react-doctor 0.5.8 → 0.6.0-dev.0748a4b

package/dist/index.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="33508ee6-c977-5b5f-8585-9939928ce74d")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="62cf4740-7938-5db0-8b80-dc81b60af36a")}catch(e){}}();
 import { r as __toESM$1, t as __commonJSMin$1 } from "./chunk-N93fKeF6.js";
 import { createRequire } from "node:module";
 import * as NFS from "node:fs";
@@ -7,7 +7,7 @@ import fs from "node:fs";
 import * as Path from "node:path";
 import path from "node:path";
 import * as NodeChildProcess from "node:child_process";
-import { spawn, spawnSync } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import * as ts from "typescript";
 import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
@@ -5996,7 +5996,7 @@ const composePassthrough = /* @__PURE__ */ dual(2, (left, right) => (input) => {
 * @since 2.0.0
 */
 const Scheduler = /* @__PURE__ */ Reference("effect/Scheduler", { defaultValue: () => new MixedScheduler() });
-const setImmediate = "setImmediate" in globalThis ? (f) => {
+const setImmediate$1 = "setImmediate" in globalThis ? (f) => {
 	const timer = globalThis.setImmediate(f);
 	return () => globalThis.clearImmediate(timer);
 } : (f) => {
@@ -6040,7 +6040,7 @@ var PriorityBuckets = class {
 var MixedScheduler = class {
 	executionMode;
 	setImmediate;
-	constructor(executionMode = "async", setImmediateFn = setImmediate) {
+	constructor(executionMode = "async", setImmediateFn = setImmediate$1) {
 		this.executionMode = executionMode;
 		this.setImmediate = setImmediateFn;
 	}
@@ -6065,7 +6065,7 @@ var MixedSchedulerDispatcher = class {
 	tasks = /* @__PURE__ */ new PriorityBuckets();
 	running = void 0;
 	setImmediate;
-	constructor(setImmediateFn = setImmediate) {
+	constructor(setImmediateFn = setImmediate$1) {
 		this.setImmediate = setImmediateFn;
 	}
 	/**
@@ -19364,6 +19364,15 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	ok: Boolean$1,
 	directory: String$1,
 	mode: JsonReportMode,
+	/**
+	* True when a `changed` (compare) run was intended but the base couldn't be
+	* resolved — a shallow CI checkout with no merge base, or a failed base/head
+	* lint. The report then lists every finding in the changed files (mode
+	* downgrades to `diff`, the `baseline` block is dropped, the CI gate is
+	* skipped) rather than only the ones the change introduced. Absent on a
+	* successful `baseline` run (`schemaVersion: 2`) and on non-compare scopes.
+	*/
+	baselineDegraded: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
 	diagnostics: ArraySchema(Diagnostic),
@@ -32780,12 +32789,31 @@ const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 const IGNORED_DIRECTORIES = new Set([
+	".angular",
+	".astro",
+	".cache",
+	".contentlayer",
+	".direnv",
+	".docusaurus",
+	".expo",
+	".firebase",
 	".git",
+	".gradle",
+	".hg",
 	".next",
 	".nuxt",
+	".nx",
 	".output",
+	".parcel-cache",
+	".serverless",
 	".svelte-kit",
+	".svn",
+	".terraform",
 	".turbo",
+	".venv",
+	".vercel",
+	".wrangler",
+	".yarn",
 	"build",
 	"coverage",
 	"dist",
@@ -32793,6 +32821,119 @@ const IGNORED_DIRECTORIES = new Set([
 	"out",
 	"storybook-static"
 ]);
+const JSX_FILE_PATTERN = /\.(tsx|jsx)$/;
+const MILLISECONDS_PER_SECOND = 1e3;
+const SCORE_API_URL = "https://www.react.doctor/api/score";
+const FETCH_TIMEOUT_MS = 1e4;
+const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
+const SPAWN_ARGS_MAX_LENGTH_CHARS = 24e3;
+const SPAWN_ARGS_MAX_LENGTH_CHARS_POSIX = 15e5;
+const SPAWN_ARGS_MAX_LENGTH_CHARS_DARWIN = 8e5;
+const NODE_VERSION_PROBE_TIMEOUT_MS = 5e3;
+const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
+const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
+const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
+const GIT_SHOW_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
+const ES_TARGET_YEAR_BY_NAME = {
+	es3: 1999,
+	es5: 2009,
+	es6: 2015,
+	es2015: 2015,
+	es2016: 2016,
+	es2017: 2017,
+	es2018: 2018,
+	es2019: 2019,
+	es2020: 2020,
+	es2021: 2021,
+	es2022: 2022,
+	es2023: 2023,
+	es2024: 2024,
+	es2025: 2025,
+	esnext: 9999
+};
+/**
+* tsconfig filenames probed when resolving a project's TypeScript
+* compiler options — the root config first, then a monorepo base config.
+*/
+const TSCONFIG_FILENAMES = ["tsconfig.json", "tsconfig.base.json"];
+/**
+* Project-config files that `StagedFiles.materialize` copies into
+* the temp directory alongside staged sources so oxlint resolves
+* `tsconfig` / `package.json` / lint configs the same way it would
+* in the working tree. Hoisted out of the staged-files helper so
+* the constant lives next to the rest of the IO budget knobs.
+*/
+const STAGED_FILES_PROJECT_CONFIG_FILENAMES = [
+	"tsconfig.json",
+	"tsconfig.base.json",
+	"package.json",
+	"doctor.config.ts",
+	"doctor.config.mts",
+	"doctor.config.cts",
+	"doctor.config.js",
+	"doctor.config.mjs",
+	"doctor.config.cjs",
+	"doctor.config.json",
+	"doctor.config.jsonc",
+	"oxlint.json",
+	".oxlintrc.json"
+];
+const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
+const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
+const NODE_COMPILE_CACHE_DIR_NAME = "node-compile-cache";
+const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
+const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
+const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
+const LINT_PHASE_TIMEOUT_MS = 3e5;
+const SCAN_TOTAL_DEADLINE_MS = 9e5;
+const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
+const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
+const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
+const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
+const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
+const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
+const REACT_SERVER_DOM_PACKAGES = [
+	"react-server-dom-webpack",
+	"react-server-dom-parcel",
+	"react-server-dom-turbopack"
+];
+const REACT_BLOG_RSC_ADVISORY_URL = "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components";
+const VERCEL_NEXTJS_SECURITY_RELEASE_URL = "https://vercel.com/changelog/next-js-may-2026-security-release";
+const DIAGNOSTIC_CATEGORY_BUCKETS = [
+	"Security",
+	"Bugs",
+	"Performance",
+	"Accessibility",
+	"Maintainability"
+];
+const APP_ONLY_RULE_KEYS = new Set([
+	"react-hooks-js/static-components",
+	"react-doctor/no-render-prop-children",
+	"react-doctor/prefer-explicit-variants"
+]);
+const COMPILER_CLEANUP_BUCKET = "compiler-cleanup";
+const COMPILER_CLEANUP_RULE_KEYS = new Set(["react-doctor/react-compiler-no-manual-memoization"]);
+const ROOT_CAUSE_GROUPABLE_RULE_KEYS = new Set([
+	"react-doctor/no-derived-state",
+	"react-doctor/no-derived-state-effect",
+	"react-doctor/no-derived-useState",
+	"react-doctor/no-adjust-state-on-prop-change",
+	"react-doctor/no-reset-all-state-on-prop-change"
+]);
+const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
+const CONFIG_CACHE_TTL_MS = 300 * 1e3;
+const SOCKET_FREE_PURL_API_BASE = "https://firewall-api.socket.dev/purl";
+const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
+const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
+const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
+const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
+const SUPPLY_CHAIN_PLUGIN = "socket";
+const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
+const SUPPLY_CHAIN_CATEGORY = "Security";
+const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
+const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
+const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
+const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => IGNORED_DIRECTORIES.has(segment));
 const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath);
 const isMinifiedSource = (absolutePath) => {
 	let fileDescriptor;
@@ -32849,23 +32990,38 @@ const readDirectoryEntries = (directoryPath) => {
 		throw error;
 	}
 };
-const countSourceFilesViaFilesystem = (rootDirectory) => {
-	let count = 0;
+function* walkSourceTreeFiles(rootDirectory) {
 	const stack = [rootDirectory];
 	while (stack.length > 0) {
 		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
+		if (currentDirectory === void 0) continue;
+		for (const entry of readDirectoryEntries(currentDirectory)) {
+			const absolutePath = Path.join(currentDirectory, entry.name);
 			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(Path.join(currentDirectory, entry.name));
+				if (!IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
 				continue;
 			}
-			if (entry.isFile() && isLintableSourceFile(entry.name) && !isLargeMinifiedFile(Path.join(currentDirectory, entry.name))) count++;
+			if (entry.isFile()) yield {
+				absolutePath,
+				name: entry.name
+			};
 		}
 	}
-	return count;
+}
+const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
+	const entries = [];
+	for (const relativePath of relativePaths) {
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (isLargeMinifiedFile(absolutePath, sizeBytes)) continue;
+		entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+	}
+	return entries;
 };
-const countSourceFilesViaGit = (rootDirectory) => {
+const listSourceFilesViaGit = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
 		"-z",
@@ -32878,9 +33034,16 @@ const countSourceFilesViaGit = (rootDirectory) => {
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !isLargeMinifiedFile(Path.resolve(rootDirectory, filePath))).length;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath));
+};
+const listSourceFilesViaFilesystem = (rootDirectory) => {
+	const filePaths = [];
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+	return filePaths;
 };
-const countSourceFiles = (rootDirectory) => countSourceFilesViaGit(rootDirectory) ?? countSourceFilesViaFilesystem(rootDirectory);
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
+const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
+const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
 const cachedPackageJsons = /* @__PURE__ */ new Map();
 const clearPackageJsonCache = () => {
 	cachedPackageJsons.clear();
@@ -33689,113 +33852,6 @@ const resolveEffectiveReactMajor = (reactVersion, packageJson) => {
 	if (peerFloor === null) return hasUpperBoundOnlyPeerRange(peerReactRange) ? null : installedReactMajor;
 	return installedReactMajor !== null ? Math.min(installedReactMajor, peerFloor) : peerFloor;
 };
-const JSX_FILE_PATTERN = /\.(tsx|jsx)$/;
-const MILLISECONDS_PER_SECOND = 1e3;
-const SCORE_API_URL = "https://www.react.doctor/api/score";
-const FETCH_TIMEOUT_MS = 1e4;
-const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
-const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
-const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
-const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
-const GIT_SHOW_MAX_BUFFER_BYTES = 10 * 1024 * 1024;
-const ES_TARGET_YEAR_BY_NAME = {
-	es3: 1999,
-	es5: 2009,
-	es6: 2015,
-	es2015: 2015,
-	es2016: 2016,
-	es2017: 2017,
-	es2018: 2018,
-	es2019: 2019,
-	es2020: 2020,
-	es2021: 2021,
-	es2022: 2022,
-	es2023: 2023,
-	es2024: 2024,
-	es2025: 2025,
-	esnext: 9999
-};
-/**
-* tsconfig filenames probed when resolving a project's TypeScript
-* compiler options — the root config first, then a monorepo base config.
