react-doctor 0.8.0 → 0.8.1-dev.1839566

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5cb8a881-e8fc-5561-8b89-ad2c8357acbc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c24708ed-97a3-59cc-81f7-4cf277ab29f2")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -36242,7 +36242,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.8.0";
+const CORE_PACKAGE_VERSION = "0.8.1";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -38359,6 +38359,9 @@ const SCRIPT_EXTENSION_FRAGMENT = "[cm]?[jt]sx?";
 const STORY_FILE_SUFFIX_PATTERN = new RegExp(`\\.(?:stories|story)\\.(?:${SCRIPT_EXTENSION_FRAGMENT})$`);
 const TEST_FILE_SUFFIX_PATTERN = new RegExp(`\\.(?:test|spec|fixture|fixtures)\\.(?:${SCRIPT_EXTENSION_FRAGMENT})$`);
 const TEST_FILE_DIRECTORY_PATTERN = /(?:^|\/)(?:__tests__|__test__|tests|test|__mocks__|cypress|e2e|playwright)\//;
+const AMBIGUOUS_TEST_ROUTE_DIRECTORY_PATTERN = /(?:^|\/)(?:tests|test)\//;
+const NEXT_APP_ROUTE_FILE_SUFFIX_PATTERN = /\/(?:default|error|forbidden|global-error|layout|loading|not-found|page|route|template|unauthorized)\.[cm]?[jt]sx?$/;
+const SCRIPT_FILE_SUFFIX_PATTERN = /\.[cm]?[jt]sx?$/;
 const FIXTURE_PROJECT_PATTERN = /\/(?:fixtures|__fixtures__)\//;
 const SOURCE_ROOT_PATTERN = /\/(?:src|app|lib|components|pages|features|modules|packages|apps|frontend|client)\//g;
 const stripAboveSourceRoot = (relativePath) => {
@@ -38369,6 +38372,14 @@ const stripAboveSourceRoot = (relativePath) => {
 	if (lastIdx >= 0) return relativePath.slice(lastIdx);
 	return relativePath.slice(fixtureMatch.index + fixtureMatch[0].length - 1);
 };
+const isFrameworkRouteBeforeAmbiguousTestDirectory = (relativePath) => {
+	const testDirectoryMatch = AMBIGUOUS_TEST_ROUTE_DIRECTORY_PATTERN.exec(relativePath);
+	if (testDirectoryMatch === null) return false;
+	let nearestRouteRoot;
+	for (const pathSegment of relativePath.slice(0, testDirectoryMatch.index).split("/")) if (pathSegment === "app" || pathSegment === "pages") nearestRouteRoot = pathSegment;
+	if (nearestRouteRoot === void 0) return false;
+	return nearestRouteRoot === "pages" ? SCRIPT_FILE_SUFFIX_PATTERN.test(relativePath) : NEXT_APP_ROUTE_FILE_SUFFIX_PATTERN.test(relativePath);
+};
 /**
 * Classifies where a file sits relative to shipped code. A finding in a
 * `.stories.tsx` or `.spec.ts` file never runs in front of users, so
@@ -38385,6 +38396,7 @@ const classifyFileContext = (relativePath) => {
 	if (STORY_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return "story";
 	if (TEST_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return "test";
 	const scoped = stripAboveSourceRoot(forwardSlashed);
+	if (isFrameworkRouteBeforeAmbiguousTestDirectory(scoped)) return "production";
 	return TEST_FILE_DIRECTORY_PATTERN.test(scoped) ? "test" : "production";
 };
 /**
@@ -39244,6 +39256,7 @@ const VALID_RULE_SEVERITIES = [
 	"warn",
 	"off"
 ];
+const VALID_INCLUDED_FILE_CONTEXTS = ["test", "story"];
 const KNOWN_CATEGORY_LABEL = DIAGNOSTIC_CATEGORY_BUCKETS.join(", ");
 const isDiagnosticCategoryBucket = (value) => DIAGNOSTIC_CATEGORY_BUCKETS.includes(value);
 const filterKnownCategories = (fieldName, categories) => categories.filter((category) => {
@@ -39278,6 +39291,7 @@ const SURFACE_CONTROL_FIELD_NAMES = [
 	"includeRules",
 	"excludeRules"
 ];
+const isIncludedFileContext = (value) => VALID_INCLUDED_FILE_CONTEXTS.some((fileContext) => fileContext === value);
 const SEVERITY_FIELD_NAMES = ["rules", "categories"];
 const isPlainObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const formatType = (value) => typeof value === "string" ? `"${value}"` : typeof value;
@@ -39312,6 +39326,15 @@ const validateSurfaceControls = (surface, rawControls) => {
 		return;
 	}
 	const validatedSurfaceControls = {};
+	if (rawControls.includeFileContexts !== void 0) {
+		const qualifiedName = `surfaces.${surface}.includeFileContexts`;
+		const result = validateStringArrayField(qualifiedName, rawControls.includeFileContexts);
+		if (result !== void 0) validatedSurfaceControls.includeFileContexts = result.filter((fileContext) => {
+			if (isIncludedFileContext(fileContext)) return true;
+			warnConfigIssue(`config field "${qualifiedName}" lists "${fileContext}", which is not a non-production file context (expected one of: ${VALID_INCLUDED_FILE_CONTEXTS.join(", ")}); ignoring the entry.`);
+			return false;
+		});
+	}
 	for (const fieldName of SURFACE_CONTROL_FIELD_NAMES) {
 		if (rawControls[fieldName] === void 0) continue;
 		const qualifiedName = `surfaces.${surface}.${fieldName}`;
@@ -42047,6 +42070,7 @@ const buildResolvedControls = (surface, userControls) => {
 	for (const tag of includeTags) excludeTags.delete(tag);
 	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
 	return {
+		includeFileContexts: toStringSet(userControls?.includeFileContexts),
 		includeTags,
 		excludeTags,
 		includeCategories: toStringSet(userControls?.includeCategories),
@@ -42062,7 +42086,7 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	if (resolved.includeRuleKeys.has(ruleKey)) return true;
 	if (resolved.includeCategories.has(category)) return true;
 	if (intersects(tags, resolved.includeTags)) return true;
-	if (diagnostic.fileContext !== void 0 && (surface === "score" || surface === "ciFailure")) return false;
+	if (diagnostic.fileContext !== void 0 && (surface === "score" || surface === "ciFailure") && !resolved.includeFileContexts.has(diagnostic.fileContext)) return false;
 	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
 	if (resolved.excludeCategories.has(category)) return false;
 	if (intersects(tags, resolved.excludeTags)) return false;
@@ -42310,6 +42334,35 @@ const parseGithubViewerPermission = (stdout) => {
 	return /^[A-Z_]+$/.test(value) ? value.toLowerCase() : null;
