react-doctor 0.9.12 → 0.9.13

package/dist/{should-fail-scan-gate-DzZuTxim.js → should-fail-scan-gate-BYPsKIde.js}

@@ -1,21 +1,25 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="00cf2dc8-65a5-523e-b3b1-8400324c9d87")}catch(e){}}();
-import { $n as orElseSucceed, An as resolveReactDoctorCacheDir, Bt as computeConfigFingerprint, Cn as mapWithConcurrency, Ct as SHARE_BASE_URL, Dt as SidecarLintCacheEnabled, E as NANOSECONDS_PER_MILLISECOND, Et as Score, Ft as buildSkippedChecks, G as isCiOrCodingAgentEnvironment, Gn as log, Gt as discoverReactSubprojects, H as ACTION_INPUT_ENVIRONMENT_VARIABLES, Hn as Console, Ht as createNodeReadFileLinesSync, It as calculateScore, Jn as decodeUnknownSync, Jt as filterSourceFiles, Kn as warn, Kt as filterDiagnosticsForSurface, Ln as summarizeDiagnostics, Lt as canonicalizeUserRuleKey, Mn as resolveScanTarget, Mt as atomicWriteJson, Nn as restoreLegacyThrow, On as resolveGithubActionsScoreMetadata, Pn as runInspect, Pt as buildRuleDocsUrl, Qn as map, R as CliInputError, St as Reporter, Tn as mergeReactDoctorConfigs, U as detectRunnerOs, Un as error, Ut as createOxlintSpawnSlots, Vn as yieldToEventLoop, Vt as computeDiagnosticDelta, W as isCiEnvironment, X as CI_URL, Xn as gen, Zn as makeSpan, _ as makeNoopConsole, _r as ParentSpan, _t as OxlintConcurrency, an as hasPublishedFixRecipe, ar as runSync, at as Files, bn as listSourceFiles, bt as Progress, c as setSentryProjectInfo, cn as highlighter, ct as Git, d as isJsonModeActive, dn as isFile, er as promise, et as Config, fn as isMonorepoRoot, fr as succeed, ft as LintPartialFailures, g as VERSION, gn as isReactDoctorError, gr as void_, gt as OXLINT_NODE_REQUIREMENT, hr as fail, ht as NodeResolver, in as groupBy, ir as runPromise, it as ENTERPRISE_CONTACT_URL, jn as resolveScanConcurrency, k as SCAN_RESULT_CACHE_FILENAME, kn as resolveLintBatchOrdering, kt as SupplyChain, l as getRunId, ln as isDirectory, lt as HTML_FILE_PATTERN, mt as MILLISECONDS_PER_SECOND, n as recordDistribution, nr as provideContext, o as buildSentryScope, or as sync, pt as Linter, qn as Diagnostic, qt as filterPathsOutsideDirectories, r as toSpanAttributes, rr as provideService, rt as DeadCode, s as buildSentryProjectContext, sn as hashFileContents, sr as try_, st as GIT_SHOW_MAX_BUFFER_BYTES, t as recordCount, tn as getDiagnosticRuleIdentity, tr as provide, tt as DIAGNOSTIC_CATEGORY_BUCKETS, ur as mergeAll, ut as JSX_FILE_PATTERN, vn as isScanComplete, vt as OxlintSpawnSlots, w as METRIC, wn as materializeSourceTree, x as BASELINE_FILES_TEMP_DIR_PREFIX, xn as listWorkspacePackages, xt as Project, yt as PerFileLintCacheEnabled, z as isNonInteractiveEnvironment, zt as collectSourceFileCountsByDirectory } from "./record-metric-CsQXJewH.js";
-import { a as setActiveRunTrace, i as recordRunTraceId, o as getTelemetryContext } from "./unref-stdin-0a_0uwC6.js";
-import { n as buildFooterLinkLines, r as activeScanAbortRegistry, t as buildSectionDivider } from "./build-section-divider-BsQvH-7I.js";
-import { D as getPackageJsonPath, L as cliLogger, O as isRecord, P as runGit, a as installReactDoctorScriptStep, c as spinner, n as findNearestPackageDirectory, o as isSpinnerSilent, s as setSpinnerSilent } from "./install-doctor-script-DLayXS7q.js";
-import { d as detectDefaultBranch, l as prompts, r as installReactDoctorWorkflow, u as isCommandAvailable } from "./install-github-workflow-Goz-KFqb.js";
-import { a as isValidBlockingLevel, c as openWorkflowPullRequest, l as stageWorkflowFile, o as pickBlockingLevel, u as toForwardSlashes } from "./resolve-scope-DP6rYlNO.js";
-import { h as detectAvailableAgents, t as reportWorkflowResult } from "./report-workflow-result-6n_wSqzA.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="40d3b0cf-26ca-5238-9651-4a1de64ef1f0")}catch(e){}}();
+import { $ as Linter, A as SCAN_RESULT_CACHE_FILENAME, An as gen, At as discoverSupportedSubprojects, B as isNonInteractiveEnvironment, Bn as sync, Cn as error, Ct as collectSourceFileCountsByDirectory, Dn as Diagnostic, Dt as createNodeReadFileLinesSync, En as warn, Et as countOptInProjectRuleSelections, Fn as provide, G as isCiEnvironment, Gt as hashFileContents, Ht as groupBy, In as provideContext, J as Config, Jt as isPathInsideDirectory, K as isCiOrCodingAgentEnvironment, Kn as succeed, Kt as highlighter, Ln as provideService, Mn as map, Mt as filterPathsOutsideDirectories, Nn as orElseSucceed, Nt as filterSourceFiles, On as decodeUnknownSync, Ot as createOxlintSpawnSlots, Pn as promise, Q as LintPartialFailures, Qt as isScanComplete, Rn as runPromise, S as BASELINE_FILES_TEMP_DIR_PREFIX, Sn as Console, T as METRIC, Tn as log, Tt as computeDiagnosticDelta, U as ACTION_INPUT_ENVIRONMENT_VARIABLES, Ut as hasPublishedFixRecipe, Vn as try_, W as detectRunnerOs, Wn as mergeAll, X as Git, Xt as isReactDoctorError, Y as Files, Zn as ParentSpan, _ as VERSION, _n as shouldUseMaintainabilityLayer, _t as buildRuleSeverityControls, an as materializeSourceTree, ar as DIAGNOSTIC_CATEGORY_BUCKETS, at as Progress, bt as canonicalizeUserRuleKey, cn as resolveGithubActionsScoreMetadata, ct as Score, d as isJsonModeActive, dn as resolveScanConcurrency, dr as JSX_DUPLICATION_SOURCE_FILE_PATTERN, dt as SupplyChain, en as listSourceFiles, et as Maintainability, fn as resolveScanTarget, fr as JSX_FILE_PATTERN, gt as buildRuleDocsUrl, hr as SHARE_BASE_URL, in as mapWithConcurrency, it as PerFileLintCacheEnabled, jt as filterDiagnosticsForSurface, l as getRunId, ln as resolveLintBatchOrdering, lr as GIT_SHOW_MAX_BUFFER_BYTES, lt