-*/
-const TSCONFIG_FILENAMES = ["tsconfig.json", "tsconfig.base.json"];
-/**
-* Project-config files that `StagedFiles.materialize` copies into
-* the temp directory alongside staged sources so oxlint resolves
-* `tsconfig` / `package.json` / lint configs the same way it would
-* in the working tree. Hoisted out of the staged-files helper so
-* the constant lives next to the rest of the IO budget knobs.
-*/
-const STAGED_FILES_PROJECT_CONFIG_FILENAMES = [
-	"tsconfig.json",
-	"tsconfig.base.json",
-	"package.json",
-	"doctor.config.ts",
-	"doctor.config.mts",
-	"doctor.config.cts",
-	"doctor.config.js",
-	"doctor.config.mjs",
-	"doctor.config.cjs",
-	"doctor.config.json",
-	"doctor.config.jsonc",
-	"oxlint.json",
-	".oxlintrc.json"
-];
-const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
-const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
-const NODE_COMPILE_CACHE_DIR_NAME = "node-compile-cache";
-const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
-const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
-const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
-const LINT_PHASE_TIMEOUT_MS = 3e5;
-const SCAN_TOTAL_DEADLINE_MS = 9e5;
-const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
-const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
-const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
-const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
-const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
-const REACT_SERVER_DOM_PACKAGES = [
-	"react-server-dom-webpack",
-	"react-server-dom-parcel",
-	"react-server-dom-turbopack"
-];
-const REACT_BLOG_RSC_ADVISORY_URL = "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components";
-const VERCEL_NEXTJS_SECURITY_RELEASE_URL = "https://vercel.com/changelog/next-js-may-2026-security-release";
-const DIAGNOSTIC_CATEGORY_BUCKETS = [
-	"Security",
-	"Bugs",
-	"Performance",
-	"Accessibility",
-	"Maintainability"
-];
-const APP_ONLY_RULE_KEYS = new Set([
-	"react-hooks-js/static-components",
-	"react-doctor/no-render-prop-children",
-	"react-doctor/prefer-explicit-variants"
-]);
-const COMPILER_CLEANUP_BUCKET = "compiler-cleanup";
-const COMPILER_CLEANUP_RULE_KEYS = new Set(["react-doctor/react-compiler-no-manual-memoization"]);
-const ROOT_CAUSE_GROUPABLE_RULE_KEYS = new Set([
-	"react-doctor/no-derived-state",
-	"react-doctor/no-derived-state-effect",
-	"react-doctor/no-derived-useState",
-	"react-doctor/no-adjust-state-on-prop-change",
-	"react-doctor/no-reset-all-state-on-prop-change"
-]);
-const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
-const CONFIG_CACHE_TTL_MS = 300 * 1e3;
-const SOCKET_FREE_PURL_API_BASE = "https://firewall-api.socket.dev/purl";
-const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
-const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
-const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
-const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
-const SUPPLY_CHAIN_PLUGIN = "socket";
-const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
-const SUPPLY_CHAIN_CATEGORY = "Security";
-const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
-const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
-const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
 const TSCONFIG_FILENAME = "tsconfig.json";
 const isRelativeExtendsValue = (extendsValue) => extendsValue.startsWith("./") || extendsValue.startsWith("../") || Path.isAbsolute(extendsValue);
 const ensureJsonExtension = (filePath) => Path.extname(filePath) === "" ? `${filePath}.json` : filePath;
@@ -34487,7 +34543,10 @@ for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_N
 	NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
 }
 const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
-const canonicalizeRuleKey = (ruleKey) => LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey] ?? ruleKey;
+const canonicalizeRuleKey = (ruleKey) => {
+	const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
+	return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
+};
 const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
 const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
 	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
@@ -34514,7 +34573,7 @@ const tokenizeRuleList = (ruleList) => {
 const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
 const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
 const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
-const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — change it to \`${ruleId}\`.`;
+const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — add \`${ruleId}\` to the comment (e.g. \`${token}, ${ruleId}\`).`;
 const tokenMisnamesRule = (token, ruleId) => token !== ruleId && isSameRuleKey(token, ruleId);
 const detectInlineNearMiss = (lines, diagnosticLineIndex, ruleId) => {
 	const candidates = [{
@@ -34994,6 +35053,7 @@ const collectStringSet = (values) => {
 	if (!Array.isArray(values)) return /* @__PURE__ */ new Set();
 	return new Set(values.filter((value) => typeof value === "string"));
 };
+const JSX_NO_UNDEF_IDENTIFIER_PATTERN = /^`([^`]+)`/;
 /**
 * Pre-compiles every stateful filter and returns a single
 * `apply(diagnostic)` closure that runs (in order):
@@ -35027,11 +35087,28 @@ const buildDiagnosticPipeline = (input) => {
 	const compiledOverrides = compileIgnoreOverrides(userConfig);
 	const textComponentNames = collectStringSet(userConfig?.textComponents);
 	const rawTextWrapperComponentNames = collectStringSet(userConfig?.rawTextWrapperComponents);
+	const runtimeGlobalNames = collectStringSet(userConfig?.runtimeGlobals);
 	const hasTextComponents = textComponentNames.size > 0;
 	const hasRawTextWrappers = rawTextWrapperComponentNames.size > 0;
+	const hasRuntimeGlobals = runtimeGlobalNames.size > 0;
 	const fileLinesCache = /* @__PURE__ */ new Map();
 	const fileContextCache = /* @__PURE__ */ new Map();
 	const libraryFileCache = /* @__PURE__ */ new Map();
+	const suppressions = /* @__PURE__ */ new Map();
+	const suppress = (diagnostic, source) => {
+		const { ruleKey } = getDiagnosticRuleIdentity(diagnostic);
+		const suppressionKey = `${ruleKey}\u0000${source}`;
+		const existing = suppressions.get(suppressionKey);
+		suppressions.set(suppressionKey, existing ? {
+			...existing,
+			count: existing.count + 1
+		} : {
+			rule: ruleKey,
+			source,
+			count: 1
+		});
+		return null;
+	};
 	const isLibraryFile = (filePath) => {
 		let cached = libraryFileCache.get(filePath);
 		if (cached === void 0) {
@@ -35080,50 +35157,60 @@ const buildDiagnosticPipeline = (input) => {
 		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
 		return false;
 	};
-	return { apply: (diagnostic) => {
-		if (shouldAutoSuppress(diagnostic)) return null;
-		let current = diagnostic;
-		let explicitSeverityOverride;
-		let explicitRuleOverride;
-		if (severityControls) {
-			const { ruleKey, category } = getDiagnosticRuleIdentity(current);
-			explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey }, severityControls);
-			explicitSeverityOverride = resolveRuleSeverityOverride({
-				ruleKey,
-				category
-			}, severityControls);
-			if (explicitSeverityOverride === "off") return null;
-			if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
-		}
-		if (explicitRuleOverride === void 0) {
-			if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
-		}
-		if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
-		if (userConfig) {
-			if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return null;
-			if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
-			if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return null;
-			if (isRnRawTextSuppressedByConfig(current)) return null;
-		}
-		if (respectInlineDisables && current.line > 0) {
-			const lines = getFileLines(current.filePath);
-			if (lines) {
-				const ruleIdentifier = `${current.plugin}/${current.rule}`;
-				const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
-				if (evaluation.isSuppressed) return null;
-				if (evaluation.nearMissHint) current = {
-					...current,
-					suppressionHint: evaluation.nearMissHint
-				};
+	const isJsxNoUndefSuppressedByConfig = (diagnostic) => {
+		if (!hasRuntimeGlobals) return false;
+		if (diagnostic.rule !== "jsx-no-undef") return false;
+		const identifierMatch = JSX_NO_UNDEF_IDENTIFIER_PATTERN.exec(diagnostic.message);
+		return identifierMatch !== null && runtimeGlobalNames.has(identifierMatch[1]);
+	};
+	return {
+		apply: (diagnostic) => {
+			if (shouldAutoSuppress(diagnostic)) return null;
+			let current = diagnostic;
+			let explicitSeverityOverride;
+			let explicitRuleOverride;
+			if (severityControls) {
+				const { ruleKey, category } = getDiagnosticRuleIdentity(current);
+				explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey }, severityControls);
+				explicitSeverityOverride = resolveRuleSeverityOverride({
+					ruleKey,
+					category
+				}, severityControls);
+				if (explicitSeverityOverride === "off") return suppress(current, "config");
+				if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 			}
-		}
-		const fileContext = getFileContext(current.filePath);
-		if (fileContext !== "production") current = {
-			...current,
-			fileContext
-		};
-		return current;
-	} };
+			if (explicitRuleOverride === void 0) {