 };
 const splitNullSeparated = (value) => value.split("\0").filter((entry) => entry.length > 0);
+const parseBaselineDiffPlan = (value) => {
+	const entries = splitNullSeparated(value);
+	const baseFiles = /* @__PURE__ */ new Set();
+	const headFiles = /* @__PURE__ */ new Set();
+	for (let entryIndex = 0; entryIndex < entries.length; entryIndex += 2) {
+		const status = entries[entryIndex];
+		const filePath = entries[entryIndex + 1];
+		if (status === void 0 || filePath === void 0 || status.length !== 1) return null;
+		if (status === "A") {
+			headFiles.add(filePath);
+			continue;
+		}
+		if (status === "D") {
+			baseFiles.add(filePath);
+			continue;
+		}
+		if (status === "M" || status === "T") {
+			baseFiles.add(filePath);
+			headFiles.add(filePath);
+			continue;
+		}
+		return null;
+	}
+	return {
+		baseFiles: [...baseFiles],
+		headFiles: [...headFiles],
+		untrackedFiles: []
+	};
+};
 const UNTRACKED_FILE_LAST_LINE = Number.MAX_SAFE_INTEGER;
 /**
 * `Git` wraps every `git`-via-subprocess call react-doctor makes
@@ -42512,6 +42565,45 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			githubViewerPermission,
 			branchExists,
 			mergeBase,
+			baselineDiffPlan: (input) => {
+				if (!isSafeGitRevision(input.ref)) return succeed$2(null);
+				return gen(function* () {
+					const unmerged = yield* runGit(input.directory, [
+						"diff",
+						"--no-ext-diff",
+						"-z",
+						"--name-only",
+						"--diff-filter=U",
+						"--relative"
+					]);
+					if (unmerged.status !== 0 || unmerged.stdout.length > 0) return null;
+					const result = yield* runGit(input.directory, [
+						"diff",
+						"--no-ext-diff",
+						"--no-textconv",
+						"--no-renames",
+						"-z",
+						"--name-status",
+						"--relative",
+						input.ref
+					]);
+					if (result.status !== 0) return null;
+					const plan = parseBaselineDiffPlan(result.stdout);
+					if (plan === null) return null;
+					const untracked = yield* runGit(input.directory, [
+						"ls-files",
+						"--others",
+						"--exclude-standard",
+						"-z"
+					]);
+					if (untracked.status !== 0) return null;
+					return {
+						baseFiles: plan.baseFiles,
+						headFiles: plan.headFiles,
+						untrackedFiles: splitNullSeparated(untracked.stdout)
+					};
+				}).pipe(catch_$1(() => succeed$2(null)), withSpan("Git.baselineDiffPlan"));
+			},
 			diffSelection: ({ directory, explicitBaseBranch, includeUntracked = false }) => gen(function* () {
 				if (explicitBaseBranch !== void 0 && explicitBaseBranch.trim().length === 0) return yield* fail$4(new ReactDoctorError({ reason: new GitBaseBranchInvalid({ detail: "Diff base branch cannot be empty." }) }));
 				if (explicitBaseBranch !== void 0) {
@@ -42661,6 +42753,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 		githubViewerPermission: () => succeed$2(snapshot.githubViewerPermission ?? null),
 		branchExists: (_directory, branch) => succeed$2(snapshot.branchExists?.get(branch) ?? false),
 		mergeBase: ({ ref }) => succeed$2(snapshot.mergeBase?.get(ref) ?? null),
+		baselineDiffPlan: () => succeed$2(snapshot.baselineDiffPlan ?? null),
 		diffSelection: () => succeed$2(snapshot.diffSelection ?? null),
 		stagedFilePaths: () => succeed$2(snapshot.stagedFiles ?? []),
 		showStagedContent: (_directory, relativePath) => succeed$2(snapshot.stagedContent?.get(relativePath) ?? null),
@@ -46397,12 +46490,19 @@ const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
 */
 const materializeSourceTree = (input) => gen(function* () {
 	const materializedFiles = [];
+	const unmaterializedFiles = [];
 	const resolvedTempDirectory = path.resolve(input.tempDirectory);
 	for (const relativePath of input.files) {
 		const content = yield* input.readContent(relativePath).pipe(orElseSucceed(() => null));
-		if (content === null) continue;
+		if (content === null) {
+			unmaterializedFiles.push(relativePath);
+			continue;
+		}
 		const candidateTargetPath = path.resolve(resolvedTempDirectory, relativePath);
-		if (!isPathInsideDirectory(candidateTargetPath, resolvedTempDirectory)) continue;
+		if (!isPathInsideDirectory(candidateTargetPath, resolvedTempDirectory)) {
+			unmaterializedFiles.push(relativePath);
+			continue;
+		}
 		yield* sync(() => {
 			fs.mkdirSync(path.dirname(candidateTargetPath), { recursive: true });
 			fs.writeFileSync(candidateTargetPath, content);
@@ -46419,6 +46519,7 @@ const materializeSourceTree = (input) => gen(function* () {
 	return {
 		tempDirectory: input.tempDirectory,
 		materializedFiles,
+		unmaterializedFiles,
 		cleanup: () => {
 			try {
 				fs.rmSync(input.tempDirectory, {
@@ -46688,54 +46789,80 @@ const buildSkippedChecks = (input) => {
 		skippedCheckReasons
 	};
 };
-const fingerprintDiagnostic = (diagnostic, lineText) => {
+const fingerprintText = (text) => createHash("sha256").update(text).digest("hex");
+const normalizeEvidence = (evidence) => evidence.replace(/\s+/g, " ").trim();
+const getDiagnosticMatchKeys = (diagnostic, evidence) => {
 	const ruleKey = `${diagnostic.plugin}/${diagnostic.rule}`;
-	const snippet = lineText === null || diagnostic.matchByOccurrence ? "" : createHash("sha1").update(lineText.trim()).digest("hex");
-	return `${diagnostic.filePath}\u0000${ruleKey}\u0000${snippet}`;
-};
-/**
-* Diffs a head scan against a base scan to isolate the diagnostics a change
-* introduced (and count the ones it resolved). Matching is a multiset over a
-* position-independent fingerprint — `(filePath, plugin/rule, hash(flagged
-* line text))` — so inserting lines above an existing issue doesn't make it
-* look new, while a genuinely new occurrence (new line text, or one more of
-* the same) surfaces. Identical repeated findings are matched by count.
