react-doctor 0.9.3 → 0.9.4-dev.25dbf6d

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="707bd0ef-8490-5120-ba82-f65ad0b490e1")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e74e6a68-20e1-59fe-8db0-62b87e8fe049")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -6666,7 +6666,7 @@ const flatMap$5 = /* @__PURE__ */ dual(2, (self, f) => isNone(self) ? none() : f
 * @category filtering
 * @since 2.0.0
 */
-const filter = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
+const filter$1 = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.0-beta.70/node_modules/effect/dist/Result.js
 /**
@@ -18657,7 +18657,7 @@ function transformOptional(f) {
 */
 function withDefault$1(defaultValue) {
 	return new Getter((o) => {
-		const filtered = filter(o, isNotUndefined);
+		const filtered = filter$1(o, isNotUndefined);
 		return isSome(filtered) ? succeed$2(filtered) : mapEager(defaultValue, some);
 	});
 }
@@ -22505,6 +22505,10 @@ var JsonReportProjectEntryV3 = class extends Class("JsonReportProjectEntryV3")({
 	scannedFileCount: optional(Number$1),
 	elapsedMilliseconds: Number$1
 }) {};
+var JsonReportSkippedProject = class extends Class("JsonReportSkippedProject")({
+	directory: String$1,
+	reason: Literal("max-duration")
+}) {};
 /** Original full, diff, and staged report contract. */
 var JsonReportV1 = class extends Class("JsonReportV1")({
 	schemaVersion: Literal(1),
@@ -22533,6 +22537,7 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -22561,6 +22566,7 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: JsonReportBaseline,
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -22577,6 +22583,7 @@ var JsonReportV3 = class extends Class("JsonReportV3")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: optional(JsonReportBaseline),
 	projects: ArraySchema(JsonReportProjectEntryV3),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(JsonReportDiagnosticV3),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -56559,6 +56566,47 @@ const flattenArray = (self) => transformPull$1(self, (pull) => {
 	}));
 });
 /**
+* Filters arrays of elements emitted by a channel, applying the filter
+* to each element within the arrays and only emitting non-empty filtered arrays.
+*
+* **Example** (Filtering array output)
+*
+* ```ts
+* import { Array, Channel } from "effect"
+*
+* const nonEmptyArrayPredicate = Array.isReadonlyArrayNonEmpty
+*
+* // Create a channel that outputs arrays of mixed data
+* const arrayChannel = Channel.fromIterable([
+*   Array.make(1, 2, 3, 4, 5),
+*   Array.make(6, 7, 8, 9, 10),
+*   Array.make(11, 12, 13, 14, 15)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+*
+* // Filter arrays to keep only even numbers
+* const evenArraysChannel = Channel.filterArray(arrayChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4], [6, 8, 10], [12, 14]
+* // Note: Only non-empty filtered arrays are emitted
+*
+* // Arrays that would become empty after filtering are discarded entirely
+* const oddChannel = Channel.fromIterable([
+*   Array.make(1, 3, 5),
+*   Array.make(2, 4),
+*   Array.make(7, 9)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+* const filteredOddChannel = Channel.filterArray(oddChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4] (the arrays [1,3,5] and [7,9] are discarded)
+* ```
+*
+* @category filtering
+* @since 4.0.0
+*/
+const filterArray = /* @__PURE__ */ dual(2, (self, predicate) => transformPull$1(self, (pull) => succeed$2(flatMap$2(pull, function loop(arr) {
+	const passes = [];
+	for (let i = 0; i < arr.length; i++) if (predicate(arr[i])) passes.push(arr[i]);
+	return isReadonlyArrayNonEmpty(passes) ? succeed$2(passes) : flatMap$2(pull, loop);
+}))));
+/**
 * Filters and maps each element inside emitted non-empty arrays using a
 * `Filter`.
 *
@@ -58196,6 +58244,30 @@ const concat = /* @__PURE__ */ dual(2, (self, that) => flatten(fromArray([self,
 */
 const merge$1 = /* @__PURE__ */ dual((args) => isStream(args[0]) && isStream(args[1]), (self, that, options) => fromChannel(merge$2(toChannel(self), toChannel(that), options)));
 /**
+* Filters a stream to the elements that satisfy a predicate.
+*
+* **Example** (Filtering stream values)
+*
+* ```ts
+* import { Console, Effect, Stream } from "effect"
+*
+* const program = Effect.gen(function*() {
+*   const stream = Stream.make(1, 2, 3, 4).pipe(
+*     Stream.filter((n) => n % 2 === 0)
+*   )
+*   const values = yield* Stream.runCollect(stream)
+*   yield* Console.log(values)
+* })
+*
+* Effect.runPromise(program)
+* // Output: [ 2, 4 ]
+* ```
+*
+* @category filtering
+* @since 2.0.0
+*/
+const filter = /* @__PURE__ */ dual(2, (self, predicate) => fromChannel(filterArray(toChannel(self), predicate)));
+/**
 * Filters and maps stream elements in one pass using a `Filter`.
 *
 * @category filtering
@@ -65046,6 +65118,7 @@ const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
+const GIT_CHECK_ATTR_MAX_BUFFER_BYTES = GIT_LS_FILES_MAX_BUFFER_BYTES;
 const SCANNED_DOT_DIRECTORIES = new Set([".dumi", ".storybook"]);
 const IGNORED_DIRECTORIES = new Set([
 	".angular",
@@ -65365,13 +65438,9 @@ const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
 const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
 const ABORT_EXIT_CODES = new Set([134, 3221226505]);
 const OXLINT_OOM_RESCUE_BUDGET_MS = 6e4;
-const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
-const LINT_PHASE_TIMEOUT_MS = 3e5;
-const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
 const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
 const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
-const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
 const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const REACT_SERVER_DOM_PACKAGES = [
@@ -65419,7 +65488,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.9.3";
+const CORE_PACKAGE_VERSION = "0.9.4";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -65432,17 +65501,20 @@ const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
 const isErrnoException = (error) => error instanceof Error && "code" in error;
 const IGNORABLE_READDIR_ERROR_CODES = new Set([
 	"EACCES",
+	"EBUSY",
 	"EPERM",
 	"ENOENT",
 	"ENOTDIR",
 	"EINVAL",
 	"ELOOP",
-	"ENAMETOOLONG"
+	"ENAMETOOLONG",
+	"ETIMEDOUT",
+	"UNKNOWN"
 ]);
 const isIgnorableReaddirError = (error) => isErrnoException(error) && typeof error.code === "string" && IGNORABLE_READDIR_ERROR_CODES.has(error.code);
 const readDirectoryEntries = (directoryPath) => {
 	try {
-		return NFS.readdirSync(directoryPath, { withFileTypes: true });
+		return fs.readdirSync(directoryPath, { withFileTypes: true });
 	} catch (error) {
 		if (isIgnorableReaddirError(error)) return [];
 		throw error;
@@ -65450,14 +65522,14 @@ const readDirectoryEntries = (directoryPath) => {
 };
 const isFile = (filePath) => {
 	try {
-		return NFS.statSync(filePath).isFile();
+		return fs.statSync(filePath).isFile();
 	} catch {
 		return false;
 	}
 };
 const isDirectory = (directoryPath) => {
 	try {
-		return NFS.statSync(directoryPath).isDirectory();
+		return fs.statSync(directoryPath).isDirectory();
 	} catch {
 		return false;
 	}
@@ -65467,6 +65539,66 @@ const isPlainObject = (value) => {
 	const prototype = Object.getPrototypeOf(value);
 	return prototype === null || prototype === Object.prototype;
 };
+const LINGUIST_ATTRIBUTES = ["linguist-generated", "linguist-vendored"];
+const DISABLED_ATTRIBUTE_VALUES = new Set([
+	"unspecified",
+	"unset",
+	"false",
+	"0",
+	"off",
+	"no"
+]);
+const buildInput = (relativePaths) => `${relativePaths.join("\0")}\0`;
+const parseIgnoredPaths = (output) => {
+	const ignoredPaths = /* @__PURE__ */ new Set();
+	const fields = output.split("\0");
+	for (let fieldIndex = 0; fieldIndex + 2 < fields.length; fieldIndex += 3) {
+		const filePath = fields[fieldIndex];
+		const value = fields[fieldIndex + 2]?.toLowerCase();
+		if (filePath && value && !DISABLED_ATTRIBUTE_VALUES.has(value)) ignoredPaths.add(filePath);
+	}
+	return ignoredPaths;
+};
+const collectGitLinguistIgnoredPaths = (rootDirectory, relativePaths) => {
+	if (relativePaths.length === 0) return /* @__PURE__ */ new Set();
+	const result = spawnSync("git", [
+		"check-attr",
+		"-z",
+		"--stdin",
+		...LINGUIST_ATTRIBUTES
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		input: buildInput(relativePaths),
+		maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return /* @__PURE__ */ new Set();
+	return parseIgnoredPaths(result.stdout);
+};
+const collectGitLinguistIgnoredPathsCooperative = (rootDirectory, relativePaths, signal) => {
+	if (relativePaths.length === 0) return Promise.resolve(/* @__PURE__ */ new Set());
+	return new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"check-attr",
+			"-z",
+			"--stdin",
+			...LINGUIST_ATTRIBUTES
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? /* @__PURE__ */ new Set() : parseIgnoredPaths(stdout));
+		}).stdin?.end(buildInput(relativePaths));
+	});
+};
 const lastSourceMappingUrl = (fileContent) => {
 	const lastReference = [...fileContent.matchAll(/\/\/# sourceMappingURL=(\S+)/g)].at(-1);
 	return lastReference ? lastReference[1] : null;
@@ -65568,6 +65700,9 @@ function* walkSourceTreeFiles(rootDirectory) {
 		}
 	}
 }
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
 const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	const entries = [];
 	for (const relativePath of relativePaths) {
@@ -65581,23 +65716,55 @@ const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	}
 	return entries;
 };
-const gitLsFiles = (rootDirectory, flags) => {
+const collectSizedSourceFilesCooperative = async (rootDirectory, relativePaths, signal) => {
+	const entries = [];
+	let sliceStartedAt = performance.now();
+	for (const relativePath of relativePaths) {
+		signal?.throwIfAborted();
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (!isLargeMinifiedFile(absolutePath, sizeBytes)) entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return entries;
+};
+const parseGitSourceFilePaths = (output) => {
+	const trackedPaths = /* @__PURE__ */ new Set();
+	const untrackedPaths = [];
+	for (const entry of output.split("\0")) {
+		if (entry.length === 0) continue;
+		const trackedPath = /^[0-7]{6} [0-9a-f]+ [0-3]\t([\s\S]+)$/.exec(entry)?.[1];
+		if (trackedPath === void 0) untrackedPaths.push(entry);
+		else trackedPaths.add(trackedPath);
