react-doctor 0.6.2 → 0.6.3-dev.20d81f6

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a9894975-1858-5b46-8a22-ae1680ad9a8a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="d7bda084-a223-5aa7-8605-578888bd1b33")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -18,6 +18,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
 import * as Crypto from "node:crypto";
 import crypto, { createHash, randomUUID } from "node:crypto";
+import { ANALYZED_MANIFEST_FILENAMES, DEFAULT_EXTENSIONS } from "deslop-js/analyzed-inputs";
 import { gzipSync } from "node:zlib";
 import * as Sentry from "@sentry/node";
 import { performance as performance$1 } from "node:perf_hooks";
@@ -36128,6 +36129,8 @@ const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
 const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
+const CORE_PACKAGE_VERSION = "0.6.3";
+const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
 const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
 const SUPPLY_CHAIN_CATEGORY = "Security";
@@ -38678,7 +38681,7 @@ const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
 };
 const resolveLintBatchOrdering = () => {
-	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "cost" ? "cost" : "arrival";
+	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "arrival" ? "arrival" : "cost";
 };
 /**
 * Per-batch oxlint wall-clock budget. Reads from the env var on
@@ -38775,17 +38778,19 @@ var DeadCodeOverlap = class extends Reference("react-doctor/DeadCodeOverlap", {
 	return "auto";
 } }) {};
 /**
-* How the full-scan lint pass orders its file batches. `"arrival"` (the
-* default) keeps `git ls-files` discovery order. `"cost"` opts into LPT (feed
-* the largest files first); set `REACT_DOCTOR_LINT_BATCH_ORDERING=cost`. NOTE:
-* `cost` is OFF by default because the current sort-desc-then-chunk-100 packs
-* the heaviest files into one wave-1 batch — on size-skewed repos that mega-
-* batch is a straggler (and can trip the per-batch timeout + split), measurably
-* regressing the common full-scan case. LPT needs the heavy files SPREAD across
-* batches before `cost` earns the default. Tests override via
-* `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans never reach this
-* — they pass user-scoped `includePaths` that skip discovery and stay in
-* arrival order; only the full-scan branch reads it.
+* How the full-scan lint pass plans its file batches. `"cost"` (the default)
+* builds size-balanced LPT batches (`planLintBatches`): the same mandatory
+* batch count as greedy chunking (`ceil(files / 100)`), but every batch gets
+* an even share of files AND bytes, so no 100-file chunk is a straggler while
+* the remainder-batch worker idles — and the heavy files are SPREAD across
+* batches, the precondition the old sort-desc-then-chunk-100 `cost` mode
+* lacked (it packed the heaviest files into one wave-1 straggler batch,
+* measurably regressing size-skewed repos, which is why it never earned the
+* default). `"arrival"` (`REACT_DOCTOR_LINT_BATCH_ORDERING=arrival`) is the
+* rollback hatch to plain greedy 100-file chunking in discovery order. Tests
+* override via `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans
+* never reach this — they pass user-scoped `includePaths` that skip discovery
+* and stay in arrival order; only the full-scan branch reads it.
 */
 var LintBatchOrdering = class extends Reference("react-doctor/LintBatchOrdering", { defaultValue: resolveLintBatchOrdering }) {};
 const CACHE_DISABLED_VALUES$1 = new Set(["1", "true"]);
@@ -38810,6 +38815,25 @@ var PerFileLintCacheEnabled = class extends Reference("react-doctor/PerFileLintC
 	if (CACHE_DISABLED_VALUES$1.has(noFileCache)) return false;
 	return true;
 } }) {};
+/**
+* Whether the whole-project dead-code result cache
+* (`dead-code/dead-code-result-cache.ts`) is active. Defaults ON — a rescan
+* whose inputs (source tree, manifests, configs, analyzer version) are
+* unchanged replays the stored diagnostics instead of re-running the
+* analysis worker. Opt-OUT, two knobs (matching the per-file lint cache):
+*
+*   - `REACT_DOCTOR_NO_CACHE` — the global off-switch.
+*   - `REACT_DOCTOR_NO_DEAD_CODE_CACHE` — granular: bust only this cache.
+*
+* Tests override via `Layer.succeed(DeadCodeResultCacheEnabled, false)`.