-*
-* Diagnostics carrying `matchByOccurrence` (resolved at diagnostic creation:
-* every Accessibility-category finding, plus rules opting in via their
-* `matchByOccurrence` metadata flag) drop the line-text snippet and match by
-* `(filePath, plugin/rule)` occurrence count alone. Their identity is the
-* flagged element, not the line's text, so editing the line (reindentation,
-* prettier reflow, collapsing a multi-line JSX element) doesn't reclassify a
-* pre-existing finding as new — while one MORE occurrence of the same rule in
-* the file still surfaces. Expression-level rules keep the line-text snippet:
-* there the flagged expression IS the finding, so changed text means new +
-* fixed.
-*
-* v1 limitation: the fingerprint keys on the head-relative `filePath`, and base
-* content is read at that same path. A file renamed by the change therefore has
-* no base match, so its pre-existing findings are reported as new. This
-* over-reports (never hides a real issue) and is rare; rename-aware base
-* resolution is a follow-up.
+	const messageFingerprint = fingerprintText(`${diagnostic.title ?? ""}\0${diagnostic.message}`);
+	const normalizedEvidence = evidence === null ? "" : normalizeEvidence(evidence);
+	const stableEvidenceKey = normalizedEvidence.length > 0 ? `evidence\0${ruleKey}\0${messageFingerprint}\0${fingerprintText(normalizedEvidence)}` : null;
+	return {
+		stableEvidenceKey,
+		sameFileStableEvidenceKey: stableEvidenceKey === null ? null : `${diagnostic.filePath}\0${stableEvidenceKey}`,
+		sameFileFallbackKey: diagnostic.matchByOccurrence || normalizedEvidence.length === 0 ? `fallback\0${diagnostic.filePath}\0${ruleKey}\0${messageFingerprint}` : null
+	};
+};
+const addDiagnosticIndex = (buckets, key, diagnosticIndex) => {
+	if (key === null) return;
+	const diagnosticIndexes = buckets.get(key) ?? [];
+	diagnosticIndexes.push(diagnosticIndex);
+	buckets.set(key, diagnosticIndexes);
+};
+const takeMatchingDiagnosticIndex = (buckets, key, matchedDiagnosticIndexes) => {
+	if (key === null) return null;
+	for (const diagnosticIndex of buckets.get(key) ?? []) if (!matchedDiagnosticIndexes.has(diagnosticIndex)) return diagnosticIndex;
+	return null;
+};
+const readDiagnosticEvidence = (diagnostic, readEvidence, readLine) => readEvidence?.(diagnostic) ?? readLine(diagnostic.filePath, diagnostic.line);
+const buildMatchCandidates = (diagnostics, readEvidence, readLine) => diagnostics.map((diagnostic, diagnosticIndex) => ({
+	diagnosticIndex,
+	...getDiagnosticMatchKeys(diagnostic, readDiagnosticEvidence(diagnostic, readEvidence, readLine))
+}));
+/**
+* Diffs a head scan against a base scan using a multiset of construct-level
+* evidence. Stable identities combine plugin/rule, the diagnostic message,
+* and normalized diagnosed source, so unchanged findings can move across
+* files while changed constructs or messages remain new. Cardinality is
+* retained for identical findings. Diagnostics explicitly marked
+* `matchByOccurrence` may fall back to same-file plugin/rule/message matching
+* after same-file strict evidence matching. Cross-file evidence matching runs
+* last so a copy cannot consume a reformatted local occurrence. Unreadable
+* evidence uses the same conservative fallback rather than matching across
+* files without proof.
 */
 const computeDiagnosticDelta = (input) => {
-	const unmatchedBaseByFingerprint = /* @__PURE__ */ new Map();
-	for (const diagnostic of input.baseDiagnostics) {
-		const key = fingerprintDiagnostic(diagnostic, input.readBaseLine(diagnostic.filePath, diagnostic.line));
-		unmatchedBaseByFingerprint.set(key, (unmatchedBaseByFingerprint.get(key) ?? 0) + 1);
-	}
-	const newDiagnostics = [];
-	for (const diagnostic of input.headDiagnostics) {
-		const key = fingerprintDiagnostic(diagnostic, input.readHeadLine(diagnostic.filePath, diagnostic.line));
-		const availableMatches = unmatchedBaseByFingerprint.get(key) ?? 0;
-		if (availableMatches > 0) unmatchedBaseByFingerprint.set(key, availableMatches - 1);
-		else newDiagnostics.push(diagnostic);
-	}
-	let fixedCount = 0;
-	for (const remaining of unmatchedBaseByFingerprint.values()) fixedCount += remaining;
+	const baseCandidates = buildMatchCandidates(input.baseDiagnostics, input.readBaseEvidence, input.readBaseLine);
+	const headCandidates = buildMatchCandidates(input.headDiagnostics, input.readHeadEvidence, input.readHeadLine);
+	const baseByStableEvidence = /* @__PURE__ */ new Map();
+	const baseBySameFileStableEvidence = /* @__PURE__ */ new Map();
+	const baseBySameFileFallback = /* @__PURE__ */ new Map();
+	for (const candidate of baseCandidates) {
+		addDiagnosticIndex(baseByStableEvidence, candidate.stableEvidenceKey, candidate.diagnosticIndex);
+		addDiagnosticIndex(baseBySameFileStableEvidence, candidate.sameFileStableEvidenceKey, candidate.diagnosticIndex);
+		addDiagnosticIndex(baseBySameFileFallback, candidate.sameFileFallbackKey, candidate.diagnosticIndex);
+	}
+	const matchedHeadDiagnosticIndexes = /* @__PURE__ */ new Set();
+	const matchedBaseDiagnosticIndexes = /* @__PURE__ */ new Set();
+	const matchCandidates = (baseBuckets, getKey, onMatch) => {
+		for (const candidate of headCandidates) {
+			if (matchedHeadDiagnosticIndexes.has(candidate.diagnosticIndex)) continue;
+			const baseDiagnosticIndex = takeMatchingDiagnosticIndex(baseBuckets, getKey(candidate), matchedBaseDiagnosticIndexes);
+			if (baseDiagnosticIndex === null) continue;
+			matchedHeadDiagnosticIndexes.add(candidate.diagnosticIndex);
+			matchedBaseDiagnosticIndexes.add(baseDiagnosticIndex);
+			onMatch?.(candidate.diagnosticIndex, baseDiagnosticIndex);