+				if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
+			}
+			if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
+			if (userConfig) {
+				if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return suppress(current, "config");
+				if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
+				if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return suppress(current, "override");
+				if (isRnRawTextSuppressedByConfig(current)) return null;
+				if (isJsxNoUndefSuppressedByConfig(current)) return null;
+			}
+			if (respectInlineDisables && current.line > 0) {
+				const lines = getFileLines(current.filePath);
+				if (lines) {
+					const ruleIdentifier = `${current.plugin}/${current.rule}`;
+					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
+					if (evaluation.isSuppressed) return suppress(current, "inline");
+					if (evaluation.nearMissHint) current = {
+						...current,
+						suppressionHint: evaluation.nearMissHint
+					};
+				}
+			}
+			const fileContext = getFileContext(current.filePath);
+			if (fileContext !== "production") current = {
+				...current,
+				fileContext
+			};
+			return current;
+		},
+		summarizeSuppressions: () => [...suppressions.values()]
+	};
 };
 const OxlintUnavailableKind = Literals(["binary-not-found", "native-binding-missing"]);
 var OxlintUnavailable = class extends TaggedErrorClass()("OxlintUnavailable", {
@@ -35365,7 +35452,7 @@ const resolveScanConcurrency = (requested) => {
 	if (!Number.isFinite(requested) || requested < 1) return 1;
 	return Math.min(Math.floor(requested), 32);
 };
-const readSystemFacts = () => ({
+const readSystemFacts$1 = () => ({
 	availableCores: os.availableParallelism(),
 	totalMemoryBytes: os.totalmem(),
 	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
@@ -35386,7 +35473,7 @@ const readSystemFacts = () => ({
 * `facts` is injectable so tests exercise core-bound, memory-bound, cgroup-
 * limited, and ceiling cases without mocking `os` or the filesystem.
 */
-const resolveAutoScanConcurrency = (facts = readSystemFacts()) => {
+const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
 	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
@@ -35427,13 +35514,7 @@ var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { de
 * without recompiling react-doctor. Tests override via
 * `Layer.succeed(SupplyChainOverlapTimeoutMs, ...)`.
 */
-var SupplyChainOverlapTimeoutMs = class extends Reference("react-doctor/SupplyChainOverlapTimeoutMs", { defaultValue: () => {
-	const raw = process.env["REACT_DOCTOR_SUPPLY_CHAIN_TIMEOUT_MS"];
-	if (raw === void 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
-	const parsed = Number(raw);
-	if (!Number.isFinite(parsed) || parsed <= 0) return SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS;
-	return parsed;
-} }) {};
+var SupplyChainOverlapTimeoutMs = class extends Reference("react-doctor/SupplyChainOverlapTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SUPPLY_CHAIN_TIMEOUT_MS", SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS) }) {};
 /**
 * Hard cap on combined stdout+stderr bytes per oxlint batch. The
 * subprocess gets SIGKILL'd if it produces more; the recovery path
@@ -35577,6 +35658,13 @@ const BOOLEAN_FIELD_NAMES = [
 	"adoptExistingLintConfig"
 ];
 const STRING_FIELD_NAMES = ["rootDir"];
+const STRING_ARRAY_FIELD_NAMES = [
+	"projects",
+	"textComponents",
+	"rawTextWrapperComponents",
+	"runtimeGlobals",
+	"serverAuthFunctionNames"
+];
 const SURFACE_CONTROL_FIELD_NAMES = [
 	"includeTags",
 	"excludeTags",
@@ -35678,6 +35766,7 @@ const validateConfigTypes = (config) => {
 	const validated = { ...config };
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
+	for (const fieldName of STRING_ARRAY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateStringArrayField(fieldName, value));
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
 	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
@@ -36710,14 +36799,17 @@ const checkReactServerComponentsAdvisory = (scanDirectory, project) => {
 	return diagnostics;
 };
 const REDUCED_MOTION_GREP_PATTERN = "prefers-reduced-motion|useReducedMotion|MotionConfig|reducedMotion";
-const REDUCED_MOTION_FILE_GLOBS = [
-	"*.ts",
-	"*.tsx",
-	"*.js",
-	"*.jsx",
-	"*.css",
-	"*.scss"
-];
+const REDUCED_MOTION_PATTERN = new RegExp(REDUCED_MOTION_GREP_PATTERN);
+const REDUCED_MOTION_FILE_EXTENSIONS = new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".css",
+	".scss"
+]);
+const REDUCED_MOTION_FILE_GLOBS = [...REDUCED_MOTION_FILE_EXTENSIONS].map((extension) => `*${extension}`);
+const GIT_GREP_NO_MATCH_STATUS = 1;
 const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
 	filePath: "package.json",
 	plugin: "react-doctor",
@@ -36729,6 +36821,19 @@ const MISSING_REDUCED_MOTION_DIAGNOSTIC = {
 	column: 0,
 	category: "Accessibility"
 };
+const hasReducedMotionHandlingViaFilesystem = (rootDirectory) => {
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) {
+		if (!REDUCED_MOTION_FILE_EXTENSIONS.has(Path.extname(name))) continue;
+		let content;
+		try {
+			content = NFS.readFileSync(absolutePath, "utf-8");
+		} catch {
+			continue;
+		}
+		if (REDUCED_MOTION_PATTERN.test(content)) return true;
+	}
+	return false;
+};
 const checkReducedMotion = (rootDirectory) => {
 	const packageJsonPath = Path.join(rootDirectory, "package.json");
 	if (!isFile(packageJsonPath)) return [];
@@ -36747,22 +36852,21 @@ const checkReducedMotion = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"grep",
 		"--untracked",
-		"-ql",
-		"-E",
+		"-lE",
 		REDUCED_MOTION_GREP_PATTERN,
 		"--",
 		...REDUCED_MOTION_FILE_GLOBS
 	], {
 		cwd: rootDirectory,
+		encoding: "utf-8",
 		stdio: [
 			"ignore",
 			"pipe",
 			"pipe"
 		]
 	});
-	if (result.error) return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
-	if (result.status === 0) return [];
-	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+	if (!(!result.error && (result.status === 0 || result.status === GIT_GREP_NO_MATCH_STATUS))) return hasReducedMotionHandlingViaFilesystem(rootDirectory) ? [] : [MISSING_REDUCED_MOTION_DIAGNOSTIC];
+	return result.status === 0 && result.stdout.split("\n").some((filePath) => filePath.length > 0 && !hasIgnoredPathSegment(filePath)) ? [] : [MISSING_REDUCED_MOTION_DIAGNOSTIC];
 };
 const buildSecurityScanDiagnostic = (finding, entry, relativePath) => ({
 	filePath: relativePath,
@@ -36912,7 +37016,10 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy)
 	}
 	return true;
 };
-const checkSecurityScan = (rootDirectory, options = {}) => {
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
+const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? buildCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
 	const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
@@ -36927,7 +37034,7 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 			committedFilesOnly: rule.committedFilesOnly === true
 		}];
 	});
-	if (enabledScanRules.length === 0) return [];
+	if (enabledScanRules.length === 0) return null;
 	const diagnostics = [];
 	const seen = /* @__PURE__ */ new Set();
 	const gitIgnoredCache = /* @__PURE__ */ new Map();
@@ -36939,15 +37046,34 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 		}
 		return status === true;
 	};
-	for (const file of collectSecurityScanFiles(rootDirectory)) for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
-		if (committedFilesOnly && isFileGitIgnored(file)) continue;
-		const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
-		const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
-		if (seen.has(key)) continue;
-		seen.add(key);
-		diagnostics.push(diagnostic);
+	const scanFile = (file) => {
+		for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
+			if (committedFilesOnly && isFileGitIgnored(file)) continue;
+			const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
+			const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			diagnostics.push(diagnostic);
+		}
+	};
+	return {
+		scanFile,
+		diagnostics
+	};
+};
+const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const session = createSecurityScanSession(rootDirectory, options);
+	if (session === null) return [];
+	let filesSinceYield = 0;
+	for (const file of collectSecurityScanFiles(rootDirectory)) {
+		session.scanFile(file);
+		filesSinceYield += 1;
+		if (filesSinceYield >= 16) {
+			filesSinceYield = 0;
+			await yieldToEventLoop();
+		}
 	}
-	return diagnostics;
+	return session.diagnostics;
 };
 var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {}, argv = p.argv || [], env = p.env || {};
@@ -37164,6 +37290,74 @@ const collectDeadCodeIgnorePatterns = (rootDirectory) => {
 	return [...seen].filter((pattern) => pattern.length > 0);
 };
 const collectDeadCodeEntryPatterns = (rootDirectory) => [...new Set(collectKnipPatterns(rootDirectory, "entry"))].filter((pattern) => pattern.length > 0);
+const readSystemFacts = () => ({
+	availableCores: os.availableParallelism(),
+	totalMemoryBytes: os.totalmem(),
+	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
+});
+/**
+* How many real deslop dead-code child processes may run at once, across the
+* concurrent per-project `runInspect` fibers of one CLI run. The cap is the
+* smaller of the core count and the number of `DEAD_CODE_WORKER_MEM_BUDGET_BYTES`
+* workers that fit in available memory, floored at 1.
