react-doctor 0.6.3-dev.e257a5e → 0.6.3-dev.ea9a775

package/dist/index.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fb390a00-3616-5547-b572-1ce120b0e1a2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b55ef8b2-8e9d-512b-81de-a01f6ce3e60e")}catch(e){}}();
 import { r as __toESM$1, t as __commonJSMin$1 } from "./chunk-N93fKeF6.js";
 import { createRequire } from "node:module";
 import * as NFS from "node:fs";
@@ -9,7 +9,7 @@ import path from "node:path";
 import * as NodeChildProcess from "node:child_process";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import * as ts from "typescript";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
 import os from "node:os";
 import { parseJSON5 } from "confbox";
@@ -18,6 +18,7 @@ import { fileURLToPath } from "node:url";
 import { createJiti } from "jiti";
 import * as Crypto from "node:crypto";
 import crypto, { createHash } from "node:crypto";
+import { ANALYZED_MANIFEST_FILENAMES, DEFAULT_EXTENSIONS } from "deslop-js/analyzed-inputs";
 import { gzipSync } from "node:zlib";
 //#region ../../node_modules/.pnpm/effect@4.0.0-beta.70/node_modules/effect/dist/Pipeable.js
 /**
@@ -32927,7 +32928,10 @@ const SOCKET_PACKAGE_PAGE_BASE = "https://socket.dev/npm/package";
 const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
+const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
+const CORE_PACKAGE_VERSION = "0.6.3";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
+const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
 const SUPPLY_CHAIN_RULE = "low-supply-chain-score";
 const SUPPLY_CHAIN_CATEGORY = "Security";
@@ -35615,6 +35619,29 @@ var PerFileLintCacheEnabled = class extends Reference("react-doctor/PerFileLintC
 	return true;
 } }) {};
 /**
+* Whether the sidecar lint cache (`runners/oxlint/sidecar-lint-cache.ts`) is
+* active. Defaults ON — warm rescans replay the cross-file rules' cached
+* diagnostics for every file whose dependency fingerprint (the probe set the
+* plugin's collectors recorded) still matches the tree, and re-lint only the
+* rest. Only reachable when the per-file lint cache itself is on (the
+* sidecar covers its cache hits), so `REACT_DOCTOR_NO_CACHE` /
+* `REACT_DOCTOR_NO_FILE_CACHE` implicitly disable it too. Opt-OUT knobs:
+*
+*   - `REACT_DOCTOR_NO_CACHE` — the global off-switch.
+*   - `REACT_DOCTOR_NO_SIDECAR_CACHE` — granular rollback hatch: keep the
+*     per-file cache but run the always-fresh sidecar over every hit
+*     (the pre-cache behavior).
+*
+* Tests override via `Layer.succeed(SidecarLintCacheEnabled, false)`.
+*/
+var SidecarLintCacheEnabled = class extends Reference("react-doctor/SidecarLintCacheEnabled", { defaultValue: () => {
+	const noCache = process.env["REACT_DOCTOR_NO_CACHE"]?.toLowerCase() ?? "";
+	const noSidecarCache = process.env["REACT_DOCTOR_NO_SIDECAR_CACHE"]?.toLowerCase() ?? "";
+	if (CACHE_DISABLED_VALUES.has(noCache)) return false;
+	if (CACHE_DISABLED_VALUES.has(noSidecarCache)) return false;
+	return true;
+} }) {};
+/**
 * Whether the whole-project dead-code result cache
 * (`dead-code/dead-code-result-cache.ts`) is active. Defaults ON — a rescan
 * whose inputs (source tree, manifests, configs, analyzer version) are
@@ -37338,38 +37365,9 @@ const failOpenReadJson = (filePath, fallback) => {
 		return fallback;
 	}
 };
-const ANALYZED_FILE_EXTENSIONS = new Set([
-	".ts",
-	".tsx",
-	".js",
-	".jsx",
-	".mts",
-	".mjs",
-	".cts",
-	".cjs",
-	".mdx",
-	".astro",
-	".graphql",
-	".gql",
-	".css",
-	".scss",
-	".vue",
-	".svelte"
-]);
-const ANALYZED_MANIFEST_NAMES = new Set([
-	"package.json",
-	"knip.json",
-	"app.json",
-	"pnpm-workspace.yaml",
-	"lerna.json",
-	"pnpm-lock.yaml",
-	"package-lock.json",
-	"yarn.lock",
-	"bun.lock",
-	"bun.lockb",
-	"deno.lock",
-	".gitignore"
-]);
+const ANALYZED_FILE_EXTENSIONS = new Set(DEFAULT_EXTENSIONS);