as SidecarLintCacheEnabled, mn as runInspect, mr as OXLINT_NODE_REQUIREMENT, mt as atomicWriteJson, n as recordDistribution, nn as listWorkspacePackages, nt as OxlintConcurrency, on as mergeReactDoctorConfigs, ot as Project, pn as restoreLegacyThrow, pr as MILLISECONDS_PER_SECOND, qt as isMonorepoRoot, r as toSpanAttributes, rt as OxlintSpawnSlots, sn as remainingDeadlineBudgetMs, sr as ENTERPRISE_CONTACT_URL, st as Reporter, t as recordCount, tn as listSourceFilesCooperative, tr as CI_URL, tt as NodeResolver, un as resolveReactDoctorCacheDir, ur as HTML_FILE_PATTERN, v as makeNoopConsole, vn as summarizeDiagnostics, vt as buildSkippedChecks, wt as computeConfigFingerprint, xn as yieldToEventLoop, xr as isFile, xt as classifyFileContext, yr as isDirectory, yt as calculateScore, z as CliInputError, zn as runSync, zt as getDiagnosticRuleIdentity } from "./record-metric-Cckscwg_.js";
+import { t as getTelemetryContext } from "./telemetry-runtime-DKJyjz9o.js";
+import { n as buildFooterLinkLines, t as buildSectionDivider } from "./build-section-divider-DELfSn3p.js";
+import { t as activeScanAbortRegistry } from "./active-scan-abort-registry-DwG6tSPy.js";
+import { t as toForwardSlashes } from "./path-format-DnHpmJwG.js";
+import { C as isRecord, M as cliLogger, S as getPackageJsonPath, a as installReactDoctorScriptStep, c as spinner, k as runGit, n as findNearestPackageDirectory, o as isSpinnerSilent, s as setSpinnerSilent } from "./install-doctor-script-4EWviJL8.js";
+import { d as detectDefaultBranch, l as prompts, r as installReactDoctorWorkflow, u as isCommandAvailable } from "./install-github-workflow-BPznUbbo.js";
+import { a as isValidBlockingLevel, c as openWorkflowPullRequest, l as stageWorkflowFile, o as pickBlockingLevel } from "./resolve-scope-Bb6fljxd.js";
+import { n as resetSentryRunState, r as withRunSpan, t as recordSentryProjectContext } from "./with-run-span-DxFGyW7k.js";
+import { h as detectAvailableAgents, t as reportWorkflowResult } from "./report-workflow-result-IdGRoBFN.js";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import * as path$1 from "node:path";
 import path from "node:path";
-import * as fs$1 from "node:fs";
+import * as fs$2 from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
-import crypto, { randomUUID } from "node:crypto";
 import ts from "typescript";
+import crypto, { randomUUID } from "node:crypto";
 import { tmpdir } from "node:os";
+import * as fs$1 from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 //#region src/cli/utils/apply-observability.ts
 /**
@@ -83,7 +87,10 @@ const buildSpinnerProgressHandle = (text) => {
 */
 const buildRuntimeLayers = (input) => {
 	const linterLayer = input.shouldSkipLint ? Linter.layerOf([]) : Linter.layerOxlint;
-	const deadCodeLayer = input.shouldRunDeadCode ? DeadCode.layerNode : DeadCode.layerOf([]);
+	const maintainabilityLayer = shouldUseMaintainabilityLayer({
+		shouldRunDuplicateJsx: input.shouldRunDeadCode,
+		userConfig: input.userConfig
+	}) ? Maintainability.layerNode : Maintainability.layerOf([]);
 	const scoreLayer = input.shouldComputeScore ? Score.layerHttp : Score.layerOf(null);
 	const supplyChainLayer = input.shouldRunSupplyChain ? SupplyChain.layerNode : SupplyChain.layerOf([]);
 	const projectLayer = input.projectInfoOverride === void 0 ? Project.layerNode : Project.layerOf(input.projectInfoOverride);
@@ -93,112 +100,11 @@ const buildRuntimeLayers = (input) => {
 		config: input.userConfig,
 		resolvedDirectory: input.directory,
 		configSourceDirectory: input.configSourceDirectory
-	}) : Config.layerNode, Files.layerNode, Git.layerNode, linterLayer, LintPartialFailures.layerLive, deadCodeLayer, progressLayer, reporterLayer, scoreLayer, supplyChainLayer);
+	}) : Config.layerNode, Files.layerNode, Git.layerNode, linterLayer, LintPartialFailures.layerLive, maintainabilityLayer, progressLayer, reporterLayer, scoreLayer, supplyChainLayer);
 	const layersWithConcurrency = input.oxlintConcurrency === void 0 ? baseLayers : mergeAll(baseLayers, succeed(OxlintConcurrency, input.oxlintConcurrency));
 	return input.oxlintSpawnSlots === void 0 ? layersWithConcurrency : mergeAll(layersWithConcurrency, succeed(OxlintSpawnSlots, input.oxlintSpawnSlots));
 };
 //#endregion
-//#region src/cli/utils/with-run-span.ts
-/**
-* Ends the run span without letting a telemetry failure change the run's
-* outcome — the invariant every other emit site here already holds.
-*
-* The failure path is the reason this matters most: a throw from `end` there
-* would replace the user's original scan error, so a project-config mistake
-* could surface as an exporter stack trace, be reclassified as a crash, and get
-* reported as one.
-*/
-const endSpanSafely = (span, exit) => {
-	try {
-		span.end(BigInt(Date.now()) * NANOSECONDS_PER_MILLISECOND, exit);
-	} catch {}
-};
-/**
-* Clears the module-level run-scoped telemetry state — the current scanned
-* project and the active run trace. `inspect()` calls this at the start of every
-* run and again after a clean one, so a prior or just-finished scan can't attach
-* its project tags / trace to a later run or to a non-scan error (e.g.
-* inspectAction's post-loop finalize/handoff steps). A thrown scan error skips
-* the post-run reset, leaving the state for the command catch to attribute and
-* link the crash. Concurrent batch members (`concurrentScan`) never touch this
-* state — they neither write nor reset it. Safe to call when telemetry is off
-* (the refs are read only when an event is built).