+*
+* On a roomy dev box / CI runner this resolves high enough that every
+* concurrently-scanned project still spawns its own worker (no serialization vs
+* the prior uncapped behavior); on a memory-constrained runner it collapses
+* toward 1, so the `withDeadCodeWorkerSlot` semaphore serializes the spawns
+* instead of oversubscribing memory with N simultaneous children — the global
+* cap the per-project spawn path lacked.
+*
+* Mirrors `resolveAutoScanConcurrency` (lint), but budgets memory per the
+* heavier dead-code worker. `facts` is injectable for tests.
+*/
+const resolveDeadCodeConcurrency = (facts = readSystemFacts()) => {
+	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
+	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / DEAD_CODE_WORKER_MEM_BUDGET_BYTES);
+	return Math.max(1, Math.min(facts.availableCores, memoryBoundedWorkers));
+};
+let availableSlots = -1;
+const waiters = [];
+const releaseSlot = () => {
+	const nextWaiter = waiters.shift();
+	if (nextWaiter !== void 0) nextWaiter();
+	else availableSlots += 1;
+};
+/**
+* Runs `task` once a dead-code worker slot is free, releasing the slot when the
+* task settles (success or failure). With a high cap (roomy machine) every
+* caller proceeds immediately; with a low cap (constrained runner) callers
+* queue and run as slots free.
+*
+* `abortSignal` short-circuits the WAIT: if it's already aborted, or fires while
+* this caller is queued, the call rejects without acquiring a slot or running
+* `task` — so a cancelled scan (e.g. lint failed) doesn't sit in the queue and
+* then spawn a child only to tear it down. A queued caller that aborts removes
+* its own waiter so a later release never hands a slot to a dead request.
+*/
+const withDeadCodeWorkerSlot = async (task, abortSignal) => {
+	if (abortSignal?.aborted) throw new Error("Dead-code worker aborted.");
+	if (availableSlots < 0) availableSlots = resolveDeadCodeConcurrency();
+	if (availableSlots > 0) availableSlots -= 1;
+	else await new Promise((resolve, reject) => {
+		const waiter = () => {
+			abortSignal?.removeEventListener("abort", onAbort);
+			resolve();
+		};
+		const onAbort = () => {
+			const queuedIndex = waiters.indexOf(waiter);
+			if (queuedIndex !== -1) waiters.splice(queuedIndex, 1);
+			reject(/* @__PURE__ */ new Error("Dead-code worker aborted."));
+		};
+		waiters.push(waiter);
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return await task();
+	} finally {
+		releaseSlot();
+	}
+};
 /**
 * Resolves a path to its canonical, symlink-free form, falling back to
 * the input when it cannot be realpath'd (broken symlink, permission
@@ -37188,6 +37382,11 @@ const toCanonicalPath = (filePath) => {
 };
 const DEAD_CODE_PLUGIN = "deslop";
 const DEAD_CODE_CATEGORY = "Maintainability";
+const REACT_DOCTOR_TOOLCHAIN_PACKAGES = new Set([
+	"react-doctor",
+	"eslint-plugin-react-doctor",
+	"oxlint-plugin-react-doctor"
+]);
 const DEAD_CODE_WORKER_SCRIPT = `
 const inputChunks = [];
 process.stdin.on("data", (chunk) => inputChunks.push(chunk));
@@ -37454,14 +37653,17 @@ const checkDeadCode = async (options) => {
 	if (!NFS.existsSync(Path.join(rootDirectory, "package.json"))) return [];
 	const entryPatterns = collectDeadCodeEntryPatterns(rootDirectory);
 	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory);
-	const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
-		rootDirectory,
-		entryPatterns,
-		tsConfigPath: resolveTsConfigPath(rootDirectory),
-		ignorePatterns,
-		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
-		parseConcurrency: options.parseConcurrency
-	}), options.workerTimeoutMs ?? 12e4, options.abortSignal));
+	const spawnAndRun = () => {
+		return runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
+			rootDirectory,
+			entryPatterns,
+			tsConfigPath: resolveTsConfigPath(rootDirectory),
+			ignorePatterns,
+			deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
+			parseConcurrency: options.parseConcurrency
+		}), options.workerTimeoutMs ?? 12e4, options.abortSignal);
+	};
+	const result = parseDeadCodeWorkerResult(options.createWorker === void 0 ? await withDeadCodeWorkerSlot(spawnAndRun, options.abortSignal) : await spawnAndRun());
 	const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -37490,6 +37692,7 @@ const checkDeadCode = async (options) => {
 		});
 	}
 	for (const unusedDependency of result.unusedDependencies) {
+		if (REACT_DOCTOR_TOOLCHAIN_PACKAGES.has(unusedDependency.name)) continue;
 		const label = unusedDependency.isDevDependency ? "devDependency" : "dependency";
 		diagnostics.push({
 			filePath: "package.json",
@@ -37559,6 +37762,7 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
+const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 /**
 * Budget for the dead-code phase, scaled to the work. deslop's graph build is
 * CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
@@ -37577,53 +37781,6 @@ const resolveDeadCodeTimeout = (input) => {
 		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
 	};
 };
-const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
-	const entries = [];
-	for (const relativePath of relativePaths) {
-		const absolutePath = Path.resolve(rootDirectory, relativePath);
-		const sizeBytes = statSourceFileSize(absolutePath);
-		if (isLargeMinifiedFile(absolutePath, sizeBytes)) continue;
-		entries.push({
-			path: relativePath,
-			sizeBytes: sizeBytes ?? 0
-		});
-	}
-	return entries;
-};
-const listSourceFilesViaGit = (rootDirectory) => {
-	const result = spawnSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd: rootDirectory,
-		encoding: "utf-8",
-		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
-	});
-	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
-};
-const listSourceFilesViaFilesystem = (rootDirectory) => {
-	const filePaths = [];
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
-			const absolutePath = Path.join(currentDirectory, entry.name);
-			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
-				continue;
-			}
-			if (entry.isFile() && isLintableSourceFile(entry.name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
-		}
-	}
-	return filePaths;
-};
-const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
-const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const resolveLintIncludePaths = (rootDirectory, userConfig, project) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
@@ -37668,7 +37825,6 @@ var DeadCode = class DeadCode extends Service()("react-doctor/DeadCode") {
 		return yield* tryPromise({
 			try: (signal) => checkDeadCode({
 				rootDirectory: input.rootDirectory,
-				userConfig: input.userConfig,
 				parseConcurrency: input.parseConcurrency,
 				workerTimeoutMs: input.workerTimeoutMs,
 				abortSignal: signal
@@ -37791,6 +37947,11 @@ const isSafeGitRevision = (candidate) => {
 	if (candidate.includes("..") || candidate.includes("@{")) return false;
 	return SAFE_GIT_REVISION_PATTERN.test(candidate);
 };
+const resolveSpawnArgsLengthCap = () => {
+	if (process.platform === "win32") return SPAWN_ARGS_MAX_LENGTH_CHARS;
+	if (process.platform === "darwin") return SPAWN_ARGS_MAX_LENGTH_CHARS_DARWIN;
+	return SPAWN_ARGS_MAX_LENGTH_CHARS_POSIX;
+};
 /**
 * Splits a git revision range into its endpoints: three-dot `A...B`
 * (symmetric, merge-base) or two-dot `A..B` (direct). Returns `null`
@@ -37862,43 +38023,47 @@ var Git = class Git extends Service()("react-doctor/Git") {
 		* reason: GitInvocationFailed })` so the rest of the codebase
 		* sees a single failure channel.