+const CORE_SIDE_MANIFEST_NAMES = ["knip.json", "deno.lock"];
+const ANALYZED_MANIFEST_NAMES = new Set([...ANALYZED_MANIFEST_FILENAMES, ...CORE_SIDE_MANIFEST_NAMES]);
 const isTsConfigLikeFile = (fileName) => (fileName.startsWith("tsconfig") || fileName.startsWith("jsconfig")) && fileName.endsWith(".json");
 const isFingerprintedFile = (fileName) => ANALYZED_FILE_EXTENSIONS.has(Path.extname(fileName).toLowerCase()) || ANALYZED_MANIFEST_NAMES.has(fileName) || isTsConfigLikeFile(fileName);
 const collectAnalyzedFileFingerprints = (rootDirectory) => {
@@ -37395,6 +37393,7 @@ const resolveDeslopVersion = () => {
 };
 const computeDeadCodeCacheKey = (input) => crypto.createHash("sha1").update(JSON.stringify({
 	schemaVersion: 1,
+	coreVersion: input.coreVersion,
 	deslopVersion: resolveDeslopVersion(),
 	deslopJsModuleSpecifier: input.deslopJsModuleSpecifier,
 	entryPatterns: input.entryPatterns,
@@ -37402,10 +37401,10 @@ const computeDeadCodeCacheKey = (input) => crypto.createHash("sha1").update(JSON
 	tsConfigFile: input.tsConfigPath === void 0 ? null : Path.relative(input.rootDirectory, input.tsConfigPath).replace(/\\/g, "/"),
 	files: collectAnalyzedFileFingerprints(input.rootDirectory)
 })).digest("hex");
-const validateDiagnostic$1 = decodeUnknownSync(Diagnostic);
+const validateDiagnostic$2 = decodeUnknownSync(Diagnostic);
 const decodeCachedDiagnostics = (raw) => {
 	try {
-		for (const entry of raw) validateDiagnostic$1(entry);
+		for (const entry of raw) validateDiagnostic$2(entry);
 		return raw;
 	} catch {
 		return null;
@@ -37559,6 +37558,14 @@ process.stdin.on("end", () => {
     circularDependencies: result.circularDependencies.map((cycle) => ({
       files: cycle.files,
     })),
+    ...(result.incrementalCacheStats
+      ? {
+          summaryCacheStats: {
+            hits: result.incrementalCacheStats.summaryHits,
+            misses: result.incrementalCacheStats.summaryMisses,
+          },
+        }
+      : {}),
   });
 
   const serializeError = (error) =>
@@ -37582,6 +37589,9 @@ process.stdin.on("end", () => {
         ...(workerInput.ignorePatterns.length > 0
           ? { ignorePatterns: workerInput.ignorePatterns }
           : {}),
+        ...(workerInput.incrementalCachePath
+          ? { incrementalCachePath: workerInput.incrementalCachePath }
+          : {}),
         // We consume only deslop's GRAPH-based findings (unusedFiles, unusedExports,
         // unusedDependencies, circularDependencies). Everything else deslop can compute
         // is pure wasted work for us, and it's the bulk of the runtime:
@@ -37592,12 +37602,18 @@ process.stdin.on("end", () => {
         //     are the single most expensive pass — duplicate-block detection alone was
         //     ~83s of a ~130s Sentry scan — so skipping them is an ~8.5x dead-code
         //     speedup on a large repo.
-        // Both are provably safe: the consumed graph findings are computed by their own
+        //   - reportRedundancy: the DRY-pattern detectors (duplicate types/constants,
+        //     simplifiable functions, identity wrappers, …) — ~120 ms of discarded
+        //     output per scan, and skipping them lets the incremental cache drop the
+        //     DRY-pattern summary fields (the largest slice of the cache file).
+        // All are provably safe: the consumed graph findings are computed by their own
         // detectors, independent of these passes (confirmed byte-identical on
-        // excalidraw + mui-material + sentry). tsConfigPath stays — the module resolver
-        // needs it for path-alias resolution in the import graph.
+        // excalidraw + mui-material + sentry; re-verified on sentry after the
+        // reportRedundancy flip). tsConfigPath stays — the module resolver needs it
+        // for path-alias resolution in the import graph.
