react-doctor 0.9.2 → 0.9.3

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c86de9ea-b858-5528-89a8-6ff4d377c873")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="707bd0ef-8490-5120-ba82-f65ad0b490e1")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -8,18 +8,19 @@ import path from "node:path";
 import * as NFS from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
 import process$1 from "node:process";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, FRAMEWORK_TOKENS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, FRAMEWORK_TOKENS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, REACT_DOCTOR_RULE_REGISTRY, REACT_DOCTOR_SCAN_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor/core";
 import * as Crypto from "node:crypto";
 import crypto, { createHash, randomUUID } from "node:crypto";
 import { ResolverFactory } from "oxc-resolver";
 import ts from "typescript";
+import * as NodeUrl from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import * as OS from "node:os";
 import os, { tmpdir } from "node:os";
 import { parseJSON5 } from "confbox";
-import * as NodeUrl from "node:url";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
 import { ANALYZED_MANIFEST_FILENAMES, DEFAULT_EXTENSIONS } from "deslop-js/analyzed-inputs";
+import { convertToTSX } from "@astrojs/compiler/sync";
 import { gzipSync } from "node:zlib";
 import * as Sentry from "@sentry/node";
 import { performance as performance$1 } from "node:perf_hooks";
@@ -13342,7 +13343,7 @@ const Number$4 = globalThis.Number;
 * @category constructors
 * @since 2.0.0
 */
-const parse = (s) => {
+const parse$1 = (s) => {
 	if (s === "NaN") return some(NaN);
 	if (s === "Infinity") return some(Infinity);
 	if (s === "-Infinity") return some(-Infinity);
@@ -17405,12 +17406,12 @@ TaggedError("EncodingError");
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.0-beta.70/node_modules/effect/dist/internal/schema/annotations.js
 /** @internal */
-function resolve(ast) {
+function resolve$1(ast) {
 	return ast.checks ? ast.checks[ast.checks.length - 1].annotations : ast.annotations;
 }
 /** @internal */
 function resolveAt(key) {
-	return (ast) => resolve(ast)?.[key];
+	return (ast) => resolve$1(ast)?.[key];
 }
 /** @internal */
 const resolveIdentifier = /* @__PURE__ */ resolveAt("identifier");
@@ -21162,7 +21163,7 @@ function asSync(parser) {
 }
 const recur$1 = /* @__PURE__ */ memoize((ast) => {
 	let parser;
-	const astOptions = resolve(ast)?.["parseOptions"];
+	const astOptions = resolve$1(ast)?.["parseOptions"];
 	if (!ast.context && !ast.encoding && !ast.checks) return (ou, options) => {
 		parser ??= ast.getParser(recur$1);
 		if (astOptions) options = {
@@ -60767,7 +60768,7 @@ var UrlParamsError = class extends TaggedError("UrlParamsError") {};
 * @category converting
 * @since 4.0.0
 */
-const makeUrl = (url, params, hash) => {
+const makeUrl$1 = (url, params, hash) => {
 	try {
 		const urlInstance = new URL(url, baseUrl());
 		for (let i = 0; i < params.params.length; i++) {
@@ -61401,7 +61402,7 @@ const Proto$2 = {
 const make$10 = (f) => makeWith$1((effect) => flatMap$2(effect, (request) => withFiber((fiber) => {
 	const scopedController = scopedRequests.get(request);
 	const controller = scopedController ?? new AbortController();
-	const urlResult = makeUrl(request.url, request.urlParams, getOrUndefined(request.hash));
+	const urlResult = makeUrl$1(request.url, request.urlParams, getOrUndefined(request.hash));
 	if (isFailure(urlResult)) return fail$4(new HttpClientError({ reason: new InvalidUrlError({
 		request,
 		cause: urlResult.failure
@@ -61840,7 +61841,7 @@ const layer$8 = (loggers, options) => effect(CurrentLoggers, withFiber$1(fnUntra
 * @since 4.0.0
 */
 const policy = /* @__PURE__ */ forever$1.pipe(passthrough$2, /* @__PURE__ */ addDelay((error) => {
-	if (isHttpClientError(error) && error.reason._tag === "StatusCodeError" && error.reason.response.status === 429) return succeed$2(seconds(fromUndefinedOr(error.reason.response.headers["retry-after"]).pipe(flatMap$5(parse), getOrElse$1(() => 5))));
+	if (isHttpClientError(error) && error.reason._tag === "StatusCodeError" && error.reason.response.status === 429) return succeed$2(seconds(fromUndefinedOr(error.reason.response.headers["retry-after"]).pipe(flatMap$5(parse$1), getOrElse$1(() => 5))));
 	return succeed$2(seconds(1));
 }));
 /**
@@ -64549,6 +64550,428 @@ const layer$1 = /* @__PURE__ */ succeed$3(Path$1)({
 	toFileUrl
 });
 //#endregion
+//#region ../../node_modules/.pnpm/@jridgewell+sourcemap-codec@1.5.5/node_modules/@jridgewell/sourcemap-codec/dist/sourcemap-codec.mjs
+var comma = ",".charCodeAt(0);
+";".charCodeAt(0);
+var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var intToChar = new Uint8Array(64);
+var charToInt = new Uint8Array(128);
+for (let i = 0; i < chars.length; i++) {
+	const c = chars.charCodeAt(i);
+	intToChar[i] = c;
+	charToInt[c] = i;
+}
+function decodeInteger(reader, relative) {
+	let value = 0;
+	let shift = 0;
+	let integer = 0;
+	do {
+		integer = charToInt[reader.next()];
+		value |= (integer & 31) << shift;
+		shift += 5;
+	} while (integer & 32);
+	const shouldNegate = value & 1;
+	value >>>= 1;
+	if (shouldNegate) value = -2147483648 | -value;
+	return relative + value;
+}
+function hasMoreVlq(reader, max) {
+	if (reader.pos >= max) return false;
+	return reader.peek() !== comma;
+}
+var StringReader = class {
+	constructor(buffer) {
+		this.pos = 0;
+		this.buffer = buffer;
+	}
+	next() {
+		return this.buffer.charCodeAt(this.pos++);
+	}
+	peek() {
+		return this.buffer.charCodeAt(this.pos);
+	}
+	indexOf(char) {
+		const { buffer, pos } = this;
+		const idx = buffer.indexOf(char, pos);
+		return idx === -1 ? buffer.length : idx;
+	}
+};
+function decode(mappings) {
+	const { length } = mappings;
+	const reader = new StringReader(mappings);
+	const decoded = [];
+	let genColumn = 0;
+	let sourcesIndex = 0;
+	let sourceLine = 0;
+	let sourceColumn = 0;
+	let namesIndex = 0;
+	do {
+		const semi = reader.indexOf(";");
+		const line = [];
+		let sorted = true;
+		let lastCol = 0;
+		genColumn = 0;
+		while (reader.pos < semi) {
+			let seg;
+			genColumn = decodeInteger(reader, genColumn);
+			if (genColumn < lastCol) sorted = false;
+			lastCol = genColumn;
+			if (hasMoreVlq(reader, semi)) {
+				sourcesIndex = decodeInteger(reader, sourcesIndex);
+				sourceLine = decodeInteger(reader, sourceLine);
+				sourceColumn = decodeInteger(reader, sourceColumn);
+				if (hasMoreVlq(reader, semi)) {
+					namesIndex = decodeInteger(reader, namesIndex);
+					seg = [
+						genColumn,
+						sourcesIndex,
+						sourceLine,
+						sourceColumn,
+						namesIndex
+					];
+				} else seg = [
+					genColumn,
+					sourcesIndex,
+					sourceLine,
+					sourceColumn
+				];
+			} else seg = [genColumn];
+			line.push(seg);
+			reader.pos++;
+		}
+		if (!sorted) sort(line);
+		decoded.push(line);
+		reader.pos = semi + 1;
+	} while (reader.pos <= length);
+	return decoded;
+}
+function sort(line) {
+	line.sort(sortComparator$1);
+}
+function sortComparator$1(a, b) {
+	return a[0] - b[0];
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@jridgewell+resolve-uri@3.1.2/node_modules/@jridgewell/resolve-uri/dist/resolve-uri.mjs
+const schemeRegex = /^[\w+.-]+:\/\//;
+/**
+* Matches the parts of a URL:
+* 1. Scheme, including ":", guaranteed.
+* 2. User/password, including "@", optional.
+* 3. Host, guaranteed.
+* 4. Port, including ":", optional.
+* 5. Path, including "/", optional.
+* 6. Query, including "?", optional.
+* 7. Hash, including "#", optional.
+*/
+const urlRegex = /^([\w+.-]+:)\/\/([^@/#?]*@)?([^:/#?]*)(:\d+)?(\/[^#?]*)?(\?[^#]*)?(#.*)?/;
+/**
+* File URLs are weird. They dont' need the regular `//` in the scheme, they may or may not start
+* with a leading `/`, they can have a domain (but only if they don't start with a Windows drive).
+*
+* 1. Host, optional.
+* 2. Path, which may include "/", guaranteed.
+* 3. Query, including "?", optional.
+* 4. Hash, including "#", optional.
+*/
+const fileRegex = /^file:(?:\/\/((?![a-z]:)[^/#?]*)?)?(\/?[^#?]*)(\?[^#]*)?(#.*)?/i;
+function isAbsoluteUrl(input) {
+	return schemeRegex.test(input);
+}
+function isSchemeRelativeUrl(input) {
+	return input.startsWith("//");
+}
+function isAbsolutePath(input) {
+	return input.startsWith("/");
+}
+function isFileUrl(input) {
+	return input.startsWith("file:");
+}
+function isRelative(input) {
+	return /^[.?#]/.test(input);
+}
+function parseAbsoluteUrl(input) {
+	const match = urlRegex.exec(input);
+	return makeUrl(match[1], match[2] || "", match[3], match[4] || "", match[5] || "/", match[6] || "", match[7] || "");
+}
+function parseFileUrl(input) {
+	const match = fileRegex.exec(input);
+	const path = match[2];
+	return makeUrl("file:", "", match[1] || "", "", isAbsolutePath(path) ? path : "/" + path, match[3] || "", match[4] || "");
+}
+function makeUrl(scheme, user, host, port, path, query, hash) {
+	return {
+		scheme,
+		user,
+		host,
+		port,
+		path,
+		query,
+		hash,
+		type: 7
+	};
+}
+function parseUrl(input) {
+	if (isSchemeRelativeUrl(input)) {
+		const url = parseAbsoluteUrl("http:" + input);
+		url.scheme = "";
+		url.type = 6;
+		return url;
+	}
+	if (isAbsolutePath(input)) {
+		const url = parseAbsoluteUrl("http://foo.com" + input);
+		url.scheme = "";
+		url.host = "";
+		url.type = 5;
+		return url;
+	}
+	if (isFileUrl(input)) return parseFileUrl(input);
+	if (isAbsoluteUrl(input)) return parseAbsoluteUrl(input);
+	const url = parseAbsoluteUrl("http://foo.com/" + input);
+	url.scheme = "";
+	url.host = "";
+	url.type = input ? input.startsWith("?") ? 3 : input.startsWith("#") ? 2 : 4 : 1;
+	return url;
+}
+function stripPathFilename(path) {
+	if (path.endsWith("/..")) return path;
+	const index = path.lastIndexOf("/");
+	return path.slice(0, index + 1);
+}
+function mergePaths(url, base) {
+	normalizePath(base, base.type);
+	if (url.path === "/") url.path = base.path;
+	else url.path = stripPathFilename(base.path) + url.path;
+}
+/**
+* The path can have empty directories "//", unneeded parents "foo/..", or current directory
+* "foo/.". We need to normalize to a standard representation.
+*/
+function normalizePath(url, type) {
+	const rel = type <= 4;
+	const pieces = url.path.split("/");
+	let pointer = 1;
+	let positive = 0;
+	let addTrailingSlash = false;
+	for (let i = 1; i < pieces.length; i++) {
+		const piece = pieces[i];
+		if (!piece) {
+			addTrailingSlash = true;
+			continue;
+		}
+		addTrailingSlash = false;
+		if (piece === ".") continue;
+		if (piece === "..") {
+			if (positive) {
+				addTrailingSlash = true;
+				positive--;
+				pointer--;
+			} else if (rel) pieces[pointer++] = piece;
+			continue;
+		}
+		pieces[pointer++] = piece;
+		positive++;
+	}
+	let path = "";
+	for (let i = 1; i < pointer; i++) path += "/" + pieces[i];
+	if (!path || addTrailingSlash && !path.endsWith("/..")) path += "/";
+	url.path = path;
+}
+/**
+* Attempts to resolve `input` URL/path relative to `base`.