 		*/
-		const runCommand = (input) => scoped(gen(function* () {
-			const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
-				cwd: input.directory,
-				env: input.env,
-				extendEnv: true
-			}));
-			const maxStdoutBytes = input.maxStdoutBytes;
-			const stdoutByteCount = yield* make$13(0);
-			const [stdout, stderr, status] = yield* all([
-				mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
-					args: [...input.args],
-					directory: input.directory,
-					cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
-				}) })) : void_)))))),
-				mkString(decodeText(handle.stderr)),
-				handle.exitCode
-			], { concurrency: 3 });
-			return {
-				status,
-				stdout,
-				stderr
-			};
-		})).pipe(catchTag$1("PlatformError", (cause) => {
-			if (input.command !== "git") return succeed$2({
+		const runCommand = (input) => {
+			const foldSpawnFailure = (cause) => input.command !== "git" ? succeed$2({
 				status: 127,
 				stdout: "",
 				stderr: String(cause)
-			});
-			return new ReactDoctorError({ reason: new GitInvocationFailed({
+			}) : fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
 				args: [...input.args],
 				directory: input.directory,
 				cause
-			}) });
-		}), withSpan("git.exec", { attributes: {
-			"git.command": input.command,
-			"git.subcommand": input.args[0] ?? ""
-		} }));
+			}) }));
+			return scoped(gen(function* () {
+				if (!isDirectory(input.directory)) return yield* foldSpawnFailure(`spawn ENOTDIR (cwd is not a directory: ${input.directory})`);
+				const argvLengthChars = input.command.length + 1 + input.args.reduce((total, arg) => total + arg.length + 1, 0);
+				const spawnArgsLengthCap = resolveSpawnArgsLengthCap();
+				if (argvLengthChars > spawnArgsLengthCap) return yield* foldSpawnFailure(`spawn ENAMETOOLONG (${argvLengthChars} argv chars exceed ${spawnArgsLengthCap})`);
+				const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
+					cwd: input.directory,
+					env: input.env,
+					extendEnv: true
+				}));
+				const maxStdoutBytes = input.maxStdoutBytes;
+				const stdoutByteCount = yield* make$13(0);
+				const [stdout, stderr, status] = yield* all([
+					mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
+						args: [...input.args],
+						directory: input.directory,
+						cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
+					}) })) : void_)))))),
+					mkString(decodeText(handle.stderr)),
+					handle.exitCode
+				], { concurrency: 3 });
+				return {
+					status,
+					stdout,
+					stderr
+				};
+			})).pipe(catchTag$1("PlatformError", foldSpawnFailure), withSpan("git.exec", { attributes: {
+				"git.command": input.command,
+				"git.subcommand": input.args[0] ?? ""
+			} }));
+		};
 		const runGit = (directory, args) => runCommand({
 			command: "git",
 			args,
@@ -37931,7 +38096,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			"rev-parse",
 			"--verify",
 			branch
-		]).pipe(map$3((result) => result.status === 0));
+		]).pipe(map$3((result) => result.status === 0), catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(false) : fail$4(error)));
 		const headSha = (directory) => runGit(directory, ["rev-parse", "HEAD"]).pipe(map$3((result) => result.status === 0 ? trimOrNull(result.stdout) : null));
 		const mergeBase = (input) => isSafeGitRevision(input.ref) ? runGit(input.directory, [
 			"merge-base",
@@ -38041,6 +38206,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				if (resolvedCurrentBranch === null && explicitBaseBranch === void 0) return null;
 				const baseBranch = explicitBaseBranch ?? (yield* defaultBranch(directory));
 				if (baseBranch === null) return null;
+				if (!isSafeGitRevision(baseBranch)) return null;
 				if (explicitBaseBranch !== void 0) {
 					if (!(yield* branchExists(directory, explicitBaseBranch))) return yield* fail$4(new ReactDoctorError({ reason: new GitBaseBranchMissing({ branch: explicitBaseBranch }) }));
 				}
@@ -38145,7 +38311,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				]);
 				if (result.status !== 0) return null;
 				return parseChangedLineRanges(result.stdout);
-			}).pipe(withSpan("Git.changedLineRanges"))
+			}).pipe(catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(null) : fail$4(error)), withSpan("Git.changedLineRanges"))
 		});
 	})).pipe(provide$2(layer$2.pipe(provide$2(mergeAll$1(layer$1, layer)))));
 	/**
@@ -38311,12 +38477,12 @@ const findFilesWithDisableDirectivesViaGit = async (rootDirectory, includePaths)
 		return null;
 	}
 	if (grepResult === null) return null;
-	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
+	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath));
 };
 const findFilesWithDisableDirectivesViaFilesystem = (rootDirectory, includePaths) => {
 	const matches = [];
 	const checkFile = (relativePath) => {
-		if (!isLintableSourceFile(relativePath)) return;
+		if (!isLintableSourceFile(relativePath) || hasIgnoredPathSegment(relativePath)) return;
 		const absolutePath = Path.join(rootDirectory, relativePath);
 		let content;
 		try {
@@ -38330,22 +38496,7 @@ const findFilesWithDisableDirectivesViaFilesystem = (rootDirectory, includePaths
 		for (const candidate of includePaths) checkFile(candidate);
 		return matches;
 	}
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const current = stack.pop();
-		if (current === void 0) continue;
-		const entries = readDirectoryEntries(current);
-		for (const entry of entries) {
-			if (entry.isDirectory()) {
-				if (entry.name.startsWith(".") || IGNORED_DIRECTORIES.has(entry.name)) continue;
-				stack.push(Path.join(current, entry.name));
-				continue;
-			}
-			if (!entry.isFile()) continue;
-			const absolute = Path.join(current, entry.name);
-			checkFile(Path.relative(rootDirectory, absolute));
-		}
-	}
+	for (const { absolutePath } of walkSourceTreeFiles(rootDirectory)) checkFile(Path.relative(rootDirectory, absolutePath));
 	return matches;
 };
 const findFilesWithDisableDirectives = async (rootDirectory, includePaths) => await findFilesWithDisableDirectivesViaGit(rootDirectory, includePaths) ?? findFilesWithDisableDirectivesViaFilesystem(rootDirectory, includePaths);
@@ -38391,7 +38542,7 @@ const normalizeConfigForHash = (config) => {
 	if (Array.isArray(clone?.jsPlugins)) clone.jsPlugins = clone.jsPlugins.map((_, index) => `<plugin:${index}>`);
 	return clone;
 };
-const computeRulesetHash = (input) => crypto.createHash("sha1").update(JSON.stringify(normalizeConfigForHash(input.config))).update("\0").update([...input.toolchainVersions].join("\0")).update("\0").update([...input.ignorePatterns].join("\n")).update(" ").update(input.tsconfigContent ?? "").digest("hex");
+const computeRulesetHash = (input) => crypto.createHash("sha1").update(JSON.stringify(normalizeConfigForHash(input.config))).update("\0").update([...input.toolchainVersions].join("\0")).update("\0").update([...input.ignorePatterns].join("\n")).update("\0").update(input.tsconfigContent ?? "").digest("hex");
 /**
 * Loads a plugin module via the local require resolver and extracts
 * `(name, ruleNames)` from either `module.exports.meta + rules` or
@@ -38562,12 +38713,12 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
 		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledBy)) continue;
-		const explicitSeverity = resolveRuleSeverityOverride({
+		const explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey: registryEntry.key }, severityControls);
+		if (rule.defaultEnabled === false && explicitRuleOverride === void 0) continue;
+		const severity = resolveRuleSeverityOverride({
 			ruleKey: registryEntry.key,
 			category: rule.category
-		}, severityControls);
-		if (rule.defaultEnabled === false && explicitSeverity === void 0) continue;
-		const severity = explicitSeverity ?? resolveCompilerCleanupBucketSeverity(registryEntry.key, severityControls) ?? rule.severity;
+		}, severityControls) ?? resolveCompilerCleanupBucketSeverity(registryEntry.key, severityControls) ?? rule.severity;
 		if (severity === "off") continue;
 		enabledReactDoctorRules[registryEntry.key] = severity;
 	}
@@ -38669,24 +38820,38 @@ const createFileLintCache = (cacheDirectory, rulesetHash) => {
 				updatedAtMs: Date.now(),
 				files: Object.fromEntries(cappedEntries)
 			};
-			const keptHashes = Object.entries(rulesets).sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8).map(([hash]) => hash);
-			const prunedRulesets = {};
-			for (const hash of keptHashes) prunedRulesets[hash] = rulesets[hash];
 			atomicWriteJson(cacheFilePath, {
 				version: 1,
-				rulesets: prunedRulesets
