react-doctor 0.5.8-dev.849580c → 0.5.8-dev.88a5c3c

package/dist/index.d.ts

@@ -9271,6 +9271,15 @@ interface ReactDoctorConfig {
    * suppresses regardless of sibling content.
    */
   rawTextWrapperComponents?: string[];
+  /**
+   * Capitalized identifiers that exist at runtime but aren't imported in
+   * the file that uses them — react-live's `<LiveProvider scope={...}>`,
+   * Storybook globals, MDX live blocks, or an ambient `declare global` in a
+   * separate `.d.ts`. The single-file `jsx-no-undef` rule can't see those
+   * bindings and would report `<DatePicker />` as an undefined JSX component.
+   * List the injected names here and `jsx-no-undef` treats them as known.
+   */
+  runtimeGlobals?: string[];
   /**
    * Project-level allowlist of function names that the
    * `server-auth-actions` rule treats as an auth check at the top of
@@ -9377,6 +9386,10 @@ interface ReactDoctorConfig {
    * { "categories": { "Maintainability": "off", "Performance": "warn" } }
    * ```
    *
+   * A category severity re-stamps rules that are already enabled; it
+   * never activates opt-out (`defaultEnabled: false`) rules — pin the
+   * rule itself under `rules` to opt in.
+   *
    * To silence a whole tag-defined rule family (e.g. `"design"`,
    * `"test-noise"`, `"migration-hint"`) that doesn't align with a
    * single category, use `ignore.tags` instead.
@@ -10082,6 +10095,14 @@ interface BuildJsonReportInput {
     fixedCount: number;
     baseTotalCount: number;
   };
+  /**
+   * True when a `changed` run was intended but its baseline delta couldn't be
+   * computed (no merge base — usually a shallow CI checkout — or a failed
+   * base/head lint), so `diagnostics` list every finding in the changed files
+   * rather than only the introduced ones. Ignored when `baseline` is set: a
+   * computed baseline (v2) wins, so callers pass at most one.
+   */
+  baselineDegraded?: boolean;
 }
 declare const buildJsonReport: (input: BuildJsonReportInput) => JsonReport; //#endregion
 //#region src/build-skipped-checks.d.ts

package/dist/index.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9807b1bf-1e62-5421-ad35-d1f4129c1538")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7cfd5199-4216-5c6e-8cf5-c9623c317a1e")}catch(e){}}();
 import { r as __toESM$1, t as __commonJSMin$1 } from "./chunk-N93fKeF6.js";
 import { createRequire } from "node:module";
 import * as NFS from "node:fs";
@@ -7,7 +7,7 @@ import fs from "node:fs";
 import * as Path from "node:path";
 import path from "node:path";
 import * as NodeChildProcess from "node:child_process";
-import { spawn, spawnSync } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import * as ts from "typescript";
 import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
@@ -19364,6 +19364,15 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	ok: Boolean$1,
 	directory: String$1,
 	mode: JsonReportMode,
+	/**
+	* True when a `changed` (compare) run was intended but the base couldn't be
+	* resolved — a shallow CI checkout with no merge base, or a failed base/head
+	* lint. The report then lists every finding in the changed files (mode
+	* downgrades to `diff`, the `baseline` block is dropped, the CI gate is
+	* skipped) rather than only the ones the change introduced. Absent on a
+	* successful `baseline` run (`schemaVersion: 2`) and on non-compare scopes.