+		}
+	};
+	matchCandidates(baseBySameFileStableEvidence, (candidate) => candidate.sameFileStableEvidenceKey);
+	matchCandidates(baseBySameFileFallback, (candidate) => candidate.sameFileFallbackKey);
+	let crossFileMatchCount = 0;
+	matchCandidates(baseByStableEvidence, (candidate) => candidate.stableEvidenceKey, (head, base) => {
+		if (input.headDiagnostics[head]?.filePath !== input.baseDiagnostics[base]?.filePath) crossFileMatchCount += 1;
+	});
 	return {
-		newDiagnostics,
-		fixedCount
+		newDiagnostics: input.headDiagnostics.filter((_diagnostic, diagnosticIndex) => !matchedHeadDiagnosticIndexes.has(diagnosticIndex)),
+		fixedCount: input.baseDiagnostics.length - matchedBaseDiagnosticIndexes.size,
+		crossFileMatchCount
 	};
 };
 /**
@@ -46767,6 +46894,12 @@ const getDiffInfo = (directory, explicitBaseBranch, includeUntracked) => runProm
 	};
 }).pipe(provide(Git.layerNode)));
 const filterSourceFiles = (filePaths) => filePaths.filter(isLintableSourceFile);
+const getBaselineDiffPlan = (directory, ref) => runPromise(gen(function* () {
+	return yield* (yield* Git).baselineDiffPlan({
+		directory,
+		ref
+	});
+}).pipe(provide(Git.layerNode)));
 /**
 * Programmatic façade over `Git.changedLineRanges` (the `lines` scope). Diffs
 * `files` with `--unified=0` against `baseRef` (or the index when `cached`),
@@ -47223,7 +47356,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.8.0";
+const VERSION = "0.8.1-dev.1839566";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -47575,13 +47708,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.8.0`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.8.1-dev.1839566`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.8.0") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.8.1-dev.1839566") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -60204,6 +60337,7 @@ const buildOutcomeAttributes = (input) => {
 		new: summary.totalDiagnosticCount,
 		fixed: result.baselineDelta.fixedCount,
 		baseTotal: result.baselineDelta.baseTotalCount,
+		crossFileMatches: result.baselineDelta.crossFileMatchCount ?? null,
 		degraded: false
 	}));
 	else if (input.gateExempt) attributes["baseline.degraded"] = true;
@@ -60317,28 +60451,49 @@ const diagnosticIntersectsLineRanges = (diagnostic, lineRanges) => {
 	return lineRanges.some(([rangeStartLine, rangeEndLine]) => diagnostic.line <= rangeEndLine && diagnosticEndLine >= rangeStartLine);
 };
 //#endregion
+//#region src/cli/utils/is-materializable-git-source.ts
+const GIT_LFS_POINTER_HEADER = "version https://git-lfs.github.com/spec/v1";
+const isMaterializableGitSource = (content) => !content.includes("\0") && !content.startsWith(GIT_LFS_POINTER_HEADER);
+//#endregion
 //#region src/cli/utils/materialize-baseline-files.ts
 /**
-* Materializes the `ref` version of `files` into `tempDirectory` (via
-* `git show <ref>:<path>`), mirroring the project layout + head's config files
-* so the base lints under the same rules as head. Reuses the shared,
-* zip-slip-guarded `materializeSourceTree`. Per-file read misses (e.g. a file
-* the PR added, absent at base) are skipped, which is exactly what we want:
-* a brand-new file has no base counterpart, so all its findings are "new".
+* Materializes the base side of the `ref` → worktree diff into
+* `tempDirectory`, mirroring the project layout plus head's config files so
+* both sides lint under the same rules. Git rename heuristics are disabled by
+* the diff planner, so an old path is retained as a base deletion while its
+* new path is a head addition. Missing head-only additions are expected;
+* missing paths that the plan says must exist at base make `isComplete` false.
 */
 const materializeBaselineFiles = (input) => runPromise(gen(function* () {
 	const git = yield* Git;
-	return yield* materializeSourceTree({
+	const diffPlan = yield* git.baselineDiffPlan({
 		directory: input.directory,
-		files: input.files,
+		ref: input.ref
+	});
+	const baseFiles = input.baseFiles ?? diffPlan?.baseFiles;
+	const headFiles = input.headFiles ?? diffPlan?.headFiles;
+	const untrackedFiles = diffPlan?.untrackedFiles ?? [];
+	if (baseFiles === void 0 || headFiles === void 0) return null;
+	const files = [...new Set([...input.files, ...baseFiles])];
+	const tree = yield* materializeSourceTree({
+		directory: input.directory,
+		files,
 		tempDirectory: input.tempDirectory,
 		readContent: (relativePath) => git.showRefContent({
 			directory: input.directory,
 			ref: input.ref,
 			relativePath,
 			options: { maxBufferBytes: GIT_SHOW_MAX_BUFFER_BYTES }
-		})
+		}).pipe(map$3((content) => content !== null && isMaterializableGitSource(content) ? content : null))
 	});
+	const materializedFiles = new Set(tree.materializedFiles);
+	return {
+		...tree,
+		baseFiles,
+		headFiles,
+		isComplete: baseFiles.every((filePath) => materializedFiles.has(filePath)),
+		untrackedFiles
+	};
 }).pipe(provide(Git.layerNode)));
 /**
 * Resolves the commit a baseline scan should read base content from — the
@@ -60361,8 +60516,8 @@ const resolveMergeBaseRef = async (directory, ref) => {
 //#region src/cli/utils/read-source-line.ts
 /**
 * Builds a cached `(filePath, line) -> source text` reader rooted at
-* `rootDirectory`, used to fingerprint a diagnostic by the content of its
-* flagged line (see `computeDiagnosticDelta`). Wraps core's
+* `rootDirectory`, used as the fallback when construct-level diagnostic
+* evidence cannot be read. Wraps core's
 * `createNodeReadFileLinesSync` with per-file memoization + 1-indexed line
 * lookup; unreadable files / out-of-range lines return `null`.