+	}
+	return {
+		trackedPaths: [...trackedPaths],
+		untrackedPaths
+	};
+};
+const listGitSourceFilePaths = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
 		"-z",
-		...flags
+		"--stage",
+		"--others",
+		"--exclude-standard"
 	], {
 		cwd: rootDirectory,
 		encoding: "utf-8",
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0);
+	return parseGitSourceFilePaths(result.stdout);
 };
-const listSourceFilesViaGit = (rootDirectory) => {
-	const trackedPaths = gitLsFiles(rootDirectory, ["--cached"]);
-	const untrackedPaths = gitLsFiles(rootDirectory, ["--others", "--exclude-standard"]);
-	if (trackedPaths === null || untrackedPaths === null) return null;
+const collectGitCandidateSourceFilePaths = (rootDirectory, paths) => {
+	const { trackedPaths, untrackedPaths } = paths;
 	const emitDuplicateJsPaths = collectTypeScriptEmitDuplicateJsPaths({
 		trackedPaths: new Set(trackedPaths),
 		untrackedPaths,
@@ -65605,12 +65772,65 @@ const listSourceFilesViaGit = (rootDirectory) => {
 	});
 	return [...trackedPaths, ...untrackedPaths].filter((filePath) => isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath) && !emitDuplicateJsPaths.has(filePath));
 };
+const filterGitSourceFilePaths = (rootDirectory, paths) => {
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = collectGitLinguistIgnoredPaths(rootDirectory, candidatePaths);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
+const listSourceFilesViaGit = (rootDirectory) => {
+	const paths = listGitSourceFilePaths(rootDirectory);
+	return paths === null ? null : filterGitSourceFilePaths(rootDirectory, paths);
+};
+const listSourceFilesViaGitCooperative = async (rootDirectory, signal) => {
+	const paths = await new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"ls-files",
+			"-z",
+			"--stage",
+			"--others",
+			"--exclude-standard"
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? null : parseGitSourceFilePaths(stdout));
+		});
+	});
+	if (paths === null) return null;
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = await collectGitLinguistIgnoredPathsCooperative(rootDirectory, candidatePaths, signal);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
 const listSourceFilesViaFilesystem = (rootDirectory) => {
 	const filePaths = [];
 	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
 	return filePaths;
 };
-const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
+const listSourceFilesViaFilesystemCooperative = async (rootDirectory, signal) => {
+	const filePaths = [];
+	let sliceStartedAt = performance.now();
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) {
+		signal?.throwIfAborted();
+		if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return filePaths;
+};
+const listSourceFilePaths = (rootDirectory) => (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort();
+const listSourceFilePathsCooperative = async (rootDirectory, signal) => (await listSourceFilesViaGitCooperative(rootDirectory, signal) ?? await listSourceFilesViaFilesystemCooperative(rootDirectory, signal)).sort();
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilePaths(rootDirectory));
+const listSourceFilesCooperative = async (rootDirectory, signal) => (await collectSizedSourceFilesCooperative(rootDirectory, await listSourceFilePathsCooperative(rootDirectory, signal), signal)).map((entry) => entry.path);
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
 const UTF8_BOM_CHARACTER = "";
@@ -65733,7 +65953,12 @@ const mergeCompilerOptions = (inherited, current) => {
 	};
 };
 const readResolvedCompilerOptions = (tsConfigPath, extendsDepth, visitedPaths) => {
-	const realPath = NFS.realpathSync.native(tsConfigPath);
+	let realPath;
+	try {
+		realPath = NFS.realpathSync.native(tsConfigPath);
+	} catch {
+		return null;
+	}
 	if (visitedPaths.has(realPath)) return null;
 	const tsConfig = readTsConfig(realPath);
 	if (!tsConfig) return null;
@@ -66261,27 +66486,30 @@ const getSelectedObjectProperty = (expression, propertyName, analysis, visitedEx
 	}
 	return null;
 };
-const configExpressionMayDefineProperty = (expression, propertyName, analysis) => {
+const configExpressionMayDefineProperty = (expression, propertyName, analysis, visitedExpressions = /* @__PURE__ */ new Set()) => {
 	let resolvedExpression = expression;
 	while (ts.isParenthesizedExpression(resolvedExpression) || ts.isAsExpression(resolvedExpression) || ts.isTypeAssertionExpression(resolvedExpression) || ts.isSatisfiesExpression(resolvedExpression) || ts.isNonNullExpression(resolvedExpression)) resolvedExpression = resolvedExpression.expression;
+	if (visitedExpressions.has(resolvedExpression)) return true;
+	const nextVisitedExpressions = new Set(visitedExpressions);
+	nextVisitedExpressions.add(resolvedExpression);
 	if (ts.isIdentifier(resolvedExpression)) {
 		if (analysis.localBindings.has(resolvedExpression.text)) {
 			const localReference = analysis.localBindings.get(resolvedExpression.text);
-			return localReference?.expression ? configExpressionMayDefineProperty(localReference.expression, propertyName, localReference.analysis) : true;
+			return localReference?.expression ? configExpressionMayDefineProperty(localReference.expression, propertyName, localReference.analysis, nextVisitedExpressions) : true;
 		}
 		const scopedBinding = getScopedConfigBinding(resolvedExpression);
-		if (scopedBinding.wasFound) return scopedBinding.initializer ? configExpressionMayDefineProperty(scopedBinding.initializer, propertyName, analysis) : true;
+		if (scopedBinding.wasFound) return scopedBinding.initializer ? configExpressionMayDefineProperty(scopedBinding.initializer, propertyName, analysis, nextVisitedExpressions) : true;
 		const topLevelBinding = getTopLevelBinding(analysis.sourceFile, resolvedExpression.text);
-		return topLevelBinding && ts.isExpression(topLevelBinding) ? configExpressionMayDefineProperty(topLevelBinding, propertyName, analysis) : true;
+		return topLevelBinding && ts.isExpression(topLevelBinding) ? configExpressionMayDefineProperty(topLevelBinding, propertyName, analysis, nextVisitedExpressions) : true;
 	}
 	if (ts.isConditionalExpression(resolvedExpression)) {
-		if (isStaticallyTruthyConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis);
-		if (isStaticallyDisabledConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis);
-		return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis) || configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis);
+		if (isStaticallyTruthyConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis, nextVisitedExpressions);
+		if (isStaticallyDisabledConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis, nextVisitedExpressions);
+		return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis, nextVisitedExpressions) || configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis, nextVisitedExpressions);
 	}
 	if (!ts.isObjectLiteralExpression(resolvedExpression)) return true;
 	return resolvedExpression.properties.some((property) => {
-		if (ts.isSpreadAssignment(property)) return configExpressionMayDefineProperty(property.expression, propertyName, analysis);
+		if (ts.isSpreadAssignment(property)) return configExpressionMayDefineProperty(property.expression, propertyName, analysis, nextVisitedExpressions);
 		if (ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property) || ts.isMethodDeclaration(property) || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property)) {
 			const staticPropertyName = getStaticPropertyName$2(property.name);
 			return staticPropertyName === null || staticPropertyName === propertyName;
@@ -66357,7 +66585,13 @@ const analyzeConfigModuleExport = (filePath, exportName, allowCompilerTransform,
 	if (visitedModules.has(moduleVisitKey)) return false;
 	const nextVisitedModules = new Set(visitedModules);
 	nextVisitedModules.add(moduleVisitKey);
-	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, NFS.readFileSync(filePath, "utf-8")), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList, argumentAnalysis);
+	let sourceText;
+	try {
+		sourceText = NFS.readFileSync(filePath, "utf-8");
+	} catch {
+		return false;
+	}
+	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, sourceText), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList, argumentAnalysis);
 };
 const analyzeConfigSourceFileExport = (sourceFile, filePath, exportName, allowCompilerTransform, importDepth, visitedModules, argumentsList = [], argumentAnalysis) => {
 	const analysis = {
@@ -67185,13 +67419,7 @@ const hasReactDependency = (packageJson) => {
 	};
 	return Object.keys(allDependencies).some((packageName) => REACT_DEPENDENCY_NAMES.has(packageName));
 };
-const getPreactVersion = (packageJson) => {
-	return {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	}.preact ?? null;
-};
+const getPreactVersion = (packageJson) => getDependencySpec(packageJson, "preact");
 const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, sourceDirectory = rootDirectory, sourcePackageJson = rootPackageJson, version }) => {
 	if (version === null || !isCatalogReference(version)) return version;
 	const catalogName = extractCatalogName(version);
@@ -67933,7 +68161,16 @@ const getBrowserslistProtectionRequirement = (directory) => {
 		if (!queries) return void 0;
 		let requirement;
 		let hasUnsupportedTarget = false;
-		for (const browserTarget of (0, import_browserslist.default)(queries)) {
+		const previousIgnoreOldData = process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+		let browserTargets = [];
+		try {
+			process.env.BROWSERSLIST_IGNORE_OLD_DATA = "true";
+			browserTargets = (0, import_browserslist.default)(queries);
+		} finally {
+			if (previousIgnoreOldData === void 0) delete process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+			else process.env.BROWSERSLIST_IGNORE_OLD_DATA = previousIgnoreOldData;
+		}
+		for (const browserTarget of browserTargets) {
 			const browserRequirement = getBrowserProtectionRequirement(browserTarget);
 			if (browserRequirement === "unsupported") hasUnsupportedTarget = true;
 			if (browserRequirement === "noreferrer") requirement = "noreferrer";
@@ -68039,9 +68276,9 @@ const cachedProjectInfos = /* @__PURE__ */ new Map();
 * framework-agnostic rules. Throws only when the directory has nothing
 * to scan (no enclosing project and no source files of its own).