+	*/
+	baselineDegraded: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
 	diagnostics: ArraySchema(Diagnostic),
@@ -33695,6 +33704,9 @@ const SCORE_API_URL = "https://www.react.doctor/api/score";
 const FETCH_TIMEOUT_MS = 1e4;
 const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
 const SPAWN_ARGS_MAX_LENGTH_CHARS = 24e3;
+const SPAWN_ARGS_MAX_LENGTH_CHARS_POSIX = 15e5;
+const SPAWN_ARGS_MAX_LENGTH_CHARS_DARWIN = 8e5;
+const NODE_VERSION_PROBE_TIMEOUT_MS = 5e3;
 const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
 const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
 const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
@@ -34519,7 +34531,7 @@ const tokenizeRuleList = (ruleList) => {
 const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
 const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
 const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
-const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — change it to \`${ruleId}\`.`;
+const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — add \`${ruleId}\` to the comment (e.g. \`${token}, ${ruleId}\`).`;
 const tokenMisnamesRule = (token, ruleId) => token !== ruleId && isSameRuleKey(token, ruleId);
 const detectInlineNearMiss = (lines, diagnosticLineIndex, ruleId) => {
 	const candidates = [{
@@ -34999,6 +35011,7 @@ const collectStringSet = (values) => {
 	if (!Array.isArray(values)) return /* @__PURE__ */ new Set();
 	return new Set(values.filter((value) => typeof value === "string"));
 };
+const JSX_NO_UNDEF_IDENTIFIER_PATTERN = /^`([^`]+)`/;
 /**
 * Pre-compiles every stateful filter and returns a single
 * `apply(diagnostic)` closure that runs (in order):
@@ -35032,11 +35045,28 @@ const buildDiagnosticPipeline = (input) => {
 	const compiledOverrides = compileIgnoreOverrides(userConfig);
 	const textComponentNames = collectStringSet(userConfig?.textComponents);
 	const rawTextWrapperComponentNames = collectStringSet(userConfig?.rawTextWrapperComponents);
+	const runtimeGlobalNames = collectStringSet(userConfig?.runtimeGlobals);
 	const hasTextComponents = textComponentNames.size > 0;
 	const hasRawTextWrappers = rawTextWrapperComponentNames.size > 0;
+	const hasRuntimeGlobals = runtimeGlobalNames.size > 0;
 	const fileLinesCache = /* @__PURE__ */ new Map();
 	const fileContextCache = /* @__PURE__ */ new Map();
 	const libraryFileCache = /* @__PURE__ */ new Map();
+	const suppressions = /* @__PURE__ */ new Map();
+	const suppress = (diagnostic, source) => {
+		const { ruleKey } = getDiagnosticRuleIdentity(diagnostic);
+		const suppressionKey = `${ruleKey}\u0000${source}`;
+		const existing = suppressions.get(suppressionKey);
+		suppressions.set(suppressionKey, existing ? {
+			...existing,
+			count: existing.count + 1
+		} : {
+			rule: ruleKey,
+			source,
+			count: 1
+		});
+		return null;
+	};
 	const isLibraryFile = (filePath) => {
 		let cached = libraryFileCache.get(filePath);
 		if (cached === void 0) {
@@ -35085,50 +35115,60 @@ const buildDiagnosticPipeline = (input) => {
 		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
 		return false;
 	};
-	return { apply: (diagnostic) => {
-		if (shouldAutoSuppress(diagnostic)) return null;
-		let current = diagnostic;
-		let explicitSeverityOverride;
-		let explicitRuleOverride;
-		if (severityControls) {
-			const { ruleKey, category } = getDiagnosticRuleIdentity(current);
-			explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey }, severityControls);
-			explicitSeverityOverride = resolveRuleSeverityOverride({
-				ruleKey,
-				category
-			}, severityControls);
-			if (explicitSeverityOverride === "off") return null;
-			if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
-		}