+*/
+function resolve(input, base) {
+	if (!input && !base) return "";
+	const url = parseUrl(input);
+	let inputType = url.type;
+	if (base && inputType !== 7) {
+		const baseUrl = parseUrl(base);
+		const baseType = baseUrl.type;
+		switch (inputType) {
+			case 1: url.hash = baseUrl.hash;
+			case 2: url.query = baseUrl.query;
+			case 3:
+			case 4: mergePaths(url, baseUrl);
+			case 5:
+				url.user = baseUrl.user;
+				url.host = baseUrl.host;
+				url.port = baseUrl.port;
+			case 6: url.scheme = baseUrl.scheme;
+		}
+		if (baseType > inputType) inputType = baseType;
+	}
+	normalizePath(url, inputType);
+	const queryHash = url.query + url.hash;
+	switch (inputType) {
+		case 2:
+		case 3: return queryHash;
+		case 4: {
+			const path = url.path.slice(1);
+			if (!path) return queryHash || ".";
+			if (isRelative(base || input) && !isRelative(path)) return "./" + path + queryHash;
+			return path + queryHash;
+		}
+		case 5: return url.path + queryHash;
+		default: return url.scheme + "//" + url.user + url.host + url.port + url.path + queryHash;
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@jridgewell+trace-mapping@0.3.31/node_modules/@jridgewell/trace-mapping/dist/trace-mapping.mjs
+function stripFilename(path) {
+	if (!path) return "";
+	const index = path.lastIndexOf("/");
+	return path.slice(0, index + 1);
+}
+function resolver(mapUrl, sourceRoot) {
+	const from = stripFilename(mapUrl);
+	const prefix = sourceRoot ? sourceRoot + "/" : "";
+	return (source) => resolve(prefix + (source || ""), from);
+}
+var COLUMN = 0;
+var SOURCES_INDEX = 1;
+var SOURCE_LINE = 2;
+var SOURCE_COLUMN = 3;
+var NAMES_INDEX = 4;
+function maybeSort(mappings, owned) {
+	const unsortedIndex = nextUnsortedSegmentLine(mappings, 0);
+	if (unsortedIndex === mappings.length) return mappings;
+	if (!owned) mappings = mappings.slice();
+	for (let i = unsortedIndex; i < mappings.length; i = nextUnsortedSegmentLine(mappings, i + 1)) mappings[i] = sortSegments(mappings[i], owned);
+	return mappings;
+}
+function nextUnsortedSegmentLine(mappings, start) {
+	for (let i = start; i < mappings.length; i++) if (!isSorted(mappings[i])) return i;
+	return mappings.length;
+}
+function isSorted(line) {
+	for (let j = 1; j < line.length; j++) if (line[j][COLUMN] < line[j - 1][COLUMN]) return false;
+	return true;
+}
+function sortSegments(line, owned) {
+	if (!owned) line = line.slice();
+	return line.sort(sortComparator);
+}
+function sortComparator(a, b) {
+	return a[COLUMN] - b[COLUMN];
+}
+var found = false;
+function binarySearch(haystack, needle, low, high) {
+	while (low <= high) {
+		const mid = low + (high - low >> 1);
+		const cmp = haystack[mid][COLUMN] - needle;
+		if (cmp === 0) {
+			found = true;
+			return mid;
+		}
+		if (cmp < 0) low = mid + 1;
+		else high = mid - 1;
+	}
+	found = false;
+	return low - 1;
+}
+function upperBound(haystack, needle, index) {
+	for (let i = index + 1; i < haystack.length; index = i++) if (haystack[i][COLUMN] !== needle) break;
+	return index;
+}
+function lowerBound(haystack, needle, index) {
+	for (let i = index - 1; i >= 0; index = i--) if (haystack[i][COLUMN] !== needle) break;
+	return index;
+}
+function memoizedState() {
+	return {
+		lastKey: -1,
+		lastNeedle: -1,
+		lastIndex: -1
+	};
+}
+function memoizedBinarySearch(haystack, needle, state, key) {
+	const { lastKey, lastNeedle, lastIndex } = state;
+	let low = 0;
+	let high = haystack.length - 1;
+	if (key === lastKey) {
+		if (needle === lastNeedle) {
+			found = lastIndex !== -1 && haystack[lastIndex][COLUMN] === needle;
+			return lastIndex;
+		}
+		if (needle >= lastNeedle) low = lastIndex === -1 ? 0 : lastIndex;
+		else high = lastIndex;
+	}
+	state.lastKey = key;
+	state.lastNeedle = needle;
+	return state.lastIndex = binarySearch(haystack, needle, low, high);
+}
+function parse(map) {
+	return typeof map === "string" ? JSON.parse(map) : map;
+}
+var LINE_GTR_ZERO = "`line` must be greater than 0 (lines start at line 1)";
+var COL_GTR_EQ_ZERO = "`column` must be greater than or equal to 0 (columns start at column 0)";
+var TraceMap = class {
+	constructor(map, mapUrl) {
+		const isString = typeof map === "string";
+		if (!isString && map._decodedMemo) return map;
+		const parsed = parse(map);
+		const { version, file, names, sourceRoot, sources, sourcesContent } = parsed;
+		this.version = version;
+		this.file = file;
+		this.names = names || [];
+		this.sourceRoot = sourceRoot;
+		this.sources = sources;
+		this.sourcesContent = sourcesContent;
+		this.ignoreList = parsed.ignoreList || parsed.x_google_ignoreList || void 0;
+		const resolve = resolver(mapUrl, sourceRoot);
+		this.resolvedSources = sources.map(resolve);
+		const { mappings } = parsed;
+		if (typeof mappings === "string") {
+			this._encoded = mappings;
+			this._decoded = void 0;
+		} else if (Array.isArray(mappings)) {
+			this._encoded = void 0;
+			this._decoded = maybeSort(mappings, isString);
+		} else if (parsed.sections) throw new Error(`TraceMap passed sectioned source map, please use FlattenMap export instead`);
+		else throw new Error(`invalid source map: ${JSON.stringify(parsed)}`);
+		this._decodedMemo = memoizedState();
+		this._bySources = void 0;
+		this._bySourceMemos = void 0;
+	}
+};
+function cast(map) {
+	return map;
+}
+function decodedMappings(map) {
+	var _a;
+	return (_a = cast(map))._decoded || (_a._decoded = decode(cast(map)._encoded));
+}
+function originalPositionFor(map, needle) {
+	let { line, column, bias } = needle;
+	line--;
+	if (line < 0) throw new Error(LINE_GTR_ZERO);
+	if (column < 0) throw new Error(COL_GTR_EQ_ZERO);
+	const decoded = decodedMappings(map);
+	if (line >= decoded.length) return OMapping(null, null, null, null);
+	const segments = decoded[line];
+	const index = traceSegmentInternal(segments, cast(map)._decodedMemo, line, column, bias || 1);
+	if (index === -1) return OMapping(null, null, null, null);
+	const segment = segments[index];
+	if (segment.length === 1) return OMapping(null, null, null, null);
+	const { names, resolvedSources } = map;
+	return OMapping(resolvedSources[segment[SOURCES_INDEX]], segment[SOURCE_LINE] + 1, segment[SOURCE_COLUMN], segment.length === 5 ? names[segment[NAMES_INDEX]] : null);
+}
+function OMapping(source, line, column, name) {
+	return {
+		source,
+		line,
+		column,
+		name
+	};
+}
+function traceSegmentInternal(segments, memo, line, column, bias) {
+	let index = memoizedBinarySearch(segments, column, memo, line);
+	if (found) index = (bias === -1 ? upperBound : lowerBound)(segments, column, index);
+	else if (bias === -1) index++;
+	if (index === -1 || index === segments.length) return -1;
+	return index;
+}
+//#endregion
 //#region ../core/dist/index.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -64618,7 +65041,7 @@ var AmbiguousProjectError = class extends Error {
 };
 const isProjectDiscoveryError = (value) => value instanceof ProjectNotFoundError || value instanceof NoReactDependencyError || value instanceof PackageJsonNotFoundError || value instanceof NotADirectoryError || value instanceof AmbiguousProjectError;
 const HTML_FILE_PATTERN = /\.html$/i;
-const SOURCE_FILE_PATTERN = /\.(?:tsx?|jsx?|mts|mjs|[hH][tT][mM][lL])$/;
+const SOURCE_FILE_PATTERN = /\.(?:astro|tsx?|jsx?|mts|mjs|[hH][tT][mM][lL])$/;
 const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
@@ -64996,7 +65419,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.9.2";
+const CORE_PACKAGE_VERSION = "0.9.3";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -65375,6 +65798,7 @@ const FRAMEWORK_PACKAGES = {
 	"@tanstack/react-start": "tanstack-start",
 	"@remix-run/react": "remix",
 	gatsby: "gatsby",
+	astro: "astro",
 	vite: "vite",
 	"react-scripts": "cra",
 	expo: "expo",
@@ -65596,10 +66020,16 @@ const getTopLevelBinding = (sourceFile, bindingName) => {
 	}
 	return null;
 };
-const getFunctionLocalBindings = (functionNode, argumentsList) => {
+const getFunctionLocalBindings = (functionNode, argumentsList, argumentAnalysis, functionAnalysis) => {
 	const localBindings = /* @__PURE__ */ new Map();
 	functionNode.parameters.forEach((parameter, parameterIndex) => {
-		if (ts.isIdentifier(parameter.name)) localBindings.set(parameter.name.text, argumentsList[parameterIndex] ?? parameter.initializer ?? null);
+		if (ts.isIdentifier(parameter.name)) {
+			const argument = argumentsList[parameterIndex];
+			localBindings.set(parameter.name.text, {
+				expression: argument ?? parameter.initializer ?? null,
+				analysis: argument ? argumentAnalysis : functionAnalysis
+			});
+		}
 	});
 	return localBindings;
 };
@@ -65735,8 +66165,8 @@ const getStaticConfigValueState = (expression, analysis, visitedExpressions = /*
 	};
 	if (ts.isIdentifier(unwrappedExpression)) {
 		if (analysis.localBindings.has(unwrappedExpression.text)) {
-			const localInitializer = analysis.localBindings.get(unwrappedExpression.text);
-			return localInitializer ? getStaticConfigValueState(localInitializer, analysis, nextVisitedExpressions) : null;
+			const localReference = analysis.localBindings.get(unwrappedExpression.text);
+			return localReference?.expression ? getStaticConfigValueState(localReference.expression, localReference.analysis, nextVisitedExpressions) : null;
 		}
 		const topLevelBinding = getTopLevelBinding(analysis.sourceFile, unwrappedExpression.text);
 		return topLevelBinding && ts.isExpression(topLevelBinding) ? getStaticConfigValueState(topLevelBinding, analysis, nextVisitedExpressions) : null;
@@ -65778,8 +66208,8 @@ const getReactCompilerFlagState = (expression, analysis, visitedExpressions = /*
 		const assignedBinding = getAssignedPropertyInitializer(unwrappedExpression, "reactCompiler");
 		if (assignedBinding.wasFound && assignedBinding.initializer) return { isEnabled: !isStaticallyDisabledConfigExpression(assignedBinding.initializer, analysis) };
 		if (analysis.localBindings.has(unwrappedExpression.text)) {
-			const localInitializer = analysis.localBindings.get(unwrappedExpression.text);
-			return localInitializer ? getReactCompilerFlagState(localInitializer, analysis, nextVisitedExpressions) : null;
+			const localReference = analysis.localBindings.get(unwrappedExpression.text);
+			return localReference?.expression ? getReactCompilerFlagState(localReference.expression, localReference.analysis, nextVisitedExpressions) : null;
 		}
 		const topLevelBinding = getTopLevelBinding(analysis.sourceFile, unwrappedExpression.text);
 		return topLevelBinding && ts.isExpression(topLevelBinding) ? getReactCompilerFlagState(topLevelBinding, analysis, nextVisitedExpressions) : null;
@@ -65802,8 +66232,8 @@ const getSelectedObjectProperty = (expression, propertyName, analysis, visitedEx
 	visitedExpressions.add(resolvedExpression);
 	if (ts.isIdentifier(resolvedExpression)) {
 		if (analysis.localBindings.has(resolvedExpression.text)) {
-			const localInitializer = analysis.localBindings.get(resolvedExpression.text);
-			return localInitializer ? getSelectedObjectProperty(localInitializer, propertyName, analysis, visitedExpressions) : null;
+			const localReference = analysis.localBindings.get(resolvedExpression.text);
+			return localReference?.expression ? getSelectedObjectProperty(localReference.expression, propertyName, localReference.analysis, visitedExpressions) : null;
 		}
 		const scopedBinding = getScopedConfigBinding(resolvedExpression);
 		if (scopedBinding.wasFound) return scopedBinding.initializer ? getSelectedObjectProperty(scopedBinding.initializer, propertyName, analysis, visitedExpressions) : null;
@@ -65812,9 +66242,18 @@ const getSelectedObjectProperty = (expression, propertyName, analysis, visitedEx
 	}
 	if (!ts.isObjectLiteralExpression(resolvedExpression)) return null;
 	for (const property of [...resolvedExpression.properties].reverse()) {
-		if (ts.isPropertyAssignment(property) && getStaticPropertyName$2(property.name) === propertyName) return property.initializer;
-		if (ts.isMethodDeclaration(property) && getStaticPropertyName$2(property.name) === propertyName) return property;
-		if (ts.isShorthandPropertyAssignment(property) && property.name.text === propertyName) return property.name;
+		if (ts.isPropertyAssignment(property) && getStaticPropertyName$2(property.name) === propertyName) return {
+			node: property.initializer,
+			analysis
+		};
+		if (ts.isMethodDeclaration(property) && getStaticPropertyName$2(property.name) === propertyName) return {
+			node: property,
+			analysis
+		};
+		if (ts.isShorthandPropertyAssignment(property) && property.name.text === propertyName) return {
+			node: property.name,
+			analysis
+		};
 		if (ts.isSpreadAssignment(property)) {
 			const spreadProperty = getSelectedObjectProperty(property.expression, propertyName, analysis, visitedExpressions);
 			if (spreadProperty) return spreadProperty;
@@ -65827,8 +66266,8 @@ const configExpressionMayDefineProperty = (expression, propertyName, analysis) =
 	while (ts.isParenthesizedExpression(resolvedExpression) || ts.isAsExpression(resolvedExpression) || ts.isTypeAssertionExpression(resolvedExpression) || ts.isSatisfiesExpression(resolvedExpression) || ts.isNonNullExpression(resolvedExpression)) resolvedExpression = resolvedExpression.expression;
 	if (ts.isIdentifier(resolvedExpression)) {
 		if (analysis.localBindings.has(resolvedExpression.text)) {
-			const localInitializer = analysis.localBindings.get(resolvedExpression.text);
-			return localInitializer ? configExpressionMayDefineProperty(localInitializer, propertyName, analysis) : true;
+			const localReference = analysis.localBindings.get(resolvedExpression.text);
+			return localReference?.expression ? configExpressionMayDefineProperty(localReference.expression, propertyName, localReference.analysis) : true;
 		}
 		const scopedBinding = getScopedConfigBinding(resolvedExpression);
 		if (scopedBinding.wasFound) return scopedBinding.initializer ? configExpressionMayDefineProperty(scopedBinding.initializer, propertyName, analysis) : true;
@@ -65912,15 +66351,15 @@ const getReExportedConfigModules = (sourceFile, exportName) => {
 	}
 	return bindings;
 };
-const analyzeConfigModuleExport = (filePath, exportName, allowCompilerTransform, importDepth, visitedModules, argumentsList = []) => {
+const analyzeConfigModuleExport = (filePath, exportName, allowCompilerTransform, importDepth, visitedModules, argumentsList = [], argumentAnalysis) => {
 	if (!isFile(filePath) || importDepth > 4) return false;
 	const moduleVisitKey = `${filePath}:${exportName}:${allowCompilerTransform}`;
 	if (visitedModules.has(moduleVisitKey)) return false;
 	const nextVisitedModules = new Set(visitedModules);
 	nextVisitedModules.add(moduleVisitKey);
-	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, NFS.readFileSync(filePath, "utf-8")), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList);
+	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, NFS.readFileSync(filePath, "utf-8")), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList, argumentAnalysis);
 };
-const analyzeConfigSourceFileExport = (sourceFile, filePath, exportName, allowCompilerTransform, importDepth, visitedModules, argumentsList = []) => {
+const analyzeConfigSourceFileExport = (sourceFile, filePath, exportName, allowCompilerTransform, importDepth, visitedModules, argumentsList = [], argumentAnalysis) => {
 	const analysis = {
 		filePath,
 		sourceFile,
@@ -65930,14 +66369,27 @@ const analyzeConfigSourceFileExport = (sourceFile, filePath, exportName, allowCo
 		localBindings: /* @__PURE__ */ new Map(),
 		activeFunctions: /* @__PURE__ */ new Set()
 	};
+	const resolvedArgumentAnalysis = argumentAnalysis ?? analysis;
 	const exportedConfigNodes = getExportedConfigNodes(sourceFile, exportName);