+*/
+var DeadCodeResultCacheEnabled = class extends Reference("react-doctor/DeadCodeResultCacheEnabled", { defaultValue: () => {
+	const noCache = process.env["REACT_DOCTOR_NO_CACHE"]?.toLowerCase() ?? "";
+	const noDeadCodeCache = process.env["REACT_DOCTOR_NO_DEAD_CODE_CACHE"]?.toLowerCase() ?? "";
+	if (CACHE_DISABLED_VALUES$1.has(noCache)) return false;
+	if (CACHE_DISABLED_VALUES$1.has(noDeadCodeCache)) return false;
+	return true;
+} }) {};
 const DIAGNOSTIC_SURFACES = [
 	"cli",
 	"prComment",
@@ -40170,6 +40194,7 @@ function* collectSecurityScanFiles(rootDirectory) {
 				isGeneratedBundleByName: classification.isGeneratedBundleByName
 			});
 		}
+		yield null;
 	}
 	for (const candidates of [
 		priorityCandidates,
@@ -40295,9 +40320,18 @@ const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
 	const session = createSecurityScanSession(rootDirectory, options);
 	if (session === null) return [];
 	let sliceStartedAt = performance.now();
-	for (const file of collectSecurityScanFiles(rootDirectory)) for (const _ruleStep of session.scanFileByRule(file)) if (performance.now() - sliceStartedAt >= 12) {
-		await yieldToEventLoop();
-		sliceStartedAt = performance.now();
+	for (const file of collectSecurityScanFiles(rootDirectory)) {
+		if (file === null) {
+			if (performance.now() - sliceStartedAt >= 12) {
+				await yieldToEventLoop();
+				sliceStartedAt = performance.now();
+			}
+			continue;
+		}
+		for (const _ruleStep of session.scanFileByRule(file)) if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
 	}
 	return session.diagnostics;
 };
@@ -40532,6 +40566,80 @@ const collectDeadCodeIgnorePatterns = (rootDirectory) => {
 	return [...seen].filter((pattern) => pattern.length > 0);
 };
 const collectDeadCodeEntryPatterns = (rootDirectory) => [...new Set(collectKnipPatterns(rootDirectory, "entry"))].filter((pattern) => pattern.length > 0);
+const atomicWriteJson = (filePath, value) => {
+	try {
+		NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
+		const temporaryPath = `${filePath}.${process.pid}.tmp`;
+		NFS.writeFileSync(temporaryPath, JSON.stringify(value));
+		NFS.renameSync(temporaryPath, filePath);
+	} catch {
+		return;
+	}
+};
+const failOpenReadJson = (filePath, fallback) => {
+	try {
+		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
+	} catch {
+		return fallback;
+	}
+};
+const ANALYZED_FILE_EXTENSIONS = new Set(DEFAULT_EXTENSIONS);
+const CORE_SIDE_MANIFEST_NAMES = ["knip.json", "deno.lock"];
+const ANALYZED_MANIFEST_NAMES = new Set([...ANALYZED_MANIFEST_FILENAMES, ...CORE_SIDE_MANIFEST_NAMES]);
+const isTsConfigLikeFile = (fileName) => (fileName.startsWith("tsconfig") || fileName.startsWith("jsconfig")) && fileName.endsWith(".json");
+const isFingerprintedFile = (fileName) => ANALYZED_FILE_EXTENSIONS.has(Path.extname(fileName).toLowerCase()) || ANALYZED_MANIFEST_NAMES.has(fileName) || isTsConfigLikeFile(fileName);
+const collectAnalyzedFileFingerprints = (rootDirectory) => {
+	const fingerprints = [];
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) {
+		if (!isFingerprintedFile(name)) continue;
+		try {
+			const fileStat = NFS.statSync(absolutePath);
+			const relativePath = Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/");
+			fingerprints.push(`${relativePath}:${fileStat.mtimeMs}:${fileStat.size}`);
+		} catch {}
+	}
+	return fingerprints.sort();
+};
+const bundledRequire$2 = createRequire(import.meta.url);
+const resolveDeslopVersion = () => {
+	try {
+		const packageJson = JSON.parse(NFS.readFileSync(bundledRequire$2.resolve("deslop-js/package.json"), "utf8"));
+		return isRecord$1(packageJson) && typeof packageJson.version === "string" ? packageJson.version : "unknown";
+	} catch {
+		return "unknown";
+	}
+};
+const computeDeadCodeCacheKey = (input) => crypto.createHash("sha1").update(JSON.stringify({
+	schemaVersion: 1,
+	coreVersion: input.coreVersion,
+	deslopVersion: resolveDeslopVersion(),
+	deslopJsModuleSpecifier: input.deslopJsModuleSpecifier,
+	entryPatterns: input.entryPatterns,
+	ignorePatterns: input.ignorePatterns,