         semantic: { enabled: false },
         reportCodeQuality: false,
+        reportRedundancy: false,
       };
       const result = await analyze(defineConfig(config));
       emit({ ok: true, result: normalizeResult(result) });
@@ -37681,13 +37697,23 @@ const parseCircularDependencies = (value) => {
 	}
 	return circularDependencies;
 };
+const parseSummaryCacheStats = (value) => {
+	if (!isRecord(value)) return void 0;
+	if (typeof value.hits !== "number" || typeof value.misses !== "number") return void 0;
+	return {
+		hits: value.hits,
+		misses: value.misses
+	};
+};
 const parseDeadCodeWorkerResult = (value) => {
 	if (!isRecord(value)) throw new Error("Dead-code worker returned an invalid result.");
+	const summaryCacheStats = parseSummaryCacheStats(value.summaryCacheStats);
 	return {
 		unusedFiles: parseUnusedFiles(value.unusedFiles),
 		unusedExports: parseUnusedExports(value.unusedExports),
 		unusedDependencies: parseUnusedDependencies(value.unusedDependencies),
-		circularDependencies: parseCircularDependencies(value.circularDependencies)
+		circularDependencies: parseCircularDependencies(value.circularDependencies),
+		...summaryCacheStats ? { summaryCacheStats } : {}
 	};
 };
 const parseDeadCodeWorkerError = (value) => {
@@ -37808,13 +37834,15 @@ const checkDeadCode = async (options) => {
 		entryPatterns,
 		ignorePatterns,
 		tsConfigPath,
-		deslopJsModuleSpecifier
+		deslopJsModuleSpecifier,
+		coreVersion: CORE_PACKAGE_VERSION
 	}) : null;
 	if (cacheKey !== null) {
 		const cachedDiagnostics = lookupDeadCodeResultCache(resolveReactDoctorCacheDir(rootDirectory), cacheKey);
 		options.onCacheOutcome?.(cachedDiagnostics !== null);
 		if (cachedDiagnostics !== null) return [...cachedDiagnostics];
 	}
+	const incrementalCachePath = options.cacheEnabled === true ? Path.join(resolveReactDoctorCacheDir(rootDirectory), DEAD_CODE_SUMMARY_CACHE_FILENAME) : void 0;
 	const spawnAndRun = () => {
 		return runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
 			rootDirectory,
@@ -37822,10 +37850,12 @@ const checkDeadCode = async (options) => {
 			tsConfigPath,
 			ignorePatterns,
 			deslopJsModuleSpecifier,
-			parseConcurrency: options.parseConcurrency
+			parseConcurrency: options.parseConcurrency,
+			incrementalCachePath
 		}), options.workerTimeoutMs ?? 12e4, options.abortSignal);
 	};
 	const result = parseDeadCodeWorkerResult(options.createWorker === void 0 ? await withDeadCodeWorkerSlot(spawnAndRun, options.abortSignal) : await spawnAndRun());
+	if (result.summaryCacheStats !== void 0) options.onSummaryCacheStats?.(result.summaryCacheStats);
 	const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -37993,7 +38023,8 @@ var DeadCode = class DeadCode extends Service()("react-doctor/DeadCode") {
 				workerTimeoutMs: input.workerTimeoutMs,
 				abortSignal: signal,
 				cacheEnabled,
-				onCacheOutcome: input.onCacheOutcome
+				onCacheOutcome: input.onCacheOutcome,
+				onSummaryCacheStats: input.onSummaryCacheStats
 			}),
 			catch: (cause) => new ReactDoctorError({ reason: new DeadCodeAnalysisFailed({ cause }) })
 		}).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)));
@@ -38863,7 +38894,7 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection }) => {
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
 	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" ? null : resolveReactHooksJsPlugin(project.hasReactCompiler, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
 	const jsPlugins = [];
@@ -38875,6 +38906,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		if (!rule) continue;
 		if (ruleSelection === "cacheable" && CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
 		if (ruleSelection === "sidecar" && !CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
+		if (ruleSelection === "sidecar" && sidecarRuleIdFilter !== void 0 && !sidecarRuleIdFilter.has(registryEntry.id)) continue;
 		if (rule.scan !== void 0) continue;
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
@@ -38919,23 +38951,23 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		}
 	};
 };
-const validateDiagnostic = decodeUnknownSync(Diagnostic);
+const validateDiagnostic$1 = decodeUnknownSync(Diagnostic);
 const decodeFileDiagnostics = (raw) => {
 	if (!Array.isArray(raw)) return null;
 	try {
-		for (const entry of raw) validateDiagnostic(entry);
+		for (const entry of raw) validateDiagnostic$1(entry);
 		return raw;
 	} catch {
 		return null;
 	}
 };
-const emptyCache = () => ({
+const emptyCache$1 = () => ({
 	version: 1,
 	rulesets: {}
 });
-const loadRulesetEntries = (cacheFilePath, rulesetHash) => {
+const loadRulesetEntries$1 = (cacheFilePath, rulesetHash) => {
 	const entries = /* @__PURE__ */ new Map();
-	const persisted = failOpenReadJson(cacheFilePath, emptyCache());
+	const persisted = failOpenReadJson(cacheFilePath, emptyCache$1());
 	if (persisted.version !== 1 || !isRecord(persisted.rulesets)) return entries;
 	const bucket = persisted.rulesets[rulesetHash];
 	if (!isRecord(bucket) || !isRecord(bucket.files)) return entries;
@@ -38947,7 +38979,7 @@ const loadRulesetEntries = (cacheFilePath, rulesetHash) => {
 };
 const createFileLintCache = (cacheDirectory, rulesetHash) => {
 	const cacheFilePath = Path.join(cacheDirectory, FILE_LINT_CACHE_FILENAME);
-	const entries = loadRulesetEntries(cacheFilePath, rulesetHash);
+	const entries = loadRulesetEntries$1(cacheFilePath, rulesetHash);
 	return {
 		lookup: (fileKey) => entries.get(fileKey) ?? null,
 		store: (fileKey, diagnostics) => {
@@ -38955,7 +38987,7 @@ const createFileLintCache = (cacheDirectory, rulesetHash) => {
 			entries.set(fileKey, diagnostics);
 		},
 		persist: () => {
-			const onDisk = failOpenReadJson(cacheFilePath, emptyCache());
+			const onDisk = failOpenReadJson(cacheFilePath, emptyCache$1());
 			const rulesets = onDisk.version === 1 && isRecord(onDisk.rulesets) ? { ...onDisk.rulesets } : {};
 			const existingBucket = rulesets[rulesetHash];
 			const existingFiles = isRecord(existingBucket) && isRecord(existingBucket.files) ? existingBucket.files : {};
@@ -38976,6 +39008,142 @@ const createFileLintCache = (cacheDirectory, rulesetHash) => {
 		}
 	};
 };
+const hashFileContents = (filePath) => {
+	try {
+		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
+	} catch {
+		return null;
+	}
+};
+const ABSENT_CONTENT_ANSWER = "absent";
+/**
+* Answers dependency probes for the sidecar lint cache — used both when
+* STORING an entry (turn the collector's probe paths into answers) and when
+* VERIFYING one (re-answer each stored probe against the current tree).