 */
-const discoverProjectWithoutPackageJson = (directory) => {
-	const sourceFileCount = countSourceFiles(directory);
-	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
+const discoverProjectWithoutPackageJson = (directory, options) => {
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
+	const hasOwnTsConfig = isFile(Path.join(directory, "tsconfig.json"));
 	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
 	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
@@ -68107,12 +68344,15 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		sourceFileCount
 	};
 };
-const discoverProject = (directory) => {
+const discoverProject = (directory, options = {}) => {
 	const cached = cachedProjectInfos.get(directory);
-	if (cached !== void 0) return cached;
+	if (cached !== void 0) return options.sourceFileCount === void 0 ? cached : {
+		...cached,
+		sourceFileCount: options.sourceFileCount
+	};
 	const packageJsonPath = Path.join(directory, "package.json");
 	if (!isFile(packageJsonPath)) {
-		const synthesized = discoverProjectWithoutPackageJson(directory);
+		const synthesized = discoverProjectWithoutPackageJson(directory, options);
 		cachedProjectInfos.set(directory, synthesized);
 		return synthesized;
 	}
@@ -68174,8 +68414,8 @@ const discoverProject = (directory) => {
 	const tailwindVersion = tailwindcss.version;
 	const zodVersion = zod.version;
 	const projectName = packageJson.name ?? Path.basename(directory);
-	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const sourceFileCount = countSourceFiles(directory);
+	const hasTypeScript = isFile(Path.join(directory, "tsconfig.json"));
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
 	const hasReactNativeWorkspace = framework === "expo" || framework === "react-native" || workspaceFacts.hasReactNativeAwarePackage;
 	const expoVersion = hasReactNativeWorkspace ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
@@ -68304,6 +68544,155 @@ const discoverProject = (directory) => {
 * single source file has nothing to analyze.
 */
 const isAnalyzableProject = (project) => project.reactVersion !== null || project.preactVersion !== null || project.sourceFileCount > 0;
+const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
+	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
+	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
+	"effect/no-derived-state": "react-doctor/no-derived-state",
+	"effect/no-event-handler": "react-doctor/no-event-handler",
+	"effect/no-initialize-state": "react-doctor/no-initialize-state",
+	"effect/no-pass-data-to-parent": "react-doctor/no-pass-data-to-parent",
+	"effect/no-pass-live-state-to-parent": "react-doctor/no-pass-live-state-to-parent",
+	"effect/no-reset-all-state-on-prop-change": "react-doctor/no-reset-all-state-on-prop-change",
+	"jsx-a11y/alt-text": "react-doctor/alt-text",
+	"jsx-a11y/anchor-ambiguous-text": "react-doctor/anchor-ambiguous-text",
+	"jsx-a11y/anchor-has-content": "react-doctor/anchor-has-content",
+	"jsx-a11y/anchor-is-valid": "react-doctor/anchor-is-valid",
+	"jsx-a11y/aria-activedescendant-has-tabindex": "react-doctor/aria-activedescendant-has-tabindex",
+	"jsx-a11y/aria-props": "react-doctor/aria-props",
+	"jsx-a11y/aria-proptypes": "react-doctor/aria-proptypes",
+	"jsx-a11y/aria-role": "react-doctor/aria-role",
+	"jsx-a11y/aria-unsupported-elements": "react-doctor/aria-unsupported-elements",
+	"jsx-a11y/autocomplete-valid": "react-doctor/autocomplete-valid",
+	"jsx-a11y/click-events-have-key-events": "react-doctor/click-events-have-key-events",
+	"jsx-a11y/control-has-associated-label": "react-doctor/control-has-associated-label",
+	"jsx-a11y/heading-has-content": "react-doctor/heading-has-content",
+	"jsx-a11y/html-has-lang": "react-doctor/html-has-lang",
+	"jsx-a11y/iframe-has-title": "react-doctor/iframe-has-title",
+	"jsx-a11y/img-redundant-alt": "react-doctor/img-redundant-alt",
+	"jsx-a11y/interactive-supports-focus": "react-doctor/interactive-supports-focus",
+	"jsx-a11y/label-has-associated-control": "react-doctor/label-has-associated-control",
+	"jsx-a11y/lang": "react-doctor/lang",
+	"jsx-a11y/media-has-caption": "react-doctor/media-has-caption",
+	"jsx-a11y/mouse-events-have-key-events": "react-doctor/mouse-events-have-key-events",
+	"jsx-a11y/no-access-key": "react-doctor/no-access-key",
+	"jsx-a11y/no-aria-hidden-on-focusable": "react-doctor/no-aria-hidden-on-focusable",
+	"jsx-a11y/no-autofocus": "react-doctor/no-autofocus",
+	"jsx-a11y/no-distracting-elements": "react-doctor/no-distracting-elements",
+	"jsx-a11y/no-interactive-element-to-noninteractive-role": "react-doctor/no-interactive-element-to-noninteractive-role",
+	"jsx-a11y/no-noninteractive-element-interactions": "react-doctor/no-noninteractive-element-interactions",
+	"jsx-a11y/no-noninteractive-element-to-interactive-role": "react-doctor/no-noninteractive-element-to-interactive-role",
+	"jsx-a11y/no-noninteractive-tabindex": "react-doctor/no-noninteractive-tabindex",
+	"jsx-a11y/no-redundant-roles": "react-doctor/no-redundant-roles",
+	"jsx-a11y/no-static-element-interactions": "react-doctor/no-static-element-interactions",
+	"jsx-a11y/prefer-tag-over-role": "react-doctor/prefer-tag-over-role",
+	"jsx-a11y/role-has-required-aria-props": "react-doctor/role-has-required-aria-props",
+	"jsx-a11y/role-supports-aria-props": "react-doctor/role-supports-aria-props",
+	"jsx-a11y/scope": "react-doctor/scope",
+	"jsx-a11y/tabindex-no-positive": "react-doctor/tabindex-no-positive",
+	"react-hooks/exhaustive-deps": "react-doctor/exhaustive-deps",
+	"react-hooks/rules-of-hooks": "react-doctor/rules-of-hooks",
+	"react-perf/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
+	"react-perf/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
+	"react-perf/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
+	"react-perf/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
+	"react-refresh/only-export-components": "react-doctor/only-export-components",
+	"react/button-has-type": "react-doctor/button-has-type",
+	"react/checked-requires-onchange-or-readonly": "react-doctor/checked-requires-onchange-or-readonly",
+	"react/display-name": "react-doctor/display-name",
+	"react/exhaustive-deps": "react-doctor/exhaustive-deps",
+	"react/forbid-component-props": "react-doctor/forbid-component-props",
+	"react/forbid-dom-props": "react-doctor/forbid-dom-props",
+	"react/forbid-elements": "react-doctor/forbid-elements",
+	"react/forward-ref-uses-ref": "react-doctor/forward-ref-uses-ref",
+	"react/hook-use-state": "react-doctor/hook-use-state",
+	"react/iframe-missing-sandbox": "react-doctor/iframe-missing-sandbox",
+	"react/jsx-boolean-value": "react-doctor/jsx-boolean-value",
+	"react/jsx-curly-brace-presence": "react-doctor/jsx-curly-brace-presence",
+	"react/jsx-filename-extension": "react-doctor/jsx-filename-extension",
+	"react/jsx-fragments": "react-doctor/jsx-fragments",
+	"react/jsx-handler-names": "react-doctor/jsx-handler-names",
+	"react/jsx-key": "react-doctor/jsx-key",
+	"react/jsx-max-depth": "react-doctor/jsx-max-depth",
+	"react/jsx-no-comment-textnodes": "react-doctor/jsx-no-comment-textnodes",
+	"react/jsx-no-constructed-context-values": "react-doctor/jsx-no-constructed-context-values",
+	"react/jsx-no-duplicate-props": "react-doctor/jsx-no-duplicate-props",
+	"react/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
+	"react/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
+	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
+	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
+	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
+	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
+	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
+	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
+	"react/jsx-props-no-spread-multi": "react-doctor/jsx-props-no-spread-multi",
+	"react/jsx-props-no-spreading": "react-doctor/jsx-props-no-spreading",
+	"react/no-array-index-key": "react-doctor/no-array-index-key",
+	"react/no-children-prop": "react-doctor/no-children-prop",
+	"react/no-clone-element": "react-doctor/no-clone-element",
+	"react/no-danger": "react-doctor/no-danger",
+	"react/no-danger-with-children": "react-doctor/no-danger-with-children",
+	"react/no-did-mount-set-state": "react-doctor/no-did-mount-set-state",
+	"react/no-did-update-set-state": "react-doctor/no-did-update-set-state",
+	"react/no-direct-mutation-state": "react-doctor/no-direct-mutation-state",
+	"react/no-find-dom-node": "react-doctor/no-find-dom-node",
+	"react/no-is-mounted": "react-doctor/no-is-mounted",
+	"react/no-multi-comp": "react-doctor/no-multi-comp",
+	"react/no-namespace": "react-doctor/no-namespace",
+	"react/no-react-children": "react-doctor/no-react-children",
+	"react/no-redundant-should-component-update": "react-doctor/no-redundant-should-component-update",
+	"react/no-render-return-value": "react-doctor/no-render-return-value",
+	"react/no-set-state": "react-doctor/no-set-state",
+	"react/no-string-refs": "react-doctor/no-string-refs",
+	"react/no-this-in-sfc": "react-doctor/no-this-in-sfc",
+	"react/no-unescaped-entities": "react-doctor/no-unescaped-entities",
+	"react/no-unknown-property": "react-doctor/no-unknown-property",
+	"react/no-unsafe": "react-doctor/no-unsafe",
+	"react/no-unstable-nested-components": "react-doctor/no-unstable-nested-components",
+	"react/no-will-update-set-state": "react-doctor/no-will-update-set-state",
+	"react/only-export-components": "react-doctor/only-export-components",
+	"react/prefer-es6-class": "react-doctor/prefer-es6-class",
+	"react/prefer-function-component": "react-doctor/prefer-function-component",
+	"react/react-in-jsx-scope": "react-doctor/react-in-jsx-scope",
+	"react/require-render-return": "react-doctor/require-render-return",
+	"react/rules-of-hooks": "react-doctor/rules-of-hooks",
+	"react/self-closing-comp": "react-doctor/self-closing-comp",
+	"react/state-in-constructor": "react-doctor/state-in-constructor",
+	"react/style-prop-object": "react-doctor/style-prop-object",
+	"react/void-dom-elements-no-children": "react-doctor/void-dom-elements-no-children"
+};
+const NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS = /* @__PURE__ */ new Map();
+for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY)) {
+	const aliases = NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(nativeRuleKey) ?? [];
+	aliases.push(legacyRuleKey);
+	NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
+}
+const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
+const REACT_DOCTOR_RULE_KEY_PREFIX = "react-doctor/";
+const canonicalizeRuleKey = (ruleKey) => {
+	const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
+	return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
+};
+const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
+/**
+* Canonicalizes a rule key as users write it in config: a legacy alias
+* (`react/jsx-key`) maps to its native key, and a bare short id (`no-eval`)
+* qualifies as `react-doctor/<id>` — mirroring `isSameRuleKey`'s matching —
+* so telemetry groups every spelling of one rule under one key.