-*/
-const resetSentryRunState = () => {
-	setSentryProjectInfo(null);
-	setActiveRunTrace(null);
-};
-/**
-* Runs an inspect invocation inside a root span so each `react-doctor` run is a
-* first-class trace with timing and the run snapshot as attributes. The span is
-* handed to `run` so the scan's Effect spans parent under it and so the wide
-* event can be stamped onto it once the outcome is known.
-*
-* A no-op pass-through when telemetry is off (`--no-telemetry`, tests, or an
-* unconfigured build) — `run` receives `undefined` and no span is created, so
-* there's no added exit latency.
-*
-* The span is created against the shared telemetry context rather than a
-* freshly-provided layer, so it lives in the same tracer as the scan program's
-* spans; see `telemetry-runtime.ts` for why that matters. It is started and
-* ended manually because the body it wraps is a promise-returning imperative
-* function, not an Effect — the same shape the Sentry inactive span had.
-*
-* While the span runs, its trace context is recorded as the active run trace so
-* `reportErrorToSentry` can attach a crash thrown during the scan back to this
-* trace (errors surface in the command catch, after the span has ended).
-*
-* A `concurrentScan` (one member of the CLI's multi-project pool) still gets its
-* own root span, but skips recording the active run trace — the module-level
-* handle has single-scan semantics, and overlapping writers would link a crash
-* to an arbitrary sibling's trace.
-*/
-const withRunSpan = async (run, options = {}) => {
-	const telemetryContext = getTelemetryContext();
-	if (telemetryContext === null) return run(void 0);
-	const { tags } = buildSentryScope();
-	const command = typeof tags.command === "string" ? tags.command : "inspect";
-	let rootSpan;
-	try {
-		rootSpan = runSync(makeSpan(`react-doctor ${command}`, { attributes: toSpanAttributes(tags) }).pipe(provideContext(telemetryContext)));
-	} catch {
-		return run(void 0);
-	}
-	recordRunTraceId(rootSpan.traceId);
-	if (options.concurrentScan !== true) setActiveRunTrace({
-		traceId: rootSpan.traceId,
-		spanId: rootSpan.spanId,
-		sampled: rootSpan.sampled
-	});
-	try {
-		const result = await run(rootSpan);
-		endSpanSafely(rootSpan, void_);
-		return result;
-	} catch (error) {
-		endSpanSafely(rootSpan, fail(error));
-		throw error;
-	}
-};
-/**
-* Records the scanned project (discovered in the `beforeLint` hook): remembers
-* it for the lazy Sentry error-capture path (`buildSentryScope` folds it into
-* exception events) and for per-emit metric attributes, and sets it on the run's
-* root span so the trace carries the project shape too. Always cheap — the span
-* attributes are skipped when `rootSpan` is absent (telemetry off), and storing
-* the info is a plain assignment.
-*
-* A `concurrentScan` only sets the span attributes: the module-level project ref
-* has single-scan semantics, and overlapping writers would stamp events and
-* metrics with an arbitrary sibling's project. Wide events keep full attribution
-* (they ride the span); per-emit metrics simply omit the project shape during a
-* concurrent batch (absent, never wrong).
-*/
-const recordSentryProjectContext = (projectInfo, rootSpan, options = {}) => {
-	if (options.concurrentScan !== true) setSentryProjectInfo(projectInfo);
-	if (rootSpan === void 0) return;
-	for (const [key, value] of Object.entries(toSpanAttributes(buildSentryProjectContext(projectInfo).tags))) rootSpan.attribute(key, value);
-};
-//#endregion
 //#region src/cli/utils/diagnostic-grouping.ts
 const buildRulePriorityMap = (scores) => {
 	const rulePriority = /* @__PURE__ */ new Map();
@@ -309,7 +215,7 @@ const recordScanMetrics = (input) => {
 	recordCount(METRIC.scanCompleted, 1, {
 		mode: input.mode,
 		lint: input.lint,
-		deadCode: input.deadCode,
+		maintainability: input.deadCode,
 		parallel: input.parallel,
 		scoreOnly: input.scoreOnly,
 		didLintFail: input.didLintFail,
@@ -349,7 +255,7 @@ const recordScanMetrics = (input) => {
 	else if (!input.noScore && !input.didLintFail && !input.didDeadCodeFail) recordCount(METRIC.scoreUnavailable, 1, { mode: input.mode });
 	if (input.baselineDegraded) recordCount(METRIC.baselineDegraded, 1);
 	if (input.didLintFail) recordCount(METRIC.lintFailed, 1, { reasonKind: input.lintFailureReasonKind });
-	if (input.didDeadCodeFail) recordCount(METRIC.deadCodeFailed, 1);
+	if (input.didDeadCodeFail) recordCount(METRIC.maintainabilityFailed, 1);
 	for (const check of result.skippedChecks) recordCount(METRIC.scanCheckSkipped, 1, {
 		check,
 		reason: result.skippedCheckReasons?.[check] ?? null
@@ -493,10 +399,16 @@ const CACHE_DISABLED_VALUES = new Set(["1", "true"]);
 const TOOLCHAIN_PACKAGE_SPECIFIERS = [
 	"oxlint/package.json",
 	"oxlint-plugin-react-doctor/package.json",
-	"deslop-js/package.json",
 	"eslint-plugin-react-hooks/package.json"
 ];
 const bundledRequire = createRequire(import.meta.url);
+const RULE_PLUGIN_CONTENT_FINGERPRINT = (() => {
+	try {
+		return `oxlint-plugin-react-doctor#fingerprint=${hashFileContents(bundledRequire.resolve("oxlint-plugin-react-doctor")) ?? "unreadable"}`;
+	} catch {
+		return "oxlint-plugin-react-doctor#fingerprint=unresolved";
+	}
+})();
 const normalizeForStableJson = (value) => {
 	if (value === null) return null;
 	if (value === void 0) return void 0;
@@ -632,12 +544,12 @@ const resolveCacheFilePath = (projectDirectory) => path.join(resolveReactDoctorC