-	return exportedConfigNodes.some((node) => ts.isArrowFunction(node) || ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node) ? analyzeConfigFunction(node, analysis, allowCompilerTransform, argumentsList) : analyzeConfigNode(node, analysis, allowCompilerTransform)) || getReExportedConfigModules(sourceFile, exportName).some((binding) => {
+	return exportedConfigNodes.some((node) => {
+		if (ts.isArrowFunction(node) || ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node)) return analyzeConfigFunction(node, analysis, allowCompilerTransform, argumentsList, resolvedArgumentAnalysis);
+		if (argumentsList.length > 0 && ts.isIdentifier(node)) {
+			const topLevelBinding = getTopLevelBinding(sourceFile, node.text);
+			if (topLevelBinding && ts.isFunctionLike(topLevelBinding)) return analyzeConfigFunction(topLevelBinding, analysis, allowCompilerTransform, argumentsList, resolvedArgumentAnalysis);
+			const importBinding = getImportBinding(sourceFile, node.text);
+			if (importBinding) {
+				const importedFilePath = resolveImportedConfigFile(filePath, importBinding.moduleSpecifier);
+				return Boolean(importedFilePath && analyzeConfigModuleExport(importedFilePath, importBinding.exportName, allowCompilerTransform, importDepth + 1, visitedModules, argumentsList, resolvedArgumentAnalysis));
+			}
+		}
+		return analyzeConfigNode(node, analysis, allowCompilerTransform);
+	}) || getReExportedConfigModules(sourceFile, exportName).some((binding) => {
 		if (exportedConfigNodes.length > 0 && binding.isNamespace) return false;
 		const importedFilePath = resolveImportedConfigFile(filePath, binding.moduleSpecifier);
-		return Boolean(importedFilePath && analyzeConfigModuleExport(importedFilePath, binding.exportName, allowCompilerTransform, importDepth + 1, visitedModules, argumentsList));
+		return Boolean(importedFilePath && analyzeConfigModuleExport(importedFilePath, binding.exportName, allowCompilerTransform, importDepth + 1, visitedModules, argumentsList, resolvedArgumentAnalysis));
 	});
 };
-const analyzeConfigFunction = (functionNode, analysis, allowCompilerTransform, argumentsList = []) => {
+const analyzeConfigFunction = (functionNode, analysis, allowCompilerTransform, argumentsList = [], argumentAnalysis = analysis) => {
 	if (!functionNode.body) return false;
 	if (analysis.activeFunctions.has(functionNode.pos)) return false;
 	const activeFunctions = new Set(analysis.activeFunctions);
@@ -65945,7 +66397,7 @@ const analyzeConfigFunction = (functionNode, analysis, allowCompilerTransform, a
 	const functionAnalysis = {
 		...analysis,
 		visitedNodes: /* @__PURE__ */ new Set(),
-		localBindings: getFunctionLocalBindings(functionNode, argumentsList),
+		localBindings: getFunctionLocalBindings(functionNode, argumentsList, argumentAnalysis, analysis),
 		activeFunctions
 	};
 	if (!ts.isBlock(functionNode.body)) return analyzeConfigNode(functionNode.body, functionAnalysis, allowCompilerTransform);
@@ -65964,7 +66416,7 @@ const analyzeConfigFunction = (functionNode, analysis, allowCompilerTransform, a
 const analyzeImportedConfig = ({ analysis, moduleSpecifier, exportName, allowCompilerTransform, argumentsList }) => {
 	const importedFilePath = resolveImportedConfigFile(analysis.filePath, moduleSpecifier);
 	if (!importedFilePath) return null;
-	return analyzeConfigModuleExport(importedFilePath, exportName, allowCompilerTransform, analysis.importDepth + 1, analysis.visitedModules, argumentsList);
+	return analyzeConfigModuleExport(importedFilePath, exportName, allowCompilerTransform, analysis.importDepth + 1, analysis.visitedModules, argumentsList, analysis);
 };
 const analyzeConfigIdentifier = (identifier, analysis, allowCompilerTransform, isCompilerTransformCollection, excludedPropertyNames) => {
 	const assignedReactCompiler = getAssignedPropertyInitializer(identifier, "reactCompiler");
@@ -65978,8 +66430,8 @@ const analyzeConfigIdentifier = (identifier, analysis, allowCompilerTransform, i
 	if (assignedPlugins.wasFound) overriddenPropertyNames.add("plugins");
 	if (assignedPresets.wasFound) overriddenPropertyNames.add("presets");
 	if (analysis.localBindings.has(identifier.text)) {
-		const localInitializer = analysis.localBindings.get(identifier.text);
-		return Boolean(localInitializer && analyzeConfigNode(localInitializer, analysis, allowCompilerTransform, isCompilerTransformCollection, overriddenPropertyNames));
+		const localReference = analysis.localBindings.get(identifier.text);
+		return Boolean(localReference?.expression && analyzeConfigNode(localReference.expression, localReference.analysis, allowCompilerTransform, isCompilerTransformCollection, overriddenPropertyNames));
 	}
 	const scopedBinding = getScopedConfigBinding(identifier);
 	if (scopedBinding.wasFound) return Boolean(scopedBinding.initializer && analyzeConfigNode(scopedBinding.initializer, analysis, allowCompilerTransform, isCompilerTransformCollection, overriddenPropertyNames));
@@ -66045,7 +66497,7 @@ const analyzeConfigCallTarget = (callExpression, analysis, allowCompilerTransfor
 	}
 	const selectedProperty = getSelectedObjectProperty(target.expression, propertyName, analysis);
 	if (selectedProperty === null) return null;
-	return ts.isFunctionLike(selectedProperty) ? analyzeConfigFunction(selectedProperty, analysis, allowCompilerTransform, callExpression.arguments) : analyzeConfigNode(selectedProperty, analysis, allowCompilerTransform);
+	return ts.isFunctionLike(selectedProperty.node) ? analyzeConfigFunction(selectedProperty.node, selectedProperty.analysis, allowCompilerTransform, callExpression.arguments, analysis) : analyzeConfigNode(selectedProperty.node, selectedProperty.analysis, allowCompilerTransform);
 };
 const analyzeConfigNode = (node, analysis, allowCompilerTransform, isCompilerTransformCollection = false, excludedPropertyNames) => {
 	const excludedPropertiesVisitKey = excludedPropertyNames ? [...excludedPropertyNames].sort().join(",") : "";
@@ -66145,7 +66597,7 @@ const analyzeConfigNode = (node, analysis, allowCompilerTransform, isCompilerTra
 		if (ts.isIdentifier(node.expression)) {
 			if (analysis.localBindings.has(node.expression.text) || getScopedConfigBinding(node.expression).wasFound) {
 				const selectedProperty = getSelectedObjectProperty(node.expression, node.name.text, analysis);
-				return Boolean(selectedProperty && analyzeConfigNode(selectedProperty, analysis, allowCompilerTransform));
+				return Boolean(selectedProperty && analyzeConfigNode(selectedProperty.node, selectedProperty.analysis, allowCompilerTransform));
 			}
 			const importBinding = getImportBinding(analysis.sourceFile, node.expression.text);
 			if (importBinding?.isNamespace) {
@@ -66159,7 +66611,7 @@ const analyzeConfigNode = (node, analysis, allowCompilerTransform, isCompilerTra
 				return false;
 			}
 			const selectedProperty = getSelectedObjectProperty(node.expression, node.name.text, analysis);
-			if (selectedProperty) return analyzeConfigNode(selectedProperty, analysis, allowCompilerTransform);
+			if (selectedProperty) return analyzeConfigNode(selectedProperty.node, selectedProperty.analysis, allowCompilerTransform);
 			return false;
 		}
 		return analyzeConfigNode(node.expression, analysis, allowCompilerTransform);
@@ -66168,7 +66620,7 @@ const analyzeConfigNode = (node, analysis, allowCompilerTransform, isCompilerTra
 		if (ts.isIdentifier(node.expression)) {
 			if (analysis.localBindings.has(node.expression.text) || getScopedConfigBinding(node.expression).wasFound) {
 				const selectedProperty = getSelectedObjectProperty(node.expression, node.argumentExpression.text, analysis);
-				return Boolean(selectedProperty && analyzeConfigNode(selectedProperty, analysis, allowCompilerTransform));
+				return Boolean(selectedProperty && analyzeConfigNode(selectedProperty.node, selectedProperty.analysis, allowCompilerTransform));
 			}
 			const importBinding = getImportBinding(analysis.sourceFile, node.expression.text);
 			if (importBinding?.isNamespace) {
@@ -66181,7 +66633,7 @@ const analyzeConfigNode = (node, analysis, allowCompilerTransform, isCompilerTra
 				}));
 			}
 			const selectedProperty = getSelectedObjectProperty(node.expression, node.argumentExpression.text, analysis);
-			if (selectedProperty) return analyzeConfigNode(selectedProperty, analysis, allowCompilerTransform);
+			if (selectedProperty) return analyzeConfigNode(selectedProperty.node, selectedProperty.analysis, allowCompilerTransform);
 			return false;
 		}
 		return analyzeConfigNode(node.expression, analysis, allowCompilerTransform);
@@ -68422,7 +68874,7 @@ const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
 const getDiagnosticRuleIdentity = (diagnostic) => ({
 	ruleKey: `${diagnostic.plugin}/${diagnostic.rule}`,
 	category: diagnostic.category,
-	tags: diagnostic.plugin === "react-doctor" ? reactDoctorPlugin.rules[diagnostic.rule]?.tags ?? [] : []
+	tags: diagnostic.plugin === "react-doctor" ? REACT_DOCTOR_RULE_REGISTRY[diagnostic.rule]?.tags ?? [] : []
 });
 const compileIgnoredFilePatterns = (userConfig) => {
 	const files = userConfig?.ignore?.files;
@@ -68558,6 +69010,7 @@ const classifyPackageRole = (filename) => {
 * Resolves the absolute path to read for a diagnostic's `filePath`,
 * accounting for the various shapes oxlint emits:
 *
+* - `file://` URL — decode to an absolute filesystem path.
 * - Absolute POSIX (`/abs/path/file.tsx`) — pass through.
 * - Absolute Windows (`C:/...` or `C:\...`) — pass through.
 * - `./relative` or bare relative — join against `rootDirectory`.
@@ -68567,6 +69020,7 @@ const classifyPackageRole = (filename) => {
 * use one canonical resolution path.
 */
 const resolveCandidateReadPath = (rootDirectory, filePath) => {
+	if (filePath.startsWith("file://")) return fileURLToPath(filePath);
 	const normalizedFile = filePath.replace(/\\/g, "/");
 	if (normalizedFile.startsWith("/") || /^[a-zA-Z]:\//.test(normalizedFile) || /^[a-zA-Z]:\\/.test(filePath)) return filePath;
 	return `${rootDirectory.replace(/\\/g, "/").replace(/\/$/, "")}/${normalizedFile.replace(/^\.\//, "")}`;
@@ -68768,7 +69222,7 @@ const buildDiagnosticPipeline = (input) => {
 	};
 	const shouldAutoSuppress = (diagnostic) => {
 		if (diagnostic.plugin !== "react-doctor") return false;
-		const rule = reactDoctorPlugin.rules[diagnostic.rule];
+		const rule = REACT_DOCTOR_RULE_REGISTRY[diagnostic.rule];
 		if (!rule?.tags?.includes("test-noise")) return false;
 		if (rule.tags.includes("migration-hint")) return false;
 		return getFileContext(diagnostic.filePath) !== "production";
@@ -69200,6 +69654,7 @@ var OxlintConcurrency = class extends Reference("react-doctor/OxlintConcurrency"
 	if (Number.isInteger(parsed) && parsed > 0) return resolveScanConcurrency(parsed);
 	return resolveAutoScanConcurrency();
 } }) {};
+var OxlintSpawnSlots = class extends Reference("react-doctor/OxlintSpawnSlots", { defaultValue: () => null }) {};
 /**
 * Three-state control for overlapping the dead-code pass with the lint pass —
 * forking dead-code as a child fiber that runs DURING lint instead of strictly
@@ -71550,8 +72005,8 @@ const getCapabilities = (project) => {
 	const cached = capabilitiesByProject.get(project);
 	if (cached !== void 0) return cached;
 	const capabilities = new Set(buildCapabilities(project));
-	const packageJson = readPackageJson$1(Path.join(project.rootDirectory, "package.json"));
-	const targetBlankOpenerProtection = detectTargetBlankOpenerProtection(project.rootDirectory, packageJson);
+	const capabilityRootDirectory = isFile(Path.join(project.rootDirectory, "package.json")) ? project.rootDirectory : findNearestAncestorPackageJson(project.rootDirectory) ?? project.rootDirectory;
+	const targetBlankOpenerProtection = detectTargetBlankOpenerProtection(capabilityRootDirectory, readPackageJson$1(Path.join(capabilityRootDirectory, "package.json")));
 	if (targetBlankOpenerProtection !== void 0) capabilities.add("target-blank-needs-explicit-protection");
 	if (targetBlankOpenerProtection === "noreferrer") capabilities.add("target-blank-needs-noreferrer");
 	capabilitiesByProject.set(project, capabilities);
@@ -71581,7 +72036,7 @@ const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? getCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
 	const includedTags = options.includedTags ?? /* @__PURE__ */ new Set();
-	const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
+	const enabledScanRules = REACT_DOCTOR_SCAN_RULES.flatMap((entry) => {
 		const rule = entry.rule;
 		const scan = rule.scan;
 		if (typeof scan !== "function") return [];
@@ -72042,47 +72497,55 @@ const resolveDeadCodeConcurrency = (facts = readSystemFacts()) => {
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / DEAD_CODE_WORKER_MEM_BUDGET_BYTES);
 	return Math.max(1, Math.min(facts.availableCores, memoryBoundedWorkers));
 };
-let availableSlots = -1;
-const waiters = [];
-const releaseSlot = () => {
-	const nextWaiter = waiters.shift();
-	if (nextWaiter !== void 0) nextWaiter();
-	else availableSlots += 1;
+const createWorkerSlots = (input) => {
+	let availableSlotCount = input.slotCount;
+	const waiters = [];
+	const releaseSlot = () => {
+		const nextWaiter = waiters.shift();
+		if (nextWaiter === void 0) {
+			availableSlotCount += 1;
+			return;
+		}
+		nextWaiter.abortSignal?.removeEventListener("abort", nextWaiter.onAbort);
+		nextWaiter.resolve();
+	};
+	const acquireSlot = async (abortSignal) => {
+		if (abortSignal?.aborted) throw input.createAbortError();
+		if (availableSlotCount > 0) {
+			availableSlotCount -= 1;
+			return;
+		}
+		await new Promise((resolve, reject) => {
+			const onAbort = () => {
+				const waiterIndex = waiters.indexOf(waiter);
+				if (waiterIndex !== -1) waiters.splice(waiterIndex, 1);
+				reject(input.createAbortError());
+			};
+			const waiter = {
+				resolve,
+				abortSignal,
+				onAbort
+			};
+			waiters.push(waiter);
+			abortSignal?.addEventListener("abort", onAbort, { once: true });
+		});
+	};
+	return { run: async (task, abortSignal) => {
+		await acquireSlot(abortSignal);
+		try {
+			return await task();
+		} finally {
+			releaseSlot();
+		}
+	} };
 };
-/**
-* Runs `task` once a dead-code worker slot is free, releasing the slot when the
-* task settles (success or failure). With a high cap (roomy machine) every
-* caller proceeds immediately; with a low cap (constrained runner) callers
-* queue and run as slots free.
-*
-* `abortSignal` short-circuits the WAIT: if it's already aborted, or fires while
-* this caller is queued, the call rejects without acquiring a slot or running
-* `task` — so a cancelled scan (e.g. lint failed) doesn't sit in the queue and
-* then spawn a child only to tear it down. A queued caller that aborts removes
-* its own waiter so a later release never hands a slot to a dead request.
-*/
+let deadCodeWorkerSlots = null;
 const withDeadCodeWorkerSlot = async (task, abortSignal) => {
-	if (abortSignal?.aborted) throw new Error("Dead-code worker aborted.");
-	if (availableSlots < 0) availableSlots = resolveDeadCodeConcurrency();
-	if (availableSlots > 0) availableSlots -= 1;
-	else await new Promise((resolve, reject) => {
-		const waiter = () => {
-			abortSignal?.removeEventListener("abort", onAbort);
-			resolve();
-		};
-		const onAbort = () => {
-			const queuedIndex = waiters.indexOf(waiter);
-			if (queuedIndex !== -1) waiters.splice(queuedIndex, 1);
-			reject(/* @__PURE__ */ new Error("Dead-code worker aborted."));
-		};
-		waiters.push(waiter);
-		abortSignal?.addEventListener("abort", onAbort, { once: true });
+	deadCodeWorkerSlots ??= createWorkerSlots({
+		slotCount: resolveDeadCodeConcurrency(),
+		createAbortError: () => /* @__PURE__ */ new Error("Dead-code worker aborted.")