+*/
+const canonicalizeUserRuleKey = (ruleKey) => {
+	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
+	return nativeRuleKey.includes("/") ? nativeRuleKey : `${REACT_DOCTOR_RULE_KEY_PREFIX}${nativeRuleKey}`;
+};
+const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
+	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
+	const canonicalTarget = canonicalizeRuleKey(targetRuleKey);
+	if (canonicalCandidate === canonicalTarget) return true;
+	return isReactDoctorShortIdOf(canonicalCandidate, canonicalTarget) || isReactDoctorShortIdOf(canonicalTarget, canonicalCandidate);
+};
+const getEquivalentRuleKeys = (ruleKey) => {
+	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
+	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
+};
 const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
 var InvalidGlobPatternError = class extends Error {
 	pattern;
@@ -68357,6 +68746,11 @@ const warnConfigIssue = (message) => {
 };
 const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
 const collectStringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+const hasMatchingRuleOverride = (ruleIds, ruleIdentifier) => {
+	if (ruleIds.size === 0) return true;
+	for (const ruleId of ruleIds) if (isSameRuleKey(ruleId, ruleIdentifier)) return true;
+	return false;
+};
 const validateOverrideEntry = (entry, index) => {
 	if (!isPlainObject(entry)) {
 		warnConfigIssue(`ignore.overrides[${index}] must be an object with { files, rules }; ignoring this entry.`);
@@ -68397,7 +68791,7 @@ const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) =>
 	if (overrides.length === 0) return false;
 	const relativeFilePath = toRelativePath(diagnostic.filePath, rootDirectory);
 	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
-	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && (override.ruleIds.size === 0 || override.ruleIds.has(ruleIdentifier)));
+	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && hasMatchingRuleOverride(override.ruleIds, ruleIdentifier));
 };
 const SEVERITY_FOR_OVERRIDE = {
 	error: "error",
@@ -68432,155 +68826,6 @@ const buildRuleSeverityControls = (config) => {
 const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
 const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
 const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
-const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
-	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
-	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
-	"effect/no-derived-state": "react-doctor/no-derived-state",
-	"effect/no-event-handler": "react-doctor/no-event-handler",
-	"effect/no-initialize-state": "react-doctor/no-initialize-state",
-	"effect/no-pass-data-to-parent": "react-doctor/no-pass-data-to-parent",
-	"effect/no-pass-live-state-to-parent": "react-doctor/no-pass-live-state-to-parent",
-	"effect/no-reset-all-state-on-prop-change": "react-doctor/no-reset-all-state-on-prop-change",
-	"jsx-a11y/alt-text": "react-doctor/alt-text",
-	"jsx-a11y/anchor-ambiguous-text": "react-doctor/anchor-ambiguous-text",
-	"jsx-a11y/anchor-has-content": "react-doctor/anchor-has-content",
-	"jsx-a11y/anchor-is-valid": "react-doctor/anchor-is-valid",
-	"jsx-a11y/aria-activedescendant-has-tabindex": "react-doctor/aria-activedescendant-has-tabindex",
-	"jsx-a11y/aria-props": "react-doctor/aria-props",
-	"jsx-a11y/aria-proptypes": "react-doctor/aria-proptypes",
-	"jsx-a11y/aria-role": "react-doctor/aria-role",
-	"jsx-a11y/aria-unsupported-elements": "react-doctor/aria-unsupported-elements",
-	"jsx-a11y/autocomplete-valid": "react-doctor/autocomplete-valid",
-	"jsx-a11y/click-events-have-key-events": "react-doctor/click-events-have-key-events",
-	"jsx-a11y/control-has-associated-label": "react-doctor/control-has-associated-label",
-	"jsx-a11y/heading-has-content": "react-doctor/heading-has-content",
-	"jsx-a11y/html-has-lang": "react-doctor/html-has-lang",
-	"jsx-a11y/iframe-has-title": "react-doctor/iframe-has-title",
-	"jsx-a11y/img-redundant-alt": "react-doctor/img-redundant-alt",
-	"jsx-a11y/interactive-supports-focus": "react-doctor/interactive-supports-focus",
-	"jsx-a11y/label-has-associated-control": "react-doctor/label-has-associated-control",
-	"jsx-a11y/lang": "react-doctor/lang",
-	"jsx-a11y/media-has-caption": "react-doctor/media-has-caption",
-	"jsx-a11y/mouse-events-have-key-events": "react-doctor/mouse-events-have-key-events",
-	"jsx-a11y/no-access-key": "react-doctor/no-access-key",
-	"jsx-a11y/no-aria-hidden-on-focusable": "react-doctor/no-aria-hidden-on-focusable",
-	"jsx-a11y/no-autofocus": "react-doctor/no-autofocus",
-	"jsx-a11y/no-distracting-elements": "react-doctor/no-distracting-elements",
-	"jsx-a11y/no-interactive-element-to-noninteractive-role": "react-doctor/no-interactive-element-to-noninteractive-role",
-	"jsx-a11y/no-noninteractive-element-interactions": "react-doctor/no-noninteractive-element-interactions",
-	"jsx-a11y/no-noninteractive-element-to-interactive-role": "react-doctor/no-noninteractive-element-to-interactive-role",
-	"jsx-a11y/no-noninteractive-tabindex": "react-doctor/no-noninteractive-tabindex",
-	"jsx-a11y/no-redundant-roles": "react-doctor/no-redundant-roles",
-	"jsx-a11y/no-static-element-interactions": "react-doctor/no-static-element-interactions",
-	"jsx-a11y/prefer-tag-over-role": "react-doctor/prefer-tag-over-role",
-	"jsx-a11y/role-has-required-aria-props": "react-doctor/role-has-required-aria-props",
-	"jsx-a11y/role-supports-aria-props": "react-doctor/role-supports-aria-props",
-	"jsx-a11y/scope": "react-doctor/scope",
-	"jsx-a11y/tabindex-no-positive": "react-doctor/tabindex-no-positive",
-	"react-hooks/exhaustive-deps": "react-doctor/exhaustive-deps",
-	"react-hooks/rules-of-hooks": "react-doctor/rules-of-hooks",
-	"react-perf/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
-	"react-perf/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
-	"react-perf/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
-	"react-perf/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
-	"react-refresh/only-export-components": "react-doctor/only-export-components",
-	"react/button-has-type": "react-doctor/button-has-type",
-	"react/checked-requires-onchange-or-readonly": "react-doctor/checked-requires-onchange-or-readonly",
-	"react/display-name": "react-doctor/display-name",
-	"react/exhaustive-deps": "react-doctor/exhaustive-deps",
-	"react/forbid-component-props": "react-doctor/forbid-component-props",
-	"react/forbid-dom-props": "react-doctor/forbid-dom-props",
-	"react/forbid-elements": "react-doctor/forbid-elements",
-	"react/forward-ref-uses-ref": "react-doctor/forward-ref-uses-ref",
-	"react/hook-use-state": "react-doctor/hook-use-state",
-	"react/iframe-missing-sandbox": "react-doctor/iframe-missing-sandbox",
-	"react/jsx-boolean-value": "react-doctor/jsx-boolean-value",
-	"react/jsx-curly-brace-presence": "react-doctor/jsx-curly-brace-presence",
-	"react/jsx-filename-extension": "react-doctor/jsx-filename-extension",
-	"react/jsx-fragments": "react-doctor/jsx-fragments",
-	"react/jsx-handler-names": "react-doctor/jsx-handler-names",
-	"react/jsx-key": "react-doctor/jsx-key",
-	"react/jsx-max-depth": "react-doctor/jsx-max-depth",
-	"react/jsx-no-comment-textnodes": "react-doctor/jsx-no-comment-textnodes",
-	"react/jsx-no-constructed-context-values": "react-doctor/jsx-no-constructed-context-values",
-	"react/jsx-no-duplicate-props": "react-doctor/jsx-no-duplicate-props",
-	"react/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
-	"react/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
-	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
-	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
-	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
-	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
-	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
-	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
-	"react/jsx-props-no-spread-multi": "react-doctor/jsx-props-no-spread-multi",
-	"react/jsx-props-no-spreading": "react-doctor/jsx-props-no-spreading",
-	"react/no-array-index-key": "react-doctor/no-array-index-key",
-	"react/no-children-prop": "react-doctor/no-children-prop",
-	"react/no-clone-element": "react-doctor/no-clone-element",
-	"react/no-danger": "react-doctor/no-danger",
-	"react/no-danger-with-children": "react-doctor/no-danger-with-children",
-	"react/no-did-mount-set-state": "react-doctor/no-did-mount-set-state",