 const readPersistedCache = (cacheFilePath) => {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord(parsed) || parsed.version !== 6) return {
-			version: 6,
+		if (!isRecord(parsed) || parsed.version !== 7) return {
+			version: 7,
 			entries: []
 		};
 		if (!Array.isArray(parsed.entries)) return {
-			version: 6,
+			version: 7,
 			entries: []
 		};
 		const entries = [];
@@ -652,12 +564,12 @@ const readPersistedCache = (cacheFilePath) => {
 			});
 		}
 		return {
-			version: 6,
+			version: 7,
 			entries
 		};
 	} catch {
 		return {
-			version: 6,
+			version: 7,
 			entries: []
 		};
 	}
@@ -665,7 +577,7 @@ const readPersistedCache = (cacheFilePath) => {
 /**
 * The global cache off-switch (`REACT_DOCTOR_NO_CACHE`), which disables every
 * cache subsystem: this whole-repo scan cache plus core's per-file lint,
-* sidecar, and dead-code caches (their `Context.Reference` defaults read the
+* sidecar caches (their `Context.Reference` defaults read the
 * same variable). Exported for the wide event's `cache.temperature`
 * derivation, which reports `"disabled"` instead of `"cold"` when the switch
 * is on. Granular knobs (`REACT_DOCTOR_NO_FILE_CACHE`, …) are deliberately
@@ -688,7 +600,7 @@ const fileFingerprint = (filePath) => {
 		return null;
 	}
 };
-const resolveToolchainFingerprint = (nodeBinaryPath) => {
+const resolveScanResultToolchainFingerprint = (nodeBinaryPath) => {
 	const fingerprints = [];
 	if (nodeBinaryPath !== null) fingerprints.push(nodeBinaryPath === process.execPath ? `node=${process.version}` : `node=${fileFingerprint(nodeBinaryPath) ?? "unreadable"}`);
 	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS) try {
@@ -698,6 +610,7 @@ const resolveToolchainFingerprint = (nodeBinaryPath) => {
 	} catch {
 		fingerprints.push(`${specifier}=missing`);
 	}
+	fingerprints.push(RULE_PLUGIN_CONTENT_FINGERPRINT);
 	return fingerprints;
 };
 const buildScanResultCacheKey = (input) => {
@@ -707,14 +620,14 @@ const buildScanResultCacheKey = (input) => {
 	if (repositoryIdentity === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 6,
+		schemaVersion: 7,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha: repositoryIdentity.headSha,
 		worktreeFingerprint: repositoryIdentity.worktreeFingerprint,
 		dotenvFingerprint: resolveDotenvFingerprint(input.projectDirectory),
 		reactDoctorVersion: input.version,
 		nodeVersion: process.version,
-		toolchainFingerprint: resolveToolchainFingerprint(input.nodeBinaryPath),
+		toolchainFingerprint: resolveScanResultToolchainFingerprint(input.nodeBinaryPath),
 		configFingerprint: computeConfigFingerprint(input.projectDirectory, input.version),
 		hasConfigOverride: input.hasConfigOverride,
 		configSourceDirectory: input.configSourceDirectory,
@@ -755,7 +668,7 @@ const createScanResultCache = (projectDirectory) => {
 		for (const entry of readPersistedCache(cacheFilePath).entries) mergedEntries.set(entry.key, entry);
 		for (const entry of entries.values()) mergedEntries.set(entry.key, entry);
 		atomicWriteJson(cacheFilePath, {
-			version: 6,
+			version: 7,
 			entries: [...mergedEntries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
 	};
@@ -790,8 +703,7 @@ const shouldBlockCi = (diagnostics, blockingLevel) => {
 /**
 * Lowercase, key-safe form of a rule category for the `diag.category.*`
 * telemetry attribute namespace (categories carry spaces / capitals, e.g.
-* "Performance" → `performance`, "Dead Code" → `dead_code`). Shared by the
-* CLI run event and the editor LSP wide event so both namespace identically.
+* "Performance" → `performance`, "Dead Code" → `dead_code`).
 */
 const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g, "_");
 //#endregion
@@ -821,12 +733,6 @@ const readEnvBoolean = (name) => {
 	return value.toLowerCase() === "true" || value === "1";
 };
 const ratioOf = (numerator, denominator) => denominator != null && denominator > 0 ? (numerator ?? 0) / denominator : null;
-const resolveDeadCodeReuseRatio = (result) => {
-	if (result.deadCodeCacheHit === true) return 1;
-	const summaryTotal = (result.deadCodeSummaryCacheHits ?? 0) + (result.deadCodeSummaryCacheMisses ?? 0);
-	if (summaryTotal > 0) return (result.deadCodeSummaryCacheHits ?? 0) / summaryTotal;
-	return result.deadCodeCacheHit === false ? 0 : null;
-};
 /**
 * One queryable cache temperature per scan, derived from the whole stack:
 *
@@ -834,8 +740,7 @@ const resolveDeadCodeReuseRatio = (result) => {
 *                    `wholeRepoCacheHit` flag from the CLI's cachedPayload
 *                    branch; no scan work ran).
 *   - `"warm"`     — any incremental reuse: per-file lint hits, sidecar
-*                    replays, a dead-code whole-result hit, or dead-code
-*                    summary-cache hits.
+*                    replays.
 *   - `"disabled"` — zero reuse because the global `REACT_DOCTOR_NO_CACHE`
 *                    off-switch is on. Granular per-cache opt-outs
 *                    (`REACT_DOCTOR_NO_FILE_CACHE`, …) still read warm/cold,
@@ -844,7 +749,7 @@ const resolveDeadCodeReuseRatio = (result) => {
 *
 * `cache.warmth` is the headline reuse magnitude in [0, 1]: the plain mean of
 * the subsystem reuse fractions known this run (lint hit ratio, sidecar
-* replay ratio, dead-code reuse), skipping subsystems that never consulted a
+* replay ratio), skipping subsystems that never consulted a
 * cache; `1` on turbo, dropped when nothing consulted any cache. Deliberately
 * unweighted — the per-subsystem dims stay the precise signal; warmth is the
 * p50/p90-able summary. Emitted only on the success path.