+	tsConfigFile: input.tsConfigPath === void 0 ? null : Path.relative(input.rootDirectory, input.tsConfigPath).replace(/\\/g, "/"),
+	files: collectAnalyzedFileFingerprints(input.rootDirectory)
+})).digest("hex");
+const validateDiagnostic$1 = decodeUnknownSync(Diagnostic);
+const decodeCachedDiagnostics = (raw) => {
+	try {
+		for (const entry of raw) validateDiagnostic$1(entry);
+		return raw;
+	} catch {
+		return null;
+	}
+};
+const lookupDeadCodeResultCache = (cacheDirectory, cacheKey) => {
+	const persisted = failOpenReadJson(Path.join(cacheDirectory, DEAD_CODE_CACHE_FILENAME), null);
+	if (persisted === null || !isRecord$1(persisted) || persisted.version !== 1 || persisted.key !== cacheKey || !Array.isArray(persisted.diagnostics)) return null;
+	return decodeCachedDiagnostics(persisted.diagnostics);
+};
+const storeDeadCodeResultCache = (cacheDirectory, cacheKey, diagnostics) => {
+	atomicWriteJson(Path.join(cacheDirectory, DEAD_CODE_CACHE_FILENAME), {
+		version: 1,
+		key: cacheKey,
+		diagnostics
+	});
+};
 const readSystemFacts = () => ({
 	availableCores: os.availableParallelism(),
 	totalMemoryBytes: os.totalmem(),
@@ -40600,6 +40708,21 @@ const withDeadCodeWorkerSlot = async (task, abortSignal) => {
 		releaseSlot();
 	}
 };
+const projectCacheSubdir = (projectDirectory) => crypto.createHash("sha256").update(projectDirectory).digest("hex").slice(0, 16);
+const resolveReactDoctorCacheDir = (projectDirectory) => {
+	const cacheDirOverride = process.env["REACT_DOCTOR_CACHE_DIR"]?.trim();
+	if (cacheDirOverride) return Path.join(cacheDirOverride, projectCacheSubdir(projectDirectory));
+	const nodeModulesDirectory = Path.join(projectDirectory, "node_modules");
+	if (NFS.existsSync(nodeModulesDirectory)) return Path.join(nodeModulesDirectory, ".cache", "react-doctor");
+	return Path.join(os.tmpdir(), `react-doctor-cache-${resolveUserCacheScope()}`, projectCacheSubdir(projectDirectory));
+};
+const resolveUserCacheScope = () => {
+	try {
+		return String(process.getuid?.() ?? os.userInfo().username);
+	} catch {
+		return "shared";
+	}
+};
 /**
 * Resolves a path to its canonical, symlink-free form, falling back to
 * the input when it cannot be realpath'd (broken symlink, permission
@@ -40895,13 +41018,28 @@ const checkDeadCode = async (options) => {
 	if (!NFS.existsSync(Path.join(rootDirectory, "package.json"))) return [];
 	const entryPatterns = collectDeadCodeEntryPatterns(rootDirectory);
 	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory);
+	const tsConfigPath = resolveTsConfigPath(rootDirectory);
+	const deslopJsModuleSpecifier = options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js");
+	const cacheKey = options.cacheEnabled ? computeDeadCodeCacheKey({
+		rootDirectory,
+		entryPatterns,
+		ignorePatterns,
+		tsConfigPath,
+		deslopJsModuleSpecifier,
+		coreVersion: CORE_PACKAGE_VERSION
+	}) : null;
+	if (cacheKey !== null) {
+		const cachedDiagnostics = lookupDeadCodeResultCache(resolveReactDoctorCacheDir(rootDirectory), cacheKey);
+		options.onCacheOutcome?.(cachedDiagnostics !== null);
+		if (cachedDiagnostics !== null) return [...cachedDiagnostics];
+	}
 	const spawnAndRun = () => {
 		return runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
 			rootDirectory,
 			entryPatterns,
-			tsConfigPath: resolveTsConfigPath(rootDirectory),
+			tsConfigPath,
 			ignorePatterns,
-			deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
+			deslopJsModuleSpecifier,
 			parseConcurrency: options.parseConcurrency
 		}), options.workerTimeoutMs ?? 12e4, options.abortSignal);
 	};
@@ -40962,6 +41100,7 @@ const checkDeadCode = async (options) => {
 			category: DEAD_CODE_CATEGORY
 		});
 	}
+	if (cacheKey !== null) storeDeadCodeResultCache(resolveReactDoctorCacheDir(rootDirectory), cacheKey, diagnostics);
 	return diagnostics;
 };
 const DEAD_CODE_RULE_KEY_PREFIX = `${DEAD_CODE_PLUGIN}/`;
@@ -41064,12 +41203,15 @@ var Config = class Config extends Service()("react-doctor/Config") {
 */
 var DeadCode = class DeadCode extends Service()("react-doctor/DeadCode") {
