", "workflows");
 const RECOMMENDED_ACTION_REF = "v2";
-const MUTABLE_ACTION_REF = /(uses:\s*[\w.-]+\/react-doctor@)(?:main|master)\b/g;
+const MUTABLE_ACTION_REF = /(uses:\s*millionco\/react-doctor@)(?:main|master)\b/gi;
 const isWorkflowFile = (fileName) => /\.ya?ml$/.test(fileName);
 /**
 * Rewrites mutable `@main` / `@master` React Doctor GitHub Action references in
@@ -61412,34 +61537,54 @@ export default ${serializeTsObjectLiteral(config)} satisfies ReactDoctorConfig;
 	NFS.rmSync(legacy.legacyFilePath, { force: true });
 	return targetPath;
 };
-const PROJECT_MIGRATIONS = [{
-	id: "config-json-to-ts",
-	scope: "project",
-	run: ({ projectRoot }) => {
-		if (projectRoot === void 0) return false;
-		const legacyConfig = findLegacyConfig(projectRoot);
-		if (!legacyConfig) return false;
-		const migratedPath = migrateLegacyConfig(legacyConfig);
-		if (!migratedPath) return false;
-		cliLogger.success("Migrated react-doctor.config.json → doctor.config.ts");
-		cliLogger.dim(`  Your settings were preserved. Review ${toRelativePath(migratedPath, projectRoot)} and commit it.`);
-		cliLogger.break();
-		return true;
-	}
-}, {
-	id: "action-pin-main-to-v2",
-	scope: "project",
-	run: ({ projectRoot }) => {
-		if (projectRoot === void 0) return false;
-		const rewrittenFiles = migrateActionPin(projectRoot);
-		if (rewrittenFiles.length === 0) return false;
-		const relativeFiles = rewrittenFiles.map((file) => toRelativePath(file, projectRoot)).join(", ");
-		cliLogger.success(`Pinned the React Doctor action to @v2 in ${relativeFiles}`);
-		cliLogger.dim("  An unpinned @main reference runs whatever the action's HEAD points to (a supply-chain risk). Review and commit the change — or revert it if you intentionally track main.");
-		cliLogger.break();
-		return true;
+const PROJECT_MIGRATIONS = [
+	{
+		id: "config-json-to-ts",
+		scope: "project",
+		run: ({ projectRoot }) => {
+			if (projectRoot === void 0) return false;
+			const legacyConfig = findLegacyConfig(projectRoot);
+			if (!legacyConfig) return false;
+			const migratedPath = migrateLegacyConfig(legacyConfig);
+			if (!migratedPath) return false;
+			cliLogger.success("Migrated react-doctor.config.json → doctor.config.ts");
+			cliLogger.dim(`  Your settings were preserved. Review ${toRelativePath(migratedPath, projectRoot)} and commit it.`);
+			cliLogger.break();
+			return true;
+		}
+	},
+	{
+		id: "action-pin-main-to-v2",
+		scope: "project",
+		run: ({ projectRoot }) => {
+			if (projectRoot === void 0) return false;
+			const rewrittenFiles = migrateActionPin(projectRoot);
+			if (rewrittenFiles.length === 0) return false;
+			const relativeFiles = rewrittenFiles.map((file) => toRelativePath(file, projectRoot)).join(", ");
+			cliLogger.success(`Pinned the React Doctor action to @v2 in ${relativeFiles}`);
+			cliLogger.dim("  An unpinned @main reference runs whatever the action's HEAD points to (a supply-chain risk). Review and commit the change — or revert it if you intentionally track main.");
+			cliLogger.break();
+			return true;
+		}
+	},
+	{
+		id: "agent-hooks-sh-to-mjs",
+		scope: "project",
+		run: ({ projectRoot }) => {