@@ -857,11 +762,7 @@ const buildCacheAttributes = (input) => {
 		warmth: 1
 	});
 	const result = input.result;
-	const subsystemReuseRatios = [
-		ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount),
-		ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount),
-		resolveDeadCodeReuseRatio(result)
-	];
+	const subsystemReuseRatios = [ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount), ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)];
 	let knownSubsystemCount = 0;
 	let reuseRatioSum = 0;
 	for (const reuseRatio of subsystemReuseRatios) {
@@ -1013,13 +914,7 @@ const buildOutcomeAttributes = (input) => {
 			sidecarTotalFiles: result.lintSidecarTotalFileCount,
 			sidecarReplayRatio: ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)
 		}),
-		...withNamespace("deadCode", {
-			failed: input.didDeadCodeFail,
-			overlapped: input.deadCodeOverlapped,
-			cacheHit: result.deadCodeCacheHit,
-			summaryCacheHits: result.deadCodeSummaryCacheHits,
-			summaryCacheMisses: result.deadCodeSummaryCacheMisses
-		}),
+		...withNamespace("maintainability", { failed: input.didDeadCodeFail }),
 		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut }),
 		...withNamespace("securityScan", { failed: input.securityScanFailed }),
 		...withNamespace("timing", {
@@ -1062,7 +957,7 @@ const buildScanAttributes = (input) => {
 		workerCount: input.workerCount,
 		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
-		deadCode: input.deadCode,
+		maintainability: input.deadCode,
 		supplyChain: input.supplyChain,
 		scoreOnly: input.scoreOnly,
 		noScore: input.noScore,
@@ -1073,6 +968,7 @@ const buildScanAttributes = (input) => {
 		hasCustomConfig: input.hasCustomConfig,
 		rulesConfigured: ruleKeys.length,
 		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
+		projectAnalysisRuleCount: countOptInProjectRuleSelections(buildRuleSeverityControls(input.userConfig)),
 		fileCount: input.result?.scannedFileCount,
 		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length,
 		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length,
@@ -1083,7 +979,7 @@ const buildScanAttributes = (input) => {
 * Projects a scan into the namespaced attribute set for its root span — the
 * canonical per-scan "wide event". Every attribute carries a dotted namespace
 * that groups it by concept (`scan.*` config, `action.*` CI knobs, `outcome.*`
-* verdict, `diag.*` findings, `score.*`, `lint.*`, `deadCode.*`, `cache.*`,
+* verdict, `diag.*` findings, `score.*`, `lint.*`, `maintainability.*`, `cache.*`,
 * `supplyChain.*`, `timing.*`, `migration.*`, `baseline.*`) so the attributes
 * tree up in Sentry's attribute browser and stay filter-/group-/aggregate-able
 * in the Spans dataset. Pure and exported so the projection (outcome
@@ -1322,7 +1218,7 @@ const buildNoScoreMessage = (input) => {
 			reason = input.disabledMessage ?? "Score disabled by --no-score.";
 			break;
 		case "analysis-incomplete":
-			reason = "Score not shown because lint or dead-code analysis could not complete.";
+			reason = "Score not shown because lint or maintainability analysis could not complete.";
 			break;
 		case "api-unavailable":
 			reason = "Score unavailable (could not reach the score API).";
@@ -1370,7 +1266,7 @@ const formatRuleSummary = (ruleKey, ruleDiagnostics) => {
 const ruleDumpFileName = (ruleKey) => ruleKey.replace(/\//g, "--") + ".txt";
 const readPreviousRuleDumpFileNames = (directory) => {
 	try {
-		const previous = JSON.parse(fs$1.readFileSync(path$1.join(directory, "diagnostics.json"), "utf8"));
+		const previous = JSON.parse(fs$2.readFileSync(path$1.join(directory, "diagnostics.json"), "utf8"));
 		return new Set(previous.filter((d) => typeof d?.plugin === "string" && typeof d?.rule === "string").map((d) => ruleDumpFileName(`${d.plugin}/${d.rule}`)));
 	} catch {
 		return /* @__PURE__ */ new Set();
@@ -1378,10 +1274,10 @@ const readPreviousRuleDumpFileNames = (directory) => {
 };
 const writeDiagnosticsDirectory = (diagnostics, outputDirectory) => {
 	const directory = outputDirectory ? path$1.resolve(outputDirectory) : path$1.join(tmpdir(), `react-doctor-${randomUUID()}`);
-	if (outputDirectory) for (const fileName of readPreviousRuleDumpFileNames(directory)) fs$1.rmSync(path$1.join(directory, fileName), { force: true });
-	fs$1.mkdirSync(directory, { recursive: true });
-	for (const [ruleKey, ruleDiagnostics] of buildSortedRuleGroups(diagnostics)) fs$1.writeFileSync(path$1.join(directory, ruleDumpFileName(ruleKey)), formatRuleSummary(ruleKey, ruleDiagnostics));
-	fs$1.writeFileSync(path$1.join(directory, "diagnostics.json"), JSON.stringify(diagnostics));
+	if (outputDirectory) for (const fileName of readPreviousRuleDumpFileNames(directory)) fs$2.rmSync(path$1.join(directory, fileName), { force: true });
+	fs$2.mkdirSync(directory, { recursive: true });
+	for (const [ruleKey, ruleDiagnostics] of buildSortedRuleGroups(diagnostics)) fs$2.writeFileSync(path$1.join(directory, ruleDumpFileName(ruleKey)), formatRuleSummary(ruleKey, ruleDiagnostics));
+	fs$2.writeFileSync(path$1.join(directory, "diagnostics.json"), JSON.stringify(diagnostics));
 	return directory;
 };
 //#endregion
@@ -1425,6 +1321,9 @@ const formatElapsedTime = (elapsedMilliseconds) => {
 	return `${(elapsedMilliseconds / MILLISECONDS_PER_SECOND).toFixed(1)}s`;
 };
 //#endregion
+//#region src/cli/utils/format-skipped-check-label.ts
+const formatSkippedCheckLabel = (skippedCheck) => skippedCheck === "dead-code" ? "maintainability" : skippedCheck;
+//#endregion
 //#region src/cli/utils/pluralize.ts
 const pluralize = (count, singularNoun) => `${count} ${singularNoun}${count === 1 ? "" : "s"}`;
 //#endregion
@@ -1473,7 +1372,7 @@ const printHeadlessReport = (input) => gen(function* () {
 	}
 	if (input.skippedChecks.length > 0) {
 		yield* log("");
-		yield* warn(highlighter.warn(`Results are incomplete: ${input.skippedChecks.join(" and ")} checks failed.`));
+		yield* warn(highlighter.warn(`Results are incomplete: ${input.skippedChecks.map(formatSkippedCheckLabel).join(" and ")} checks failed.`));