 */
@@ -60377,6 +60532,338 @@ const createSourceLineReader = (rootDirectory) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/read-diagnostic-evidence.ts
+const SOURCE_EXTENSIONS = [
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".cts",
+	".mjs",
+	".cjs"
+];
+const COMPONENT_WRAPPER_NAMES = new Set(["memo", "forwardRef"]);
+const getScriptKind = (filePath) => {
+	const extension = path.extname(filePath).toLowerCase();
+	if (extension === ".tsx") return ts.ScriptKind.TSX;
+	if (extension === ".jsx") return ts.ScriptKind.JSX;
+	if (extension === ".js" || extension === ".mjs" || extension === ".cjs") return ts.ScriptKind.JS;
+	return ts.ScriptKind.TS;
+};
+const resolveSafeSourcePath = (rootDirectory, filePath) => {
+	try {
+		const resolvedRootDirectory = fs.realpathSync(rootDirectory);
+		const absolutePath = path.resolve(resolvedRootDirectory, filePath);
+		const relativePath = path.relative(resolvedRootDirectory, absolutePath);
+		if (relativePath.length === 0 || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) return null;
+		const stats = fs.lstatSync(absolutePath);
+		if (!stats.isFile() || stats.isSymbolicLink()) return null;
+		const realPath = fs.realpathSync(absolutePath);
+		const realRelativePath = path.relative(resolvedRootDirectory, realPath);
+		return realRelativePath !== ".." && !realRelativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(realRelativePath) ? realPath : null;
+	} catch {
+		return null;
+	}
+};
+const readSourceRecord = (rootDirectory, filePath, state) => {
+	const normalizedFilePath = filePath.replace(/\\/g, "/");
+	if (state.recordByFilePath.has(normalizedFilePath)) return state.recordByFilePath.get(normalizedFilePath) ?? null;
+	const absolutePath = resolveSafeSourcePath(rootDirectory, normalizedFilePath);
+	if (absolutePath === null) {
+		state.recordByFilePath.set(normalizedFilePath, null);
+		return null;
+	}
+	try {
+		const sourceText = fs.readFileSync(absolutePath, "utf-8");
+		const record = {
+			absolutePath,
+			filePath: normalizedFilePath,
+			sourceFile: ts.createSourceFile(absolutePath, sourceText, ts.ScriptTarget.Latest, true, getScriptKind(absolutePath)),
+			sourceText
+		};
+		state.recordByFilePath.set(normalizedFilePath, record);
+		return record;
+	} catch {
+		state.recordByFilePath.set(normalizedFilePath, null);
+		return null;
+	}
+};
+const listSourceRecords = (rootDirectory, state) => {
+	if (state.sourceRecords !== null) return state.sourceRecords;
+	state.sourceRecords = listSourceFiles(rootDirectory).flatMap((filePath) => {
+		const record = readSourceRecord(rootDirectory, filePath, state);
+		return record === null ? [] : [record];
+	});
+	return state.sourceRecords;
+};
+const unwrapExpression = (expression) => {
+	let currentExpression = expression;
+	while (ts.isParenthesizedExpression(currentExpression) || ts.isAsExpression(currentExpression) || ts.isTypeAssertionExpression(currentExpression) || ts.isNonNullExpression(currentExpression) || ts.isSatisfiesExpression(currentExpression)) currentExpression = currentExpression.expression;
+	return currentExpression;
+};
+const getCalleeName = (expression) => {
+	const unwrappedExpression = unwrapExpression(expression);
+	if (ts.isIdentifier(unwrappedExpression)) return unwrappedExpression.text;
+	if (ts.isPropertyAccessExpression(unwrappedExpression)) return unwrappedExpression.name.text;
+	return null;
+};
+const isComponentWrapperCall = (node) => {
+	const wrapperName = getCalleeName(node.expression);
+	return wrapperName !== null && COMPONENT_WRAPPER_NAMES.has(wrapperName);
+};
+const getFunctionName = (node) => {
+	if (ts.isFunctionDeclaration(node) && node.name !== void 0) return node.name.text;
+	if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
+		let componentExpression = node;
+		while (true) {
+			const parent = componentExpression.parent;
+			if (ts.isParenthesizedExpression(parent) || ts.isAsExpression(parent) || ts.isTypeAssertionExpression(parent) || ts.isNonNullExpression(parent) || ts.isSatisfiesExpression(parent)) {
+				componentExpression = parent;
+				continue;
+			}
+			if (ts.isCallExpression(parent) && parent.arguments[0] === componentExpression && isComponentWrapperCall(parent)) {
+				componentExpression = parent;
+				continue;
+			}
+			if (ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name)) return parent.name.text;
+			return node.name?.text ?? null;
+		}
+	}
+	return null;
+};
+const isComponentFunction = (node) => ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node);
+const isDefaultExportedComponent = (record, node, componentName) => {
+	if (ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword)) return true;
+	return record.sourceFile.statements.some((statement) => ts.isExportAssignment(statement) && ts.isIdentifier(statement.expression) && statement.expression.text === componentName);
+};
+const findEnclosingComponent = (record, diagnostic) => {
+	if (!Number.isInteger(diagnostic.line) || diagnostic.line < 1) return null;
+	const lineIndex = diagnostic.line - 1;
+	const lineStarts = record.sourceFile.getLineStarts();
+	const lineStart = lineStarts[lineIndex];
+	if (lineStart === void 0) return null;
+	const nextLineStart = lineStarts[lineIndex + 1] ?? record.sourceFile.end;
+	const lineEnd = Math.max(lineStart, nextLineStart - 1);
+	const columnIndex = Number.isInteger(diagnostic.column) ? Math.max(0, diagnostic.column - 1) : 0;
+	const diagnosticPosition = Math.min(lineStart + columnIndex, lineEnd);
+	let component = null;
+	let componentWidth = Number.POSITIVE_INFINITY;
+	const visit = (node) => {
+		if (diagnosticPosition < node.getStart(record.sourceFile) || diagnosticPosition > node.end) return;
+		if (isComponentFunction(node)) {
+			const name = getFunctionName(node);
+			const width = node.end - node.getStart(record.sourceFile);
+			if (name !== null && /^[A-Z]/.test(name) && width < componentWidth) {
+				component = {
+					isDefaultExport: isDefaultExportedComponent(record, node, name),
+					name,
+					node,
+					record
+				};
+				componentWidth = width;
+			}
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(record.sourceFile);
+	return component;
+};
+const moduleSpecifierTargetsComponent = (callerRecord, moduleSpecifier, componentRecord) => {
+	if (!moduleSpecifier.startsWith(".")) return false;