-		if (explicitRuleOverride === void 0) {
-			if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
-		}
-		if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
-		if (userConfig) {
-			if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return null;
-			if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
-			if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return null;
-			if (isRnRawTextSuppressedByConfig(current)) return null;
-		}
-		if (respectInlineDisables && current.line > 0) {
-			const lines = getFileLines(current.filePath);
-			if (lines) {
-				const ruleIdentifier = `${current.plugin}/${current.rule}`;
-				const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
-				if (evaluation.isSuppressed) return null;
-				if (evaluation.nearMissHint) current = {
-					...current,
-					suppressionHint: evaluation.nearMissHint
-				};
+	const isJsxNoUndefSuppressedByConfig = (diagnostic) => {
+		if (!hasRuntimeGlobals) return false;
+		if (diagnostic.rule !== "jsx-no-undef") return false;
+		const identifierMatch = JSX_NO_UNDEF_IDENTIFIER_PATTERN.exec(diagnostic.message);
+		return identifierMatch !== null && runtimeGlobalNames.has(identifierMatch[1]);
+	};
+	return {
+		apply: (diagnostic) => {
+			if (shouldAutoSuppress(diagnostic)) return null;
+			let current = diagnostic;
+			let explicitSeverityOverride;
+			let explicitRuleOverride;
+			if (severityControls) {
+				const { ruleKey, category } = getDiagnosticRuleIdentity(current);
+				explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey }, severityControls);
+				explicitSeverityOverride = resolveRuleSeverityOverride({
+					ruleKey,
+					category
+				}, severityControls);
+				if (explicitSeverityOverride === "off") return suppress(current, "config");
+				if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 			}
-		}
-		const fileContext = getFileContext(current.filePath);
-		if (fileContext !== "production") current = {
-			...current,
-			fileContext
-		};
-		return current;
-	} };
+			if (explicitRuleOverride === void 0) {
+				if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
+			}
+			if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
+			if (userConfig) {
+				if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return suppress(current, "config");
+				if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
+				if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return suppress(current, "override");
+				if (isRnRawTextSuppressedByConfig(current)) return null;
+				if (isJsxNoUndefSuppressedByConfig(current)) return null;
+			}
+			if (respectInlineDisables && current.line > 0) {
+				const lines = getFileLines(current.filePath);
+				if (lines) {
+					const ruleIdentifier = `${current.plugin}/${current.rule}`;
+					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
+					if (evaluation.isSuppressed) return suppress(current, "inline");
+					if (evaluation.nearMissHint) current = {
+						...current,
+						suppressionHint: evaluation.nearMissHint
+					};
+				}
+			}
+			const fileContext = getFileContext(current.filePath);
+			if (fileContext !== "production") current = {
+				...current,
+				fileContext
+			};
+			return current;
+		},
+		summarizeSuppressions: () => [...suppressions.values()]
+	};
 };
 const OxlintUnavailableKind = Literals(["binary-not-found", "native-binding-missing"]);
 var OxlintUnavailable = class extends TaggedErrorClass()("OxlintUnavailable", {
@@ -35432,13 +35472,7 @@ var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { de
 * without recompiling react-doctor. Tests override via
 * `Layer.succeed(SupplyChainOverlapTimeoutMs, ...)`.
 */
-var SupplyChainOverlapTimeoutMs = class extends Reference("react-doctor/SupplyChainOverlapTimeoutMs", { defaultValue: () => {