 	static layerNode = succeed$3(DeadCode, DeadCode.of({ run: (input) => unwrap(fn("DeadCode.run")(function* () {
+		const cacheEnabled = yield* DeadCodeResultCacheEnabled;
 		return yield* tryPromise({
 			try: (signal) => checkDeadCode({
 				rootDirectory: input.rootDirectory,
 				parseConcurrency: input.parseConcurrency,
 				workerTimeoutMs: input.workerTimeoutMs,
-				abortSignal: signal
+				abortSignal: signal,
+				cacheEnabled,
+				onCacheOutcome: input.onCacheOutcome
 			}),
 			catch: (cause) => new ReactDoctorError({ reason: new DeadCodeAnalysisFailed({ cause }) })
 		}).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)));
@@ -41995,23 +42137,6 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		}
 	};
 };
-const atomicWriteJson = (filePath, value) => {
-	try {
-		NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
-		const temporaryPath = `${filePath}.${process.pid}.tmp`;
-		NFS.writeFileSync(temporaryPath, JSON.stringify(value));
-		NFS.renameSync(temporaryPath, filePath);
-	} catch {
-		return;
-	}
-};
-const failOpenReadJson = (filePath, fallback) => {
-	try {
-		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
-	} catch {
-		return fallback;
-	}
-};
 const validateDiagnostic = decodeUnknownSync(Diagnostic);
 const decodeFileDiagnostics = (raw) => {
 	if (!Array.isArray(raw)) return null;
@@ -42069,7 +42194,7 @@ const createFileLintCache = (cacheDirectory, rulesetHash) => {
 		}
 	};
 };
-const bundledRequire$2 = createRequire(import.meta.url);
+const bundledRequire$3 = createRequire(import.meta.url);
 const childNodeVersionByBinaryPath = /* @__PURE__ */ new Map();
 const resolveChildNodeVersion = (nodeBinaryPath) => {
 	if (nodeBinaryPath === process.execPath) return process.version;
@@ -42095,7 +42220,7 @@ const TOOLCHAIN_PACKAGE_SPECIFIERS$1 = [
 const resolveOxlintToolchainVersions = (nodeBinaryPath = process.execPath) => {
 	const versions = [`node=${resolveChildNodeVersion(nodeBinaryPath)}`];
 	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS$1) try {
-		const packageJson = bundledRequire$2(specifier);
+		const packageJson = bundledRequire$3(specifier);
 		const version = typeof packageJson.version === "string" ? packageJson.version : "unknown";
 		versions.push(`${specifier}=${version}`);
 	} catch {
@@ -43075,22 +43200,70 @@ const hashFileContents = (filePath) => {
 		return null;
 	}
 };
-const projectCacheSubdir = (projectDirectory) => crypto.createHash("sha256").update(projectDirectory).digest("hex").slice(0, 16);
-const resolveReactDoctorCacheDir = (projectDirectory) => {
-	const cacheDirOverride = process.env["REACT_DOCTOR_CACHE_DIR"]?.trim();
-	if (cacheDirOverride) return Path.join(cacheDirOverride, projectCacheSubdir(projectDirectory));
-	const nodeModulesDirectory = Path.join(projectDirectory, "node_modules");
-	if (NFS.existsSync(nodeModulesDirectory)) return Path.join(nodeModulesDirectory, ".cache", "react-doctor");
-	return Path.join(os.tmpdir(), `react-doctor-cache-${resolveUserCacheScope()}`, projectCacheSubdir(projectDirectory));
-};
-const resolveUserCacheScope = () => {
-	try {
-		return String(process.getuid?.() ?? os.userInfo().username);
-	} catch {
-		return "shared";
+/**
+* Balanced LPT (longest-processing-time-first) lint batch planner. Where
+* `batchIncludePaths` greedily fills 100-file batches and leaves a small
+* remainder batch (617 files → 6×100 + 17, so the parallel pool's wall clock
+* is set by whichever 100-file chunk happened to collect the most work while
+* the remainder's worker idles), this planner keeps the SAME mandatory batch
+* count — `ceil(files / OXLINT_MAX_FILES_PER_BATCH)`, the JS-plugin
+* perf-cliff / native-binding SIGABRT guard — and assigns files largest-first,
+* each to the least-loaded batch by cumulative byte size. Every batch ends up
+* with an even share of files AND bytes, so no batch is a straggler; heavy
+* files are SPREAD across batches (the documented precondition for `cost`
+* ordering to beat `arrival`) instead of concentrated in one.