+			if (projectRoot === void 0) return false;
+			const agents = findAgentsWithLegacyShellHooks(projectRoot);
+			if (agents.length === 0) return false;
+			installReactDoctorAgentHooks({
+				projectRoot,
+				agents
+			});
+			cliLogger.success(`Upgraded the legacy react-doctor.sh agent hook to the Node hook (${agents.join(", ")})`);
+			cliLogger.dim("  The shell hook can't run on Windows and would double-scan next to the current hook. Review and commit the change.");
+			cliLogger.break();
+			return true;
+		}
 	}
-}];
+];
 const runProjectMigrations = (projectRoot, options = {}) => runMigrations(PROJECT_MIGRATIONS, { projectRoot }, options);
 //#endregion
 //#region src/cli/utils/render-welcome.ts
@@ -61499,7 +61644,7 @@ const readChangedFilesFrom = (filePath) => {
 	try {
 		raw = NFS.readFileSync(filePath, "utf8");
 	} catch (error) {
-		const errorCode = error?.code;
+		const errorCode = isErrnoException(error) ? error.code : void 0;
 		throw new CliInputError(`Could not read the --changed-files-from file "${filePath}"${errorCode ? ` (${errorCode})` : ""}. Pass a path to a readable text file that lists changed files, one per line.`);
 	}
 	const uniqueFiles = /* @__PURE__ */ new Set();
@@ -61642,6 +61787,17 @@ const printAgentInstallHint = (writeLine = defaultWriteLine) => {
 	for (const line of AGENT_INSTALL_HINT_LINES) writeLine(line);
 };
 //#endregion
+//#region src/cli/utils/resolve-max-duration-flag.ts
+const resolveMaxDurationFlag = (maxDuration) => {
+	if (maxDuration === void 0) return void 0;
+	const seconds = Number(maxDuration);
+	if (!Number.isFinite(seconds) || seconds <= 0) {
+		cliLogger.warn(`Invalid --max-duration "${maxDuration}". Expected a positive number of seconds; running without a budget.`);
+		return;
+	}
+	return seconds * MILLISECONDS_PER_SECOND;
+};
+//#endregion
 //#region src/cli/utils/resolve-parallel-flag.ts
 /**
 * Maps the `--no-parallel` flag to an `InspectOptions.concurrency` value.
@@ -61655,14 +61811,12 @@ const resolveParallelFlag = (parallel) => parallel === false ? 1 : void 0;
 //#region src/cli/utils/resolve-cli-inspect-options.ts
 /**
 * Translates CLI flags into the `InspectOptions` contract `inspect()`
-* accepts. Flag-specific computed fields (`scoreOnly`, `noScore`,
-* `silent`, `isCi`) live here — there's no `userConfig` knob for them,
-* only flag derivation. The plain boolean knobs (`lint`, `deadCode`,
-* `verbose`) pass through unchanged: `inspect()` owns the
-* userConfig-fallback layer so the merge logic isn't duplicated. The
-* shell still hands `userConfig` in via `configOverride` and `noScore`
-* so this resolver can apply the one flag-and-config rule that flags own
-* (`--score false` wins, otherwise inherit `userConfig.noScore`).
+* accepts. Flag-derived fields only (`scoreOnly`, `noScore`, `silent`,
+* `isCi`): every `userConfig` fallback — including `noScore` — lives in
+* `inspect()`'s merge layer, which sees each project's module-merged
+* config. The plain boolean knobs (`lint`, `deadCode`, `verbose`) pass
+* through unchanged for the same reason. This resolver reads
+* `userConfig` only to decide the `--blocking warning` gate.