-	const raw = process.env["REACT_DOCTOR_SUPPLY_CHAIN_TIMEOUT_MS"];
-	if (raw === void 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
-	const parsed = Number(raw);
-	if (!Number.isFinite(parsed) || parsed <= 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
-	return parsed;
-} }) {};
+var SupplyChainOverlapTimeoutMs = class extends Reference("react-doctor/SupplyChainOverlapTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SUPPLY_CHAIN_TIMEOUT_MS", SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS) }) {};
 /**
 * Hard cap on combined stdout+stderr bytes per oxlint batch. The
 * subprocess gets SIGKILL'd if it produces more; the recovery path
@@ -35586,6 +35620,7 @@ const STRING_ARRAY_FIELD_NAMES = [
 	"projects",
 	"textComponents",
 	"rawTextWrapperComponents",
+	"runtimeGlobals",
 	"serverAuthFunctionNames"
 ];
 const SURFACE_CONTROL_FIELD_NAMES = [
@@ -37290,6 +37325,11 @@ const toCanonicalPath = (filePath) => {
 };
 const DEAD_CODE_PLUGIN = "deslop";
 const DEAD_CODE_CATEGORY = "Maintainability";
+const REACT_DOCTOR_TOOLCHAIN_PACKAGES = new Set([
+	"react-doctor",
+	"eslint-plugin-react-doctor",
+	"oxlint-plugin-react-doctor"
+]);
 const DEAD_CODE_WORKER_SCRIPT = `
 const inputChunks = [];
 process.stdin.on("data", (chunk) => inputChunks.push(chunk));
@@ -37595,6 +37635,7 @@ const checkDeadCode = async (options) => {
 		});
 	}
 	for (const unusedDependency of result.unusedDependencies) {
+		if (REACT_DOCTOR_TOOLCHAIN_PACKAGES.has(unusedDependency.name)) continue;
 		const label = unusedDependency.isDevDependency ? "devDependency" : "dependency";
 		diagnostics.push({
 			filePath: "package.json",
@@ -37773,7 +37814,6 @@ var DeadCode = class DeadCode extends Service()("react-doctor/DeadCode") {
 		return yield* tryPromise({
 			try: (signal) => checkDeadCode({
 				rootDirectory: input.rootDirectory,
-				userConfig: input.userConfig,
 				parseConcurrency: input.parseConcurrency,
 				workerTimeoutMs: input.workerTimeoutMs,
 				abortSignal: signal
@@ -37896,6 +37936,11 @@ const isSafeGitRevision = (candidate) => {
 	if (candidate.includes("..") || candidate.includes("@{")) return false;
 	return SAFE_GIT_REVISION_PATTERN.test(candidate);
 };
+const resolveSpawnArgsLengthCap = () => {
+	if (process.platform === "win32") return SPAWN_ARGS_MAX_LENGTH_CHARS;
+	if (process.platform === "darwin") return SPAWN_ARGS_MAX_LENGTH_CHARS_DARWIN;
+	return SPAWN_ARGS_MAX_LENGTH_CHARS_POSIX;
+};
 /**
 * Splits a git revision range into its endpoints: three-dot `A...B`
 * (symmetric, merge-base) or two-dot `A..B` (direct). Returns `null`
@@ -37980,7 +38025,8 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			return scoped(gen(function* () {
 				if (!isDirectory(input.directory)) return yield* foldSpawnFailure(`spawn ENOTDIR (cwd is not a directory: ${input.directory})`);
 				const argvLengthChars = input.command.length + 1 + input.args.reduce((total, arg) => total + arg.length + 1, 0);
-				if (argvLengthChars > 24e3) return yield* foldSpawnFailure(`spawn ENAMETOOLONG (${argvLengthChars} argv chars exceed ${SPAWN_ARGS_MAX_LENGTH_CHARS})`);
+				const spawnArgsLengthCap = resolveSpawnArgsLengthCap();
+				if (argvLengthChars > spawnArgsLengthCap) return yield* foldSpawnFailure(`spawn ENAMETOOLONG (${argvLengthChars} argv chars exceed ${spawnArgsLengthCap})`);
 				const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
 					cwd: input.directory,
 					env: input.env,
@@ -38149,6 +38195,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				if (resolvedCurrentBranch === null && explicitBaseBranch === void 0) return null;
 				const baseBranch = explicitBaseBranch ?? (yield* defaultBranch(directory));
 				if (baseBranch === null) return null;