+*
+* Deliberately NOT worker-count-aware: splitting into extra batches to feed
+* idle workers was measured (619-file corpus, 10 cores) to REGRESS the lint
+* wall — each additional concurrent subprocess pays a contended cold start
+* (node boot + plugin import + native dlopen, ~180 ms uncontended and 2-3×
+* that in a full wave) that outweighs the smaller per-batch file share.
+*
+* Every batch also respects the spawn-args char budget; a file that fits no
+* existing batch opens a new one, mirroring `batchIncludePaths`. Within a
+* batch, files return in arrival order, and the assignment is fully
+* deterministic (ties broken by lowest batch index), so a plan is
+* reproducible for a fixed (files, sizes) input. Batch composition cannot
+* change diagnostics — rules that look beyond one file (`CROSS_FILE_RULE_IDS`)
+* read the OTHER files via the filesystem, never via batch-mates — so the
+* plan only moves wall-clock time.
+*
+* O(files × batches); the linear least-loaded scan is fine at real-world
+* scale (a 3,500-file monorepo is 36 batches ≈ 126k comparisons).
+*/
+const planLintBatches = ({ baseArgs, files, sizeByFile }) => {
+	if (files.length === 0) return [];
+	const batchCount = Math.ceil(files.length / 100);
+	const maxFilesPerBatch = Math.ceil(files.length / batchCount);
+	const baseArgsLengthChars = estimateArgsLength(baseArgs);
+	const descendingSizeIndexes = [...files.keys()].sort((leftIndex, rightIndex) => (sizeByFile.get(files[rightIndex]) ?? 0) - (sizeByFile.get(files[leftIndex]) ?? 0));
+	const batches = Array.from({ length: batchCount }, () => ({
+		fileIndexes: [],
+		totalSizeBytes: 0,
+		argsLengthChars: baseArgsLengthChars
+	}));
+	for (const fileIndex of descendingSizeIndexes) {
+		const entryLengthChars = files[fileIndex].length + 1;
+		let targetBatch = null;
+		for (const batch of batches) {
+			if (batch.fileIndexes.length >= maxFilesPerBatch) continue;
+			if (batch.fileIndexes.length > 0 && batch.argsLengthChars + entryLengthChars > 24e3) continue;
+			if (targetBatch === null || batch.totalSizeBytes < targetBatch.totalSizeBytes || batch.totalSizeBytes === targetBatch.totalSizeBytes && batch.fileIndexes.length < targetBatch.fileIndexes.length) targetBatch = batch;
+		}
+		if (targetBatch === null) {
+			targetBatch = {
+				fileIndexes: [],
+				totalSizeBytes: 0,
+				argsLengthChars: baseArgsLengthChars
+			};
+			batches.push(targetBatch);
+		}
+		targetBatch.fileIndexes.push(fileIndex);
+		targetBatch.totalSizeBytes += sizeByFile.get(files[fileIndex]) ?? 0;
+		targetBatch.argsLengthChars += entryLengthChars;
 	}
+	return batches.filter((batch) => batch.fileIndexes.length > 0).map((batch) => batch.fileIndexes.sort((leftIndex, rightIndex) => leftIndex - rightIndex).map((fileIndex) => files[fileIndex]));
 };
-const sortSourceFilesByCost = (entries) => [...entries].sort((left, right) => right.sizeBytes - left.sizeBytes).map((entry) => entry.path);
 /**
 * Atomically (re)writes the generated oxlintrc.json. Used twice in
 * the runner: once for the primary scan, once for the
@@ -43149,7 +43322,7 @@ const reactHooksJsPluginDropNote = (error) => {
 *   6. always restore disable directives + clean up the temp dir
 */
 const runOxlint = async (options) => {
-	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, perFileLintCacheEnabled = false, onCacheStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "arrival" } = options;
+	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, perFileLintCacheEnabled = false, onCacheStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "cost" } = options;
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
@@ -43201,8 +43374,15 @@ const runOxlint = async (options) => {
 			"json",
 			...sharedArgs
 		];
-		const discoverScanFiles = () => lintBatchOrdering === "cost" ? sortSourceFilesByCost(listSourceFilesWithSize(rootDirectory)) : listSourceFiles(rootDirectory);