 	});
-	try {
-		return await task();
-	} finally {
-		releaseSlot();
-	}
+	return deadCodeWorkerSlots.run(task, abortSignal);
 };
 const projectCacheSubdir = (projectDirectory) => crypto.createHash("sha256").update(projectDirectory).digest("hex").slice(0, 16);
 const resolveReactDoctorCacheDir = (projectDirectory) => {
@@ -72875,7 +73338,10 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				if (argvLengthChars > spawnArgsLengthCap) return yield* foldSpawnFailure(`spawn ENAMETOOLONG (${argvLengthChars} argv chars exceed ${spawnArgsLengthCap})`);
 				const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
 					cwd: input.directory,
-					env: input.env,
+					env: input.command === "git" ? {
+						...input.env,
+						GIT_DIR: void 0
+					} : input.env,
 					extendEnv: true
 				}));
 				const maxStdoutBytes = input.maxStdoutBytes;
@@ -73148,7 +73614,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				"--diff-filter=ACMR",
 				"--relative"
 			]).pipe(map$3((result) => {
-				if (result.status !== 0) return [];
+				if (result.status !== 0) return null;
 				return splitNullSeparated(result.stdout);
 			})),
 			showStagedContent: (directory, relativePath, options) => runCommand({
@@ -73606,12 +74072,12 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 	const settingsRootDirectory = resolveSettingsRootDirectory(project.rootDirectory);
 	const enabledReactDoctorRules = {};
 	for (const registryEntry of REACT_DOCTOR_RULES) {
-		const rule = reactDoctorPlugin.rules[registryEntry.id];
+		const rule = REACT_DOCTOR_RULE_REGISTRY[registryEntry.id];
 		if (!rule) continue;
 		if (ruleSelection === "cacheable" && CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
 		if (ruleSelection === "sidecar" && !CROSS_FILE_RULE_IDS.has(registryEntry.id)) continue;
 		if (ruleSelection === "sidecar" && sidecarRuleIdFilter !== void 0 && !sidecarRuleIdFilter.has(registryEntry.id)) continue;
-		if (rule.scan !== void 0) continue;
+		if (rule.isScanRule) continue;
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
 		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledWhen, includedTags)) continue;
@@ -74236,6 +74702,50 @@ const columnOfUtf8Offset = (sourceBuffer, utf8Offset) => {
 	while (lineStartOffset > 0 && sourceBuffer[lineStartOffset - 1] !== 10) lineStartOffset--;
 	return sourceBuffer.subarray(lineStartOffset, boundedOffset).toString("utf8").length + 1;
 };
+const utf8OffsetFromSourcePosition = (sourceBuffer, lineNumber, zeroBasedColumn) => {
+	if (lineNumber < 1 || zeroBasedColumn < 0) return null;
+	const sourceLines = sourceBuffer.toString("utf8").split("\n");
+	const sourceLine = sourceLines[lineNumber - 1];
+	if (sourceLine === void 0 || zeroBasedColumn > sourceLine.length) return null;
+	const precedingLines = sourceLines.slice(0, lineNumber - 1).join("\n");
+	return (lineNumber === 1 ? 0 : Buffer.byteLength(precedingLines) + Buffer.byteLength("\n")) + Buffer.byteLength(sourceLine.slice(0, zeroBasedColumn));
+};
+const mapPreparedSourceSpan = (span, preparedSourceMap) => {
+	const generatedLine = lineOfUtf8Offset(preparedSourceMap.generatedBuffer, span.offset);
+	const generatedColumn = columnOfUtf8Offset(preparedSourceMap.generatedBuffer, span.offset) - 1;
+	const originalStart = originalPositionFor(preparedSourceMap.traceMap, {
+		line: generatedLine,
+		column: generatedColumn
+	});
+	if (originalStart.source === null || originalStart.line === null || originalStart.column === null) return null;
+	const originalOffset = utf8OffsetFromSourcePosition(preparedSourceMap.sourceBuffer, originalStart.line, originalStart.column);
+	if (originalOffset === null) return null;
+	const generatedSpan = preparedSourceMap.generatedBuffer.subarray(span.offset, span.offset + span.length);
+	return {
+		offset: originalOffset,
+		length: preparedSourceMap.sourceBuffer.subarray(originalOffset, originalOffset + generatedSpan.length).equals(generatedSpan) ? generatedSpan.length : 0,
+		line: originalStart.line,
+		column: originalStart.column + 1
+	};
+};
+const mapPreparedSourceLabels = (labels, preparedSourceMap) => {
+	const primaryLabel = labels[0];
+	if (primaryLabel === void 0) return null;
+	const primarySpan = mapPreparedSourceSpan(primaryLabel.span, preparedSourceMap);
+	if (primarySpan === null) return null;
+	const mappedLabels = [{
+		...primaryLabel,
+		span: primarySpan
+	}];
+	for (const relatedLabel of labels.slice(1)) {
+		const relatedSpan = mapPreparedSourceSpan(relatedLabel.span, preparedSourceMap);
+		if (relatedSpan !== null) mappedLabels.push({
+			...relatedLabel,
+			span: relatedSpan
+		});
+	}
+	return mappedLabels;
+};
 const REDACTED_PLACEHOLDER = "<redacted>";
 const KEEP_PREFIX = `$1${REDACTED_PLACEHOLDER}`;
 const KNOWN_SECRET_RULES = [
@@ -74878,7 +75388,7 @@ const PLUGIN_CATEGORY_MAP = {
 };
 const lookupOwnString = (record, key) => Object.hasOwn(record, key) ? record[key] : void 0;
 const getRuleRecommendation = (ruleName, project) => {
-	const rule = reactDoctorPlugin.rules[ruleName];
+	const rule = REACT_DOCTOR_RULE_REGISTRY[ruleName];
 	if (!rule) return void 0;
 	if (rule.recommendationFor) {
 		const capabilities = getCapabilities(project);
@@ -74887,8 +75397,8 @@ const getRuleRecommendation = (ruleName, project) => {
 	}
 	return rule.recommendation;
 };
-const getRuleCategory = (ruleName) => reactDoctorPlugin.rules[ruleName]?.category;
-const getRuleTitle = (ruleName) => reactDoctorPlugin.rules[ruleName]?.title;
+const getRuleCategory = (ruleName) => REACT_DOCTOR_RULE_REGISTRY[ruleName]?.category;
+const getRuleTitle = (ruleName) => REACT_DOCTOR_RULE_REGISTRY[ruleName]?.title;
 const resolveDiagnosticTitle = (plugin, rule) => {
 	if (plugin !== "react-hooks-js") return getRuleTitle(rule);
 	if (rule === "error-boundaries") return REACT_ERROR_BOUNDARY_TITLE;
@@ -74943,7 +75453,7 @@ const resolveDiagnosticCategory = (plugin, rule) => {
 	if (plugin === "react-hooks-js" && rule === "error-boundaries") return "Bugs";
 	return getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Bugs";
 };
-const resolveMatchByOccurrence = (rule, category) => OCCURRENCE_MATCHED_CATEGORIES.has(category) || Boolean(reactDoctorPlugin.rules[rule]?.matchByOccurrence);
+const resolveMatchByOccurrence = (rule, category) => OCCURRENCE_MATCHED_CATEGORIES.has(category) || Boolean(REACT_DOCTOR_RULE_REGISTRY[rule]?.matchByOccurrence);
 /**
 * Maps oxlint's non-primary labels (`labels[1..]`) into related source
 * locations. Editors surface these as a diagnostic's
@@ -74980,7 +75490,7 @@ const isOxlintOutput = (value) => isRecord$1(value) && Array.isArray(value.diagn
 * to the first `{`. Raises `OxlintOutputUnparseable` when the
 * stdout isn't valid JSON or doesn't carry a `diagnostics` array.
 */
-const parseOxlintOutput = (stdout, project, rootDirectory, sourcePathByLintPath) => {
+const parseOxlintOutput = (stdout, project, rootDirectory, sourcePathByLintPath, sourceMapByLintPath) => {
 	if (!stdout) return [];
 	const jsonStart = stdout.indexOf("{");
 	const sanitizedStdout = jsonStart > 0 ? stdout.slice(jsonStart) : stdout;
@@ -74998,6 +75508,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory, sourcePathByLintPath)
 	const sourceLinesCache = /* @__PURE__ */ new Map();
 	const resolveAbsolutePath = (filename) => Path.isAbsolute(filename) ? filename : Path.resolve(rootDirectory || ".", filename);
 	const resolveMappedSourceFilename = (filename) => sourcePathByLintPath?.get(Path.normalize(resolveAbsolutePath(filename)));
+	const resolvePreparedSourceMap = (filename) => sourceMapByLintPath?.get(Path.normalize(resolveAbsolutePath(filename)));
 	const resolveSourceFilename = (filename) => resolveMappedSourceFilename(filename) ?? filename;
 	const readSourceBuffer = (filename) => {
 		const absolutePath = resolveAbsolutePath(resolveSourceFilename(filename));
@@ -75029,7 +75540,19 @@ const parseOxlintOutput = (stdout, project, rootDirectory, sourcePathByLintPath)
 		minifiedFileCache.set(absolutePath, minified);
 		return minified;
 	};
-	return suppressMemoizationInBailedOutFunctions(parsed.diagnostics.filter((diagnostic) => isMappableOxlintDiagnostic(diagnostic) && isLintableSourceFile(resolveSourceFilename(diagnostic.filename)) && !(TYPESCRIPT_DECLARATION_FILE_PATTERN.test(diagnostic.filename) && OXLINT_IGNORED_DECLARATION_DIAGNOSTIC_CODES.has(diagnostic.code)) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory) && !shouldSuppressCompilerFindingInWorklet(diagnostic, project, rootDirectory)).map((diagnostic) => {
+	return suppressMemoizationInBailedOutFunctions(parsed.diagnostics.flatMap((diagnostic) => {
+		const preparedSourceMap = resolvePreparedSourceMap(diagnostic.filename);
+		if (preparedSourceMap === void 0) return [diagnostic];
+		const { plugin, rule } = parseRuleCode(diagnostic.code);
+		if (plugin !== "react-doctor" || !REACT_DOCTOR_RULE_REGISTRY[rule]?.tags?.includes("design")) return [];
+		const labels = mapPreparedSourceLabels(diagnostic.labels, preparedSourceMap);
+		const sourceFilename = resolveMappedSourceFilename(diagnostic.filename);
+		return labels === null || sourceFilename === void 0 ? [] : [{
+			...diagnostic,
+			filename: sourceFilename,
+			labels
+		}];
+	}).filter((diagnostic) => isMappableOxlintDiagnostic(diagnostic) && isLintableSourceFile(resolveSourceFilename(diagnostic.filename)) && !(TYPESCRIPT_DECLARATION_FILE_PATTERN.test(diagnostic.filename) && OXLINT_IGNORED_DECLARATION_DIAGNOSTIC_CODES.has(diagnostic.code)) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory) && !shouldSuppressCompilerFindingInWorklet(diagnostic, project, rootDirectory)).map((diagnostic) => {
 		const { plugin, rule } = parseRuleCode(diagnostic.code);
 		const primaryLabel = diagnostic.labels[0];
 		const cleaned = cleanDiagnosticMessage(diagnostic.message, diagnostic.help, plugin, rule, project);
@@ -75107,11 +75630,12 @@ const SANITIZED_ENV = buildOxlintChildEnv(process.env);
 * The first three are splittable (the caller's binary-split retry
 * shrinks the batch and re-spawns); the fourth isn't.