-	"react/no-did-update-set-state": "react-doctor/no-did-update-set-state",
-	"react/no-direct-mutation-state": "react-doctor/no-direct-mutation-state",
-	"react/no-find-dom-node": "react-doctor/no-find-dom-node",
-	"react/no-is-mounted": "react-doctor/no-is-mounted",
-	"react/no-multi-comp": "react-doctor/no-multi-comp",
-	"react/no-namespace": "react-doctor/no-namespace",
-	"react/no-react-children": "react-doctor/no-react-children",
-	"react/no-redundant-should-component-update": "react-doctor/no-redundant-should-component-update",
-	"react/no-render-return-value": "react-doctor/no-render-return-value",
-	"react/no-set-state": "react-doctor/no-set-state",
-	"react/no-string-refs": "react-doctor/no-string-refs",
-	"react/no-this-in-sfc": "react-doctor/no-this-in-sfc",
-	"react/no-unescaped-entities": "react-doctor/no-unescaped-entities",
-	"react/no-unknown-property": "react-doctor/no-unknown-property",
-	"react/no-unsafe": "react-doctor/no-unsafe",
-	"react/no-unstable-nested-components": "react-doctor/no-unstable-nested-components",
-	"react/no-will-update-set-state": "react-doctor/no-will-update-set-state",
-	"react/only-export-components": "react-doctor/only-export-components",
-	"react/prefer-es6-class": "react-doctor/prefer-es6-class",
-	"react/prefer-function-component": "react-doctor/prefer-function-component",
-	"react/react-in-jsx-scope": "react-doctor/react-in-jsx-scope",
-	"react/require-render-return": "react-doctor/require-render-return",
-	"react/rules-of-hooks": "react-doctor/rules-of-hooks",
-	"react/self-closing-comp": "react-doctor/self-closing-comp",
-	"react/state-in-constructor": "react-doctor/state-in-constructor",
-	"react/style-prop-object": "react-doctor/style-prop-object",
-	"react/void-dom-elements-no-children": "react-doctor/void-dom-elements-no-children"
-};
-const NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS = /* @__PURE__ */ new Map();
-for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY)) {
-	const aliases = NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(nativeRuleKey) ?? [];
-	aliases.push(legacyRuleKey);
-	NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
-}
-const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
-const REACT_DOCTOR_RULE_KEY_PREFIX = "react-doctor/";
-const canonicalizeRuleKey = (ruleKey) => {
-	const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
-	return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
-};
-const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
-/**
-* Canonicalizes a rule key as users write it in config: a legacy alias
-* (`react/jsx-key`) maps to its native key, and a bare short id (`no-eval`)
-* qualifies as `react-doctor/<id>` — mirroring `isSameRuleKey`'s matching —
-* so telemetry groups every spelling of one rule under one key.
-*/
-const canonicalizeUserRuleKey = (ruleKey) => {
-	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
-	return nativeRuleKey.includes("/") ? nativeRuleKey : `${REACT_DOCTOR_RULE_KEY_PREFIX}${nativeRuleKey}`;
-};
-const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
-	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
-	const canonicalTarget = canonicalizeRuleKey(targetRuleKey);
-	if (canonicalCandidate === canonicalTarget) return true;
-	return isReactDoctorShortIdOf(canonicalCandidate, canonicalTarget) || isReactDoctorShortIdOf(canonicalTarget, canonicalCandidate);
-};
-const getEquivalentRuleKeys = (ruleKey) => {
-	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
-	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
-};
 const stripDescriptionTail = (ruleList) => {
 	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
 	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
@@ -69227,12 +69472,8 @@ const buildDiagnosticPipeline = (input) => {
 		if (rule.tags.includes("migration-hint")) return false;
 		return getFileContext(diagnostic.filePath) !== "production";
 	};
-	const isRuleIgnored = (ruleIdentifier) => {
-		for (const ignored of ignoredRules) if (isSameRuleKey(ignored, ruleIdentifier)) return true;
-		return false;
-	};
-	const isAppOnlyRule = (ruleIdentifier) => {
-		for (const appOnlyRuleKey of APP_ONLY_RULE_KEYS) if (isSameRuleKey(appOnlyRuleKey, ruleIdentifier)) return true;
+	const matchesRuleKey = (ruleIdentifier, candidates) => {
+		for (const candidate of candidates) if (isSameRuleKey(candidate, ruleIdentifier)) return true;
 		return false;
 	};
 	const isRnRawTextSuppressedByConfig = (diagnostic) => {
@@ -69274,12 +69515,13 @@ const buildDiagnosticPipeline = (input) => {
 				if (explicitSeverityOverride === "off") return suppress(current, "config");
 				if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 			}
+			const ruleIdentifier = `${current.plugin}/${current.rule}`;
 			if (explicitRuleOverride === void 0) {
-				if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
+				if (matchesRuleKey(ruleIdentifier, APP_ONLY_RULE_KEYS) && isLibraryFile(current.filePath)) return null;
 			}
 			if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
 			if (userConfig) {
-				if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return suppress(current, "config");
+				if (matchesRuleKey(ruleIdentifier, ignoredRules)) return suppress(current, "config");
 				if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
 				if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return suppress(current, "override");
 				if (isRnRawTextSuppressedByConfig(current)) return null;
@@ -69288,7 +69530,6 @@ const buildDiagnosticPipeline = (input) => {
 			if (respectInlineDisables && current.line > 0) {
 				const lines = getFileLines(current.filePath);
 				if (lines) {
-					const ruleIdentifier = `${current.plugin}/${current.rule}`;
 					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
 					if (evaluation.isSuppressed) return suppress(current, evaluation.isForeignDirective ? "foreign-inline" : "inline");
 					if (evaluation.nearMissHint) current = {
@@ -69564,7 +69805,8 @@ const readSystemFacts$1 = () => ({
 /**
 * Auto lint-worker count: the smaller of the (cgroup-CPU-aware) core count and
 * the number of `PER_WORKER_MEM_BUDGET_BYTES` workers that fit in available
-* memory, then clamped to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
+* memory, and the measured automatic parallel-efficiency ceiling, then clamped
+* to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
 *
 * `os.availableParallelism()` already respects cgroup CPU quotas, so the core
 * term needs no help. Available memory is `os.totalmem()` floored by the cgroup
@@ -69580,7 +69822,7 @@ const readSystemFacts$1 = () => ({
 const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
-	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
+	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers, 10));
 };
 const resolveLintBatchOrdering = () => {
 	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "arrival" ? "arrival" : "cost";
@@ -69593,24 +69835,22 @@ const resolveLintBatchOrdering = () => {
 */
 var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS", OXLINT_SPAWN_TIMEOUT_MS) }) {};
 /**
-* Effect-side cap on the lint phase. The env var lets CI / eval runners
-* raise the phase budget for slow large repos without recompiling.
+* Optional Effect-side cap on the lint phase. Unbounded unless explicitly
+* configured through the env var or a test layer.
 * Tests override via `Layer.succeed(LintPhaseTimeoutMs, ...)`.
 */
-var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", LINT_PHASE_TIMEOUT_MS) }) {};
+var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Effect-side cap on the dead-code phase, sitting above the in-worker
-* timeout as a runtime-independent backstop. The env var raises it for
-* type-heavy projects; tests override via
+* Optional Effect-side cap on the dead-code phase. Unbounded unless explicitly
+* configured through the env var or a test layer. Tests override via
 * `Layer.succeed(DeadCodePhaseTimeoutMs, ...)`.
 */
-var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", DEAD_CODE_PHASE_TIMEOUT_MS) }) {};
+var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Overall scan deadline backstop, bounding everything the per-phase
-* timeouts don't (wedged git / IO). The env var raises it for very
-* large repos; tests override via `Layer.succeed(ScanDeadlineMs, ...)`.
+* Optional overall scan deadline. Unbounded unless explicitly configured
+* through the env var or a test layer.