-		const candidateFiles = includePaths !== void 0 ? includePaths : discoverScanFiles();
+		await yieldToEventLoop();
+		const sizedScanFiles = includePaths === void 0 ? listSourceFilesWithSize(rootDirectory) : null;
+		const candidateFiles = includePaths !== void 0 ? includePaths : (sizedScanFiles ?? []).map((entry) => entry.path);
+		const sizeByFile = sizedScanFiles !== null && lintBatchOrdering === "cost" ? new Map(sizedScanFiles.map((entry) => [entry.path, entry.sizeBytes])) : null;
+		const buildFileBatches = (passBaseArgs, passFiles) => sizeByFile !== null ? planLintBatches({
+			baseArgs: passBaseArgs,
+			files: passFiles,
+			sizeByFile
+		}) : batchIncludePaths(passBaseArgs, passFiles);
 		const runConfigOverFiles = async (buildConfigForPass, configFileName, files, fileProgress) => {
 			if (files.length === 0) return {
 				diagnostics: [],
@@ -43216,7 +43396,7 @@ const runOxlint = async (options) => {
 			};
 			const passConfigPath = Path.join(configDirectory, configFileName);
 			const passBaseArgs = makeBaseArgs(passConfigPath);
-			const passFileBatches = batchIncludePaths(passBaseArgs, files);
+			const passFileBatches = buildFileBatches(passBaseArgs, files);
 			const spawnPass = () => spawnLintBatches({
 				baseArgs: passBaseArgs,
 				fileBatches: passFileBatches,
@@ -43265,6 +43445,7 @@ const runOxlint = async (options) => {
 			const cacheKeyByFile = /* @__PURE__ */ new Map();
 			const missFiles = [];
 			const replayedDiagnostics = [];
+			let hashSliceStartedAt = performance.now();
 			for (const candidateFile of candidateFiles) {
 				const contentHash = hashFileContents(Path.resolve(rootDirectory, candidateFile));
 				if (contentHash === null) {
@@ -43276,6 +43457,10 @@ const runOxlint = async (options) => {
 				const cachedDiagnostics = cache.lookup(cacheKey);
 				if (cachedDiagnostics === null) missFiles.push(candidateFile);
 				else replayedDiagnostics.push(...cachedDiagnostics);
+				if (performance.now() - hashSliceStartedAt >= 12) {
+					await yieldToEventLoop();
+					hashSliceStartedAt = performance.now();
+				}
 			}
 			const cacheHitFileCount = candidateFiles.length - missFiles.length;
 			const fullResult = await runConfigOverFiles((overrides) => buildConfig({
@@ -43318,7 +43503,7 @@ const runOxlint = async (options) => {
 			]);
 		}
 		const baseArgs = makeBaseArgs(configPath);
-		const fileBatches = batchIncludePaths(baseArgs, candidateFiles);
+		const fileBatches = buildFileBatches(baseArgs, candidateFiles);
 		const runBatches = () => spawnLintBatches({
 			baseArgs,
 			fileBatches,
@@ -44205,7 +44390,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
 		rootDirectory: scanDirectory,
 		parseConcurrency: deadCodeParseConcurrency,
-		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs
+		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
+		onCacheOutcome: (didHitCache) => {
+			deadCodeCacheHit = didHitCache;
+		}
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
 		yield* set(deadCodeFailure, {
 			didFail: true,
@@ -44233,6 +44421,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	let lastReportedTotalFileCount = 0;
 	let lintCacheHitFileCount = null;
 	let lintCacheTotalFileCount = null;
+	let deadCodeCacheHit = null;
 	const baseLintStream = linterService.run({
 		rootDirectory: scanDirectory,
 		project,
@@ -44362,6 +44551,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		securityScanFailed,
 		lintCacheHitFileCount,
 		lintCacheTotalFileCount,
+		deadCodeCacheHit: lintFailureState.didFail ? null : deadCodeCacheHit,
 		suppressedRuleCounts: transform.summarizeSuppressions()
 	};
 }).pipe(withSpan("runInspect", { attributes: {
@@ -45143,6 +45333,7 @@ const isNonInteractiveEnvironment = () => NON_INTERACTIVE_ENVIRONMENT_VARIABLES.