+* Store and verify must agree exactly, so both go through this one resolver.
+*
+*   - `content` — SHA-1 of the file's bytes, `"absent"` when unreadable
+*     (missing, a directory, permission failure). Source files reuse the
+*     hashes the cache-partition loop already computed
+*     (`contentHashByRelativePath`); everything else (package.json,
+*     tsconfig, ignored files) is hashed on demand.
+*   - `exists` — the existence class a module-resolution candidate probe
+*     sees: `"file"`, `"dir"`, or `"none"` (missing or an exotic entry —
+*     `statSync` follows symlinks, matching the resolvers).
+*
+* Answers are memoized per scan: the filesystem is frozen for the run, and
+* hot dependency paths (a barrel imported by hundreds of files, the shared
+* tsconfig chain) repeat across many files' probe sets.
+*/
+const createSidecarProbeAnswerResolver = (input) => {
+	const contentAnswerByPath = /* @__PURE__ */ new Map();
+	const existsAnswerByPath = /* @__PURE__ */ new Map();
+	const toRelativePath = (absolutePath) => Path.relative(input.rootDirectory, absolutePath).replaceAll("\\", "/");
+	const contentAnswer = (relativePath) => {
+		const memoized = contentAnswerByPath.get(relativePath);
+		if (memoized !== void 0) return memoized;
+		const answer = input.contentHashByRelativePath.get(relativePath) ?? hashFileContents(Path.resolve(input.rootDirectory, relativePath)) ?? ABSENT_CONTENT_ANSWER;
+		contentAnswerByPath.set(relativePath, answer);
+		return answer;
+	};
+	const existsAnswer = (relativePath) => {
+		const memoized = existsAnswerByPath.get(relativePath);
+		if (memoized !== void 0) return memoized;
+		let answer;
+		try {
+			const stat = NFS.statSync(Path.resolve(input.rootDirectory, relativePath));
+			answer = stat.isFile() ? "file" : stat.isDirectory() ? "dir" : "none";
+		} catch {
+			answer = "none";
+		}
+		existsAnswerByPath.set(relativePath, answer);
+		return answer;
+	};
+	return {
+		answerFor: (kind, relativePath) => kind === "content" ? contentAnswer(relativePath) : existsAnswer(relativePath),
+		toRelativePath
+	};
+};
+const validateDiagnostic = decodeUnknownSync(Diagnostic);
+const isProbeKind = (value) => value === "content" || value === "exists";
+const decodeSidecarFileEntry = (raw) => {
+	if (!isRecord(raw) || !Array.isArray(raw.probes) || !Array.isArray(raw.diagnostics)) return null;
+	const probes = [];
+	for (const rawProbe of raw.probes) {
+		if (!Array.isArray(rawProbe) || rawProbe.length !== 3) return null;
+		const [kind, probePath, answer] = rawProbe;
+		if (!isProbeKind(kind) || typeof probePath !== "string" || typeof answer !== "string") return null;
+		probes.push({
+			kind,
+			path: probePath,
+			answer
+		});
+	}
+	try {
+		for (const entry of raw.diagnostics) validateDiagnostic(entry);
+	} catch {
+		return null;
+	}
+	return {
+		probes,
+		diagnostics: raw.diagnostics
+	};
+};
+const encodeSidecarFileEntry = (entry) => ({
+	probes: entry.probes.map((probe) => [
+		probe.kind,
+		probe.path,
+		probe.answer
+	]),
+	diagnostics: entry.diagnostics
+});
+const emptyCache = () => ({
+	version: 1,
+	rulesets: {}
+});
+const loadRulesetEntries = (cacheFilePath, rulesetHash) => {
+	const entries = /* @__PURE__ */ new Map();
+	const persisted = failOpenReadJson(cacheFilePath, emptyCache());
+	if (persisted.version !== 1 || !isRecord(persisted.rulesets)) return entries;
+	const bucket = persisted.rulesets[rulesetHash];
+	if (!isRecord(bucket) || !isRecord(bucket.files)) return entries;
+	for (const [fileKey, rawEntry] of Object.entries(bucket.files)) {
+		const decoded = decodeSidecarFileEntry(rawEntry);
+		if (decoded !== null) entries.set(fileKey, decoded);
+	}
+	return entries;
+};
+const createSidecarLintCache = (cacheDirectory, rulesetHash) => {
+	const cacheFilePath = Path.join(cacheDirectory, SIDECAR_LINT_CACHE_FILENAME);
+	const entries = loadRulesetEntries(cacheFilePath, rulesetHash);
+	return {
+		lookup: (fileKey) => entries.get(fileKey) ?? null,
+		store: (fileKey, entry) => {
+			entries.delete(fileKey);
+			entries.set(fileKey, entry);
+		},
+		persist: () => {
+			const onDisk = failOpenReadJson(cacheFilePath, emptyCache());
+			const rulesets = onDisk.version === 1 && isRecord(onDisk.rulesets) ? { ...onDisk.rulesets } : {};
+			const existingBucket = rulesets[rulesetHash];
+			const existingFiles = isRecord(existingBucket) && isRecord(existingBucket.files) ? existingBucket.files : {};
+			const ourFiles = {};
+			for (const [fileKey, entry] of entries) ourFiles[fileKey] = encodeSidecarFileEntry(entry);