 */
-const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLINT_SPAWN_TIMEOUT_MS, outputMaxBytes = OXLINT_OUTPUT_MAX_BYTES, abortSignal) => new Promise((resolve, reject) => {
+const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLINT_SPAWN_TIMEOUT_MS, outputMaxBytes = OXLINT_OUTPUT_MAX_BYTES, abortSignal, onSpawn) => new Promise((resolve, reject) => {
 	if (abortSignal?.aborted) {
 		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
 		return;
 	}
+	onSpawn?.();
 	const child = spawn(nodeBinaryPath, buildProfiledNodeArguments({
 		argumentsList: args,
 		cpuProfileDirectory: SANITIZED_ENV.REACT_DOCTOR_CPU_PROFILE_DIR,
@@ -75247,7 +75771,7 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
 	const resolveSourcePath = (filePath) => {
 		const absoluteFilePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory, filePath);
 		return sourcePathByLintPath?.get(Path.normalize(absoluteFilePath)) ?? filePath;
@@ -75271,7 +75795,21 @@ const spawnLintBatches = async (input) => {
 			}
 			const batchArgs = [...baseArgs, ...batch];
 			try {
-				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory, sourcePathByLintPath);
+				const spawnBatch = () => {
+					if (isPastDeadline()) {
+						deadlineSkippedFiles.push(...batch);
+						batchState.deadlineSkippedFileCount += batch.length;
+						return Promise.resolve(null);
+					}
+					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal, () => {
+						if (batchState.didStart) return;
+						batchState.didStart = true;
+						startedFileCount += batchState.initialFileCount;
+					});
+				};
+				const stdout = input.spawnSlots === void 0 ? await spawnBatch() : await input.spawnSlots.run(spawnBatch, signal);
+				if (stdout === null) return [];
+				return parseOxlintOutput(stdout, project, rootDirectory, sourcePathByLintPath, sourceMapByLintPath);
 			} catch (error) {
 				if (!isSplittableReactDoctorError(error)) throw error;
 				if (isPastDeadline()) {
@@ -75315,14 +75853,15 @@ const spawnLintBatches = async (input) => {
 					deadlineSkippedFiles.push(...batch);
 					return [];
 				}
-				startedFileCount += batch.length;
 				const batchState = {
 					deadlineMs: null,
-					deadlineSkippedFileCount: 0
+					deadlineSkippedFileCount: 0,
+					didStart: false,
+					initialFileCount: batch.length
 				};
 				const batchDiagnostics = await spawnLintBatch(batch, 0, batchState);
 				scannedFileCount += batch.length - batchState.deadlineSkippedFileCount;
-				if (passOnFileProgress) {
+				if (passOnFileProgress && batchState.didStart) {
 					displayedFileCount = Math.min(Math.max(displayedFileCount, scannedFileCount), totalFileCount);
 					passOnFileProgress(displayedFileCount, totalFileCount);
 				}
@@ -75406,8 +75945,8 @@ const validateRuleRegistration = () => {
 	for (const fullKey of ALL_REACT_DOCTOR_RULE_KEYS) {
 		const ruleName = fullKey.replace(/^react-doctor\//, "");
 		if (!getRuleCategory(ruleName)) missingCategory.push(fullKey);
-		if (!reactDoctorPlugin.rules[ruleName]?.recommendation) missingHelp.push(fullKey);
-		if (FRAMEWORK_SPECIFIC_RULE_KEYS.has(fullKey) && !reactDoctorPlugin.rules[ruleName]?.requires) missingMetadata.push(fullKey);
+		if (!REACT_DOCTOR_RULE_REGISTRY[ruleName]?.recommendation) missingHelp.push(fullKey);
+		if (FRAMEWORK_SPECIFIC_RULE_KEYS.has(fullKey) && !REACT_DOCTOR_RULE_REGISTRY[ruleName]?.requires) missingMetadata.push(fullKey);
 	}
 	if (missingCategory.length === 0 && missingHelp.length === 0 && missingMetadata.length === 0) return;
 	const detail = [
@@ -75710,20 +76249,47 @@ const prepareHtmlScriptSource = (sourceBuffer) => {
 		lintBuffer: maskedBuffer ?? sourceBuffer
 	};
 };
-const prepareHtmlLintSources = (rootDirectory, temporaryDirectory, candidateFiles) => {
+const ASTRO_FILE_PATTERN = /\.astro$/;
+const prepareLintSources = (rootDirectory, temporaryDirectory, candidateFiles) => {
 	const lintFiles = [];
 	const sourcePathByLintPath = /* @__PURE__ */ new Map();
+	const sourceMapByLintPath = /* @__PURE__ */ new Map();
 	const sizeByLintPath = /* @__PURE__ */ new Map();
 	const htmlSourcesDirectory = Path.join(temporaryDirectory, "html-sources");
+	const astroSourcesDirectory = Path.join(temporaryDirectory, "astro-sources");
 	let htmlFileIndex = 0;
+	let astroFileIndex = 0;
 	let hasThreeModuleImport = false;
 	for (const candidateFile of candidateFiles) {
-		if (!HTML_FILE_PATTERN.test(candidateFile)) {
+		if (!HTML_FILE_PATTERN.test(candidateFile) && !ASTRO_FILE_PATTERN.test(candidateFile)) {
 			lintFiles.push(candidateFile);
 			continue;
 		}
 		const absoluteSourcePath = Path.isAbsolute(candidateFile) ? candidateFile : Path.resolve(rootDirectory, candidateFile);
 		const sourceBuffer = NFS.readFileSync(absoluteSourcePath);
+		if (ASTRO_FILE_PATTERN.test(candidateFile)) {
+			const compilerSourcePath = absoluteSourcePath.replaceAll("\\", "/");
+			const convertedSource = convertToTSX(sourceBuffer.toString("utf8"), {
+				filename: compilerSourcePath,
+				sourcemap: "external",
+				includeScripts: true
+			});
+			if (astroFileIndex === 0) NFS.mkdirSync(astroSourcesDirectory, { recursive: true });
+			const lintPath = Path.join(astroSourcesDirectory, `${astroFileIndex}.tsx`);
+			const generatedBuffer = Buffer.from(convertedSource.code);
+			NFS.writeFileSync(lintPath, generatedBuffer);
+			lintFiles.push(candidateFile);
+			lintFiles.push(lintPath);
+			sourcePathByLintPath.set(Path.resolve(lintPath), candidateFile);
+			sourceMapByLintPath.set(Path.resolve(lintPath), {
+				traceMap: new TraceMap(JSON.stringify(convertedSource.map)),
+				generatedBuffer,
+				sourceBuffer
+			});
+			sizeByLintPath.set(lintPath, sourceBuffer.length);
+			astroFileIndex++;
+			continue;
+		}
 		const { executableScriptBodies, lintBuffer } = prepareHtmlScriptSource(sourceBuffer);
 		if (htmlFileIndex === 0) NFS.mkdirSync(htmlSourcesDirectory, { recursive: true });
 		const lintPath = Path.join(htmlSourcesDirectory, `${htmlFileIndex}.astro`);
@@ -75737,6 +76303,7 @@ const prepareHtmlLintSources = (rootDirectory, temporaryDirectory, candidateFile
 	return {
 		lintFiles,
 		sourcePathByLintPath,
+		sourceMapByLintPath,
 		sizeByLintPath,
 		hasThreeModuleImport
 	};
@@ -75955,10 +76522,10 @@ const runOxlint = async (options) => {
 			rootDirectory,
 			candidateFiles
 		});
-		const preparedHtmlSources = prepareHtmlLintSources(rootDirectory, configDirectory, candidateFiles);
-		const lintFiles = preparedHtmlSources.lintFiles;
-		const hasHtmlFiles = preparedHtmlSources.sourcePathByLintPath.size > 0;
-		const lintProject = !project.hasThree && preparedHtmlSources.hasThreeModuleImport ? {
+		const preparedLintSources = prepareLintSources(rootDirectory, configDirectory, candidateFiles);
+		const lintFiles = preparedLintSources.lintFiles;
+		const hasPreparedFiles = preparedLintSources.sourcePathByLintPath.size > 0;
+		const lintProject = !project.hasThree && preparedLintSources.hasThreeModuleImport ? {
 			...project,
 			hasThree: true
 		} : project;
@@ -75980,7 +76547,7 @@ const runOxlint = async (options) => {
 			sidecarRuleIdFilter: overrides.sidecarRuleIdFilter
 		});
 		const sizeByFile = sizedScanFiles !== null && lintBatchOrdering === "cost" ? new Map(sizedScanFiles.map((entry) => [entry.path, entry.sizeBytes])) : null;
-		if (sizeByFile !== null) for (const [lintPath, sizeBytes] of preparedHtmlSources.sizeByLintPath) sizeByFile.set(lintPath, sizeBytes);
+		if (sizeByFile !== null) for (const [lintPath, sizeBytes] of preparedLintSources.sizeByLintPath) sizeByFile.set(lintPath, sizeBytes);
 		const buildFileBatches = (passBaseArgs, passFiles) => sizeByFile !== null ? planLintBatches({
 			baseArgs: passBaseArgs,
 			files: passFiles,
@@ -76010,7 +76577,8 @@ const runOxlint = async (options) => {
 					rootDirectory,
 					nodeBinaryPath,
 					project: lintProject,
-					sourcePathByLintPath: preparedHtmlSources.sourcePathByLintPath,
+					sourcePathByLintPath: preparedLintSources.sourcePathByLintPath,
+					sourceMapByLintPath: preparedLintSources.sourceMapByLintPath,
 					onPartialFailure: reportPartialFailure,
 					onAnalyzedFiles: (filePaths) => {
 						analyzedFiles = filePaths;
@@ -76019,6 +76587,7 @@ const runOxlint = async (options) => {
 					spawnTimeoutMs,
 					outputMaxBytes,
 					concurrency: options.concurrency,
+					spawnSlots: options.spawnSlots,
 					signal: options.signal,
 					deadlineEpochMs: options.deadlineEpochMs
 				});
@@ -76045,7 +76614,7 @@ const runOxlint = async (options) => {
 				};
 			}
 		};
-		if (perFileLintCacheEnabled && !project.hasReactCompiler && project.hasReactCompilerLintPlugin !== true && extendsPaths.length === 0 && userPlugins.length === 0 && !hasHtmlFiles) {
+		if (perFileLintCacheEnabled && !project.hasReactCompiler && project.hasReactCompilerLintPlugin !== true && extendsPaths.length === 0 && userPlugins.length === 0 && !hasPreparedFiles) {
 			const rulesetHash = computeRulesetHash({
 				config: buildConfig({
 					extendsPaths: [],
@@ -76211,7 +76780,8 @@ const runOxlint = async (options) => {
 			rootDirectory,
 			nodeBinaryPath,
 			project: lintProject,
-			sourcePathByLintPath: preparedHtmlSources.sourcePathByLintPath,
+			sourcePathByLintPath: preparedLintSources.sourcePathByLintPath,
+			sourceMapByLintPath: preparedLintSources.sourceMapByLintPath,
 			onPartialFailure,
 			onAnalyzedFiles: (filePaths) => {
 				analyzedFiles = filePaths;
@@ -76220,6 +76790,7 @@ const runOxlint = async (options) => {
 			spawnTimeoutMs,
 			outputMaxBytes,
 			concurrency: options.concurrency,
+			spawnSlots: options.spawnSlots,
 			signal: options.signal,
 			deadlineEpochMs: options.deadlineEpochMs
 		});
@@ -76314,6 +76885,7 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 		const spawnTimeoutMs = yield* OxlintSpawnTimeoutMs;
 		const outputMaxBytes = yield* OxlintOutputMaxBytes;
 		const concurrency = yield* OxlintConcurrency;
+		const spawnSlots = yield* OxlintSpawnSlots;
 		const lintBatchOrdering = yield* LintBatchOrdering;
 		const perFileLintCacheEnabled = yield* PerFileLintCacheEnabled;
 		const sidecarLintCacheEnabled = yield* SidecarLintCacheEnabled;
@@ -76343,6 +76915,7 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 				onSidecarStats: input.onSidecarStats,
 				spawnTimeoutMs,
 				outputMaxBytes,
+				spawnSlots: spawnSlots ?? void 0,
 				concurrency,
 				signal,
 				lintBatchOrdering,
@@ -77571,10 +78144,14 @@ const materializeSourceTree = (input) => gen(function* () {
 		materializedFiles.push(relativePath);
 	}
 	yield* sync(() => {
-		for (const configFilename of STAGED_FILES_PROJECT_CONFIG_FILENAMES) {
-			const sourcePath = path.join(input.directory, configFilename);
-			const targetPath = path.join(resolvedTempDirectory, configFilename);
-			if (fs.existsSync(sourcePath) && !fs.existsSync(targetPath)) fs.cpSync(sourcePath, targetPath);
+		for (const subdirectory of ["", ...input.configSubdirectories ?? []]) for (const configFilename of STAGED_FILES_PROJECT_CONFIG_FILENAMES) {
+			const sourcePath = path.join(input.directory, subdirectory, configFilename);
+			const targetPath = path.resolve(resolvedTempDirectory, subdirectory, configFilename);
+			if (!isPathInsideDirectory(targetPath, resolvedTempDirectory)) continue;
+			if (fs.existsSync(sourcePath) && !fs.existsSync(targetPath)) {
+				fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+				fs.cpSync(sourcePath, targetPath);
+			}
 		}
 	});
 	return {
@@ -77607,15 +78184,17 @@ var StagedFiles = class StagedFiles extends Service()("react-doctor/StagedFiles"
 	static layerNode = effect(StagedFiles, gen(function* () {
 		const git = yield* Git;
 		return StagedFiles.of({
-			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(map$3((entries) => entries.filter(isLintableSourceFile)), withSpan("StagedFiles.discoverSourceFiles")),
-			materialize: ({ directory, stagedFiles, tempDirectory }) => materializeSourceTree({
+			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(map$3((entries) => entries === null ? null : entries.filter(isLintableSourceFile)), withSpan("StagedFiles.discoverSourceFiles")),
+			materialize: ({ directory, stagedFiles, tempDirectory, configSubdirectories }) => materializeSourceTree({
 				directory,
 				files: stagedFiles,
 				tempDirectory,
+				configSubdirectories,
 				readContent: (relativePath) => git.showStagedContent(directory, relativePath, { maxBufferBytes: GIT_SHOW_MAX_BUFFER_BYTES })
 			}).pipe(map$3((tree) => ({
 				tempDirectory: tree.tempDirectory,
 				stagedFiles: tree.materializedFiles,
+				unmaterializedFiles: tree.unmaterializedFiles,
 				cleanup: tree.cleanup
 			})), withSpan("StagedFiles.materialize"))
 		});
@@ -77630,6 +78209,7 @@ var StagedFiles = class StagedFiles extends Service()("react-doctor/StagedFiles"
 		materialize: ({ tempDirectory }) => succeed$2({
 			tempDirectory,
 			stagedFiles: snapshot.materializedFiles ?? snapshot.sourceFiles ?? [],
+			unmaterializedFiles: [],
 			cleanup: () => {}
 		})
 	}));
@@ -77998,6 +78578,11 @@ const computeConfigFingerprint = (projectDirectory, version) => {
 	}
 	return crypto.createHash("sha1").update(parts.join("|")).digest("hex");
 };
+const createLintPhaseAbortError = () => new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) });
+const createOxlintSpawnSlots = (concurrency) => createWorkerSlots({
+	slotCount: resolveScanConcurrency(concurrency),
+	createAbortError: createLintPhaseAbortError
+});
 const AI_TRAINING_ENV_VARS = [
 	["HF_DATASETS_CACHE", "huggingface"],
 	["HF_HOME", "huggingface"],
@@ -78077,7 +78662,7 @@ const groupBy = (items, keyFn) => {
 * recipe, so advertising "fetch the fix recipe" for them sends agents to
 * a 404. Gate the directive on this predicate.