 	}
 });
 //#endregion
@@ -1673,12 +1572,39 @@ const renderAndRecordScan = async (input) => {
 		didDeadCodeFail: input.payload.didDeadCodeFail,
 		supplyChainOverlapTimedOut: input.payload.supplyChainOverlapTimedOut,
 		securityScanFailed: input.payload.securityScanFailed,
-		deadCodeOverlapped: input.payload.deadCodeOverlapped,
 		suppressedRuleCounts: input.payload.suppressedRuleCounts ?? []
 	});
 	return result;
 };
 //#endregion
+//#region src/cli/utils/copy-unchanged-baseline-sources.ts
+const copyUnchangedBaselineSources = async (input) => {
+	const baseMaterializedFiles = new Set(input.baseMaterializedFiles.map(toForwardSlashes));
+	const headChangedFiles = new Set(input.headChangedFiles.map(toForwardSlashes));
+	const untrackedFiles = new Set(input.untrackedFiles.map(toForwardSlashes));
+	const sourceDirectory = path$1.resolve(input.directory);
+	const targetDirectory = path$1.resolve(input.tempDirectory);
+	return (await mapWithConcurrency(input.sourceFiles.filter((filePath) => {
+		const normalizedPath = toForwardSlashes(filePath);
+		return !baseMaterializedFiles.has(normalizedPath) && !headChangedFiles.has(normalizedPath) && !untrackedFiles.has(normalizedPath);
+	}), 32, async (filePath) => {
+		input.signal?.throwIfAborted();
+		if (input.deadlineEpochMs !== null && Date.now() >= input.deadlineEpochMs) return false;
+		const sourcePath = path$1.resolve(sourceDirectory, filePath);
+		const targetPath = path$1.resolve(targetDirectory, filePath);
+		if (!isPathInsideDirectory(sourcePath, sourceDirectory) || !isPathInsideDirectory(targetPath, targetDirectory)) return false;
+		try {
+			if (!(await fs$1.lstat(sourcePath)).isFile()) return false;
+			await fs$1.mkdir(path$1.dirname(targetPath), { recursive: true });
+			await fs$1.copyFile(sourcePath, targetPath);
+			return true;
+		} catch {
+			input.signal?.throwIfAborted();
+			return false;
+		}
+	})).every(Boolean);
+};
+//#endregion
 //#region src/cli/utils/read-diagnostic-evidence.ts
 const SOURCE_EXTENSIONS = [
 	".ts",
@@ -2096,7 +2022,6 @@ const resolveMergeBaseRef = async (directory, ref) => {
 const silentConsole$1 = makeNoopConsole();
 const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(lintPartialFailures) + countDeadlineSkippedFiles(lintPartialFailures);
 const runBaselineComparison = async (input) => {
-	const temporaryDirectory = mkdtempSync(path.join(tmpdir(), BASELINE_FILES_TEMP_DIR_PREFIX));
 	const baselineIncludePaths = filterPathsOutsideDirectories({
 		rootDirectory: input.directory,
 		relativePaths: input.options.includePaths,
@@ -2112,12 +2037,24 @@ const runBaselineComparison = async (input) => {
 		relativePaths: input.headFiles,
 		excludedDirectories: input.options.excludedProjectDirectories
 	}) : void 0;
+	const remainingBaselineBudgetMs = input.deadlineEpochMs === null ? null : remainingDeadlineBudgetMs(input.deadlineEpochMs);
+	if (remainingBaselineBudgetMs === 0) return null;
+	const baselineDeadlineSignal = remainingBaselineBudgetMs === null ? void 0 : AbortSignal.timeout(remainingBaselineBudgetMs);
+	const baselineListingSignal = baselineDeadlineSignal === void 0 ? input.oxlintRuntime.abortSignal : input.oxlintRuntime.abortSignal === void 0 ? baselineDeadlineSignal : AbortSignal.any([input.oxlintRuntime.abortSignal, baselineDeadlineSignal]);
+	let maintainabilitySourceFiles = [];
+	if (input.options.deadCode) try {
+		maintainabilitySourceFiles = (await listSourceFilesCooperative(input.directory, baselineListingSignal)).filter((filePath) => JSX_DUPLICATION_SOURCE_FILE_PATTERN.test(filePath) && classifyFileContext(filePath) === "production");
+	} catch (error) {
+		if (baselineDeadlineSignal?.aborted) return null;
+		throw error;
+	}
+	const temporaryDirectory = mkdtempSync(path.join(tmpdir(), BASELINE_FILES_TEMP_DIR_PREFIX));
 	const snapshot = await materializeBaselineFiles({
 		directory: input.directory,
 		ref: input.baselineRef,
-		files: baselineIncludePaths,
-		baseFiles: baselineBaseFiles,
-		headFiles: baselineHeadFiles,
+		files: input.options.deadCode ? input.options.includePaths : baselineIncludePaths,
+		baseFiles: input.options.deadCode ? input.baseFiles : baselineBaseFiles,
+		headFiles: input.options.deadCode ? input.headFiles : baselineHeadFiles,
 		tempDirectory: temporaryDirectory
 	}).catch((error) => {
 		rmSync(temporaryDirectory, {
@@ -2135,22 +2072,47 @@ const runBaselineComparison = async (input) => {
 	}
 	try {
 		if (!snapshot.isComplete) return null;
+		if (input.options.deadCode && !await copyUnchangedBaselineSources({
+			directory: input.directory,
+			sourceFiles: maintainabilitySourceFiles,
+			baseMaterializedFiles: snapshot.materializedFiles,
+			headChangedFiles: snapshot.headFiles,
+			untrackedFiles: snapshot.untrackedFiles,
+			tempDirectory: snapshot.tempDirectory,
+			deadlineEpochMs: input.deadlineEpochMs,
+			signal: input.oxlintRuntime.abortSignal
+		})) return null;
+		const filteredSnapshotBaseFiles = filterPathsOutsideDirectories({
+			rootDirectory: input.directory,
+			relativePaths: snapshot.baseFiles,
+			excludedDirectories: input.options.excludedProjectDirectories
+		});
+		const filteredSnapshotHeadFiles = filterPathsOutsideDirectories({
+			rootDirectory: input.directory,
+			relativePaths: snapshot.headFiles,
+			excludedDirectories: input.options.excludedProjectDirectories
+		});
 		const analyzedHeadFiles = new Set(input.headAnalyzedFiles.map(toForwardSlashes));
-		const baseFiles = new Set(snapshot.baseFiles.map(toForwardSlashes));
-		const expectedHeadFiles = new Set(snapshot.headFiles.map(toForwardSlashes));
+		const baseFiles = new Set((baselineBaseFiles ?? filteredSnapshotBaseFiles).map(toForwardSlashes));
+		const expectedHeadFiles = new Set((baselineHeadFiles ?? filteredSnapshotHeadFiles).map(toForwardSlashes));
 		for (const filePath of baselineIncludePaths) {
 			const normalizedFilePath = toForwardSlashes(filePath);