+				if (!isSafeGitRevision(baseBranch)) return null;
 				if (explicitBaseBranch !== void 0) {
 					if (!(yield* branchExists(directory, explicitBaseBranch))) return yield* fail$4(new ReactDoctorError({ reason: new GitBaseBranchMissing({ branch: explicitBaseBranch }) }));
 				}
@@ -38499,7 +38546,7 @@ const normalizeConfigForHash = (config) => {
 	if (Array.isArray(clone?.jsPlugins)) clone.jsPlugins = clone.jsPlugins.map((_, index) => `<plugin:${index}>`);
 	return clone;
 };
-const computeRulesetHash = (input) => crypto.createHash("sha1").update(JSON.stringify(normalizeConfigForHash(input.config))).update("\0").update([...input.toolchainVersions].join("\0")).update("\0").update([...input.ignorePatterns].join("\n")).update(" ").update(input.tsconfigContent ?? "").digest("hex");
+const computeRulesetHash = (input) => crypto.createHash("sha1").update(JSON.stringify(normalizeConfigForHash(input.config))).update("\0").update([...input.toolchainVersions].join("\0")).update("\0").update([...input.ignorePatterns].join("\n")).update("\0").update(input.tsconfigContent ?? "").digest("hex");
 /**
 * Loads a plugin module via the local require resolver and extracts
 * `(name, ruleNames)` from either `module.exports.meta + rules` or
@@ -38670,12 +38717,12 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
 		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledBy)) continue;
-		const explicitSeverity = resolveRuleSeverityOverride({
+		const explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey: registryEntry.key }, severityControls);
+		if (rule.defaultEnabled === false && explicitRuleOverride === void 0) continue;
+		const severity = resolveRuleSeverityOverride({
 			ruleKey: registryEntry.key,
 			category: rule.category
-		}, severityControls);
-		if (rule.defaultEnabled === false && explicitSeverity === void 0) continue;
-		const severity = explicitSeverity ?? resolveCompilerCleanupBucketSeverity(registryEntry.key, severityControls) ?? rule.severity;
+		}, severityControls) ?? resolveCompilerCleanupBucketSeverity(registryEntry.key, severityControls) ?? rule.severity;
 		if (severity === "off") continue;
 		enabledReactDoctorRules[registryEntry.key] = severity;
 	}
@@ -38777,24 +38824,38 @@ const createFileLintCache = (cacheDirectory, rulesetHash) => {
 				updatedAtMs: Date.now(),
 				files: Object.fromEntries(cappedEntries)
 			};
-			const keptHashes = Object.entries(rulesets).sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8).map(([hash]) => hash);
-			const prunedRulesets = {};
-			for (const hash of keptHashes) prunedRulesets[hash] = rulesets[hash];
 			atomicWriteJson(cacheFilePath, {
 				version: 1,
-				rulesets: prunedRulesets
+				rulesets: Object.fromEntries(Object.entries(rulesets).filter(([, bucket]) => isRecord(bucket) && typeof bucket.updatedAtMs === "number").sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8))
 			});
 		}
 	};
 };
 const bundledRequire = createRequire(import.meta.url);
+const childNodeVersionByBinaryPath = /* @__PURE__ */ new Map();
+const resolveChildNodeVersion = (nodeBinaryPath) => {
+	if (nodeBinaryPath === process.execPath) return process.version;
+	const cachedVersion = childNodeVersionByBinaryPath.get(nodeBinaryPath);
+	if (cachedVersion !== void 0) return cachedVersion;
+	let version;
+	try {
+		version = execFileSync(nodeBinaryPath, ["--version"], {
+			encoding: "utf8",
+			timeout: NODE_VERSION_PROBE_TIMEOUT_MS
+		}).trim();
+	} catch {
+		version = `unknown:${nodeBinaryPath}`;
+	}
+	childNodeVersionByBinaryPath.set(nodeBinaryPath, version);
+	return version;
+};
 const TOOLCHAIN_PACKAGE_SPECIFIERS = [
 	"oxlint/package.json",
 	"oxlint-plugin-react-doctor/package.json",