+	const unresolvedPath = path.resolve(path.dirname(callerRecord.absolutePath), moduleSpecifier);
+	const specifiedExtension = path.extname(unresolvedPath).toLowerCase();
+	const sourcePathWithoutExtension = SOURCE_EXTENSIONS.includes(specifiedExtension) ? unresolvedPath.slice(0, -specifiedExtension.length) : unresolvedPath;
+	return [
+		unresolvedPath,
+		...SOURCE_EXTENSIONS.map((extension) => `${sourcePathWithoutExtension}${extension}`),
+		...sourcePathWithoutExtension === unresolvedPath ? SOURCE_EXTENSIONS.map((extension) => path.join(unresolvedPath, `index${extension}`)) : []
+	].includes(componentRecord.absolutePath);
+};
+const getComponentTagNames = (record, component) => {
+	if (record.absolutePath === component.record.absolutePath) return new Set([component.name]);
+	const tagNames = /* @__PURE__ */ new Set();
+	for (const statement of record.sourceFile.statements) {
+		if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier) || !moduleSpecifierTargetsComponent(record, statement.moduleSpecifier.text, component.record)) continue;
+		const importClause = statement.importClause;
+		if (component.isDefaultExport && importClause?.name !== void 0) tagNames.add(importClause.name.text);
+		const namedBindings = importClause?.namedBindings;
+		if (namedBindings !== void 0 && ts.isNamedImports(namedBindings)) {
+			for (const element of namedBindings.elements) if ((element.propertyName?.text ?? element.name.text) === component.name) tagNames.add(element.name.text);
+		}
+	}
+	return tagNames;
+};
+const getTransparentCall = (functionNode) => {
+	if (functionNode.body === void 0) return null;
+	if (!ts.isBlock(functionNode.body)) {
+		const expression = unwrapExpression(functionNode.body);
+		return ts.isCallExpression(expression) ? expression : null;
+	}
+	if (functionNode.body.statements.length !== 1) return null;
+	const statement = functionNode.body.statements[0];
+	if (statement === void 0) return null;
+	const expression = ts.isExpressionStatement(statement) || ts.isReturnStatement(statement) ? statement.expression : void 0;
+	if (expression === void 0) return null;
+	const unwrappedExpression = unwrapExpression(expression);
+	return ts.isCallExpression(unwrappedExpression) ? unwrappedExpression : null;
+};
+const resolveTransparentTarget = (functionNode) => {
+	const call = getTransparentCall(functionNode);
+	if (call === null) return null;
+	const target = unwrapExpression(call.expression);
+	if (!ts.isIdentifier(target) || call.arguments.length !== functionNode.parameters.length) return null;
+	for (const [parameterIndex, parameter] of functionNode.parameters.entries()) {
+		const argument = call.arguments[parameterIndex];
+		const unwrappedArgument = argument === void 0 ? null : unwrapExpression(argument);
+		if (!ts.isIdentifier(parameter.name) || unwrappedArgument === null || !ts.isIdentifier(unwrappedArgument) || unwrappedArgument.text !== parameter.name.text) return null;
+	}
+	return target.text;
+};
+const getForwardingFunction = (declaration) => {
+	if (ts.isFunctionDeclaration(declaration)) return declaration;
+	if (!ts.isVariableDeclaration(declaration) || declaration.initializer === void 0) return null;
+	const initializer = unwrapExpression(declaration.initializer);
+	if (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer)) return initializer;
+	if (ts.isCallExpression(initializer) && getCalleeName(initializer.expression) === "useCallback") {
+		const callback = initializer.arguments[0];
+		if (callback !== void 0 && (ts.isArrowFunction(callback) || ts.isFunctionExpression(callback))) return callback;
+	}
+	return null;
+};
+const getDeclaredBindingName = (node) => {
+	if ((ts.isVariableDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isFunctionDeclaration(node)) && node.name !== void 0 && ts.isIdentifier(node.name)) return node.name.text;
+	if (ts.isImportClause(node)) return node.name?.text ?? null;
+	if (ts.isImportSpecifier(node) || ts.isNamespaceImport(node)) return node.name.text;
+	return null;
+};
+const findBindingScope = (node) => {
+	let currentNode = node;
+	while (currentNode !== void 0) {
+		if (ts.isParameter(currentNode) && ts.isFunctionLike(currentNode.parent)) return currentNode.parent;
+		if (ts.isBlock(currentNode) || ts.isModuleBlock(currentNode) || ts.isSourceFile(currentNode)) return currentNode;
+		currentNode = currentNode.parent;
+	}
+	return node.getSourceFile();
+};
+const findBindingDeclaration = (record, binding) => {
+	const usagePosition = binding.getStart(record.sourceFile);
+	const candidates = [];
+	const visit = (node) => {
+		if (getDeclaredBindingName(node) === binding.text) {
+			const scope = findBindingScope(node);
+			const isVisibleScope = usagePosition >= scope.getStart(record.sourceFile) && usagePosition <= scope.end;
+			const isVisibleDeclaration = ts.isFunctionDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isImportClause(node) || ts.isImportSpecifier(node) || ts.isNamespaceImport(node) || node.getStart(record.sourceFile) < usagePosition;
+			if (isVisibleScope && isVisibleDeclaration) candidates.push({
+				declaration: node,
+				scope
+			});
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(record.sourceFile);
+	let nearestCandidate = null;
+	let nearestScopeWidth = Number.POSITIVE_INFINITY;
+	let isNearestScopeAmbiguous = false;
+	for (const candidate of candidates) {
+		const scopeWidth = candidate.scope.end - candidate.scope.getStart(record.sourceFile);
+		if (scopeWidth < nearestScopeWidth) {
+			nearestCandidate = candidate;
+			nearestScopeWidth = scopeWidth;
+			isNearestScopeAmbiguous = false;
+		} else if (scopeWidth === nearestScopeWidth) isNearestScopeAmbiguous = true;
+	}
+	if (isNearestScopeAmbiguous) return null;
+	const declaration = nearestCandidate?.declaration;
+	return declaration !== void 0 && (ts.isVariableDeclaration(declaration) || ts.isFunctionDeclaration(declaration)) ? declaration : null;
+};
+const resolveHandlerBinding = (record, binding) => {
+	const declaration = findBindingDeclaration(record, binding);
+	if (declaration === null) return binding.text;
+	const forwardingFunction = getForwardingFunction(declaration);
+	const target = forwardingFunction === null ? null : resolveTransparentTarget(forwardingFunction);
+	return target === null || target === binding.text ? binding.text : target;
+};