 const REACT_DOCTOR_CONFIG_PROJECT_NAME = "react-doctor";
 const STAGED_FILES_TEMP_DIR_PREFIX = "react-doctor-staged-";
 const BASELINE_FILES_TEMP_DIR_PREFIX = "react-doctor-baseline-";
+const RUN_GIT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
 const GH_DEFAULT_BRANCH_PROBE_TIMEOUT_MS = 5e3;
 const CI_TRUST_COMPANIES = "PayPal, Rippling, and Alibaba";
 const WELCOME_EXPLANATION_HOLD_MS = 1e3;
@@ -45233,7 +45424,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.6.2";
+const VERSION = "0.6.3-dev.20d81f6";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -45602,13 +45793,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.6.2`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.6.3-dev.20d81f6`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.6.2") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.6.3-dev.20d81f6") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -45809,7 +46000,8 @@ const runGit = (projectRoot, args) => {
 				"ignore",
 				"pipe",
 				"ignore"
-			]
+			],
+			maxBuffer: RUN_GIT_MAX_BUFFER_BYTES
 		}).trim();
 	} catch {
 		return null;
@@ -57835,7 +58027,8 @@ const buildOutcomeAttributes = (input) => {
 		}),
 		...withNamespace("deadCode", {
 			failed: input.didDeadCodeFail ?? null,
-			overlapped: input.deadCodeOverlapped ?? null
+			overlapped: input.deadCodeOverlapped ?? null,
+			cacheHit: result.deadCodeCacheHit ?? null
 		}),
 		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut ?? null }),
 		...withNamespace("securityScan", { failed: input.securityScanFailed ?? null }),
@@ -59158,13 +59351,89 @@ const stringifyStableJson = (value) => {
 };
 const hashString = (value) => crypto.createHash("sha1").update(value).digest("hex");
 const readHeadSha = (projectDirectory) => runGit(projectDirectory, ["rev-parse", "HEAD"]);
-const isWorktreeClean = (projectDirectory) => {
-	const status = runGit(projectDirectory, [
+const parseWorktreeStatusRecords = (statusOutput) => {
+	const entries = [];
+	const tokens = statusOutput.split("\0");
+	for (let tokenIndex = 0; tokenIndex < tokens.length; tokenIndex += 1) {
+		let record = tokens[tokenIndex];
+		if (record.length === 0) continue;
+		if (record.length < 3 || record[2] !== " ") {
+			if (tokenIndex !== 0) return null;
+			record = ` ${record}`;
+		}
+		if (record.length < 4 || record[2] !== " ") return null;
+		const statusCode = record.slice(0, 2);
+		const recordPath = record.slice(3);
+		if (statusCode.includes("R") || statusCode.includes("C")) {
+			tokenIndex += 1;
+			const originPath = tokens[tokenIndex];
+			if (originPath === void 0 || originPath.length === 0) return null;
+			entries.push({
+				statusCode,
+				path: recordPath,
+				originPath
+			});
+			continue;
+		}
+		entries.push({
+			statusCode,
+			path: recordPath
+		});
+	}
+	return entries;
+};
+const buildDirtyPathContentFingerprint = (absolutePath, statusCode) => {
+	let stats;
+	try {
+		stats = fs.lstatSync(absolutePath);
+	} catch {
+		return statusCode.includes("D") ? "deleted" : null;
+	}
+	if (stats.isSymbolicLink()) try {
+		return `link:${fs.readlinkSync(absolutePath)}`;
+	} catch {
+		return null;
+	}
+	if (!stats.isFile()) return null;
+	if (stats.size > 10485760) return `stat:${stats.mtimeMs}:${stats.size}`;
+	return hashFileContents(absolutePath);
+};
+const buildWorktreeFingerprint = (projectDirectory) => {
+	const statusOutput = runGit(projectDirectory, [
 		"status",
 		"--porcelain=v1",
-		"--untracked-files=normal"
+		"-z",
+		"--untracked-files=all"
 	]);
-	return status !== null && status.length === 0;
+	if (statusOutput === null) return null;
+	if (statusOutput.length === 0) return [];
+	const statusEntries = parseWorktreeStatusRecords(statusOutput);
+	if (statusEntries === null) return null;
+	if (statusEntries.length > 300) return null;
+	const repositoryRoot = runGit(projectDirectory, ["rev-parse", "--show-toplevel"]);
+	if (repositoryRoot === null) return null;
+	const dirtyEntries = [];
+	for (const statusEntry of statusEntries) {