+				rulesets: Object.fromEntries(Object.entries(rulesets).filter(([, bucket]) => isRecord(bucket) && typeof bucket.updatedAtMs === "number").sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8))
 			});
 		}
 	};
 };
 const bundledRequire = createRequire(import.meta.url);
+const childNodeVersionByBinaryPath = /* @__PURE__ */ new Map();
+const resolveChildNodeVersion = (nodeBinaryPath) => {
+	if (nodeBinaryPath === process.execPath) return process.version;
+	const cachedVersion = childNodeVersionByBinaryPath.get(nodeBinaryPath);
+	if (cachedVersion !== void 0) return cachedVersion;
+	let version;
+	try {
+		version = execFileSync(nodeBinaryPath, ["--version"], {
+			encoding: "utf8",
+			timeout: NODE_VERSION_PROBE_TIMEOUT_MS
+		}).trim();
+	} catch {
+		version = `unknown:${nodeBinaryPath}`;
+	}
+	childNodeVersionByBinaryPath.set(nodeBinaryPath, version);
+	return version;
+};
 const TOOLCHAIN_PACKAGE_SPECIFIERS = [
 	"oxlint/package.json",
 	"oxlint-plugin-react-doctor/package.json",
 	"eslint-plugin-react-hooks/package.json"
 ];
-const resolveOxlintToolchainVersions = () => {
-	const versions = [`node=${process.version}`];
+const resolveOxlintToolchainVersions = (nodeBinaryPath = process.execPath) => {
+	const versions = [`node=${resolveChildNodeVersion(nodeBinaryPath)}`];
 	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS) try {
 		const packageJson = bundledRequire(specifier);
 		const version = typeof packageJson.version === "string" ? packageJson.version : "unknown";
@@ -39220,11 +39385,12 @@ const REACT_COMPILER_TITLE = "React Compiler can't optimize this";
 const REACT_COMPILER_TODO_TITLE = "React Compiler doesn't support this syntax";
 const REACT_COMPILER_IMPACT = "This component misses React Compiler's automatic memoization & re-renders more than it should";
 const REACT_COMPILER_ACTION = "Rewrite the flagged code so the compiler can optimize it.";
+const REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION = "It's how the library works, not a bug in your code. Memoize values you pass from it into other memoized components, or suppress it with `// react-doctor-disable-next-line react-hooks-js/incompatible-library`.";
 const REACT_COMPILER_GENERIC_MESSAGE = `${REACT_COMPILER_IMPACT}. ${REACT_COMPILER_ACTION}`;
-const buildReactCompilerMessage = (reasonSummary) => {
+const buildReactCompilerMessage = (reasonSummary, action = REACT_COMPILER_ACTION) => {
 	const normalizedSummary = reasonSummary.replace(TRAILING_PERIOD_PATTERN, "");
-	if (!normalizedSummary) return REACT_COMPILER_GENERIC_MESSAGE;
-	return `${REACT_COMPILER_IMPACT}: ${normalizedSummary}. ${REACT_COMPILER_ACTION}`;
+	if (!normalizedSummary) return `${REACT_COMPILER_IMPACT}. ${action}`;
+	return `${REACT_COMPILER_IMPACT}: ${normalizedSummary}. ${action}`;
 };
 const PLUGIN_CATEGORY_MAP = {
 	react: "Bugs",
@@ -39273,7 +39439,7 @@ const resolveCleanedDiagnostic = (message, help, plugin, rule, project) => {
 		const [reasonSummary = "", ...reasonDetailLines] = bailoutReason.split("\n");
 		const reasonDetail = reasonDetailLines.join("\n").trim();
 		return {
-			message: buildReactCompilerMessage(reasonSummary.trim()),
+			message: buildReactCompilerMessage(reasonSummary.trim(), rule === "incompatible-library" ? REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION : REACT_COMPILER_ACTION),
 			help: appendReanimatedSharedValueHint(reasonDetail || help, rule, project)
 		};
 	}
@@ -39534,28 +39700,46 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	const totalFileCount = fileBatches.reduce((sum, batch) => sum + batch.length, 0);
 	const runBatchPass = async (concurrency) => {
 		const allDiagnostics = [];
 		const droppedFiles = [];
+		const deadlineSkippedFiles = [];
+		const isPastDeadline = () => deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(deadlineEpochMs) === 0;
 		let firstDropReason = null;
-		const splitDeadlineMs = Date.now() + splitTotalBudgetMs;
-		const spawnLintBatch = async (batch, depth) => {
+		const spawnLintBatch = async (batch, depth, batchState) => {
+			if (isPastDeadline()) {
+				deadlineSkippedFiles.push(...batch);
+				batchState.deadlineSkippedFileCount += batch.length;
+				return [];
+			}
 			const batchArgs = [...baseArgs, ...batch];
 			try {
 				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory);
 			} catch (error) {
 				if (!isSplittableReactDoctorError(error)) throw error;
-				const splitBudgetExhausted = Date.now() >= splitDeadlineMs || depth >= splitMaxDepth;
-				if (batch.length <= 1 || splitBudgetExhausted) {
+				if (isPastDeadline()) {
+					deadlineSkippedFiles.push(...batch);
+					batchState.deadlineSkippedFileCount += batch.length;
+					return [];
+				}
+				batchState.deadlineMs ??= Date.now() + splitTotalBudgetMs;
+				const isBudgetElapsed = Date.now() >= batchState.deadlineMs;
+				const isDepthCapReached = depth >= splitMaxDepth;
+				if (batch.length <= 1 || isBudgetElapsed || isDepthCapReached) {
 					droppedFiles.push(...batch);
-					if (firstDropReason === null) firstDropReason = splitBudgetExhausted && batch.length > 1 ? `${error.message} (split budget exhausted after ${splitMaxDepth} levels / ${splitTotalBudgetMs / MILLISECONDS_PER_SECOND}s)` : error.message;
+					if (firstDropReason === null) {
+						let limitHint = "";
+						if (isDepthCapReached) limitHint = ` (split depth cap of ${splitMaxDepth} levels reached)`;
+						else if (isBudgetElapsed) limitHint = ` (split budget of ${splitTotalBudgetMs / MILLISECONDS_PER_SECOND}s exhausted at depth ${depth})`;
+						firstDropReason = batch.length > 1 ? `${error.message}${limitHint}` : error.message;
+					}
 					return [];
 				}
 				const splitIndex = Math.ceil(batch.length / 2);
-				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1)];
+				return [...await spawnLintBatch(batch.slice(0, splitIndex), depth + 1, batchState), ...await spawnLintBatch(batch.slice(splitIndex), depth + 1, batchState)];
 			}
 		};
 		let startedFileCount = 0;
@@ -39571,9 +39755,17 @@ const spawnLintBatches = async (input) => {
 		progressTimer?.unref?.();
 		try {
 			const batchResults = await mapWithConcurrency(fileBatches, concurrency, async (batch) => {
+				if (isPastDeadline()) {
+					deadlineSkippedFiles.push(...batch);
+					return [];
+				}
 				startedFileCount += batch.length;
-				const batchDiagnostics = await spawnLintBatch(batch, 0);
-				scannedFileCount += batch.length;
+				const batchState = {
+					deadlineMs: null,
+					deadlineSkippedFileCount: 0
+				};
+				const batchDiagnostics = await spawnLintBatch(batch, 0, batchState);
+				scannedFileCount += batch.length - batchState.deadlineSkippedFileCount;
 				if (onFileProgress) {
 					displayedFileCount = Math.min(Math.max(displayedFileCount, scannedFileCount), totalFileCount);
 					onFileProgress(displayedFileCount, totalFileCount);
@@ -39584,12 +39776,13 @@ const spawnLintBatches = async (input) => {
 		} finally {
 			if (progressTimer !== null) clearInterval(progressTimer);
 		}
-		if (droppedFiles.length > 0 && onPartialFailure) {
-			const previewFiles = droppedFiles.slice(0, 3).join(", ");
-			const remainderHint = droppedFiles.length > 3 ? `, +${droppedFiles.length - 3} more` : "";
-			const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
-			onPartialFailure(`${droppedFiles.length} file(s) failed to lint and were skipped (${previewFiles}${remainderHint})${reasonHint}`);
-		}
+		const reportSkippedFiles = (skippedFiles, buildMessage) => {
+			if (skippedFiles.length === 0 || !onPartialFailure) return;
+			onPartialFailure(buildMessage(`${skippedFiles.slice(0, 3).join(", ")}${skippedFiles.length > 3 ? `, +${skippedFiles.length - 3} more` : ""}`));
+		};
+		const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
+		reportSkippedFiles(droppedFiles, (fileListPreview) => `${droppedFiles.length} file(s) failed to lint and were skipped (${fileListPreview})${reasonHint}`);
+		reportSkippedFiles(deadlineSkippedFiles, (fileListPreview) => `${deadlineSkippedFiles.length} file(s) skipped — max scan duration reached before they were linted (${fileListPreview})`);
 		return allDiagnostics;
 	};
 	let diagnostics;
@@ -39646,7 +39839,14 @@ const resolveReactDoctorCacheDir = (projectDirectory) => {
 	if (cacheDirOverride) return Path.join(cacheDirOverride, projectCacheSubdir(projectDirectory));
 	const nodeModulesDirectory = Path.join(projectDirectory, "node_modules");
 	if (NFS.existsSync(nodeModulesDirectory)) return Path.join(nodeModulesDirectory, ".cache", "react-doctor");
-	return Path.join(os.tmpdir(), "react-doctor-cache", projectCacheSubdir(projectDirectory));
+	return Path.join(os.tmpdir(), `react-doctor-cache-${resolveUserCacheScope()}`, projectCacheSubdir(projectDirectory));