 	"eslint-plugin-react-hooks/package.json"
 ];
-const resolveOxlintToolchainVersions = () => {
-	const versions = [`node=${process.version}`];
+const resolveOxlintToolchainVersions = (nodeBinaryPath = process.execPath) => {
+	const versions = [`node=${resolveChildNodeVersion(nodeBinaryPath)}`];
 	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS) try {
 		const packageJson = bundledRequire(specifier);
 		const version = typeof packageJson.version === "string" ? packageJson.version : "unknown";
@@ -39328,11 +39389,12 @@ const REACT_COMPILER_TITLE = "React Compiler can't optimize this";
 const REACT_COMPILER_TODO_TITLE = "React Compiler doesn't support this syntax";
 const REACT_COMPILER_IMPACT = "This component misses React Compiler's automatic memoization & re-renders more than it should";
 const REACT_COMPILER_ACTION = "Rewrite the flagged code so the compiler can optimize it.";
+const REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION = "It's how the library works, not a bug in your code. Memoize values you pass from it into other memoized components, or suppress it with `// react-doctor-disable-next-line react-hooks-js/incompatible-library`.";
 const REACT_COMPILER_GENERIC_MESSAGE = `${REACT_COMPILER_IMPACT}. ${REACT_COMPILER_ACTION}`;
-const buildReactCompilerMessage = (reasonSummary) => {
+const buildReactCompilerMessage = (reasonSummary, action = REACT_COMPILER_ACTION) => {
 	const normalizedSummary = reasonSummary.replace(TRAILING_PERIOD_PATTERN, "");
-	if (!normalizedSummary) return REACT_COMPILER_GENERIC_MESSAGE;
-	return `${REACT_COMPILER_IMPACT}: ${normalizedSummary}. ${REACT_COMPILER_ACTION}`;
+	if (!normalizedSummary) return `${REACT_COMPILER_IMPACT}. ${action}`;
+	return `${REACT_COMPILER_IMPACT}: ${normalizedSummary}. ${action}`;
 };
 const PLUGIN_CATEGORY_MAP = {
 	react: "Bugs",
@@ -39381,7 +39443,7 @@ const resolveCleanedDiagnostic = (message, help, plugin, rule, project) => {
 		const [reasonSummary = "", ...reasonDetailLines] = bailoutReason.split("\n");
 		const reasonDetail = reasonDetailLines.join("\n").trim();
 		return {
-			message: buildReactCompilerMessage(reasonSummary.trim()),
+			message: buildReactCompilerMessage(reasonSummary.trim(), rule === "incompatible-library" ? REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION : REACT_COMPILER_ACTION),
 			help: appendReanimatedSharedValueHint(reasonDetail || help, rule, project)
 		};
 	}
@@ -39649,21 +39711,27 @@ const spawnLintBatches = async (input) => {
 		const allDiagnostics = [];
 		const droppedFiles = [];
 		let firstDropReason = null;
-		const splitDeadlineMs = Date.now() + splitTotalBudgetMs;
-		const spawnLintBatch = async (batch, depth) => {
+		const spawnLintBatch = async (batch, depth, splitBudget) => {
 			const batchArgs = [...baseArgs, ...batch];
 			try {
 				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory);
 			} catch (error) {
 				if (!isSplittableReactDoctorError(error)) throw error;
-				const splitBudgetExhausted = Date.now() >= splitDeadlineMs || depth >= splitMaxDepth;
-				if (batch.length <= 1 || splitBudgetExhausted) {
+				splitBudget.deadlineMs ??= Date.now() + splitTotalBudgetMs;
+				const isBudgetElapsed = Date.now() >= splitBudget.deadlineMs;
+				const isDepthCapReached = depth >= splitMaxDepth;
+				if (batch.length <= 1 || isBudgetElapsed || isDepthCapReached) {
 					droppedFiles.push(...batch);
-					if (firstDropReason === null) firstDropReason = splitBudgetExhausted && batch.length > 1 ? `${error.message} (split budget exhausted after ${splitMaxDepth} levels / ${splitTotalBudgetMs / MILLISECONDS_PER_SECOND}s)` : error.message;
+					if (firstDropReason === null) {
+						let limitHint = "";