+		const contentFingerprint = buildDirtyPathContentFingerprint(path.join(repositoryRoot, statusEntry.path), statusEntry.statusCode);
+		if (contentFingerprint === null) return null;
+		dirtyEntries.push({
+			...statusEntry,
+			contentFingerprint
+		});
+	}
+	return dirtyEntries.sort((firstEntry, secondEntry) => {
+		const firstSortKey = `${firstEntry.path}
${firstEntry.statusCode}`;
+		const secondSortKey = `${secondEntry.path}
${secondEntry.statusCode}`;
+		return firstSortKey < secondSortKey ? -1 : firstSortKey > secondSortKey ? 1 : 0;
+	});
+};
+const DOTENV_FILE_NAME_PATTERN = /^\.env(\.|$)/;
+const resolveDotenvFingerprint = (projectDirectory) => {
+	try {
+		return fs.readdirSync(projectDirectory).filter((entryName) => DOTENV_FILE_NAME_PATTERN.test(entryName)).sort().map((entryName) => `${entryName}=${fileFingerprint(path.join(projectDirectory, entryName)) ?? "unreadable"}`);
+	} catch {
+		return [];
+	}
 };
 const hasHiddenTrackedFileState = (projectDirectory) => {
 	const output = runGit(projectDirectory, ["ls-files", "-v"]);
@@ -59247,8 +59516,9 @@ const resolveToolchainFingerprint = (nodeBinaryPath) => {
 };
 const buildScanResultCacheKey = (input) => {
 	if (isScanResultCacheDisabled()) return null;
-	if (!isWorktreeClean(input.projectDirectory)) return null;
 	if (hasHiddenTrackedFileState(input.projectDirectory)) return null;
+	const worktreeFingerprint = buildWorktreeFingerprint(input.projectDirectory);
+	if (worktreeFingerprint === null) return null;
 	const headSha = readHeadSha(input.projectDirectory);
 	if (headSha === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
@@ -59256,6 +59526,8 @@ const buildScanResultCacheKey = (input) => {
 		schemaVersion: 3,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha,
+		worktreeFingerprint,
+		dotenvFingerprint: resolveDotenvFingerprint(input.projectDirectory),
 		reactDoctorVersion: input.version,
 		nodeVersion: process.version,
 		toolchainFingerprint: resolveToolchainFingerprint(input.nodeBinaryPath),
@@ -59648,7 +59920,8 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		scanMode: baselineDelta ? "baseline" : isDiffMode ? "diff" : "full",
 		baselineDegraded,
 		lintCacheHitFileCount: output.lintCacheHitFileCount,
-		lintCacheTotalFileCount: output.lintCacheTotalFileCount
+		lintCacheTotalFileCount: output.lintCacheTotalFileCount,
+		deadCodeCacheHit: output.deadCodeCacheHit
 	});
 	recordOnboardingCompletion(options);
 	return result;
@@ -59683,6 +59956,7 @@ const renderAndRecordScan = async (input) => {
 		scanElapsedMilliseconds: input.payload.scanElapsedMilliseconds,
 		lintCacheHitFileCount: input.lintCacheHitFileCount ?? null,
 		lintCacheTotalFileCount: input.lintCacheTotalFileCount ?? null,
+		deadCodeCacheHit: input.deadCodeCacheHit ?? null,
 		baselineDelta: input.payload.baselineDelta
 	}), input.options.silent));
 	const { workerCount: resolvedWorkerCount, parallel } = resolveWorkerTelemetry(input.payload.scanConcurrency, input.options.concurrency);
@@ -59721,7 +59995,7 @@ const renderAndRecordScan = async (input) => {
 	return result;
 };
 const finalizeAndRender = (input) => gen(function* () {
-	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, directory, scannedFileCount, scannedFilePaths, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, baselineDelta } = input;
+	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, directory, scannedFileCount, scannedFilePaths, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, deadCodeCacheHit, baselineDelta } = input;
 	const { skippedChecks, skippedCheckReasons } = buildSkippedChecks({
 		didLintFail,
 		lintFailureReason,
@@ -59745,6 +60019,7 @@ const finalizeAndRender = (input) => gen(function* () {
 			lintCacheHitFileCount,
 			lintCacheTotalFileCount
 		} : {},
+		...deadCodeCacheHit !== null ? { deadCodeCacheHit } : {},
 		...baselineDelta ? { baselineDelta } : {}
 	});
 	if (options.suppressRendering) return buildResult();
@@ -63591,4 +63866,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=a9894975-1858-5b46-8a22-ae1680ad9a8a
+//# debugId=d7bda084-a223-5aa7-8605-578888bd1b33