+};
+const resolveUserCacheScope = () => {
+	try {
+		return String(process.getuid?.() ?? os.userInfo().username);
+	} catch {
+		return "shared";
+	}
 };
 const sortSourceFilesByCost = (entries) => [...entries].sort((left, right) => right.sizeBytes - left.sizeBytes).map((entry) => entry.path);
 /**
@@ -39786,7 +39986,8 @@ const runOxlint = async (options) => {
 				spawnTimeoutMs,
 				outputMaxBytes,
 				concurrency: options.concurrency,
-				signal: options.signal
+				signal: options.signal,
+				deadlineEpochMs: options.deadlineEpochMs
 			});
 			writeOxlintConfig(passConfigPath, buildConfigForPass({}));
 			try {
@@ -39814,7 +40015,7 @@ const runOxlint = async (options) => {
 					extendsPaths: [],
 					ruleSelection: "cacheable"
 				}),
-				toolchainVersions: resolveOxlintToolchainVersions(),
+				toolchainVersions: resolveOxlintToolchainVersions(nodeBinaryPath),
 				ignorePatterns: combinedPatterns,
 				tsconfigContent
 			});
@@ -39828,7 +40029,7 @@ const runOxlint = async (options) => {
 					missFiles.push(candidateFile);
 					continue;
 				}
-				const cacheKey = `${candidateFile.replaceAll("\\", "/")}${contentHash}`;
+				const cacheKey = `${candidateFile.replaceAll("\\", "/")}\u0000${contentHash}`;
 				cacheKeyByFile.set(candidateFile, cacheKey);
 				const cachedDiagnostics = cache.lookup(cacheKey);
 				if (cachedDiagnostics === null) missFiles.push(candidateFile);
@@ -39885,7 +40086,8 @@ const runOxlint = async (options) => {
 			spawnTimeoutMs,
 			outputMaxBytes,
 			concurrency: options.concurrency,
-			signal: options.signal
+			signal: options.signal,
+			deadlineEpochMs: options.deadlineEpochMs
 		});
 		writeOxlintConfig(configPath, buildConfig({ extendsPaths }));
 		try {
@@ -39989,7 +40191,8 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 				outputMaxBytes,
 				concurrency,
 				signal,
-				lintBatchOrdering
+				lintBatchOrdering,
+				deadlineEpochMs: input.deadlineEpochMs
 			}),
 			catch: ensureReactDoctorError
 		});
@@ -40144,7 +40347,7 @@ const ScoreApiResponseSchema = Struct({
 	})))
 });
 const parseScoreResult = (value) => getOrNull(decodeUnknownOption(ScoreApiResponseSchema)(value));
-const stripLocalFileFields = (diagnostics) => diagnostics.map(({ filePath: _filePath, fileContext: _fileContext, ...rest }) => rest);
+const stripLocalFileFields = (diagnostics) => diagnostics.map(({ filePath: _filePath, fileContext: _fileContext, fixGroupId: _fixGroupId, ...rest }) => rest);
 const isAbortError = (error) => error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
 const describeFailure = (error) => {
 	if (isAbortError(error)) return `timed out after ${FETCH_TIMEOUT_MS / 1e3}s`;
@@ -40448,7 +40651,10 @@ const ALERT_SEVERITY_RANK = {
 	medium: 2,
 	low: 1
 };
-const severityRank = (severity) => ALERT_SEVERITY_RANK[severity.toLowerCase()] ?? 0;
+const severityRank = (severity) => {
+	const normalized = severity.toLowerCase();
+	return Object.hasOwn(ALERT_SEVERITY_RANK, normalized) ? ALERT_SEVERITY_RANK[normalized] : 0;
+};
 const displaySeverity = (severity) => {
 	const normalized = sanitizeTerminalText(severity.toLowerCase());
 	return normalized === "middle" ? "medium" : normalized;
@@ -40465,7 +40671,7 @@ const ALERT_TYPE_LABELS = {
 	typosquat: "possible typosquat"
 };
 const humanizeAlertType = (type) => type.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").toLowerCase().trim();
-const friendlyAlertType = (type) => ALERT_TYPE_LABELS[type] ?? sanitizeTerminalText(humanizeAlertType(type));
+const friendlyAlertType = (type) => Object.hasOwn(ALERT_TYPE_LABELS, type) ? ALERT_TYPE_LABELS[type] : sanitizeTerminalText(humanizeAlertType(type));
 const summarizeAlertNote = (note) => {
 	const collapsed = sanitizeTerminalText(note.replace(/\s+/g, " ").trim());
 	const firstSentence = collapsed.split(/(?<=\.)\s/)[0] || collapsed;
@@ -40560,7 +40766,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
-	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(checkSupplyChain(input).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
+	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (totalTimeoutMs) => checkSupplyChain({
+		...input,
+		totalTimeoutMs
+	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
 	static layerOf = (diagnostics) => succeed$3(SupplyChain, SupplyChain.of({ run: () => fromIterable$1(diagnostics) }));
 };
 const getObjectProperty = (value, propertyName) => {
@@ -40622,7 +40831,10 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      diagnostics).
 *   2. beforeLint hook (e.g. CLI renders the project-detection block)
 *   3. environment checks (reduced-motion + pnpm hardening +
-*      expo/react-native + security scan), collected synchronously
+*      expo/react-native), collected synchronously. The heavier
+*      content-regex security scan is forked instead (like supply-chain
+*      below) and joined before the concat, so its CPU overlaps lint
+*      rather than blocking the event loop before it.
 *   4. The supply-chain check (Socket.dev) is forked onto a background
 *      fiber so its ~100% network-bound time overlaps the ~100%
 *      CPU/subprocess-bound lint pass below, collapsing two serial
@@ -40642,7 +40854,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      order, so terminal output is identical either way; supply-chain
 *      rides alongside without a spinner.
 *   6. Join the supply-chain fiber, then assemble the diagnostics in a
-*      FIXED order (env, supply-chain, lint, dead-code) so the output is
+*      FIXED order (env, security-scan, supply-chain, lint, dead-code) so the output is
 *      byte-identical regardless of which fiber settled first. The
 *      viewer-permission fiber is joined later, during score-metadata
 *      assembly (it feeds score metadata, not diagnostics). The per-element
@@ -40703,12 +40915,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkPnpmHardening(scanDirectory),
 		...checkReactServerComponentsAdvisory(scanDirectory, project),
 		...checkExpoProject(scanDirectory, project),
-		...checkReactNativeProject(scanDirectory, project),
-		...checkSecurityScan(scanDirectory, {
-			project,
-			ignoredTags: input.ignoredTags
-		})
+		...checkReactNativeProject(scanDirectory, project)
 	])));
+	const securityScanFailedRef = yield* make$13(false);
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise(() => checkSecurityScanCooperative(scanDirectory, {
+		project,
+		ignoredTags: input.ignoredTags
+	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), catch_$1(() => set(securityScanFailedRef, true).pipe(as(empty$4))))))).pipe(withSpan("SecurityScan.run")));
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
 	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
@@ -40739,6 +40952,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
 	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
+	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
 	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeOverlapMode = yield* DeadCodeOverlap;
 	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
@@ -40746,7 +40960,6 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
 	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config,
 		parseConcurrency: deadCodeParseConcurrency,
 		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
@@ -40769,7 +40982,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	});
 	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
 		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
-		phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs)
+		phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs))
 	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
@@ -40794,7 +41007,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		onCacheStats: (cacheHitFileCount, totalConsideredFileCount) => {
 			lintCacheHitFileCount = cacheHitFileCount;
 			lintCacheTotalFileCount = totalConsideredFileCount;
-		}
+		},
+		deadlineEpochMs: input.deadlineEpochMs
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
 		yield* set(lintFailure, {
 			didFail: true,
@@ -40821,7 +41035,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	let deadCodeCollected = [];
 	if (lintFailureState.didFail) {
 		if (deadCodeFiber !== null) yield* interrupt(deadCodeFiber);
-	} else if (shouldRunDeadCode) {
+	} else if (shouldRunDeadCode) if (input.deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(input.deadlineEpochMs) === 0) {
+		if (deadCodeFiber !== null) yield* interrupt(deadCodeFiber);
+		yield* set(deadCodeFailure, {
+			didFail: true,
+			reason: "Dead-code analysis skipped — max scan duration reached."