 */
 const resolveCliInspectOptions = (flags, userConfig) => {
 	const wantsWarningGate = pickBlockingLevel(flags, userConfig) === "warning";
@@ -61674,10 +61828,11 @@ const resolveCliInspectOptions = (flags, userConfig) => {
 		respectInlineDisables: flags.respectInlineDisables === false ? false : void 0,
 		warnings: wantsWarningGate ? true : flags.warnings,
 		scoreOnly: flags.score === true,
-		noScore: flags.score === false || flags.telemetry === false || (userConfig?.noScore ?? false),
+		noScore: flags.score === false || flags.telemetry === false ? true : void 0,
 		isCi: isCiEnvironment(),
 		silent: Boolean(flags.json),
 		concurrency: resolveParallelFlag(flags.parallel),
+		maxDurationMs: resolveMaxDurationFlag(flags.maxDuration),
 		categoryFilters: resolveCliCategories(flags.category)
 	};
 };
@@ -62012,7 +62167,8 @@ const finalizeScans = (input) => {
 			diff: input.diff,
 			scans: jsonCompletedScans,
 			totalElapsedMilliseconds: performance$1.now() - input.startTime,
-			baseline
+			baseline,
+			baselineDegraded
 		}));
 	}
 	if (input.isScoreOnly || baselineDegraded) return;
@@ -62082,6 +62238,7 @@ const inspectAction = async (directory, flags) => {
 		if (!isQuiet) if (!flags.verbose && canAnimateOnboarding(process.stdout)) await runPromise(playWelcomeScene({ speedMultiplier: !isOnboardingForced() && hasCompletedOnboarding() ? 2 : 1 }));
 		else runSync(printBrandedHeader);
 		const scanOptions = resolveCliInspectOptions(flags, userConfig);
+		const scanDeadlineEpochMs = scanOptions.maxDurationMs !== void 0 ? Date.now() + scanOptions.maxDurationMs : void 0;
 		const categoryFilters = new Set(scanOptions.categoryFilters ?? []);
 		const skipPrompts = shouldSkipPrompts({
 			yes: flags.yes,
@@ -62127,8 +62284,10 @@ const inspectAction = async (directory, flags) => {
 			try {
 				const scanResult = await inspect(snapshot.tempDirectory, {
 					...scanOptions,
+					deadlineEpochMs: scanDeadlineEpochMs,
 					includePaths: snapshot.stagedFiles,
 					configOverride: userConfig,
+					configSourceDirectory: scanTarget.configSourceDirectory ?? void 0,
 					changedLineRanges: stagedLineRanges ?? void 0
 				});
 				const remappedDiagnostics = scanResult.diagnostics.map((diagnostic) => ({
@@ -62228,6 +62387,7 @@ const inspectAction = async (directory, flags) => {
 			if (!isQuiet && !isMultiProject) cliLogger.dim("  ");
 			const scanResult = await inspect(scanDirectory, {
 				...scanOptions,
+				deadlineEpochMs: scanDeadlineEpochMs,
 				includePaths,
 				configOverride: projectConfig,
 				configSourceDirectory: projectConfigSourceDirectory ?? void 0,
@@ -62268,7 +62428,7 @@ const inspectAction = async (directory, flags) => {
 			completedScans.push(scanOutcome);
 		}
 		if (!isQuiet && isMultiProject && completedScans.length > 0) {
-			const shouldShowShareLink = !scanOptions.noScore && (userConfig?.share ?? true) && !scanOptions.isCi;
+			const shouldShowShareLink = !isShareOptedOut(completedScans, scanOptions.noScore) && !scanOptions.isCi;
 			await runPromise(printMultiProjectSummary({
 				completedScans,
 				categoryFilters,
@@ -62602,6 +62762,10 @@ const resolveEffectiveRuleSeverity = (config, entry) => {
 			source: "rule"
 		};
 	}
+	if (!entry.defaultEnabled) return {
+		value: "off",
+		source: "default"
+	};
 	const categoryOverride = config?.categories?.[entry.category];
 	if (categoryOverride !== void 0) return {
 		value: categoryOverride,
@@ -63089,7 +63253,7 @@ const printDebugTrace = () => {
 //#endregion
 //#region src/cli/utils/removed-cli-flags.ts
 const REMOVED_FLAGS = new Map([
-	["--full", "use `--diff false` to force a full scan"],
+	["--full", "use `--scope full` to force a full scan"],
 	["--explain", "use the `why <file>:<line>` command"],
 	["--why", "use the `why <file>:<line>` command"],
 	["--pr-comment", "the GitHub Action posts the PR comment for you; remove this flag"]
@@ -63139,6 +63303,7 @@ const ROOT_FLAG_SPEC = {
 		"--changed-files-from",
 		"--blocking",
 		"--json-out",
+		"--max-duration",
 		"--output-dir",
 		"--fail-on",
 		"--project",
@@ -63375,7 +63540,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -63425,4 +63590,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=38109950-d718-564f-8c23-83e407ef77e9
+//# debugId=56ca0cbd-9f70-5a50-8496-43abdf078431