+			const cappedEntries = Object.entries({
+				...existingFiles,
+				...ourFiles
+			}).slice(-FILE_LINT_CACHE_MAX_FILE_COUNT);
+			rulesets[rulesetHash] = {
+				updatedAtMs: Date.now(),
+				files: Object.fromEntries(cappedEntries)
+			};
+			atomicWriteJson(cacheFilePath, {
+				version: 1,
+				rulesets: Object.fromEntries(Object.entries(rulesets).filter(([, bucket]) => isRecord(bucket) && typeof bucket.updatedAtMs === "number").sort(([, first], [, second]) => second.updatedAtMs - first.updatedAtMs).slice(0, 8))
+			});
+		}
+	};
+};
 const bundledRequire = createRequire(import.meta.url);
 const childNodeVersionByBinaryPath = /* @__PURE__ */ new Map();
 const resolveChildNodeVersion = (nodeBinaryPath) => {
@@ -39975,13 +40143,6 @@ const validateRuleRegistration = () => {
 	].filter((entry) => entry !== null).join("; ");
 	console.warn(`[react-doctor] rule-registration drift: ${detail}`);
 };
-const hashFileContents = (filePath) => {
-	try {
-		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
-	} catch {
-		return null;
-	}
-};
 /**
 * Balanced LPT (longest-processing-time-first) lint batch planner. Where
 * `batchIncludePaths` greedily fills 100-file batches and leaves a small
@@ -40063,6 +40224,106 @@ const writeOxlintConfig = (configPath, configToWrite) => {
 		NFS.closeSync(fileHandle);
 	}
 };
+/**
+* Attributes diagnostics back to the file that produced them by the
+* normalized path oxlint echoes. Returns `null` when ANY diagnostic can't be
+* attributed — the path forms don't align, so the caller must skip its cache
+* store rather than risk caching a wrong empty result for a file that
+* actually had diagnostics.
+*/
+const attributeDiagnosticsToFiles = (diagnostics, files) => {
+	const fileByNormalizedPath = /* @__PURE__ */ new Map();
+	for (const file of files) fileByNormalizedPath.set(file.replaceAll("\\", "/"), file);
+	const diagnosticsByFile = /* @__PURE__ */ new Map();
+	for (const diagnostic of diagnostics) {
+		const file = fileByNormalizedPath.get(diagnostic.filePath);
+		if (file === void 0) return null;
+		const fileDiagnostics = diagnosticsByFile.get(file) ?? [];
+		fileDiagnostics.push(diagnostic);
+		diagnosticsByFile.set(file, fileDiagnostics);
+	}
+	return diagnosticsByFile;
+};
+/**
+* Collects each file's cross-file dependency probes (via the plugin's
+* collectors) with their current answers. Fail-open per file: an unreadable /
+* unparseable / collector-failing file maps to `null` (no entry stored — it
+* re-lints next scan). The filesystem is frozen for the scan, so this can run
+* CONCURRENTLY with an oxlint child-process await — the caller starts it
+* unawaited before a lint pass and awaits it at store time, hiding the
+* in-process parse + resolution cost under the subprocess wait. The loop
+* yields on the cooperative time budget so the child's stdout handling (and
+* sibling fibers) keep flowing; each per-file collection is synchronous, so
+* the module-level probe recorder never sees interleaved use. Never rejects.
+*/
+const collectSidecarProbesForFiles = async (input) => {
+	const buildProbes = (file) => {
+		const absoluteFilePath = Path.resolve(input.rootDirectory, file);
+		let trace;
+		try {
+			trace = collectCrossFileDependencyProbes({
+				absoluteFilePath,
+				sourceText: NFS.readFileSync(absoluteFilePath, "utf8"),
+				ruleIds: input.boundedSidecarRuleIds
+			});
+		} catch {
+			return null;
+		}
+		if (trace === null) return null;
+		const probes = [];
+		for (const contentPath of trace.contentPaths) {
+			const relativePath = input.probeAnswers.toRelativePath(contentPath);
+			probes.push({
+				kind: "content",
+				path: relativePath,
+				answer: input.probeAnswers.answerFor("content", relativePath)
+			});
+		}
+		for (const existencePath of trace.existencePaths) {
+			const relativePath = input.probeAnswers.toRelativePath(existencePath);
+			probes.push({
+				kind: "exists",
+				path: relativePath,
+				answer: input.probeAnswers.answerFor("exists", relativePath)
+			});
+		}
+		return probes;
+	};
+	const probesByFile = /* @__PURE__ */ new Map();
+	let collectSliceStartedAt = performance.now();
+	for (const file of input.files) {
+		probesByFile.set(file, buildProbes(file));
+		if (performance.now() - collectSliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			collectSliceStartedAt = performance.now();
+		}
+	}
+	return probesByFile;
+};
+/**
+* Stores each freshly-linted file's probe set + cross-file diagnostics so
+* the next scan can replay instead of re-linting.