 */
-var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", SCAN_TOTAL_DEADLINE_MS) }) {};
+var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", null) }) {};
 /**
 * Wall-clock budget for the supply-chain check when it runs on a background
 * fiber overlapping the lint pass. Reads from the env var on startup so the
@@ -69683,14 +69923,14 @@ var DeadCodeOverlap = class extends Reference("react-doctor/DeadCodeOverlap", {
 /**
 * How the full-scan lint pass plans its file batches. `"cost"` (the default)
 * builds size-balanced LPT batches (`planLintBatches`): the same mandatory
-* batch count as greedy chunking (`ceil(files / 100)`), but every batch gets
-* an even share of files AND bytes, so no 100-file chunk is a straggler while
+* batch count as greedy chunking, but every batch gets an even share of files
+* AND bytes, so no full chunk is a straggler while
 * the remainder-batch worker idles — and the heavy files are SPREAD across
 * batches, the precondition the old sort-desc-then-chunk-100 `cost` mode
 * lacked (it packed the heaviest files into one wave-1 straggler batch,
 * measurably regressing size-skewed repos, which is why it never earned the
 * default). `"arrival"` (`REACT_DOCTOR_LINT_BATCH_ORDERING=arrival`) is the
-* rollback hatch to plain greedy 100-file chunking in discovery order. Tests
+* rollback hatch to plain greedy fixed-size chunking in discovery order. Tests
 * override via `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans
 * never reach this — they pass user-scoped `includePaths` that skip discovery
 * and stay in arrival order; only the full-scan branch reads it.
@@ -69785,6 +70025,7 @@ const DEFAULT_SURFACE_EXCLUDED_TAGS = {
 	score: ["design"],
 	ciFailure: ["design"]
 };
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const VALID_RULE_SEVERITIES = [
 	"error",
 	"warn",
@@ -69827,7 +70068,6 @@ const SURFACE_CONTROL_FIELD_NAMES = [
 ];
 const isIncludedFileContext = (value) => VALID_INCLUDED_FILE_CONTEXTS.some((fileContext) => fileContext === value);
 const SEVERITY_FIELD_NAMES = ["rules", "categories"];
-const isPlainObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const formatType = (value) => typeof value === "string" ? `"${value}"` : typeof value;
 const isRuleSeverity = (value) => typeof value === "string" && VALID_RULE_SEVERITIES.includes(value);
 const coerceMaybeBooleanString = (fieldName, value) => {
@@ -69854,8 +70094,45 @@ const validateStringArrayField = (fieldName, value) => {
 		return false;
 	});
 };
+const validateIgnoreOverride = (rawOverride, index) => {
+	const fieldName = `ignore.overrides[${index}]`;
+	if (!isRecord$1(rawOverride)) {
+		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawOverride}); ignoring this override.`);
+		return;
+	}
+	const files = validateStringArrayField(`${fieldName}.files`, rawOverride.files);
+	if (files === void 0) return void 0;
+	const validatedOverride = { files };
+	if (rawOverride.rules !== void 0) {
+		const rules = validateStringArrayField(`${fieldName}.rules`, rawOverride.rules);
+		if (rules !== void 0) validatedOverride.rules = rules;
+	}
+	return validatedOverride;
+};
+const validateIgnoreField = (rawIgnore) => {
+	if (!isRecord$1(rawIgnore)) {
+		warnConfigIssue(`config field "ignore" must be an object (got ${typeof rawIgnore}); ignoring this field.`);
+		return;
+	}
+	const validatedIgnore = {};
+	for (const fieldName of [
+		"rules",
+		"files",
+		"tags"
+	]) {
+		if (rawIgnore[fieldName] === void 0) continue;
+		const validatedValues = validateStringArrayField(`ignore.${fieldName}`, rawIgnore[fieldName]);
+		if (validatedValues !== void 0) validatedIgnore[fieldName] = validatedValues;
+	}
+	if (rawIgnore.overrides !== void 0) if (!Array.isArray(rawIgnore.overrides)) warnConfigIssue(`config field "ignore.overrides" must be an array (got ${typeof rawIgnore.overrides}); ignoring this field.`);
+	else validatedIgnore.overrides = rawIgnore.overrides.flatMap((rawOverride, index) => {
+		const validatedOverride = validateIgnoreOverride(rawOverride, index);
+		return validatedOverride ? [validatedOverride] : [];
+	});
+	return validatedIgnore;
+};
 const validateSurfaceControls = (surface, rawControls) => {
-	if (!isPlainObject$1(rawControls)) {
+	if (!isRecord$1(rawControls)) {
 		warnConfigIssue(`config field "surfaces.${surface}" must be an object (got ${typeof rawControls}); ignoring this surface.`);
 		return;
 	}
@@ -69879,7 +70156,7 @@ const validateSurfaceControls = (surface, rawControls) => {
 	return validatedSurfaceControls;
 };
 const validateSurfacesField = (rawSurfaces) => {
-	if (!isPlainObject$1(rawSurfaces)) {
+	if (!isRecord$1(rawSurfaces)) {
 		warnConfigIssue(`config field "surfaces" must be an object (got ${typeof rawSurfaces}); ignoring this field.`);
 		return;
 	}
@@ -69895,7 +70172,7 @@ const validateSurfacesField = (rawSurfaces) => {
 	return validated;
 };
 const validateSeverityMap = (fieldName, rawMap, keysAreCategories = false) => {
-	if (!isPlainObject$1(rawMap)) {
+	if (!isRecord$1(rawMap)) {
 		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawMap}); ignoring this field.`);
 		return;
 	}
@@ -69929,6 +70206,7 @@ const validateConfigTypes = (config) => {
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
 	for (const fieldName of STRING_ARRAY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateStringArrayField(fieldName, value));
+	applyFieldValidator(config, validated, "ignore", validateIgnoreField);
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
 	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
@@ -70256,6 +70534,10 @@ const dedupeRelatedDiagnostics = (diagnostics) => {
 	}
 	return uniqueDiagnostics;
 };
+const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
+	const relativePath = Path.relative(parentAbsolutePath, childAbsolutePath);
+	return Boolean(relativePath) && !relativePath.startsWith("..") && !Path.isAbsolute(relativePath);
+};
 const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const sortDiagnosticsStable = (diagnostics) => [...diagnostics].sort((left, right) => compareStrings(left.filePath, right.filePath) || left.line - right.line || left.column - right.column || compareStrings(left.plugin, right.plugin) || compareStrings(left.rule, right.rule) || compareStrings(left.severity, right.severity) || compareStrings(left.message, right.message));
 const getDirectDependencyNames = (packageJson) => new Set([...Object.keys(packageJson.dependencies ?? {}), ...Object.keys(packageJson.devDependencies ?? {})]);
@@ -71617,7 +71899,7 @@ const collectScriptMotionEvidence = (sourceFile, typeChecker, program) => {
 			if (calleeEvidence.isReducedMotionHook && isExpressionValueConsumed(node)) evidence.hasReducedMotionHandling = true;
 		}
 		if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
-			const tagEvidence = ts.isJsxNamespacedName(node.tagName) ? EMPTY_MOTION_EXPRESSION_EVIDENCE : resolveMotionExpressionEvidence(node.tagName, typeChecker, program);
+			const tagEvidence = ts.isIdentifier(node.tagName) || ts.isPropertyAccessExpression(node.tagName) ? resolveMotionExpressionEvidence(node.tagName, typeChecker, program) : EMPTY_MOTION_EXPRESSION_EVIDENCE;
 			if (tagEvidence.isMotionComponent || tagEvidence.isMotionComponentFactory) evidence.hasMotionUse = true;
 			if (tagEvidence.isMotionConfig && jsxElementHasReducedMotionConfiguration(node.attributes, typeChecker)) evidence.hasReducedMotionHandling = true;
 		}
@@ -71832,7 +72114,7 @@ const readScannedFile = (candidate) => {
 		return null;
 	}
 };
-function* collectSecurityScanFiles(rootDirectory) {
+function* collectSecurityScanFiles(rootDirectory, excludedDirectories = /* @__PURE__ */ new Set()) {
 	const priorityCandidates = [];
 	const artifactCandidates = [];
 	const otherCandidates = [];
@@ -71847,7 +72129,7 @@ function* collectSecurityScanFiles(rootDirectory) {
 		for (const entry of readDirectoryEntries(current.absolutePath)) {
 			const absolutePath = Path.join(current.absolutePath, entry.name);
 			if (entry.isDirectory()) {
-				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name)) stack.push({
+				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name) && !excludedDirectories.has(Path.resolve(absolutePath))) stack.push({
 					absolutePath,
 					depth: current.depth + 1
 				});
@@ -72028,10 +72310,8 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhe
 	}
 	return true;
 };
+const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 const shouldEnableRuleByDefaultStatus = (options) => options.defaultEnabled !== false || options.hasExplicitOverride === true || options.includeTagDefaults && options.hasIncludedTags;
-const yieldToEventLoop = () => new Promise((resolve) => {
-	setImmediate(resolve);
-});
 const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? getCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
@@ -72084,19 +72364,35 @@ const createSecurityScanSession = (rootDirectory, options) => {
 	};
 };
 const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const throwIfScanAborted = () => {
+		options.signal?.throwIfAborted();
+	};
+	const didReachDeadline = () => {
+		const hasDeadlineElapsed = options.deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(options.deadlineEpochMs) === 0;