 */
-const hasPublishedFixRecipe = (diagnostic) => diagnostic.plugin === "react-doctor" && Object.hasOwn(reactDoctorPlugin.rules, diagnostic.rule);
+const hasPublishedFixRecipe = (diagnostic) => diagnostic.plugin === "react-doctor" && Object.hasOwn(REACT_DOCTOR_RULE_REGISTRY, diagnostic.rule);
 const unionValues = (baseValues, overrideValues) => [...new Set([...baseValues, ...overrideValues])];
 const mergeIgnores = (baseIgnore, overrideIgnore) => {
 	const mergedIgnore = {
@@ -78326,6 +78911,7 @@ const BASELINE_FILES_TEMP_DIR_PREFIX = "react-doctor-baseline-";
 const SCAN_RESULT_CACHE_FILENAME = "scan-cache.json";
 const RUN_GIT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
 const GH_DEFAULT_BRANCH_PROBE_TIMEOUT_MS = 5e3;
+const TUI_REPORT_COMPACT_MAX_ROWS = 29;
 const TUI_REPORT_DETAIL_WIDTH_FRACTION = .6;
 const CI_TRUST_COMPANIES = "PayPal, Rippling, and Alibaba";
 const WELCOME_EXPLANATION_HOLD_MS = 1e3;
@@ -78338,11 +78924,13 @@ const METRIC = {
 	cliError: "cli.error",
 	cliEnvironmentError: "cli.env_error",
 	stagedSnapshotDivergence: "staged.snapshot_divergence",
+	stagedPerProject: "staged.per_project",
 	projectDetected: "project.detected",
 	projectPathSelected: "project.path_selected",
 	projectConfigSelected: "project.config_selected",
 	scanCompleted: "scan.completed",
 	scanDuration: "scan.duration",
+	scanFeedbackDelay: "scan.feedback_delay",
 	scanPhaseDuration: "scan.phase_duration",
 	scanFiles: "scan.files",
 	scanScore: "scan.score",
@@ -78374,6 +78962,10 @@ const METRIC = {
 	lspScanCompleted: "lsp.scan.completed",
 	lspScanDuration: "lsp.scan.duration",
 	lspScanDiagnostics: "lsp.scan.diagnostics",
+	tuiActionMenuOpened: "tui.action_menu_opened",
+	tuiCompactReportShown: "tui.compact_report_shown",
+	tuiFindingNavigated: "tui.finding_navigated",
+	tuiStackedReportCapped: "tui.stacked_report_capped",
 	aiTrainingWarningShown: "ai.training.warning_shown",
 	jsonOutUsed: "json.out_used"
 };
@@ -78418,7 +79010,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.9.2";
+const VERSION = "0.9.3";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -78776,13 +79368,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.2`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.3`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.2") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.3") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -90636,7 +91228,8 @@ const buildRuntimeLayers = (input) => {
 		resolvedDirectory: input.directory,
 		configSourceDirectory: input.configSourceDirectory
 	}) : Config.layerNode, Files.layerNode, Git.layerNode, linterLayer, LintPartialFailures.layerLive, deadCodeLayer, progressLayer, reporterLayer, scoreLayer, supplyChainLayer);
-	return input.oxlintConcurrency === void 0 ? baseLayers : mergeAll$1(baseLayers, succeed$3(OxlintConcurrency, input.oxlintConcurrency));
+	const layersWithConcurrency = input.oxlintConcurrency === void 0 ? baseLayers : mergeAll$1(baseLayers, succeed$3(OxlintConcurrency, input.oxlintConcurrency));
+	return input.oxlintSpawnSlots === void 0 ? layersWithConcurrency : mergeAll$1(layersWithConcurrency, succeed$3(OxlintSpawnSlots, input.oxlintSpawnSlots));
 };
 //#endregion
 //#region src/cli/utils/with-sentry-run-span.ts
@@ -92239,16 +92832,19 @@ const formatClusterLocation = (cluster, resolveSourceRoot, hyperlinks) => {
 	if (!hyperlinks) return `${location}${contextTag}`;
 	return `${formatHyperlink(location, pathToFileURL(resolveAbsolutePath(lead.filePath, resolveSourceRoot(lead))).href)}${contextTag}`;
 };
-const buildDiagnosticClusterLines = (cluster, resolveSourceRoot, renderCodeFrame, hyperlinks) => {
+const buildDiagnosticClusterLines = (cluster, resolveSourceRoot, resolveFrameSourceRoot, renderCodeFrame, hyperlinks) => {
 	const lead = cluster.diagnostics[0];
 	const isMultiSite = cluster.diagnostics.length > 1;
+	const sourceRoot = resolveSourceRoot(lead);
+	const frameSourceRoot = resolveFrameSourceRoot(lead);
+	const frameFilePath = Path.isAbsolute(lead.filePath) && sourceRoot !== frameSourceRoot ? Path.relative(sourceRoot, lead.filePath) : lead.filePath;
 	const lines = ["", highlighter.gray(`${TOP_ERROR_DETAIL_INDENT}${formatClusterLocation(cluster, resolveSourceRoot, hyperlinks)}`)];
 	const codeFrame = renderCodeFrame ? buildCodeFrame({
-		filePath: lead.filePath,
+		filePath: frameFilePath,
 		line: cluster.startLine,
 		column: isMultiSite ? 0 : lead.column,
 		endLine: isMultiSite ? cluster.endLine : void 0,
-		rootDirectory: resolveSourceRoot(lead)
+		rootDirectory: frameSourceRoot
 	}) : null;
 	if (codeFrame) {
 		const boxInnerWidth = resolveMeasureWidth(8);
@@ -92261,7 +92857,7 @@ const buildDiagnosticClusterLines = (cluster, resolveSourceRoot, renderCodeFrame
 	}
 	return lines;
 };
-const buildRuleDetailBlock = (ruleKey, ruleDiagnostics, resolveSourceRoot, renderEverySite, isAgentEnvironment, hyperlinks) => {
+const buildRuleDetailBlock = (ruleKey, ruleDiagnostics, resolveSourceRoot, resolveFrameSourceRoot, renderEverySite, isAgentEnvironment, hyperlinks) => {
 	const representative = pickRepresentativeDiagnostic(ruleDiagnostics);
 	const { severity } = representative;
 	const trailingBadge = formatTrailingSiteBadge(ruleDiagnostics.length);
@@ -92283,7 +92879,7 @@ const buildRuleDetailBlock = (ruleKey, ruleDiagnostics, resolveSourceRoot, rende
 	}
 	const renderCodeFrame = severity === "error";
 	const sites = renderEverySite ? ruleDiagnostics : [representative];
-	if (!(isCollapsedWarningGroup && representative.help.includes(representative.filePath))) for (const cluster of clusterNearbyDiagnostics(sites)) lines.push(...buildDiagnosticClusterLines(cluster, resolveSourceRoot, renderCodeFrame, hyperlinks));
+	if (!(isCollapsedWarningGroup && representative.help.includes(representative.filePath))) for (const cluster of clusterNearbyDiagnostics(sites)) lines.push(...buildDiagnosticClusterLines(cluster, resolveSourceRoot, resolveFrameSourceRoot, renderCodeFrame, hyperlinks));
 	return lines;
 };
 const selectErrorRuleGroups = (diagnostics, rulePriority) => buildSortedRuleGroups(diagnostics.filter((diagnostic) => diagnostic.severity === "error"), rulePriority);
@@ -92309,7 +92905,7 @@ const buildMigrationScaleAdvisoryLines = (diagnostics) => {
 	return lines;
 };
 const getTopErrorRuleKeys = (diagnostics, limit, rulePriority) => new Set(selectTopErrorRuleGroups(diagnostics, limit, rulePriority).map(([ruleKey]) => ruleKey));
-const buildTopErrorsSection = (diagnostics, resolveSourceRoot, hyperlinks, rulePriority) => {
+const buildTopErrorsSection = (diagnostics, resolveSourceRoot, resolveFrameSourceRoot, hyperlinks, rulePriority) => {
 	const topRuleGroups = selectErrorRuleGroups(diagnostics, rulePriority).slice(0, 3);
 	if (topRuleGroups.length === 0) return {
 		lines: [],
@@ -92319,7 +92915,7 @@ const buildTopErrorsSection = (diagnostics, resolveSourceRoot, hyperlinks, ruleP
 	const blockOffsets = [];
 	for (const [ruleKey, ruleDiagnostics] of topRuleGroups) {
 		blockOffsets.push(lines.length);
-		lines.push(...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, false, false, hyperlinks));
+		lines.push(...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, resolveFrameSourceRoot, false, false, hyperlinks));
 		lines.push("");
 	}
 	return {
@@ -92357,18 +92953,19 @@ const buildOverviewHeaderLines = (diagnostics) => {
 * single Effect.forEach over Console.log so failures or fiber
 * interruption produce predictable partial output.
 */
-const printDiagnostics = (diagnostics, isVerbose, sourceRoot, rulePriority, isAgentEnvironment = false, onboarding = {}, hyperlinks = false) => gen(function* () {
+const printDiagnostics = (diagnostics, isVerbose, sourceRoot, rulePriority, isAgentEnvironment = false, onboarding = {}, hyperlinks = false, frameSourceRoot = sourceRoot) => gen(function* () {
 	const sectionPause = onboarding.sectionPause ?? void_;
 	const animateCountUp = onboarding.animateCountUp ?? false;
 	const resolveSourceRoot = typeof sourceRoot === "function" ? sourceRoot : () => sourceRoot;
+	const resolveFrameSourceRoot = typeof frameSourceRoot === "function" ? frameSourceRoot : () => frameSourceRoot;
 	let detailLines;
 	let topErrorBlockOffsets = [];
 	if (!isVerbose) {
-		const topErrors = buildTopErrorsSection(diagnostics, resolveSourceRoot, hyperlinks, rulePriority);
+		const topErrors = buildTopErrorsSection(diagnostics, resolveSourceRoot, resolveFrameSourceRoot, hyperlinks, rulePriority);
 		detailLines = topErrors.lines;
 		topErrorBlockOffsets = topErrors.blockOffsets;
 	} else detailLines = buildSortedRuleGroups(diagnostics, rulePriority).flatMap(([ruleKey, ruleDiagnostics]) => {
-		return [...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, true, isAgentEnvironment, hyperlinks), ""];
+		return [...buildRuleDetailBlock(ruleKey, ruleDiagnostics, resolveSourceRoot, resolveFrameSourceRoot, true, isAgentEnvironment, hyperlinks), ""];
 	});
 	const overflowLine = isVerbose ? void 0 : buildOverflowSummaryLine(diagnostics, rulePriority);
 	const categoryTallies = buildCategoryDiagnosticGroups(diagnostics, rulePriority).map(buildCategoryTally);
@@ -93136,7 +93733,7 @@ const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorke
 		userConfig
 	};
 };
-const inspect = async (directory, inputOptions = {}) => {
+const inspectWithOxlintRuntime = async (directory, inputOptions, oxlintRuntime) => {
 	const startTime = performance$1.now();
 	const deadlineEpochMs = inputOptions.deadlineEpochMs ?? (inputOptions.maxDurationMs != null ? Date.now() + inputOptions.maxDurationMs : null);
 	const isConcurrentScan = inputOptions.concurrentScan === true;
@@ -93162,7 +93759,7 @@ const inspect = async (directory, inputOptions = {}) => {
 	try {
 		const result = await withSentryRunSpan(async (rootSentrySpan) => {
 			try {
-				return await runInspectWithRuntime(scanDirectory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, deadlineEpochMs, rootSentrySpan);
+				return await runInspectWithRuntime(scanDirectory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, deadlineEpochMs, rootSentrySpan, oxlintRuntime);
 			} catch (error) {
 				recordRunEvent(rootSentrySpan, {
 					...buildRunEventConfig(options, userConfig, userConfig !== null),
@@ -93178,6 +93775,15 @@ const inspect = async (directory, inputOptions = {}) => {
 		if (ownsSpinnerSilence) setSpinnerSilent(wasSpinnerSilent);
 	}
 };
+const createInvocationInspect = (requestedOxlintConcurrency) => {
+	const concurrency = resolveScanConcurrency(requestedOxlintConcurrency ?? runSync(OxlintConcurrency));
+	const oxlintRuntime = {
+		concurrency,
+		spawnSlots: createOxlintSpawnSlots(concurrency)
+	};
+	return (directory, inputOptions = {}) => inspectWithOxlintRuntime(directory, inputOptions, oxlintRuntime);
+};
+const inspect = async (directory, inputOptions = {}) => createInvocationInspect(inputOptions.concurrency)(directory, inputOptions);
 const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(lintPartialFailures) + countDeadlineSkippedFiles(lintPartialFailures);
 /**
 * Runs a second, lint-only scan over the changed files as they existed at the
@@ -93231,7 +93837,8 @@ const runBaselineComparison = async (params) => {
 			shouldRunSupplyChain: params.options.supplyChain,
 			shouldComputeScore: false,
 			shouldShowProgressSpinners: false,
-			oxlintConcurrency: params.options.concurrency
+			oxlintConcurrency: params.oxlintRuntime.concurrency,
+			oxlintSpawnSlots: params.oxlintRuntime.spawnSlots
 		});
 		const baseOutput = await runPromise(restoreLegacyThrow(runInspect({
 			directory: snapshot.tempDirectory,
@@ -93276,7 +93883,7 @@ const runBaselineComparison = async (params) => {
 		snapshot.cleanup();
 	}
 };
-const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, deadlineEpochMs, rootSentrySpan) => {
+const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOverride, configSourceDirectory, startTime, deadlineEpochMs, rootSentrySpan, oxlintRuntime) => {
 	const isDiffMode = options.includePaths.length > 0;
 	const resolvedNodeBinaryPath = await resolveOxlintNode(options.lint, options.scoreOnly || options.silent);
 	const lintBindingMissing = options.lint && !resolvedNodeBinaryPath;
@@ -93326,7 +93933,8 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		shouldRunSupplyChain: options.supplyChain,
 		shouldComputeScore: !options.noScore,
 		shouldShowProgressSpinners,
-		oxlintConcurrency: options.concurrency,
+		oxlintConcurrency: oxlintRuntime.concurrency,
+		oxlintSpawnSlots: oxlintRuntime.spawnSlots,
 		reporterLayer: options.uiLayers?.reporter,
 		progressLayer: options.uiLayers?.progress
 	});
@@ -93383,7 +93991,8 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 			baseFiles: options.baseline.baseFiles,
 			headFiles: options.baseline.headFiles,
 			headAnalyzedFiles: output.analyzedFiles,
-			deadlineEpochMs
+			deadlineEpochMs,
+			oxlintRuntime
 		});
 		if (comparison) {
 			inspectDiagnostics = comparison.displayDiagnostics;
@@ -93632,26 +94241,26 @@ const finalizeAndRender = (input) => gen(function* () {
 //#region src/cli/utils/get-staged-files.ts
 const stagedFilesLayer = StagedFiles.layerNode.pipe(provide$2(Git.layerNode));
 const getStagedSourceFiles = async (directory) => {
+	let stagedSourceFiles;
 	try {
-		return [...await runPromise(gen(function* () {
+		stagedSourceFiles = await runPromise(gen(function* () {
 			return yield* (yield* StagedFiles).discoverSourceFiles(directory);
-		}).pipe(provide(stagedFilesLayer)))];
+		}).pipe(provide(stagedFilesLayer)));
 	} catch (error) {
 		cliLogger.warn(`Failed to discover staged files: ${messageFromUnknown(error)}`);
 		return [];
 	}
+	if (stagedSourceFiles === null) throw new CliInputError("Could not read the git index to list staged files. Check that git can read the index in this directory.");
+	return [...stagedSourceFiles];
 };
-const materializeStagedFiles = async (directory, stagedFiles, tempDirectory) => {
+const materializeStagedFiles = async (input) => {
 	const snapshot = await runPromise(gen(function* () {
-		return yield* (yield* StagedFiles).materialize({
-			directory,
-			stagedFiles,
-			tempDirectory
-		});
+		return yield* (yield* StagedFiles).materialize(input);
 	}).pipe(provide(stagedFilesLayer)));
 	return {
 		tempDirectory: snapshot.tempDirectory,
 		stagedFiles: [...snapshot.stagedFiles],
+		unmaterializedFiles: [...snapshot.unmaterializedFiles],
 		cleanup: snapshot.cleanup
 	};
 };
@@ -95525,13 +96134,18 @@ const printMultiProjectSummary = (input) => gen(function* () {
 	const scoreDiagnostics = new Set(filterScansForSurface(completedScans, "score"));
 	const displayedScoreDiagnostics = displayDiagnostics.filter((diagnostic) => scoreDiagnostics.has(diagnostic));
 	const projectRootByDiagnostic = /* @__PURE__ */ new WeakMap();
-	for (const scan of completedScans) for (const diagnostic of scan.result.diagnostics) projectRootByDiagnostic.set(diagnostic, scan.result.project.rootDirectory);
+	const frameSourceRootByDiagnostic = /* @__PURE__ */ new WeakMap();
+	for (const scan of completedScans) for (const diagnostic of scan.result.diagnostics) {
+		projectRootByDiagnostic.set(diagnostic, scan.result.project.rootDirectory);
+		frameSourceRootByDiagnostic.set(diagnostic, scan.frameSourceRoot ?? scan.result.project.rootDirectory);
+	}
 	const resolveDiagnosticSourceRoot = (diagnostic) => projectRootByDiagnostic.get(diagnostic) ?? "";
+	const resolveDiagnosticFrameSourceRoot = (diagnostic) => frameSourceRootByDiagnostic.get(diagnostic) ?? resolveDiagnosticSourceRoot(diagnostic);
 	const totalScannedFileCount = countUniqueScannedFiles(completedScans.map((scan) => scan.result));
 	yield* log(`${highlighter.success("✔")} Scanned ${totalScannedFileCount} ${totalScannedFileCount === 1 ? "file" : "files"} in ${formatElapsedTime(totalElapsedMilliseconds)}`);
 	if (displayDiagnostics.length > 0) {
 		yield* log("");
-		yield* printDiagnostics(displayDiagnostics, verbose, resolveDiagnosticSourceRoot, buildRulePriorityMap(completedScans.map((scan) => scan.result.score)), isCodingAgentEnvironment(), { animateCountUp: animateRender }, shouldRenderHyperlinks(process.stdout));
+		yield* printDiagnostics(displayDiagnostics, verbose, resolveDiagnosticSourceRoot, buildRulePriorityMap(completedScans.map((scan) => scan.result.score)), isCodingAgentEnvironment(), { animateCountUp: animateRender }, shouldRenderHyperlinks(process.stdout), resolveDiagnosticFrameSourceRoot);
 	}
 	const lowestScoredScan = findLowestScoredScan(completedScans);
 	const aggregateScore = lowestScoredScan?.result.score ?? null;
@@ -95919,6 +96533,45 @@ const runExplain = async (fileLineArgument, context) => {
 	}
 };
 //#endregion
+//#region src/cli/utils/run-project-scan-batch.ts
+/**
+* Run one scan per project through the same bounded pool as
+* `diagnose({ projects })`, with the batch spinner and its progress counter.