+*/
+const storeSidecarEntries = (input) => {
+	let didStoreAnyEntry = false;
+	for (const pass of input.storablePasses) {
+		if (!pass.isTrusted) continue;
+		const diagnosticsByFile = attributeDiagnosticsToFiles(pass.diagnostics, pass.files);
+		if (diagnosticsByFile === null) continue;
+		for (const file of pass.files) {
+			const cacheKey = input.cacheKeyByFile.get(file);
+			if (cacheKey === void 0) continue;
+			const probes = pass.probesByFile.get(file);
+			if (probes === void 0 || probes === null) continue;
+			input.sidecarCache.store(cacheKey, {
+				probes,
+				diagnostics: diagnosticsByFile.get(file) ?? []
+			});
+			didStoreAnyEntry = true;
+		}
+	}
+	if (didStoreAnyEntry) input.sidecarCache.persist();
+};
 const REACT_HOOKS_JS_DROP_PREFIX = "React Compiler rules (react-hooks-js/*) skipped — eslint-plugin-react-hooks failed to load in this environment";
 /**
 * Detects an oxlint config-load crash caused by the optional
@@ -40104,7 +40365,7 @@ const reactHooksJsPluginDropNote = (error) => {
 *   6. always restore disable directives + clean up the temp dir
 */
 const runOxlint = async (options) => {
-	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, perFileLintCacheEnabled = false, onCacheStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "cost" } = options;
+	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, perFileLintCacheEnabled = false, sidecarLintCacheEnabled = false, onCacheStats, onSidecarStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "cost" } = options;
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
@@ -40122,7 +40383,8 @@ const runOxlint = async (options) => {
 		severityControls,
 		userPlugins,
 		disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
-		ruleSelection: overrides.ruleSelection
+		ruleSelection: overrides.ruleSelection,
+		sidecarRuleIdFilter: overrides.sidecarRuleIdFilter
 	});
 	const restoreDisableDirectives = respectInlineDisables ? () => {} : await neutralizeDisableDirectives(rootDirectory, includePaths);
 	const configDirectory = NFS.mkdtempSync(Path.join(os.tmpdir(), "react-doctor-oxlintrc-"));
@@ -40225,15 +40487,18 @@ const runOxlint = async (options) => {
 			});
 			const cache = createFileLintCache(resolveReactDoctorCacheDir(rootDirectory), rulesetHash);
 			const cacheKeyByFile = /* @__PURE__ */ new Map();
+			const contentHashByRelativePath = /* @__PURE__ */ new Map();
 			const missFiles = [];
 			const replayedDiagnostics = [];
 			let hashSliceStartedAt = performance.now();
 			for (const candidateFile of candidateFiles) {
-				const contentHash = hashFileContents(Path.resolve(rootDirectory, candidateFile));
+				const absoluteCandidatePath = Path.resolve(rootDirectory, candidateFile);
+				const contentHash = hashFileContents(absoluteCandidatePath);
 				if (contentHash === null) {
 					missFiles.push(candidateFile);
 					continue;
 				}
+				contentHashByRelativePath.set(Path.relative(rootDirectory, absoluteCandidatePath).replaceAll("\\", "/"), contentHash);
 				const cacheKey = `${candidateFile.replaceAll("\\", "/")}\u0000${contentHash}`;
 				cacheKeyByFile.set(candidateFile, cacheKey);
 				const cachedDiagnostics = cache.lookup(cacheKey);
@@ -40245,43 +40510,111 @@ const runOxlint = async (options) => {
 				}
 			}
 			const cacheHitFileCount = candidateFiles.length - missFiles.length;
+			const enabledSidecarRuleIds = Object.keys(buildConfig({
+				extendsPaths: [],
+				ruleSelection: "sidecar"
+			}).rules).map((ruleKey) => ruleKey.slice(ruleKey.lastIndexOf("/") + 1)).filter((ruleId) => CROSS_FILE_RULE_IDS.has(ruleId));
+			const boundedSidecarRuleIds = enabledSidecarRuleIds.filter((ruleId) => CROSS_FILE_DEPENDENCY_COLLECTORS.has(ruleId));
+			const boundedSidecarRuleIdSet = new Set(boundedSidecarRuleIds);
+			const unboundedSidecarRuleIds = enabledSidecarRuleIds.filter((ruleId) => !CROSS_FILE_DEPENDENCY_COLLECTORS.has(ruleId));
+			const useSidecarCache = sidecarLintCacheEnabled && boundedSidecarRuleIds.length > 0;
+			const sidecarCache = useSidecarCache ? createSidecarLintCache(resolveReactDoctorCacheDir(rootDirectory), computeRulesetHash({
+				config: buildConfig({
+					extendsPaths: [],
+					ruleSelection: "sidecar",
+					sidecarRuleIdFilter: boundedSidecarRuleIdSet
+				}),
+				toolchainVersions: resolveOxlintToolchainVersions(nodeBinaryPath),