+		if (hasDeadlineElapsed) options.onDeadlineExceeded?.();
+		return hasDeadlineElapsed;
+	};
+	throwIfScanAborted();
 	const session = createSecurityScanSession(rootDirectory, options);
 	if (session === null) return [];
+	if (didReachDeadline()) return [];
 	let sliceStartedAt = performance.now();
-	for (const file of collectSecurityScanFiles(rootDirectory)) {
+	for (const file of collectSecurityScanFiles(rootDirectory, options.excludedDirectories)) {
+		throwIfScanAborted();
+		if (didReachDeadline()) return session.diagnostics;
 		if (file === null) {
 			if (performance.now() - sliceStartedAt >= 12) {
 				await yieldToEventLoop();
+				throwIfScanAborted();
+				if (didReachDeadline()) return session.diagnostics;
 				sliceStartedAt = performance.now();
 			}
 			continue;
 		}
 		for (const _ruleStep of session.scanFileByRule(file)) if (performance.now() - sliceStartedAt >= 12) {
 			await yieldToEventLoop();
+			throwIfScanAborted();
+			if (didReachDeadline()) return session.diagnostics;
 			sliceStartedAt = performance.now();
 		}
 	}
@@ -72275,25 +72571,18 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
-const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const KNIP_JSON_FILENAME = "knip.json";
-const readJsonFileSafe = (filePath) => {
-	let rawContents;
-	try {
-		rawContents = fs.readFileSync(filePath, "utf-8");
-	} catch {
-		return null;
-	}
+const failOpenReadJson = (filePath, fallback) => {
 	try {
-		return JSON.parse(rawContents);
+		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
 	} catch {
-		return null;
+		return fallback;
 	}
 };
+const KNIP_JSON_FILENAME = "knip.json";
 const readKnipConfig = (rootDirectory) => {
-	const knipJson = readJsonFileSafe(path.join(rootDirectory, KNIP_JSON_FILENAME));
+	const knipJson = failOpenReadJson(path.join(rootDirectory, KNIP_JSON_FILENAME), null);
 	if (isRecord$1(knipJson)) return knipJson;
-	const packageJson = readJsonFileSafe(path.join(rootDirectory, "package.json"));
+	const packageJson = failOpenReadJson(path.join(rootDirectory, "package.json"), null);
 	const packageKnipConfig = isRecord$1(packageJson) ? packageJson.knip : null;
 	return isRecord$1(packageKnipConfig) ? packageKnipConfig : null;
 };
@@ -72341,13 +72630,6 @@ const atomicWriteJson = (filePath, value) => {
 		return;
 	}
 };
-const failOpenReadJson = (filePath, fallback) => {
-	try {
-		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
-	} catch {
-		return fallback;
-	}
-};
 const hashFileContents = (filePath) => {
 	try {
 		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
@@ -73026,7 +73308,6 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 /**
 * Budget for the dead-code phase, scaled to the work. deslop's graph build is
 * CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
@@ -73034,25 +73315,28 @@ const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs
 * tipped over by any concurrent load — silently dropping every dead-code
 * finding. Scaling the budget with file count (and inversely with the core
 * share when overlapped) lets the pass complete, while the ceiling still
-* reclaims a genuinely wedged worker. Returns the in-worker SIGKILL deadline
-* and the Effect-side phase backstop that sits a margin above it.
+* reclaims a genuinely wedged worker.
 */
 const resolveDeadCodeTimeout = (input) => {
 	const coreShareFactor = Math.max(1, input.fullConcurrency / Math.max(1, input.deadCodeConcurrency));
-	const workerTimeoutMs = Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor)));
-	return {
-		workerTimeoutMs,
-		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
-	};
+	return { workerTimeoutMs: Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor))) };
 };
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+const resolveLintIncludePaths = (rootDirectory, userConfig, sourceFiles) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
+	return (sourceFiles ?? listSourceFiles(rootDirectory)).filter((filePath) => {
 		if (!isLintableSourceFile(filePath)) return false;
 		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
 	});
 };
+const filterPathsOutsideDirectories = (input) => {
+	const excludedPrefixes = input.excludedDirectories.map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, input.rootDirectory)).map((excludedDirectory) => Path.relative(input.rootDirectory, excludedDirectory).replaceAll("\\", "/")).sort((left, right) => left.length - right.length).filter((candidatePrefix, index, prefixes) => !prefixes.slice(0, index).some((prefix) => candidatePrefix.startsWith(`${prefix}/`)));
+	if (excludedPrefixes.length === 0) return [...input.relativePaths];
+	return input.relativePaths.filter((relativePath) => {
+		const normalizedRelativePath = relativePath.replaceAll("\\", "/").replace(/^\.\//, "");
+		return !excludedPrefixes.some((excludedPrefix) => normalizedRelativePath === excludedPrefix || normalizedRelativePath.startsWith(`${excludedPrefix}/`));
+	});
+};
 var Config = class Config extends Service()("react-doctor/Config") {
 	static layerNode = effect(Config, gen(function* () {
 		const cache = yield* make$3({
@@ -73114,6 +73398,7 @@ var Files = class Files extends Service()("react-doctor/Files") {
 	static layerNode = succeed$3(Files, Files.of({
 		readLines: (input) => sync(() => createNodeReadFileLinesSync(input.rootDirectory)(input.filePath)),
 		listSourceFiles: (rootDirectory) => sync(() => listSourceFiles(rootDirectory)),
+		listSourceFilesCooperative: (input) => promise(() => listSourceFilesCooperative(input.rootDirectory, input.signal)),
 		isFile: (filePath) => sync(() => isFile(filePath)),
 		isDirectory: (filePath) => sync(() => isDirectory(filePath))
 	}));
@@ -73140,6 +73425,16 @@ var Files = class Files extends Service()("react-doctor/Files") {
 				}
 				return files;
 			}),
+			listSourceFilesCooperative: (input) => sync(() => {
+				const rootDirectory = input.rootDirectory;
+				const prefix = rootDirectory.endsWith("/") ? rootDirectory : `${rootDirectory}/`;
+				const files = [];
+				for (const absolute of tree.keys()) {
+					if (!absolute.startsWith(prefix)) continue;
+					files.push(absolute.slice(prefix.length));
+				}
+				return files;
+			}),
 			isFile: (filePath) => sync(() => tree.has(filePath)),
 			isDirectory: (filePath) => sync(() => {
 				const prefix = filePath.endsWith("/") ? filePath : `${filePath}/`;
@@ -73604,7 +73899,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 					changedFiles: yield* mergeUntracked(directory, splitNullSeparated(diff.stdout), includeUntracked),
 					isCurrentChanges: false
 				};
-			}).pipe(withSpan("Git.diffSelection")),
+			}).pipe(catchReasons("ReactDoctorError", { GitInvocationFailed: () => succeed$2(null) }, (_reason, error) => fail$4(error)), withSpan("Git.diffSelection")),
 			stagedFilePaths: (directory) => runGit(directory, [
 				"diff",
 				"--no-ext-diff",
@@ -73715,7 +74010,7 @@ const batchIncludePaths = (baseArgs, includePaths) => {
 	for (const filePath of includePaths) {
 		const entryLength = filePath.length + 1;
 		const exceedsArgLength = currentBatch.length > 0 && currentBatchLength + entryLength > 24e3;
-		const exceedsFileCount = currentBatch.length >= 100;
+		const exceedsFileCount = currentBatch.length >= 200;
 		if (exceedsArgLength || exceedsFileCount) {
 			batches.push(currentBatch);
 			currentBatch = [];
@@ -73820,6 +74115,33 @@ const detectUserLintConfigPaths = (rootDirectory) => {
 	return [];
 };
 const DISABLE_DIRECTIVE_PATTERN = /(eslint|oxlint)-disable/;
+const neutralizedFileLeases = /* @__PURE__ */ new Map();
+const activeNeutralizationInitializations = /* @__PURE__ */ new Set();
+const directoriesOverlap = (left, right) => {
+	const isWithin = (parent, candidate) => {
+		const relativePath = Path.relative(parent, candidate);
+		return relativePath.length === 0 || !relativePath.startsWith(`..${Path.sep}`) && relativePath !== ".." && !Path.isAbsolute(relativePath);
+	};
+	return isWithin(left, right) || isWithin(right, left);
+};
+const withOverlappingInitializationLock = async (rootDirectory, operation) => {
+	const blockers = [...activeNeutralizationInitializations].filter((initialization) => directoriesOverlap(initialization.rootDirectory, rootDirectory)).map((initialization) => initialization.done);
+	let release;
+	const initialization = {
+		rootDirectory,
+		done: new Promise((resolve) => {
+			release = resolve;
+		})
+	};
+	activeNeutralizationInitializations.add(initialization);
+	await Promise.all(blockers);
+	try {
+		return await operation();
+	} finally {
+		activeNeutralizationInitializations.delete(initialization);
+		release();
+	}
+};
 const findFilesWithDisableDirectivesViaGit = async (rootDirectory, includePaths) => {
 	const program = gen(function* () {
 		return yield* (yield* Git).grep({
@@ -73862,34 +74184,84 @@ const findFilesWithDisableDirectivesViaFilesystem = (rootDirectory, includePaths
 };
 const findFilesWithDisableDirectives = async (rootDirectory, includePaths) => await findFilesWithDisableDirectivesViaGit(rootDirectory, includePaths) ?? findFilesWithDisableDirectivesViaFilesystem(rootDirectory, includePaths);
 const neutralizeContent = (content) => content.replaceAll("eslint-disable", "eslint_disable").replaceAll("oxlint-disable", "oxlint_disable");