+		});
+	} else {
 		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
 		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
 			sourceFileCount: totalFileCount,
@@ -40830,7 +41050,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		});
 		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
 			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
-			phaseTimeoutMs: resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs)
+			phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs))
 		});
 	}
 	const deadCodeFailureState = lintFailureState.didFail ? {
@@ -40844,9 +41064,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	else yield* scanProgress.succeed(`Scanned ${scannedFilesLabel} in ${scanElapsedSeconds}s${workerCountSuffix}`);
 	const supplyChainResult = yield* join(supplyChainFiber);
 	const supplyChainCollected = supplyChainResult.diagnostics;
+	const securityScanCollected = yield* join(securityScanFiber);
 	yield* reporterService.finalize;
 	const finalDiagnostics = sortDiagnosticsStable(assignFixGroups([
 		...envCollected,
+		...securityScanCollected,
 		...supplyChainCollected,
 		...lintCollected,
 		...deadCodeCollected
@@ -40866,12 +41088,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	};
 	const scoreSurface = input.scoreSurface ?? "score";
 	const scoreDiagnostics = filterDiagnosticsForSurface([...finalDiagnostics], scoreSurface, resolvedConfig.config);
-	const score = lintFailureState.didFail ? null : yield* scoreService.compute({
+	const score = lintFailureState.didFail || deadCodeFailureState.didFail ? null : yield* scoreService.compute({
 		diagnostics: scoreDiagnostics,
 		isCi: input.isCi,
 		metadata: scoreMetadata
 	});
 	const lintPartialFailures = yield* get$2(partialFailuresRef);
+	const securityScanFailed = yield* get$2(securityScanFailedRef);
 	return {
 		project,
 		userConfig: resolvedConfig.config,
@@ -40892,8 +41115,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		scanElapsedMilliseconds,
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
+		securityScanFailed,
 		lintCacheHitFileCount,
-		lintCacheTotalFileCount
+		lintCacheTotalFileCount,
+		suppressedRuleCounts: transform.summarizeSuppressions()
 	};
 }).pipe(withSpan("runInspect", { attributes: {
 	"inspect.directory": input.directory,
@@ -41232,6 +41457,7 @@ const buildJsonReport = (input) => {
 	return {
 		schemaVersion: 1,
 		mode: input.mode,
+		...input.baselineDegraded ? { baselineDegraded: true } : {},
 		...shared
 	};
 };
@@ -41298,6 +41524,61 @@ const clearAutoSuppressionCaches = () => {};
 * untouched so the loader sees the same plain object either way.
 */
 const defineConfig = (config) => config;
+const AI_TRAINING_ENV_VARS = [
+	["HF_DATASETS_CACHE", "huggingface"],
+	["HF_HOME", "huggingface"],
+	["HUGGINGFACE_HUB_CACHE", "huggingface"],
+	["SPACE_ID", "huggingface-spaces"],
+	["CUDA_VISIBLE_DEVICES", "cuda"],
+	["NVIDIA_VISIBLE_DEVICES", "nvidia"],
+	["ROCR_VISIBLE_DEVICES", "rocm"],
+	["TPU_NAME", "google-tpu"],
+	["WANDB_RUN_ID", "wandb"],
+	["WANDB_SWEEP_ID", "wandb"],
+	["MLFLOW_RUN_ID", "mlflow"],
+	["MLFLOW_TRACKING_URI", "mlflow"],
+	["COMET_EXPERIMENT_KEY", "comet"],
+	["NEPTUNE_RUN_ID", "neptune"],
+	["CLEARML_TASK_ID", "clearml"],
+	["DVC_STAGE", "dvc"],
+	["RAY_WORKER_PROCESS", "ray"],
+	["RAY_ADDRESS", "ray"],
+	["MUJOCO_GL", "mujoco"],
+	["MUJOCO_PATH", "mujoco"],
+	["GYM_DISABLE_ENV_CHECKER", "gymnasium"],
+	["SM_TRAINING_ENV", "sagemaker"],
+	["TRAINING_JOB_ARN", "sagemaker"],
+	["SAGEMAKER_BASE_DIR", "sagemaker"],
+	["AZUREML_RUN_ID", "azure-ml"],
+	["AZURE_ML_MODEL_DIR", "azure-ml"],
+	["CLOUD_ML_PROJECT_ID", "vertex-ai"],
+	["VERTEX_AI_LOG_LEVEL", "vertex-ai"],
+	["DET_MASTER", "determined-ai"],
+	["LIGHTNING_USER_ID", "lightning-ai"],
+	["FLYTE_INTERNAL_EXECUTION_ID", "flyte"],
+	["ARGO_WORKFLOW_NAME", "argo-workflows"],
+	["KFP_POD_NAME", "kubeflow-pipelines"],
+	["KAGGLE_KERNEL_RUN_TYPE", "kaggle"],
+	["COLAB_BACKEND_VERSION", "google-colab"],
+	["DATABRICKS_RUNTIME_VERSION", "databricks"],
+	["DAYTONA_WS_ID", "daytona"],
+	["DAYTONA_WS_NAME", "daytona"],
+	["E2B_SANDBOX_ID", "e2b"],
+	["MODAL_FUNCTION_ID", "modal"],
+	["MODAL_TASK_ID", "modal"],
+	["RUNPOD_POD_ID", "runpod"],
+	["REPLICATE_USERNAME", "replicate"],
+	["VAST_CONTAINERLABEL", "vast-ai"],
+	["HARBOR_URL", "harbor"],
+	["HARBOR_HOSTNAME", "harbor"],
+	["SWE_BENCH_TASK", "swe-bench"],
+	["SWEBENCH_TASK", "swe-bench"],
+	["SWE_AGENT_MODEL", "swe-agent"]
+];
+const detectAiTrainingEnvironment = () => {
+	for (const [envVar, label] of AI_TRAINING_ENV_VARS) if (process.env[envVar]) return label;
+	return null;
+};
 const unionValues = (baseValues, overrideValues) => [...new Set([...baseValues, ...overrideValues])];
 const mergeIgnores = (baseIgnore, overrideIgnore) => {
 	const mergedIgnore = {
@@ -41342,6 +41623,12 @@ const mergeReactDoctorConfigs = (baseConfig, overrideConfig) => {
 };
 //#endregion
 //#region ../api/dist/index.js
+let didWarnAiTraining = false;
+const warnIfAiTrainingEnvironment = () => {
+	if (didWarnAiTraining || detectAiTrainingEnvironment() === null) return;
+	didWarnAiTraining = true;
+	console.warn("[react-doctor] Use in an AI or ML pipeline requires written permission under the react-doctor license. Contact founders@million.dev to request access.");
+};
 const buildDiagnoseLayer = (config, configOverrideTarget) => {
 	const configLayer = configOverrideTarget === void 0 ? Config.layerNode : Config.layerOf({
 		config,
@@ -41379,6 +41666,7 @@ const outputToDiagnoseResult = (output, elapsedMilliseconds) => {
 	};
 };
 const diagnoseDirectory = async (directory, options) => {
+	warnIfAiTrainingEnvironment();
 	const startTime = globalThis.performance.now();
 	const scanTarget = await resolveScanTarget(directory);
 	return outputToDiagnoseResult(await runPromise(restoreLegacyThrow(buildInspectProgram(scanTarget, options).pipe(provide(buildDiagnoseLayer(scanTarget.userConfig)), provide(layerOtlp)))), globalThis.performance.now() - startTime);
@@ -41425,6 +41713,7 @@ const diagnoseProject = async (projectDefinition, baseOptions, batchConfig) => {
 	}
 };
 const diagnoseProjectBatch = async (input) => {
+	warnIfAiTrainingEnvironment();
 	const startTime = globalThis.performance.now();
 	const { projects, concurrency, config: batchConfig, ...baseOptions } = input;
 	const projectResults = await mapWithConcurrency(projects, concurrency ?? 4, (projectDefinition) => diagnoseProject(projectDefinition, baseOptions, batchConfig));
@@ -41469,4 +41758,4 @@ const toJsonReport = (result, options) => buildJsonReport({
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=33508ee6-c977-5b5f-8585-9939928ce74d
+//# debugId=62cf4740-7938-5db0-8b80-dc81b60af36a