 			if (!baseFiles.has(normalizedFilePath)) expectedHeadFiles.add(normalizedFilePath);
 		}
-		if (filterSourceFiles([...expectedHeadFiles]).some((filePath) => !analyzedHeadFiles.has(filePath))) return null;
+		if (input.options.lint && filterSourceFiles([...expectedHeadFiles]).some((filePath) => !analyzedHeadFiles.has(filePath))) return null;
+		const baselineLintPaths = new Set([...baselineIncludePaths, ...filteredSnapshotBaseFiles].map(toForwardSlashes));
+		const materializedLintPaths = snapshot.materializedFiles.filter((filePath) => baselineLintPaths.has(toForwardSlashes(filePath)));
+		const maintainabilityFocusPaths = [...new Set([...input.options.includePaths, ...snapshot.baseFiles].map(toForwardSlashes))];
+		const baselineExcludedProjectDirectories = input.options.excludedProjectDirectories.map((excludedDirectory) => path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, input.directory)).map((excludedDirectory) => path.resolve(snapshot.tempDirectory, path.relative(input.directory, excludedDirectory)));
+		const baseIncludePaths = materializedLintPaths.length > 0 ? materializedLintPaths : maintainabilityFocusPaths;
 		const runtimeLayers = buildRuntimeLayers({
 			directory: snapshot.tempDirectory,
 			hasConfigOverride: true,
 			userConfig: input.userConfig,
 			configSourceDirectory: input.configSourceDirectory,
 			projectInfoOverride: input.headProjectInfo,
-			shouldSkipLint: !input.options.lint || !input.resolvedNodeBinaryPath,
-			shouldRunDeadCode: false,
+			shouldSkipLint: !input.options.lint || !input.resolvedNodeBinaryPath || materializedLintPaths.length === 0,
+			shouldRunDeadCode: input.options.deadCode,
 			shouldRunSupplyChain: input.options.supplyChain,
 			shouldComputeScore: false,
 			shouldShowProgressSpinners: false,
@@ -2159,7 +2121,8 @@ const runBaselineComparison = async (input) => {
 		});
 		const baseOutput = await runPromise(restoreLegacyThrow(runInspect({
 			directory: snapshot.tempDirectory,
-			includePaths: snapshot.materializedFiles,
+			includePaths: baseIncludePaths,
+			maintainabilityFocusPaths,
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
 			warnings: input.options.warnings,
@@ -2168,7 +2131,7 @@ const runBaselineComparison = async (input) => {
 			includedTags: input.options.includedTags,
 			includeTagDefaults: input.options.includeTagDefaults,
 			nodeBinaryPath: input.resolvedNodeBinaryPath ?? void 0,
-			runDeadCode: false,
+			runDeadCode: input.options.deadCode,
 			isCi: input.options.isCi,
 			doctorVersion: VERSION,
 			runId: getRunId(),
@@ -2176,10 +2139,16 @@ const runBaselineComparison = async (input) => {
 			suppressScanSummary: true,
 			supplyChainManifestChanged: input.options.supplyChainManifestChanged,
 			deadlineEpochMs: input.deadlineEpochMs ?? void 0,
-			signal: input.oxlintRuntime.abortSignal
+			signal: input.oxlintRuntime.abortSignal,
+			excludedProjectDirectories: baselineExcludedProjectDirectories,
+			retainExcludedProjectDeadCodeDiagnostics: input.options.retainExcludedProjectDeadCodeDiagnostics
 		}, {}).pipe(provide(runtimeLayers), provideService(PerFileLintCacheEnabled, false), provideService(SidecarLintCacheEnabled, false), provideService(Console, silentConsole$1))), { signal: input.oxlintRuntime.abortSignal });
-		if (baseOutput.didLintFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
-		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(snapshot.untrackedFiles.map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
+		if (baseOutput.didLintFail || baseOutput.didDeadCodeFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
+		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(filterPathsOutsideDirectories({
+			rootDirectory: input.directory,
+			relativePaths: snapshot.untrackedFiles,
+			excludedDirectories: input.options.excludedProjectDirectories
+		}).map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
 		const diagnosticDelta = computeDiagnosticDelta({
 			headDiagnostics: input.headDiagnostics,
 			baseDiagnostics: baseOutput.diagnostics,
@@ -2352,6 +2321,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		directory,
 		precomputedSourceFileCount: options.precomputedSourceFileCount,
 		includePaths: options.includePaths,
+		changedLineRanges: options.changedLineRanges ?? void 0,
 		customRulesOnly: options.customRulesOnly,
 		respectInlineDisables: options.respectInlineDisables,
 		warnings: options.warnings,
@@ -2382,7 +2352,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	else runSync(error(highlighter.error(lintFailureReason)));
 	let inspectDiagnostics = output.diagnostics;
 	let baselineDelta;
-	if (options.baseline && isDiffMode && !didLintFail && countIncompleteLintFiles(output.lintPartialFailures) === 0) {
+	if (options.baseline && isDiffMode && !didLintFail && !output.didDeadCodeFail && countIncompleteLintFiles(output.lintPartialFailures) === 0) {
 		const comparison = await runBaselineComparison({
 			directory,
 			options,
@@ -2535,13 +2505,13 @@ const resolveCursorBundledNode = () => {
 	if (!localAppData) return null;
 	const cursorAgentRoot = path$1.join(localAppData, "cursor-agent", "versions");
 	try {
-		const versions = fs$1.readdirSync(cursorAgentRoot);
+		const versions = fs$2.readdirSync(cursorAgentRoot);
 		if (versions.length === 0) return null;
 		const sortedVersions = versions.sort((a, b) => b.localeCompare(a, void 0, { numeric: true }));
 		for (const version of sortedVersions) try {
 			const bundledNodePath = path$1.join(cursorAgentRoot, version, "node.exe");
 			const entryScriptPath = path$1.join(cursorAgentRoot, version, "index.js");
-			if (fs$1.statSync(bundledNodePath).isFile() && fs$1.statSync(entryScriptPath).isFile()) return {
+			if (fs$2.statSync(bundledNodePath).isFile() && fs$2.statSync(entryScriptPath).isFile()) return {
 				command: bundledNodePath,
 				args: [entryScriptPath]
 			};
@@ -2555,15 +2525,15 @@ const resolveWindowsCmdEntryScript = (command) => {
 	for (const directory of pathDirectories) {
 		const cmdFilePath = path$1.join(directory, `${command}.cmd`);