+				ignorePatterns: combinedPatterns,
+				tsconfigContent
+			})) : null;
+			const probeAnswers = createSidecarProbeAnswerResolver({
+				rootDirectory,
+				contentHashByRelativePath
+			});
+			const missProbesTask = sidecarCache === null ? null : collectSidecarProbesForFiles({
+				files: missFiles,
+				rootDirectory,
+				boundedSidecarRuleIds,
+				probeAnswers
+			});
 			const fullResult = await runConfigOverFiles((overrides) => buildConfig({
 				extendsPaths: [],
 				disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin
 			}), "oxlintrc.full.json", missFiles, options.onFileProgress && ((scannedFileCount) => options.onFileProgress?.(scannedFileCount, candidateFiles.length)));
 			const missFileSet = new Set(missFiles);
-			const sidecarResult = await runConfigOverFiles(() => buildConfig({
+			const hitFiles = candidateFiles.filter((candidateFile) => !missFileSet.has(candidateFile));
+			const sidecarReplayedDiagnostics = [];
+			const sidecarLintFiles = [];
+			if (sidecarCache === null) sidecarLintFiles.push(...hitFiles);
+			else {
+				let verifySliceStartedAt = performance.now();
+				for (const hitFile of hitFiles) {
+					const cacheKey = cacheKeyByFile.get(hitFile);
+					const entry = cacheKey === void 0 ? null : sidecarCache.lookup(cacheKey);
+					if (entry !== null && entry.probes.every((probe) => probeAnswers.answerFor(probe.kind, probe.path) === probe.answer)) sidecarReplayedDiagnostics.push(...entry.diagnostics);
+					else sidecarLintFiles.push(hitFile);
+					if (performance.now() - verifySliceStartedAt >= 12) {
+						await yieldToEventLoop();
+						verifySliceStartedAt = performance.now();
+					}
+				}
+			}
+			const sidecarProbesTask = sidecarCache === null ? null : collectSidecarProbesForFiles({
+				files: sidecarLintFiles,
+				rootDirectory,
+				boundedSidecarRuleIds,
+				probeAnswers
+			});
+			const sidecarReplayedFileCount = hitFiles.length - sidecarLintFiles.length;
+			if (sidecarReplayedFileCount > 0) options.onFileProgress?.(missFiles.length + sidecarReplayedFileCount, candidateFiles.length);
+			const boundedSidecarResult = await runConfigOverFiles(() => buildConfig({
 				extendsPaths: [],
-				ruleSelection: "sidecar"
-			}), "oxlintrc.sidecar.json", candidateFiles.filter((candidateFile) => !missFileSet.has(candidateFile)), options.onFileProgress && ((scannedFileCount) => options.onFileProgress?.(missFiles.length + scannedFileCount, candidateFiles.length)));
+				ruleSelection: "sidecar",
+				...useSidecarCache ? { sidecarRuleIdFilter: boundedSidecarRuleIdSet } : {}
+			}), "oxlintrc.sidecar.json", sidecarLintFiles, options.onFileProgress && ((scannedFileCount) => options.onFileProgress?.(missFiles.length + sidecarReplayedFileCount + scannedFileCount, candidateFiles.length)));
+			const unboundedSidecarResult = useSidecarCache && unboundedSidecarRuleIds.length > 0 ? await runConfigOverFiles(() => buildConfig({
+				extendsPaths: [],
+				ruleSelection: "sidecar",
+				sidecarRuleIdFilter: new Set(unboundedSidecarRuleIds)
+			}), "oxlintrc.sidecar-unbounded.json", hitFiles, void 0) : {
+				diagnostics: [],
+				didDropReactHooksJsPlugin: false,
+				hadPartialFailure: false
+			};
 			const freshCacheableDiagnostics = [];
 			for (const diagnostic of fullResult.diagnostics) if (!CROSS_FILE_RULE_IDS.has(diagnostic.rule)) freshCacheableDiagnostics.push(diagnostic);
 			onCacheStats?.(cacheHitFileCount, candidateFiles.length);
-			const missFileByNormalizedPath = /* @__PURE__ */ new Map();
-			for (const missFile of missFiles) missFileByNormalizedPath.set(missFile.replaceAll("\\", "/"), missFile);
-			const freshDiagnosticsByFile = /* @__PURE__ */ new Map();
-			let isAttributionSound = true;
-			for (const diagnostic of freshCacheableDiagnostics) {
-				const missFile = missFileByNormalizedPath.get(diagnostic.filePath);
-				if (missFile === void 0) {
-					isAttributionSound = false;
-					break;
-				}
-				const fileDiagnostics = freshDiagnosticsByFile.get(missFile) ?? [];
-				fileDiagnostics.push(diagnostic);
-				freshDiagnosticsByFile.set(missFile, fileDiagnostics);
-			}
-			if (!fullResult.didDropReactHooksJsPlugin && !fullResult.hadPartialFailure && isAttributionSound) {
+			if (sidecarCache !== null) onSidecarStats?.(hitFiles.length - sidecarLintFiles.length, hitFiles.length);