+const getJsxTagName = (node) => ts.isIdentifier(node.tagName) ? node.tagName.text : null;
+const getHandlerBinding = (node, propName) => {
+	for (const property of node.attributes.properties) {
+		if (!ts.isJsxAttribute(property) || property.name.getText() !== propName) continue;
+		const initializer = property.initializer;
+		if (initializer === void 0 || !ts.isJsxExpression(initializer)) return null;
+		if (initializer.expression === void 0) return null;
+		const expression = unwrapExpression(initializer.expression);
+		return ts.isIdentifier(expression) ? expression : null;
+	}
+	return null;
+};
+const getForwardedHandlerAliases = (rootDirectory, component, propNames, state) => {
+	const cacheKey = `${component.record.filePath}\0${component.name}\0${[...propNames].sort().join("\0")}`;
+	const cachedAliases = state.aliasesByComponent.get(cacheKey);
+	if (cachedAliases !== void 0) return cachedAliases;
+	const bindingsByPropName = /* @__PURE__ */ new Map();
+	const unresolvedPropNames = /* @__PURE__ */ new Set();
+	let callsiteCount = 0;
+	for (const record of listSourceRecords(rootDirectory, state)) {
+		const tagNames = getComponentTagNames(record, component);
+		if (tagNames.size === 0) continue;
+		const visit = (node) => {
+			if (record === component.record && node === component.node) return;
+			if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
+				const tagName = getJsxTagName(node);
+				if (tagName !== null && tagNames.has(tagName)) {
+					callsiteCount += 1;
+					for (const propName of propNames) {
+						const binding = getHandlerBinding(node, propName);
+						if (binding === null) {
+							unresolvedPropNames.add(propName);
+							continue;
+						}
+						const bindings = bindingsByPropName.get(propName) ?? /* @__PURE__ */ new Set();
+						bindings.add(resolveHandlerBinding(record, binding));
+						bindingsByPropName.set(propName, bindings);
+					}
+				}
+			}
+			ts.forEachChild(node, visit);
+		};
+		visit(record.sourceFile);
+	}
+	const aliases = /* @__PURE__ */ new Map();
+	if (callsiteCount > 0) for (const [propName, bindings] of bindingsByPropName) {
+		if (bindings.size !== 1 || unresolvedPropNames.has(propName)) continue;
+		const [bindingName] = bindings;
+		if (bindingName !== void 0) aliases.set(propName, bindingName);
+	}
+	state.aliasesByComponent.set(cacheKey, aliases);
+	return aliases;
+};
+const normalizeForwardedHandlers = (evidence, aliases) => {
+	let normalizedEvidence = evidence;
+	for (const [propName, bindingName] of aliases) normalizedEvidence = normalizedEvidence.replace(new RegExp(`\\{\\s*${propName}\\s*\\}`, "g"), `{${bindingName}}`).replace(new RegExp(`=>\\s*${propName}\\s*\\(`, "g"), `=> ${bindingName}(`);
+	return normalizedEvidence;
+};
+const createDiagnosticEvidenceReader = (rootDirectory, options = {}) => {
+	const state = {
+		aliasesByComponent: /* @__PURE__ */ new Map(),
+		recordByFilePath: /* @__PURE__ */ new Map(),
+		sourceRecords: null
+	};
+	return (diagnostic) => {
+		const record = readSourceRecord(rootDirectory, diagnostic.filePath, state);
+		if (record === null || !Number.isInteger(diagnostic.line)) return null;
+		const sourceLines = record.sourceText.split(/\r?\n/);
+		const startLineIndex = Math.max(0, diagnostic.line - 1);
+		const endLineIndex = Math.max(startLineIndex, (diagnostic.endLine ?? diagnostic.line) - 1);
+		const evidence = sourceLines.slice(startLineIndex, endLineIndex + 1).join("\n");
+		if (!options.resolveForwardedHandlers) return evidence;
+		const propNames = new Set(evidence.match(/\bon[A-Z]\w*\b/g) ?? []);
+		if (propNames.size === 0) return evidence;
+		const component = findEnclosingComponent(record, diagnostic);
+		if (component === null) return evidence;
+		return normalizeForwardedHandlers(evidence, getForwardedHandlerAliases(rootDirectory, component, propNames, state));
+	};
+};
+//#endregion
 //#region src/cli/utils/build-no-score-message.ts
 const ENTERPRISE_CONTACT_HINT = `Want something custom to your company? Contact us at ${ENTERPRISE_CONTACT_URL}.`;
 const buildNoScoreMessage = (isScoreDisabled) => {
@@ -61620,6 +62107,8 @@ const runBaselineComparison = async (params) => {
 		directory: params.directory,
 		ref: params.baselineRef,
 		files: params.options.includePaths,
+		baseFiles: params.baseFiles,
+		headFiles: params.headFiles,
 		tempDirectory
 	}).catch((error) => {
 		rmSync(tempDirectory, {
@@ -61628,7 +62117,24 @@ const runBaselineComparison = async (params) => {
 		});
 		throw error;
 	});
+	if (snapshot === null) {
+		rmSync(tempDirectory, {
+			recursive: true,
+			force: true
+		});
+		return null;
+	}
 	try {
+		if (!snapshot.isComplete) return null;
+		const analyzedHeadFiles = new Set(params.headAnalyzedFiles.map(toForwardSlashes));
+		const baseFiles = new Set(snapshot.baseFiles.map(toForwardSlashes));
+		const trackedHeadFiles = new Set(snapshot.headFiles.map(toForwardSlashes));
+		const expectedHeadFiles = new Set(trackedHeadFiles);
+		for (const filePath of params.options.includePaths) {
+			const normalizedFilePath = toForwardSlashes(filePath);
+			if (!baseFiles.has(normalizedFilePath)) expectedHeadFiles.add(normalizedFilePath);
+		}
+		if (filterSourceFiles([...expectedHeadFiles]).some((filePath) => !analyzedHeadFiles.has(filePath))) return null;
 		const baseLayers = buildRuntimeLayers({
 			directory: snapshot.tempDirectory,
 			hasConfigOverride: true,
@@ -61644,7 +62150,7 @@ const runBaselineComparison = async (params) => {
 		});
 		const baseOutput = await runPromise(restoreLegacyThrow(runInspect({
 			directory: snapshot.tempDirectory,
-			includePaths: params.options.includePaths,
+			includePaths: snapshot.materializedFiles,
 			customRulesOnly: params.options.customRulesOnly,
 			respectInlineDisables: params.options.respectInlineDisables,
 			warnings: params.options.warnings,
@@ -61661,18 +62167,22 @@ const runBaselineComparison = async (params) => {
 			deadlineEpochMs: params.deadlineEpochMs ?? void 0
 		}, {}).pipe(provide(baseLayers), provideService$2(PerFileLintCacheEnabled, false), provideService$2(SidecarLintCacheEnabled, false), provideService$2(Console, silentConsole))));
 		if (baseOutput.didLintFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
+		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(snapshot.untrackedFiles.map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