 		try {
-			if (!fs$1.statSync(cmdFilePath).isFile()) continue;
+			if (!fs$2.statSync(cmdFilePath).isFile()) continue;
 		} catch {
 			continue;
 		}
 		try {
-			const entryScriptMatch = fs$1.readFileSync(cmdFilePath, "utf8").match(/"%(?:~dp0|dp0%)\\([^"]+\.(?:m?js|cjs))"/);
+			const entryScriptMatch = fs$2.readFileSync(cmdFilePath, "utf8").match(/"%(?:~dp0|dp0%)\\([^"]+\.(?:m?js|cjs))"/);
 			if (!entryScriptMatch) continue;
 			const resolvedScriptPath = path$1.resolve(directory, entryScriptMatch[1]);
-			if (fs$1.statSync(resolvedScriptPath).isFile()) return resolvedScriptPath;
+			if (fs$2.statSync(resolvedScriptPath).isFile()) return resolvedScriptPath;
 		} catch {}
 	}
 	return null;
@@ -2889,7 +2859,7 @@ const buildCodeFrame = (input) => {
 	const absolutePath = resolveAbsolutePath(input.filePath, input.rootDirectory);
 	let source;
 	try {
-		source = fs$1.readFileSync(absolutePath, "utf8");
+		source = fs$2.readFileSync(absolutePath, "utf8");
 	} catch {
 		return null;
 	}
@@ -2910,7 +2880,7 @@ const buildCodeFrame = (input) => {
 const discoverWorkspacePackages = (rootDirectory) => {
 	const hasRootPackageJson = isFile(path$1.join(rootDirectory, "package.json"));
 	const packages = listWorkspacePackages(rootDirectory);
-	if (packages.length === 0 && (!hasRootPackageJson || isMonorepoRoot(rootDirectory))) return discoverReactSubprojects(rootDirectory);
+	if (packages.length === 0 && (!hasRootPackageJson || isMonorepoRoot(rootDirectory))) return discoverSupportedSubprojects(rootDirectory);
 	return packages;
 };
 const selectProjects = async (rootDirectory, projectFlag, skipPrompts, configProjects) => {
@@ -3002,6 +2972,12 @@ const validateIncludeUntrackedScope = (includeUntracked, scope) => {
 	if (!includeUntracked || scope !== void 0 && scope !== "full") return;
 	throw new CliInputError("--include-untracked requires the files, changed, or lines scope (via --scope, --diff, or config).");
 };
+const validateFilePathSelectionFlags = (flags) => {
+	if (flags.staged || flags.changedFilesFrom !== void 0) throw new CliInputError("Cannot combine file path arguments with --staged or --changed-files-from. Use one file source.");
+	if (usedDiffAlias(flags)) throw new CliInputError("Cannot combine file path arguments with --diff. File path arguments use the files scope.");
+	if (usedScope(flags) && flags.scope !== "files") throw new CliInputError(`Cannot combine file path arguments with --scope ${flags.scope}. File path arguments use --scope files.`);
+	if (flags.base !== void 0) throw new CliInputError("Cannot combine file path arguments with --base. The selected files do not need a Git base.");
+};
 const validateModeFlags = (flags) => {
 	if (usedScope(flags) && usedDiffAlias(flags)) throw new CliInputError("Cannot combine --scope and --diff; --diff is the deprecated alias.");
 	if (flags.staged && usedDiffAlias(flags)) throw new CliInputError("Cannot combine --staged and --diff; pick one mode.");
@@ -3026,7 +3002,7 @@ const shouldFailScanGate = (input) => {
 	return shouldBlockCi(filterScansForSurface(input.scans, "ciFailure"), input.blockingLevel);
 };
 //#endregion
-export { resolveMergeBaseRef as A, buildEmptyReportMessage as B, copyToClipboard as C, deduplicateProjectScans as D, collectProjectSourceFileCounts as E, printDiagnosticsDump as F, formatLearnMoreLine as G, buildRulePriorityMap as H, formatDiagnosticSite as I, hasIncompleteScoreAnalysis as L, pluralize as M, formatElapsedTime as N, createInvocationInspect as O, printFooter as P, filterDiagnosticsByCategories as R, CLI_AGENT_BINARIES as S, buildHandoffPayload as T, buildSortedRuleGroups as U, hasLintHardFailure as V, formatFixRecipeLine as W, resolveCliInspectOptions as _, projectManifestChanged as a, setUpGitHubActions as b, selectProjects as c, resolveProjectChangedLineRanges as d, resolveProjectDiffIncludePaths as f, resolveWorkspaceDeadCodeOwner as g, retryMissingProjectScores as h, validateModeFlags as i, printHeadlessReport as j, inspect as k, buildCodeFrame as l, resolveProjectRelativeDirectory as m, formatSkippedProjectsMessage as n, partitionProjectScanOutcomes as o, resolveProjectSourceFilePaths as p, validateIncludeUntrackedScope as r, discoverWorkspacePackages as s, shouldFailScanGate as t, resolveProjectScan as u, filterScansForSurface as v, launchCliAgent as w, detectLaunchableAgents as x, countUniqueScannedFiles as y, buildNoScoreMessage as z };
+export { inspect as A, filterDiagnosticsByCategories as B, CLI_AGENT_BINARIES as C, collectProjectSourceFileCounts as D, buildHandoffPayload as E, formatElapsedTime as F, buildSortedRuleGroups as G, buildEmptyReportMessage as H, printFooter as I, formatFixRecipeLine as K, printDiagnosticsDump as L, printHeadlessReport as M, pluralize as N, deduplicateProjectScans as O, formatSkippedCheckLabel as P, formatDiagnosticSite as R, detectLaunchableAgents as S, launchCliAgent as T, hasLintHardFailure as U, buildNoScoreMessage as V, buildRulePriorityMap as W, resolveWorkspaceDeadCodeOwner as _, validateModeFlags as a, countUniqueScannedFiles as b, discoverWorkspacePackages as c, resolveProjectScan as d, resolveProjectChangedLineRanges as f, retryMissingProjectScores as g, resolveProjectRelativeDirectory as h, validateIncludeUntrackedScope as i, resolveMergeBaseRef as j, createInvocationInspect as k, selectProjects as l, resolveProjectSourceFilePaths as m, formatSkippedProjectsMessage as n, projectManifestChanged as o, resolveProjectDiffIncludePaths as p, formatLearnMoreLine as q, validateFilePathSelectionFlags as r, partitionProjectScanOutcomes as s, shouldFailScanGate as t, buildCodeFrame as u, resolveCliInspectOptions as v, copyToClipboard as w, setUpGitHubActions as x, filterScansForSurface as y, hasIncompleteScoreAnalysis as z };
 
-//# sourceMappingURL=should-fail-scan-gate-DzZuTxim.js.map
-//# debugId=00cf2dc8-65a5-523e-b3b1-8400324c9d87
+//# sourceMappingURL=should-fail-scan-gate-BYPsKIde.js.map
+//# debugId=40d3b0cf-26ca-5238-9651-4a1de64ef1f0