+*
+* Pool members must not toggle the module-level spinner-silent flag themselves —
+* overlapping save/restore pairs would race — so the batch owns that toggle once
+* around the whole run.
+*
+* A `scanProject` that returns `null` drops the project from the results: diff
+* mode skips projects with no changed source.
+*/
+const runProjectScanBatch = async (input) => {
+	const startTime = performance$1.now();
+	const projectCount = input.projects.length;
+	const isMultiProject = projectCount > 1;
+	const batchSpinner = isMultiProject && !input.isQuiet ? spinner(`Scanning ${projectCount} projects…`).start() : null;
+	const ownsBatchSpinnerSilence = isMultiProject && input.isSilent;
+	const wasSpinnerSilent = isSpinnerSilent();
+	if (ownsBatchSpinnerSilence) setSpinnerSilent(true);
+	let finishedProjectCount = 0;
+	let scanOutcomes;
+	try {
+		scanOutcomes = await mapWithConcurrency(input.projects, isMultiProject ? 4 : 1, async (project) => {
+			const scanOutcome = await input.scanProject(project);
+			finishedProjectCount += 1;
+			batchSpinner?.update(`Scanning ${projectCount} projects… (${finishedProjectCount}/${projectCount})`);
+			return scanOutcome;
+		});
+	} finally {
+		if (ownsBatchSpinnerSilence) setSpinnerSilent(wasSpinnerSilent);
+		batchSpinner?.stop();
+	}
+	return {
+		completedScans: scanOutcomes.filter((scanOutcome) => scanOutcome !== null),
+		elapsedMilliseconds: performance$1.now() - startTime
+	};
+};
+//#endregion
 //#region src/cli/utils/project-manifest-changed.ts
 const PACKAGE_JSON = "package.json";
 /**
@@ -95935,6 +96588,29 @@ const projectManifestChanged = (rootDirectory, projectDirectory, diffInfo) => {
 	return diffInfo.changedFiles.some((filePath) => toForwardSlashes(filePath) === manifestPath);
 };
 //#endregion
+//#region src/cli/utils/select-staged-projects.ts
+/**
+* Appended to the reason a `--staged` run could not scan per package. Shared so
+* both fallback sites word it identically.
+*/
+const STAGED_PROJECT_FALLBACK_HINT = "Scanning the staged files at the scan root instead — fix the `projects` entries in your config to scan per package.";
+/**
+* Resolve the project directories a `--staged` scan owns. The interactive picker
+* is always skipped: a commit hook has nobody to answer it.
+*/
+const selectStagedProjects = async (input) => {
+	if (input.projectFlag) return selectProjects(input.rootDirectory, input.projectFlag, true, void 0);
+	if (input.configProjects === void 0) return [input.rootDirectory];
+	try {
+		return await selectProjects(input.rootDirectory, void 0, true, input.configProjects);
+	} catch (error) {
+		if (!(error instanceof CliInputError)) throw error;
+		cliLogger.warn(`${error.message} ${STAGED_PROJECT_FALLBACK_HINT}`);
+		cliLogger.break();
+		return [input.rootDirectory];
+	}
+};
+//#endregion
 //#region src/cli/utils/should-fail-scan-gate.ts
 const shouldFailScanGate = (input) => {
 	if (input.blockingLevel === "none") return false;
@@ -96100,6 +96776,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 	const isQuiet = isScoreOnly || isJsonMode;
 	const requestedDirectory = Path.resolve(directory);
 	const startTime = performance$1.now();
+	let scanStartupSpinner = null;
 	if (isJsonMode) {
 		enableJsonMode({
 			compact: Boolean(flags.jsonCompact),
@@ -96148,6 +96825,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 		if (!isQuiet) if (!flags.verbose && canAnimateOnboarding(process.stdout)) await runPromise(playWelcomeScene({ speedMultiplier: !isOnboardingForced() && hasCompletedOnboarding() ? 2 : 1 }));
 		else runSync(printBrandedHeader);
 		const scanOptions = resolveCliInspectOptions(flags, userConfig);
+		const inspectProject = createInvocationInspect(scanOptions.concurrency);
 		const scanDeadlineEpochMs = scanOptions.maxDurationMs !== void 0 ? Date.now() + scanOptions.maxDurationMs : void 0;
 		const categoryFilters = new Set(scanOptions.categoryFilters ?? []);
 		const skipPrompts = shouldSkipPrompts({
@@ -96155,8 +96833,13 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			json: flags.json
 		});
 		if (flags.staged) {
-			const stagedFiles = await getStagedSourceFiles(resolvedDirectory);
-			if (stagedFiles.length === 0) {
+			const configProjectsApply = (userConfig?.projects ?? []).some((projectName) => projectName.trim().length > 0) && scanTarget.requestedDirectory === scanTarget.configSourceDirectory;
+			const projectDirectories = await selectStagedProjects({
+				rootDirectory: resolvedDirectory,
+				projectFlag: flags.project,
+				configProjects: configProjectsApply ? userConfig?.projects : void 0
+			});
+			const reportNothingToScan = (input) => {
 				if (isJsonMode) writeJsonReport(buildJsonReport({
 					version: VERSION,
 					directory: resolvedDirectory,
@@ -96165,75 +96848,214 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 					scans: [],
 					totalElapsedMilliseconds: performance$1.now() - startTime
 				}));
-				else if (!isScoreOnly) cliLogger.dim("No staged source files found.");
+				else if (!isScoreOnly) if (input.severity === "warn") {
+					cliLogger.warn(input.reason);
+					cliLogger.break();
+				} else cliLogger.dim(input.reason);
+			};
+			const rootStagedFiles = await getStagedSourceFiles(resolvedDirectory);
+			if (rootStagedFiles.length === 0) {
+				reportNothingToScan({ reason: "No staged source files found." });
 				return;
 			}
-			if (!isQuiet) {
-				cliLogger.log(`Scanning ${highlighter.info(`${stagedFiles.length}`)} staged files...`);
+			const buildProjectScanContext = async (projectDirectory) => {
+				const projectScanTarget = projectDirectory === resolvedDirectory ? scanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
+				const scanDirectory = projectScanTarget.resolvedDirectory;
+				const treeRelativeDirectory = resolveProjectRelativeDirectory(resolvedDirectory, scanDirectory);
+				if (treeRelativeDirectory === null) return null;
+				return {
+					projectDirectory,
+					scanDirectory,
+					treeRelativeDirectory,
+					projectConfig: projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0),
+					projectConfigSourceDirectory: projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory
+				};
+			};
+			const projectScanContexts = [];
+			const seenScanDirectories = /* @__PURE__ */ new Set();
+			for (const projectDirectory of projectDirectories) {
+				const projectScanContext = await buildProjectScanContext(projectDirectory);
+				if (projectScanContext === null) {
+					if (flags.project) throw new CliInputError(`Project "${toRelativePath(projectDirectory, resolvedDirectory)}" is outside ${resolvedDirectory}, so it holds none of the staged files. Run --staged from a directory that contains the project.`);
+					continue;
+				}
+				if (seenScanDirectories.has(projectScanContext.scanDirectory)) continue;
+				seenScanDirectories.add(projectScanContext.scanDirectory);
+				projectScanContexts.push(projectScanContext);
+			}
+			if (projectScanContexts.length === 0) {
+				cliLogger.warn(`No configured project is inside ${resolvedDirectory}. ${STAGED_PROJECT_FALLBACK_HINT}`);
 				cliLogger.break();
+				const rootScanContext = await buildProjectScanContext(resolvedDirectory);
+				if (rootScanContext !== null) projectScanContexts.push(rootScanContext);
 			}
-			const tempDirectory = NFS.mkdtempSync(Path.join(tmpdir(), STAGED_FILES_TEMP_DIR_PREFIX));
-			const snapshot = await materializeStagedFiles(resolvedDirectory, stagedFiles, tempDirectory).catch((error) => {
-				NFS.rmSync(tempDirectory, {
-					recursive: true,
-					force: true
+			const contextsByLongestPathFirst = [...projectScanContexts].sort((left, right) => right.treeRelativeDirectory.length - left.treeRelativeDirectory.length);
+			const ownedStagedFiles = /* @__PURE__ */ new Map();
+			for (const stagedFile of rootStagedFiles) {
+				const owner = contextsByLongestPathFirst.find((context) => context.treeRelativeDirectory.length === 0 || stagedFile.startsWith(`${context.treeRelativeDirectory}/`));
+				if (owner === void 0) continue;
+				const ownedFiles = ownedStagedFiles.get(owner.scanDirectory);
+				if (ownedFiles === void 0) ownedStagedFiles.set(owner.scanDirectory, [stagedFile]);
+				else ownedFiles.push(stagedFile);
+			}
+			const stagedProjectScans = [];
+			for (const projectScanContext of projectScanContexts) {
+				const projectStagedFiles = ownedStagedFiles.get(projectScanContext.scanDirectory);
+				if (projectStagedFiles === void 0) continue;
+				stagedProjectScans.push({
+					...projectScanContext,
+					stagedFiles: projectStagedFiles
 				});
-				throw error;
-			});
+			}
+			if (stagedProjectScans.length === 0) {
+				reportNothingToScan({ reason: "No staged source files in the selected projects." });
+				return;
+			}
+			const selectedStagedFiles = stagedProjectScans.flatMap((projectScan) => projectScan.stagedFiles);
+			const stagedFileCount = selectedStagedFiles.length;
+			const unselectedStagedFileCount = rootStagedFiles.length - stagedFileCount;
+			if (!isQuiet) {
+				cliLogger.log(`Scanning ${highlighter.info(`${stagedFileCount}`)} staged files...`);
+				if (unselectedStagedFileCount > 0) cliLogger.dim(`${unselectedStagedFileCount} more staged file${unselectedStagedFileCount === 1 ? "" : "s"} outside the selected projects.`);
+				cliLogger.break();
+			}
 			const stagedWantsLines = resolveScope(flags, userConfig).scope === "lines";
 			const stagedLineRanges = stagedWantsLines ? await getChangedLineRanges({
 				directory: resolvedDirectory,
 				cached: true,
-				files: snapshot.stagedFiles
+				files: selectedStagedFiles
 			}) : null;
 			if (stagedWantsLines && stagedLineRanges === null && !isQuiet) {
 				cliLogger.warn("Could not determine staged changed lines; reporting all issues in staged files.");
 				cliLogger.break();
 			}
-			try {
-				const scanResult = await inspect(snapshot.tempDirectory, {
+			if (stagedProjectScans.some((projectScan) => projectScan.treeRelativeDirectory.length > 0)) recordCount(METRIC.stagedPerProject, 1, { projectCount: stagedProjectScans.length });
+			const tempDirectory = NFS.mkdtempSync(Path.join(tmpdir(), STAGED_FILES_TEMP_DIR_PREFIX));
+			const configSubdirectories = /* @__PURE__ */ new Set();
+			for (const projectScan of stagedProjectScans) {
+				configSubdirectories.add(projectScan.treeRelativeDirectory);
+				const projectRelativeDirectory = resolveProjectRelativeDirectory(resolvedDirectory, projectScan.projectDirectory);
+				if (projectRelativeDirectory !== null) configSubdirectories.add(projectRelativeDirectory);
+			}
+			const snapshot = await materializeStagedFiles({
+				directory: resolvedDirectory,
+				stagedFiles: selectedStagedFiles,
+				tempDirectory,
+				configSubdirectories: [...configSubdirectories]
+			}).catch((error) => {
+				NFS.rmSync(tempDirectory, {
+					recursive: true,
+					force: true
+				});
+				throw error;
+			});
+			const materializedStagedFiles = new Set(snapshot.stagedFiles);
+			const stagedProjectRuns = stagedProjectScans.map((projectScan) => ({
+				projectScan,
+				includePaths: resolveProjectSourceFilePaths(resolvedDirectory, projectScan.scanDirectory, projectScan.stagedFiles.filter((stagedFile) => materializedStagedFiles.has(stagedFile)))
+			})).filter((projectRun) => projectRun.includePaths.length > 0);
+			const isMultiProject = stagedProjectRuns.length > 1;
+			if (stagedProjectRuns.length === 0) {
+				snapshot.cleanup();
+				reportNothingToScan({
+					reason: `Could not read any of the ${stagedFileCount} staged file${stagedFileCount === 1 ? "" : "s"} out of the index, so nothing was scanned. An unusually large staged file is the usual cause.`,
+					severity: "warn"
+				});
+				return;
+			}
+			if (snapshot.unmaterializedFiles.length > 0 && !isQuiet) {
+				const stagedFileLabel = `staged file${stagedFileCount === 1 ? "" : "s"}`;
+				cliLogger.warn(`Skipped ${snapshot.unmaterializedFiles.length} of ${stagedFileCount} ${stagedFileLabel}; they could not be snapshotted from the index.`);
+				cliLogger.break();
+			}
+			const scanStagedProject = async (projectRun) => {
+				const { projectScan, includePaths } = projectRun;
+				const projectTempDirectory = Path.join(snapshot.tempDirectory, projectScan.treeRelativeDirectory);
+				const scanResult = await inspectProject(projectTempDirectory, {
 					...scanOptions,
 					deadlineEpochMs: scanDeadlineEpochMs,
-					includePaths: snapshot.stagedFiles,
-					configOverride: userConfig,
-					configSourceDirectory: scanTarget.configSourceDirectory ?? void 0,
-					changedLineRanges: stagedLineRanges ?? void 0
+					includePaths: [...includePaths],
+					configOverride: projectScan.projectConfig,
+					configSourceDirectory: projectScan.projectConfigSourceDirectory ?? void 0,
+					changedLineRanges: stagedLineRanges === null ? void 0 : resolveProjectChangedLineRanges(resolvedDirectory, projectScan.scanDirectory, stagedLineRanges),
+					suppressRendering: isMultiProject,
+					concurrentScan: isMultiProject
 				});
 				const remappedDiagnostics = scanResult.diagnostics.map((diagnostic) => ({
 					...diagnostic,
-					filePath: Path.isAbsolute(diagnostic.filePath) ? diagnostic.filePath.replaceAll(snapshot.tempDirectory, () => resolvedDirectory) : diagnostic.filePath
+					filePath: Path.isAbsolute(diagnostic.filePath) ? diagnostic.filePath.replaceAll(projectTempDirectory, () => projectScan.scanDirectory) : diagnostic.filePath
 				}));
-				finalizeScans({
-					completedScans: [{
-						directory: resolvedDirectory,
-						result: {
-							...scanResult,
-							diagnostics: remappedDiagnostics,
-							project: {
-								...scanResult.project,
-								rootDirectory: resolvedDirectory
-							}
-						},
-						config: userConfig
-					}],
-					mode: "staged",
-					diff: null,
-					baselineIntended: false,
-					isJsonMode,
-					isScoreOnly,
-					flags,
-					categoryFilters,
-					userConfig,
-					resolvedDirectory,
-					startTime
-				});
+				return {
+					directory: projectScan.scanDirectory,
+					result: {
+						...scanResult,
+						diagnostics: remappedDiagnostics,
+						project: {
+							...scanResult.project,
+							rootDirectory: projectScan.scanDirectory
+						}
+					},
+					config: projectScan.projectConfig,
+					frameSourceRoot: projectTempDirectory
+				};
+			};