+						if (isDepthCapReached) limitHint = ` (split depth cap of ${splitMaxDepth} levels reached)`;
+						else if (isBudgetElapsed) limitHint = ` (split budget of ${splitTotalBudgetMs / MILLISECONDS_PER_SECOND}s exhausted at depth ${depth})`;
+						firstDropReason = batch.length > 1 ? `${error.message}${limitHint}` : error.message;
+					}
 					return [];
 				}
 				const splitIndex = Math.ceil(batch.length / 2);
-				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1)];
+				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1, splitBudget), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1, splitBudget)];
 			}
 		};
 		let startedFileCount = 0;
@@ -39680,7 +39748,7 @@ const spawnLintBatches = async (input) => {
 		try {
 			const batchResults = await mapWithConcurrency(fileBatches, concurrency, async (batch) => {
 				startedFileCount += batch.length;
-				const batchDiagnostics = await spawnLintBatch(batch, 0);
+				const batchDiagnostics = await spawnLintBatch(batch, 0, { deadlineMs: null });
 				scannedFileCount += batch.length;
 				if (onFileProgress) {
 					displayedFileCount = Math.min(Math.max(displayedFileCount, scannedFileCount), totalFileCount);
@@ -39754,7 +39822,14 @@ const resolveReactDoctorCacheDir = (projectDirectory) => {
 	if (cacheDirOverride) return Path.join(cacheDirOverride, projectCacheSubdir(projectDirectory));
 	const nodeModulesDirectory = Path.join(projectDirectory, "node_modules");
 	if (NFS.existsSync(nodeModulesDirectory)) return Path.join(nodeModulesDirectory, ".cache", "react-doctor");
-	return Path.join(os.tmpdir(), "react-doctor-cache", projectCacheSubdir(projectDirectory));
+	return Path.join(os.tmpdir(), `react-doctor-cache-${resolveUserCacheScope()}`, projectCacheSubdir(projectDirectory));
+};
+const resolveUserCacheScope = () => {
+	try {
+		return String(process.getuid?.() ?? os.userInfo().username);
+	} catch {
+		return "shared";
+	}
 };
 const sortSourceFilesByCost = (entries) => [...entries].sort((left, right) => right.sizeBytes - left.sizeBytes).map((entry) => entry.path);
 /**
@@ -39922,7 +39997,7 @@ const runOxlint = async (options) => {
 					extendsPaths: [],
 					ruleSelection: "cacheable"
 				}),
-				toolchainVersions: resolveOxlintToolchainVersions(),
+				toolchainVersions: resolveOxlintToolchainVersions(nodeBinaryPath),
 				ignorePatterns: combinedPatterns,
 				tsconfigContent
 			});
@@ -39936,7 +40011,7 @@ const runOxlint = async (options) => {
 					missFiles.push(candidateFile);
 					continue;
 				}
-				const cacheKey = `${candidateFile.replaceAll("\\", "/")}${contentHash}`;
+				const cacheKey = `${candidateFile.replaceAll("\\", "/")}\u0000${contentHash}`;
 				cacheKeyByFile.set(candidateFile, cacheKey);
 				const cachedDiagnostics = cache.lookup(cacheKey);
 				if (cachedDiagnostics === null) missFiles.push(candidateFile);
@@ -40252,7 +40327,7 @@ const ScoreApiResponseSchema = Struct({
 	})))
 });
 const parseScoreResult = (value) => getOrNull(decodeUnknownOption(ScoreApiResponseSchema)(value));
-const stripLocalFileFields = (diagnostics) => diagnostics.map(({ filePath: _filePath, fileContext: _fileContext, ...rest }) => rest);
+const stripLocalFileFields = (diagnostics) => diagnostics.map(({ filePath: _filePath, fileContext: _fileContext, fixGroupId: _fixGroupId, ...rest }) => rest);
 const isAbortError = (error) => error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
 const describeFailure = (error) => {
 	if (isAbortError(error)) return `timed out after ${FETCH_TIMEOUT_MS / 1e3}s`;
@@ -40556,7 +40631,10 @@ const ALERT_SEVERITY_RANK = {
 	medium: 2,
 	low: 1
 };
-const severityRank = (severity) => ALERT_SEVERITY_RANK[severity.toLowerCase()] ?? 0;
+const severityRank = (severity) => {
+	const normalized = severity.toLowerCase();