+			const freshDiagnosticsByFile = attributeDiagnosticsToFiles(freshCacheableDiagnostics, missFiles);
+			if (!fullResult.didDropReactHooksJsPlugin && !fullResult.hadPartialFailure && freshDiagnosticsByFile !== null) {
 				for (const missFile of missFiles) {
 					const cacheKey = cacheKeyByFile.get(missFile);
 					if (cacheKey !== void 0) cache.store(cacheKey, freshDiagnosticsByFile.get(missFile) ?? []);
 				}
 				cache.persist();
 			}
+			if (sidecarCache !== null && missProbesTask !== null && sidecarProbesTask !== null) storeSidecarEntries({
+				sidecarCache,
+				cacheKeyByFile,
+				storablePasses: [{
+					files: sidecarLintFiles,
+					diagnostics: boundedSidecarResult.diagnostics,
+					isTrusted: !boundedSidecarResult.hadPartialFailure,
+					probesByFile: await sidecarProbesTask
+				}, {
+					files: missFiles,
+					diagnostics: fullResult.diagnostics.filter((diagnostic) => boundedSidecarRuleIdSet.has(diagnostic.rule)),
+					isTrusted: !fullResult.didDropReactHooksJsPlugin && !fullResult.hadPartialFailure,
+					probesByFile: await missProbesTask
+				}]
+			});
 			return dedupeDiagnostics([
 				...replayedDiagnostics,
 				...fullResult.diagnostics,
-				...sidecarResult.diagnostics
+				...sidecarReplayedDiagnostics,
+				...boundedSidecarResult.diagnostics,
+				...unboundedSidecarResult.diagnostics
 			]);
 		}
 		const baseArgs = makeBaseArgs(configPath);
@@ -40379,6 +40712,7 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 		const concurrency = yield* OxlintConcurrency;
 		const lintBatchOrdering = yield* LintBatchOrdering;
 		const perFileLintCacheEnabled = yield* PerFileLintCacheEnabled;
+		const sidecarLintCacheEnabled = yield* SidecarLintCacheEnabled;
 		const collectedFailures = [];
 		const diagnostics = yield* tryPromise({
 			try: (signal) => runOxlint({
@@ -40397,7 +40731,9 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 				},
 				onFileProgress: input.onFileProgress,
 				perFileLintCacheEnabled,
+				sidecarLintCacheEnabled,
 				onCacheStats: input.onCacheStats,
+				onSidecarStats: input.onSidecarStats,
 				spawnTimeoutMs,
 				outputMaxBytes,
 				concurrency,
@@ -41175,6 +41511,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
 		onCacheOutcome: (didHitCache) => {
 			deadCodeCacheHit = didHitCache;
+		},
+		onSummaryCacheStats: (stats) => {
+			deadCodeSummaryCacheHits = stats.hits;
+			deadCodeSummaryCacheMisses = stats.misses;
 		}
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
 		yield* set(deadCodeFailure, {
@@ -41203,7 +41543,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	let lastReportedTotalFileCount = 0;
 	let lintCacheHitFileCount = null;
 	let lintCacheTotalFileCount = null;
+	let lintSidecarReplayedFileCount = null;
+	let lintSidecarTotalFileCount = null;
 	let deadCodeCacheHit = null;
+	let deadCodeSummaryCacheHits = null;
+	let deadCodeSummaryCacheMisses = null;
 	const baseLintStream = linterService.run({
 		rootDirectory: scanDirectory,
 		project,
@@ -41223,6 +41567,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 			lintCacheHitFileCount = cacheHitFileCount;
 			lintCacheTotalFileCount = totalConsideredFileCount;
 		},
+		onSidecarStats: (sidecarReplayedFileCount, sidecarConsideredFileCount) => {
+			lintSidecarReplayedFileCount = sidecarReplayedFileCount;
+			lintSidecarTotalFileCount = sidecarConsideredFileCount;
+		},
 		deadlineEpochMs: input.deadlineEpochMs
 	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
 		yield* set(lintFailure, {
@@ -41333,7 +41681,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		securityScanFailed,
 		lintCacheHitFileCount,
 		lintCacheTotalFileCount,
+		lintSidecarReplayedFileCount,
+		lintSidecarTotalFileCount,
 		deadCodeCacheHit: lintFailureState.didFail ? null : deadCodeCacheHit,
+		deadCodeSummaryCacheHits: lintFailureState.didFail ? null : deadCodeSummaryCacheHits,
+		deadCodeSummaryCacheMisses: lintFailureState.didFail ? null : deadCodeSummaryCacheMisses,
 		suppressedRuleCounts: transform.summarizeSuppressions()
 	};
 }).pipe(withSpan("runInspect", { attributes: {
@@ -41974,4 +42326,4 @@ const toJsonReport = (result, options) => buildJsonReport({
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=fb390a00-3616-5547-b572-1ce120b0e1a2
+//# debugId=b55ef8b2-8e9d-512b-81de-a01f6ce3e60e