 		const delta = computeDiagnosticDelta({
 			headDiagnostics: params.headDiagnostics,
 			baseDiagnostics: baseOutput.diagnostics,
 			readHeadLine: createSourceLineReader(params.directory),
-			readBaseLine: createSourceLineReader(snapshot.tempDirectory)
+			readBaseLine: createSourceLineReader(snapshot.tempDirectory),
+			readHeadEvidence: createDiagnosticEvidenceReader(params.directory, { resolveForwardedHandlers: true }),
+			readBaseEvidence: createDiagnosticEvidenceReader(snapshot.tempDirectory)
 		});
 		return {
 			displayDiagnostics: delta.newDiagnostics,
 			baselineDelta: {
 				baseRef: params.baselineRef,
-				fixedCount: delta.fixedCount,
-				baseTotalCount: baseOutput.diagnostics.length
+				fixedCount: hasUnscannedUntrackedSourceFiles ? 0 : delta.fixedCount,
+				baseTotalCount: baseOutput.diagnostics.length,
+				crossFileMatchCount: delta.crossFileMatchCount
 			}
 		};
 	} finally {
@@ -61779,6 +62289,9 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 			headDiagnostics: output.diagnostics,
 			resolvedNodeBinaryPath,
 			baselineRef: options.baseline.ref,
+			baseFiles: options.baseline.baseFiles,
+			headFiles: options.baseline.headFiles,
+			headAnalyzedFiles: output.analyzedFiles,
 			deadlineEpochMs
 		});
 		if (comparison) {
@@ -64063,20 +64576,25 @@ const resolveProjectRelativeDirectory = (rootDirectory, projectDirectory) => {
 	return relativeProjectDirectory;
 };
 //#endregion
-//#region src/cli/utils/resolve-project-diff-include-paths.ts
-const resolveProjectDiffIncludePaths = (rootDirectory, projectDirectory, diffInfo) => {
+//#region src/cli/utils/resolve-project-source-file-paths.ts
+const resolveProjectSourceFilePaths = (rootDirectory, projectDirectory, filePaths) => {
 	const relativeProjectDirectory = resolveProjectRelativeDirectory(rootDirectory, projectDirectory);
 	if (relativeProjectDirectory === null) return [];
-	const changedSourceFiles = filterSourceFiles(diffInfo.changedFiles);
-	if (relativeProjectDirectory.length === 0) return changedSourceFiles;
+	const sourceFilePaths = filterSourceFiles([...filePaths]);
+	if (relativeProjectDirectory.length === 0) return sourceFilePaths;
 	const projectPrefix = `${relativeProjectDirectory}/`;
-	return changedSourceFiles.flatMap((filePath) => {
+	return sourceFilePaths.flatMap((filePath) => {
 		const normalizedFilePath = toForwardSlashes(filePath);
 		if (!normalizedFilePath.startsWith(projectPrefix)) return [];
 		const projectRelativePath = normalizedFilePath.slice(projectPrefix.length);
 		return projectRelativePath.length > 0 ? [projectRelativePath] : [];
 	});
 };
+//#endregion
+//#region src/cli/utils/resolve-project-diff-include-paths.ts
+const resolveProjectDiffIncludePaths = (rootDirectory, projectDirectory, diffInfo) => {
+	return resolveProjectSourceFilePaths(rootDirectory, projectDirectory, diffInfo.changedFiles);
+};
 /**
 * Re-keys repo-relative changed line ranges (from `getChangedLineRanges`) to
 * the scanned project, mirroring `resolveProjectDiffIncludePaths`'s boundary
@@ -64615,6 +65133,7 @@ const inspectAction = async (directory, flags) => {
 		const isDiffMode = scope !== "full";
 		const comparisonBaseRef = isDiffMode && diffInfo && !diffInfo.isCurrentChanges ? diffInfo.baseSha ? await resolveMergeBaseRef(resolvedDirectory, diffInfo.baseSha) : diffInfo.diffBaseRef ?? await resolveMergeBaseRef(resolvedDirectory, diffInfo.baseBranch) : null;
 		const baselineRef = scope === "changed" ? comparisonBaseRef : null;
+		const baselineDiffPlan = baselineRef === null ? null : await getBaselineDiffPlan(resolvedDirectory, baselineRef);
 		const linesBaseRef = diffInfo?.isCurrentChanges ? "HEAD" : comparisonBaseRef;
 		const changedLineRanges = scope === "lines" && diffInfo !== null && (diffInfo.isCurrentChanges || linesBaseRef !== null) && diffInfo !== null ? await getChangedLineRanges({
 			directory: resolvedDirectory,
@@ -64645,10 +65164,13 @@ const inspectAction = async (directory, flags) => {
 			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
+			const projectBaselineBaseFiles = baselineDiffPlan === null ? null : resolveProjectSourceFilePaths(resolvedDirectory, scanDirectory, baselineDiffPlan.baseFiles);
+			const projectBaselineHeadFiles = baselineDiffPlan === null ? null : resolveProjectSourceFilePaths(resolvedDirectory, scanDirectory, baselineDiffPlan.headFiles);
 			if (isDiffMode) {
 				const changedSourceFiles = diffInfo === null ? [] : resolveProjectDiffIncludePaths(resolvedDirectory, scanDirectory, diffInfo);
 				supplyChainManifestChanged = supplyChainEnabled && diffInfo !== null && projectManifestChanged(resolvedDirectory, scanDirectory, diffInfo);
-				if (changedSourceFiles.length === 0 && !supplyChainManifestChanged) {
+				const hasBaselineOnlyFiles = (projectBaselineBaseFiles?.length ?? 0) > 0;
+				if (changedSourceFiles.length === 0 && !supplyChainManifestChanged && !hasBaselineOnlyFiles) {
 					if (!isQuiet) {
 						cliLogger.dim(`No changed source files in ${scanDirectory}, skipping.`);
 						cliLogger.break();
@@ -64656,6 +65178,7 @@ const inspectAction = async (directory, flags) => {
 					return null;
 				}
 				includePaths = [...changedSourceFiles];
+				if (includePaths.length === 0 && hasBaselineOnlyFiles) includePaths.push(...projectBaselineBaseFiles ?? []);
 				if (supplyChainManifestChanged) includePaths.push("package.json");
 			}
 			if (!isQuiet && !isMultiProject) cliLogger.dim("  ");
@@ -64667,7 +65190,11 @@ const inspectAction = async (directory, flags) => {
 				configSourceDirectory: projectConfigSourceDirectory ?? void 0,
 				suppressRendering: isMultiProject,
 				concurrentScan: isMultiProject,
-				baseline: baselineRef ? { ref: baselineRef } : void 0,
+				baseline: baselineRef !== null && projectBaselineBaseFiles !== null && projectBaselineHeadFiles !== null ? {
+					ref: baselineRef,
+					baseFiles: projectBaselineBaseFiles,
+					headFiles: projectBaselineHeadFiles
+				} : void 0,
 				changedLineRanges: scope === "lines" && changedLineRanges !== null ? resolveProjectChangedLineRanges(resolvedDirectory, scanDirectory, changedLineRanges) : void 0,
 				supplyChainManifestChanged
 			});
@@ -65867,4 +66394,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=5cb8a881-e8fc-5561-8b89-ad2c8357acbc
+//# debugId=c24708ed-97a3-59cc-81f7-4cf277ab29f2