+	return Object.hasOwn(ALERT_SEVERITY_RANK, normalized) ? ALERT_SEVERITY_RANK[normalized] : 0;
+};
 const displaySeverity = (severity) => {
 	const normalized = sanitizeTerminalText(severity.toLowerCase());
 	return normalized === "middle" ? "medium" : normalized;
@@ -40573,7 +40651,7 @@ const ALERT_TYPE_LABELS = {
 	typosquat: "possible typosquat"
 };
 const humanizeAlertType = (type) => type.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").toLowerCase().trim();
-const friendlyAlertType = (type) => ALERT_TYPE_LABELS[type] ?? sanitizeTerminalText(humanizeAlertType(type));
+const friendlyAlertType = (type) => Object.hasOwn(ALERT_TYPE_LABELS, type) ? ALERT_TYPE_LABELS[type] : sanitizeTerminalText(humanizeAlertType(type));
 const summarizeAlertNote = (note) => {
 	const collapsed = sanitizeTerminalText(note.replace(/\s+/g, " ").trim());
 	const firstSentence = collapsed.split(/(?<=\.)\s/)[0] || collapsed;
@@ -40668,7 +40746,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
-	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(checkSupplyChain(input).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
+	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (totalTimeoutMs) => checkSupplyChain({
+		...input,
+		totalTimeoutMs
+	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
 	static layerOf = (diagnostics) => succeed$3(SupplyChain, SupplyChain.of({ run: () => fromIterable$1(diagnostics) }));
 };
 const getObjectProperty = (value, propertyName) => {
@@ -40816,10 +40897,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkExpoProject(scanDirectory, project),
 		...checkReactNativeProject(scanDirectory, project)
 	])));
-	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(promise(() => checkSecurityScanCooperative(scanDirectory, {
+	const securityScanFailedRef = yield* make$13(false);
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise(() => checkSecurityScanCooperative(scanDirectory, {
 		project,
 		ignoredTags: input.ignoredTags
-	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)))))).pipe(withSpan("SecurityScan.run")));
+	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), catch_$1(() => set(securityScanFailedRef, true).pipe(as(empty$4))))))).pipe(withSpan("SecurityScan.run")));
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
 	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
@@ -40857,7 +40939,6 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
 	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config,
 		parseConcurrency: deadCodeParseConcurrency,
 		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
@@ -40985,6 +41066,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		metadata: scoreMetadata
 	});
 	const lintPartialFailures = yield* get$2(partialFailuresRef);
+	const securityScanFailed = yield* get$2(securityScanFailedRef);
 	return {
 		project,
 		userConfig: resolvedConfig.config,
@@ -41005,8 +41087,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		scanElapsedMilliseconds,
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
+		securityScanFailed,
 		lintCacheHitFileCount,
-		lintCacheTotalFileCount
+		lintCacheTotalFileCount,
+		suppressedRuleCounts: transform.summarizeSuppressions()
 	};
 }).pipe(withSpan("runInspect", { attributes: {
 	"inspect.directory": input.directory,
@@ -41345,6 +41429,7 @@ const buildJsonReport = (input) => {
 	return {
 		schemaVersion: 1,
 		mode: input.mode,
+		...input.baselineDegraded ? { baselineDegraded: true } : {},
 		...shared
 	};
 };
@@ -41645,4 +41730,4 @@ const toJsonReport = (result, options) => buildJsonReport({
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=9807b1bf-1e62-5421-ad35-d1f4129c1538
+//# debugId=7cfd5199-4216-5c6e-8cf5-c9623c317a1e