+			const stagedBatch = await runProjectScanBatch({
+				projects: stagedProjectRuns,
+				isQuiet,
+				isSilent: scanOptions.silent === true,
+				scanProject: scanStagedProject
+			}).catch((error) => {
+				snapshot.cleanup();
+				throw error;
+			});
+			const completedScans = stagedBatch.completedScans;
+			try {
+				if (!isQuiet && isMultiProject) {
+					const showShareLink = !isShareOptedOut(completedScans, scanOptions.noScore) && !scanOptions.isCi;
+					await runPromise(printMultiProjectSummary({
+						completedScans,
+						categoryFilters,
+						verbose: Boolean(flags.verbose),
+						outputDirectory: flags.outputDir,
+						isOffline: !showShareLink,
+						projectName: Path.basename(resolvedDirectory),
+						totalElapsedMilliseconds: stagedBatch.elapsedMilliseconds
+					}));
+				}
+				if (flags.outputDir && isMultiProject && isQuiet) await runPromise(printDiagnosticsDump(filterDiagnosticsByCategories(filterScansForSurface(completedScans, scanOptions.outputSurface ?? "cli"), categoryFilters), flags.outputDir, false, "stderr"));
 			} finally {
 				snapshot.cleanup();
 			}
+			finalizeScans({
+				completedScans,
+				mode: "staged",
+				diff: null,
+				baselineIntended: false,
+				isJsonMode,
+				isScoreOnly,
+				flags,
+				categoryFilters,
+				userConfig,
+				resolvedDirectory,
+				startTime
+			});
 			return;
 		}
 		const projectDirectories = await selectProjects(resolvedDirectory, flags.project, skipPrompts, userConfig?.projects);
-		const changedFilesDiffInfo = flags.changedFilesFrom ? buildChangedFilesDiffInfo(readChangedFilesFrom(Path.resolve(flags.changedFilesFrom))) : null;
+		const projectSelectionCompletedTime = performance$1.now();
+		let changedFilesDiffInfo = flags.changedFilesFrom ? buildChangedFilesDiffInfo(readChangedFilesFrom(Path.resolve(flags.changedFilesFrom))) : null;
+		if (changedFilesDiffInfo !== null && scanTarget.didRedirectViaRootDir) {
+			const relativeProjectDirectory = resolveProjectRelativeDirectory(requestedDirectory, resolvedDirectory);
+			if (relativeProjectDirectory) {
+				const projectPrefix = `${relativeProjectDirectory}/`;
+				changedFilesDiffInfo = {
+					...changedFilesDiffInfo,
+					changedFiles: changedFilesDiffInfo.changedFiles.flatMap((filePath) => {
+						return filePath.startsWith(projectPrefix) ? [filePath.slice(projectPrefix.length)] : [];
+					})
+				};
+			}
+		}
 		const requestedScope = resolveScope(flags, userConfig);
 		const includeUntracked = flags.includeUntracked ?? false;
 		const scopeRequest = requestedScope.scope === void 0 && changedFilesDiffInfo !== null ? {
@@ -96241,15 +97063,20 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			scope: "changed"
 		} : requestedScope;
 		validateIncludeUntrackedScope(includeUntracked, scopeRequest.scope);
+		scanStartupSpinner = !isQuiet ? spinner("Scanning...").start() : null;
+		if (scanStartupSpinner !== null) recordDistribution(METRIC.scanFeedbackDelay, performance$1.now() - projectSelectionCompletedTime, { unit: "millisecond" });
 		const wantsDiffMode = scopeRequest.scope !== void 0 && scopeRequest.scope !== "full";
 		const shouldDetectDiff = changedFilesDiffInfo === null && (wantsDiffMode || scopeRequest.scope === void 0 && !skipPrompts && !isQuiet);
 		const diffInfo = changedFilesDiffInfo ?? (shouldDetectDiff ? await getDiffInfo(resolvedDirectory, scopeRequest.base, includeUntracked) : null);
+		scanStartupSpinner?.stop();
+		scanStartupSpinner = null;
 		const scope = await finalizeScope({
 			requested: scopeRequest,
 			diffInfo,
 			skipPrompts,
 			isQuiet
 		});
+		scanStartupSpinner = !isQuiet ? spinner("Scanning...").start() : null;
 		const isDiffMode = scope !== "full";
 		const comparisonBaseRef = isDiffMode && diffInfo && !diffInfo.isCurrentChanges ? diffInfo.baseSha ? await resolveMergeBaseRef(resolvedDirectory, diffInfo.baseSha) : diffInfo.diffBaseRef ?? await resolveMergeBaseRef(resolvedDirectory, diffInfo.baseBranch) : null;
 		const baselineRef = scope === "changed" ? comparisonBaseRef : null;
@@ -96261,6 +97088,8 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			files: [...diffInfo.changedFiles],
 			includeUntracked
 		}) : null;
+		scanStartupSpinner?.stop();
+		scanStartupSpinner = null;
 		if (scope === "lines" && changedLineRanges === null && !isQuiet) {
 			cliLogger.warn("Could not determine changed lines (no base ref or git diff failed); reporting all issues in changed files.");
 			cliLogger.break();
@@ -96274,7 +97103,6 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 			cliLogger.break();
 		}
-		const completedScans = [];
 		const isMultiProject = projectDirectories.length > 1;
 		const scanProject = async (projectDirectory) => {
 			const projectScanTarget = projectDirectory === resolvedDirectory ? scanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
@@ -96302,7 +97130,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 				if (supplyChainManifestChanged) includePaths.push("package.json");
 			}
 			if (!isQuiet && !isMultiProject) cliLogger.dim("  ");
-			const scanResult = await inspect(scanDirectory, {
+			const scanResult = await inspectProject(scanDirectory, {
 				...scanOptions,
 				deadlineEpochMs: scanDeadlineEpochMs,
 				includePaths,
@@ -96325,29 +97153,13 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 				config: projectConfig
 			};
 		};
-		const scanLoopStartTime = performance$1.now();
-		const projectCount = projectDirectories.length;
-		const batchSpinner = isMultiProject && !isQuiet ? spinner(`Scanning ${projectCount} projects…`).start() : null;
-		const ownsBatchSpinnerSilence = isMultiProject && scanOptions.silent === true;
-		const wasSpinnerSilent = isSpinnerSilent();
-		if (ownsBatchSpinnerSilence) setSpinnerSilent(true);
-		let finishedProjectCount = 0;
-		let scanOutcomes;
-		try {
-			scanOutcomes = await mapWithConcurrency(projectDirectories, isMultiProject ? 4 : 1, async (projectDirectory) => {
-				const scanOutcome = await scanProject(projectDirectory);
-				finishedProjectCount += 1;
-				batchSpinner?.update(`Scanning ${projectCount} projects… (${finishedProjectCount}/${projectCount})`);
-				return scanOutcome;
-			});
-		} finally {
-			if (ownsBatchSpinnerSilence) setSpinnerSilent(wasSpinnerSilent);
-			batchSpinner?.stop();
-		}
-		for (const scanOutcome of scanOutcomes) {
-			if (scanOutcome === null) continue;
-			completedScans.push(scanOutcome);
-		}
+		const projectBatch = await runProjectScanBatch({
+			projects: projectDirectories,
+			isQuiet,
+			isSilent: scanOptions.silent === true,
+			scanProject
+		});
+		const completedScans = projectBatch.completedScans;
 		if (!isQuiet && isMultiProject && completedScans.length > 0) {
 			const showShareLink = !isShareOptedOut(completedScans, scanOptions.noScore) && !scanOptions.isCi;
 			await runPromise(printMultiProjectSummary({
@@ -96357,7 +97169,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 				outputDirectory: flags.outputDir,
 				isOffline: !showShareLink,
 				projectName: Path.basename(resolvedDirectory),
-				totalElapsedMilliseconds: performance$1.now() - scanLoopStartTime
+				totalElapsedMilliseconds: projectBatch.elapsedMilliseconds
 			}));
 		}
 		const selectedSurfaceDiagnostics = filterDiagnosticsByCategories(filterScansForSurface(completedScans, scanOptions.outputSurface ?? "cli"), categoryFilters);
@@ -96404,6 +97216,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 		}
 	} catch (error) {
+		scanStartupSpinner?.stop();
 		const isUserError = isExpectedUserError(error);
 		const sentryEventId = isUserError ? void 0 : await reportErrorToSentry(error);
 		if (isDebugFlagEnabled()) await flushSentry();
@@ -97338,6 +98151,7 @@ const COMMAND_FLAG_SPECS = new Map([
 			"--no-color",
 			"--no-dead-code",
 			"--no-score",
+			"--no-supply-chain",
 			"--yes"
 		]),
 		longOptionsWithRequiredValues: new Set(["--blocking", "--project"]),
@@ -97501,7 +98315,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS and inline HTML script source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS and inline HTML script source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks (honors --project and config `projects`; exits 0 when nothing is staged)").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("design [directory]").description("Run only the focused UI design diagnostics").addHelpText("after", renderDesignHelpEpilog).action((directory, _options, command) => designAction(directory ?? ".", command.optsWithGlobals()));
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
@@ -97523,15 +98337,17 @@ rules.command("category <category> <severity>").description("Set the severity fo
 rules.command("ignore-tag <tag>").description("Skip a whole rule family by tag before linting (e.g. design)").option("-c, --cwd <cwd>", "working directory", process.cwd()).action((tag, _options, command) => rulesIgnoreTagAction(tag, command.optsWithGlobals()));
 rules.command("unignore-tag <tag>").description("Stop ignoring a tag previously skipped via ignore-tag").option("-c, --cwd <cwd>", "working directory", process.cwd()).action((tag, _options, command) => rulesUnignoreTagAction(tag, command.optsWithGlobals()));
 program.command("experimental-lsp", { hidden: false }).description("[experimental] run the React Doctor language server over stdio (for editors)").allowUnknownOption().action(() => {});
-program.command("experimental-tui [directory]", { hidden: true }).description("[experimental] interactive, scrollable scan report").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").option("--no-dead-code", "skip dead-code analysis").option("--no-score", "skip the score API, the share URL, and crash reporting").option("-p, --project <names>", "scan specific workspace projects (comma-separated, or *)").option("-y, --yes", "skip the project prompt and scan every discovered project").action(async (directory = ".", _localOptions, command) => {
+program.command("experimental-tui [directory]", { hidden: true }).description("[experimental] interactive, scrollable scan report").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").option("--no-dead-code", "skip dead-code analysis").option("--no-supply-chain", "skip the dependency supply-chain scan").option("--no-score", "skip the score API, the share URL, and crash reporting").option("-p, --project <names>", "scan specific workspace projects (comma-separated, or *)").option("-y, --yes", "skip the project prompt and scan every discovered project").action(async (directory = ".", _localOptions, command) => {
 	const options = command.optsWithGlobals();
 	const deadCode = options.deadCode === false ? false : void 0;
 	const noScore = options.score === false ? true : void 0;
+	const supplyChain = options.supplyChain === false ? false : void 0;
 	const nodeMajorVersion = Number(process.versions.node.split(".")[0]);
 	if (process.stdout.isTTY !== true || process.stdin.isTTY !== true || isNonInteractiveEnvironment() || nodeMajorVersion < 22) {
 		await inspectAction(directory, {
 			deadCode,
 			score: options.score === false ? false : void 0,
+			supplyChain,
 			project: options.project,
 			yes: options.yes,
 			blocking: options.blocking
@@ -97539,12 +98355,13 @@ program.command("experimental-tui [directory]", { hidden: true }).description("[
 		return;
 	}
 	recordCount(METRIC.cliInvoked, 1, { command: "experimental-tui" });
-	const { runScanApp } = await import("./run-scan-app-DZ5jGWFf.js");
+	const { runScanApp } = await import("./run-scan-app-DHRvqfkX.js");
 	const { shouldFail } = await runScanApp({
 		directory,
 		options: {
 			deadCode,
-			noScore
+			noScore,
+			supplyChain
 		},
 		projectFlag: options.project,
 		skipPrompts: options.yes ?? false,
@@ -97578,7 +98395,7 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 	handleError(error, { sentryEventId });
 });
 //#endregion
-export { toForwardSlashes as A, highlighter as B, buildRulePriorityMap as C, resolveBlockingLevel as D, formatLearnMoreLine as E, isCiEnvironment as F, sync as G, mergeReactDoctorConfigs as H, DIAGNOSTIC_CATEGORY_BUCKETS as I, void_ as K, Progress as L, isUnicodeSupported as M, METRIC as N, isReactDoctorWorkflowInstalled as O, TUI_REPORT_DETAIL_WIDTH_FRACTION as P, Reporter as R, hasLintHardFailure as S, formatFixRecipeLine as T, resolveScanTarget as U, mapWithConcurrency as V, runPromise as W, canAnimateOnboarding as _, resolveCliInspectOptions as a, buildCodeFrame as b, detectLaunchableAgents as c, launchCliAgent as d, isShareOptedOut as f, doctorFace as g, easeOutCubic as h, selectProjects as i, findNearestPackageDirectory as j, recordCount as k, CLI_AGENT_BINARIES as l, printFooter as m, shouldFailScanGate as n, countUniqueScannedFiles as o, inspect as p, succeed$3 as q, discoverWorkspacePackages as r, setUpGitHubActions as s, exitGracefully as t, copyToClipboard as u, computeProjectedScore as v, buildSortedRuleGroups as w, buildNoScoreMessage as x, formatElapsedTime as y, getCategoryImpact as z };
+export { toForwardSlashes as A, getCategoryImpact as B, buildRulePriorityMap as C, resolveBlockingLevel as D, formatLearnMoreLine as E, TUI_REPORT_DETAIL_WIDTH_FRACTION as F, runPromise as G, mapWithConcurrency as H, isCiEnvironment as I, succeed$3 as J, sync as K, DIAGNOSTIC_CATEGORY_BUCKETS as L, isUnicodeSupported as M, METRIC as N, isReactDoctorWorkflowInstalled as O, TUI_REPORT_COMPACT_MAX_ROWS as P, Progress as R, hasLintHardFailure as S, formatFixRecipeLine as T, mergeReactDoctorConfigs as U, highlighter as V, resolveScanTarget as W, canAnimateOnboarding as _, resolveCliInspectOptions as a, buildCodeFrame as b, detectLaunchableAgents as c, launchCliAgent as d, isShareOptedOut as f, doctorFace as g, easeOutCubic as h, selectProjects as i, findNearestPackageDirectory as j, recordCount as k, CLI_AGENT_BINARIES as l, printFooter as m, shouldFailScanGate as n, countUniqueScannedFiles as o, createInvocationInspect as p, void_ as q, discoverWorkspacePackages as r, setUpGitHubActions as s, exitGracefully as t, copyToClipboard as u, computeProjectedScore as v, buildSortedRuleGroups as w, buildNoScoreMessage as x, formatElapsedTime as y, Reporter as z };
 
 //# sourceMappingURL=cli.js.map
-//# debugId=c86de9ea-b858-5528-89a8-6ff4d377c873
+//# debugId=707bd0ef-8490-5120-ba82-f65ad0b490e1