-const neutralizeDisableDirectives = async (rootDirectory, includePaths) => {
-	const filePaths = await findFilesWithDisableDirectives(rootDirectory, includePaths);
-	const originalContents = /* @__PURE__ */ new Map();
+const collectNeutralizationCandidatePaths = (rootDirectory, discoveredRelativePaths, includePaths) => {
+	const resolvedRootDirectory = NFS.realpathSync(rootDirectory);
+	const requestedPaths = includePaths && includePaths.length > 0 ? new Set(includePaths.flatMap((includePath) => {
+		try {
+			return [NFS.realpathSync(Path.resolve(resolvedRootDirectory, includePath))];
+		} catch {
+			return [];
+		}
+	})) : null;
+	const candidatePaths = /* @__PURE__ */ new Set();
+	for (const relativePath of discoveredRelativePaths) try {
+		candidatePaths.add(NFS.realpathSync(Path.resolve(resolvedRootDirectory, relativePath)));
+	} catch {
+		continue;
+	}
+	for (const leasedPath of neutralizedFileLeases.keys()) {
+		const relativePath = Path.relative(resolvedRootDirectory, leasedPath);
+		if (!(relativePath.length === 0 || !relativePath.startsWith(`..${Path.sep}`) && relativePath !== ".." && !Path.isAbsolute(relativePath)) || requestedPaths && !requestedPaths.has(leasedPath)) continue;
+		candidatePaths.add(leasedPath);
+	}
+	return candidatePaths;
+};
+const neutralizeDisableDirectives = async (rootDirectory, includePaths, options = {}) => {
+	const resolvedRootDirectory = NFS.realpathSync(rootDirectory);
+	const leasedPaths = /* @__PURE__ */ new Set();
 	let isRestored = false;
 	const restore = () => {
 		if (isRestored) return;
 		isRestored = true;
-		for (const [absolutePath, originalContent] of originalContents) try {
-			NFS.writeFileSync(absolutePath, originalContent);
-		} catch (error) {
-			process.stderr.write(`[react-doctor] Failed to restore inline disable directives in ${absolutePath}: ${messageFromUnknown(error)}\n[react-doctor] Run: git checkout -- ${absolutePath}\n`);
+		for (const absolutePath of leasedPaths) {
+			const lease = neutralizedFileLeases.get(absolutePath);
+			if (!lease) continue;
+			lease.referenceCount -= 1;
+			if (lease.referenceCount > 0) continue;
+			neutralizedFileLeases.delete(absolutePath);
+			try {
+				NFS.writeFileSync(absolutePath, lease.originalContent);
+			} catch (error) {
+				process.stderr.write(`[react-doctor] Failed to restore inline disable directives in ${absolutePath}: ${messageFromUnknown(error)}\n[react-doctor] Run: git checkout -- ${absolutePath}\n`);
+			}
 		}
 	};
 	const onExit = () => restore();
 	process.once("exit", onExit);
-	for (const relativePath of filePaths) {
-		const absolutePath = Path.join(rootDirectory, relativePath);
+	const leaseCandidatePath = (absolutePath) => {
+		if (leasedPaths.has(absolutePath)) return;
+		const existingLease = neutralizedFileLeases.get(absolutePath);
+		if (existingLease) {
+			existingLease.referenceCount += 1;
+			leasedPaths.add(absolutePath);
+			return;
+		}
 		let originalContent;
 		try {
 			originalContent = NFS.readFileSync(absolutePath, "utf-8");
 		} catch {
-			continue;
+			return;
 		}
 		const neutralizedContent = neutralizeContent(originalContent);
 		if (neutralizedContent !== originalContent) {
-			originalContents.set(absolutePath, originalContent);
 			NFS.writeFileSync(absolutePath, neutralizedContent);
+			neutralizedFileLeases.set(absolutePath, {
+				originalContent,
+				referenceCount: 1
+			});
+			leasedPaths.add(absolutePath);
 		}
+	};
+	try {
+		await withOverlappingInitializationLock(resolvedRootDirectory, async () => {
+			for (const absolutePath of collectNeutralizationCandidatePaths(resolvedRootDirectory, [], includePaths)) if (neutralizedFileLeases.has(absolutePath)) leaseCandidatePath(absolutePath);
+			const discoveredRelativePaths = await (options.findFiles ?? findFilesWithDisableDirectives)(resolvedRootDirectory, includePaths);
+			for (const absolutePath of collectNeutralizationCandidatePaths(resolvedRootDirectory, discoveredRelativePaths, includePaths)) leaseCandidatePath(absolutePath);
+		});
+	} catch (error) {
+		restore();
+		process.removeListener("exit", onExit);
+		throw error;
 	}
 	return () => {
 		restore();
@@ -74062,7 +74434,7 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, projectIndexModuleSources, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
 	const hasIncludedTags = includedTags.size > 0;
 	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" || hasIncludedTags ? null : resolveReactHooksJsPlugin(project.hasReactCompiler || project.hasReactCompilerLintPlugin === true, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
@@ -74126,7 +74498,8 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 				}))
 			} : {},
 			...project.shopifyFlashListMajorVersion !== null ? { shopifyFlashListMajorVersion: project.shopifyFlashListMajorVersion } : {},
-			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {}
+			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {},
+			...projectIndexModuleSources !== void 0 ? { projectIndexModuleSources: [...projectIndexModuleSources] } : {}
 		} },
 		rules: {
 			...reactCompilerRules,
@@ -74375,11 +74748,17 @@ const collectUnpluginAutoImportGlobalScopes = ({ rootDirectory, candidateFiles }
 	return scopes.some((scope) => scope.names.length > 0) ? scopes : [];
 };
 const validateDiagnostic$1 = decodeUnknownSync(Diagnostic);
+const decodeDiagnostic = (raw) => {
+	const diagnostic = validateDiagnostic$1(raw);
+	return {
+		...diagnostic,
+		relatedLocations: diagnostic.relatedLocations?.map((location) => ({ ...location }))
+	};
+};
 const decodeFileDiagnostics = (raw) => {
 	if (!Array.isArray(raw)) return null;
 	try {
-		for (const entry of raw) validateDiagnostic$1(entry);
-		return raw;
+		return raw.map((entry) => decodeDiagnostic(entry));
 	} catch {
 		return null;
 	}
@@ -75611,6 +75990,12 @@ const buildProfiledNodeArguments = (input) => [
 	...input.heapProfileDirectory ? ["--heap-prof", `--heap-prof-dir=${input.heapProfileDirectory}`] : [],
 	...input.argumentsList
 ];
+const lowerChildProcessPriority = (processId) => {
+	if (processId === void 0) return;
+	try {
+		OS.setPriority(processId, OS.constants.priority.PRIORITY_BELOW_NORMAL);
+	} catch {}
+};
 const SANITIZED_ENV = buildOxlintChildEnv(process.env);
 /**
 * Spawn one oxlint subprocess with hard ceilings on wall time and
@@ -75649,6 +76034,7 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 			"pipe"
 		]
 	});
+	lowerChildProcessPriority(child.pid);
 	const onAbort = () => {
 		child.kill("SIGKILL");
 		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
@@ -75771,7 +76157,7 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 9, signal, deadlineEpochMs } = input;
 	const resolveSourcePath = (filePath) => {
 		const absoluteFilePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory, filePath);
 		return sourcePathByLintPath?.get(Path.normalize(absoluteFilePath)) ?? filePath;
@@ -75779,6 +76165,12 @@ const spawnLintBatches = async (input) => {
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	let rescueDeadlineEpochMs;
 	const isPastDeadline = () => deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(deadlineEpochMs) === 0 || rescueDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(rescueDeadlineEpochMs) === 0;
+	const resolveSpawnTimeoutMs = () => {
+		const deadlineBudgets = [deadlineEpochMs, rescueDeadlineEpochMs].filter((deadline) => deadline !== void 0).map(remainingDeadlineBudgetMs);
+		if (deadlineBudgets.length === 0) return spawnTimeoutMs;
+		const remainingDeadlineMs = Math.min(...deadlineBudgets);
+		return spawnTimeoutMs === void 0 ? remainingDeadlineMs : Math.min(spawnTimeoutMs, remainingDeadlineMs);
+	};
 	const runBatchPass = async (concurrency, passBatches, passOnFileProgress) => {
 		const totalFileCount = passBatches.reduce((sum, batch) => sum + batch.length, 0);
 		const allDiagnostics = [];
@@ -75796,12 +76188,13 @@ const spawnLintBatches = async (input) => {
 			const batchArgs = [...baseArgs, ...batch];
 			try {
 				const spawnBatch = () => {
-					if (isPastDeadline()) {
+					const effectiveSpawnTimeoutMs = resolveSpawnTimeoutMs();
+					if (effectiveSpawnTimeoutMs === 0) {
 						deadlineSkippedFiles.push(...batch);
 						batchState.deadlineSkippedFileCount += batch.length;
 						return Promise.resolve(null);
 					}
-					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal, () => {
+					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, effectiveSpawnTimeoutMs, outputMaxBytes, signal, () => {
 						if (batchState.didStart) return;
 						batchState.didStart = true;
 						startedFileCount += batchState.initialFileCount;
@@ -75956,11 +76349,36 @@ const validateRuleRegistration = () => {
 	].filter((entry) => entry !== null).join("; ");
 	console.warn(`[react-doctor] rule-registration drift: ${detail}`);
 };
+const PROJECT_INDEX_MODULE_SOURCES = [
+	"next/og",
+	"@vercel/og",
+	"satori",
+	"remotion"
+];
+const collectProjectIndexModuleSources = async (rootDirectory, candidateFiles) => {
+	const foundModuleSources = /* @__PURE__ */ new Set();
+	let sliceStartedAt = performance.now();
+	for (const candidateFile of candidateFiles) {
+		let sourceBuffer;
+		try {
+			sourceBuffer = NFS.readFileSync(Path.isAbsolute(candidateFile) ? candidateFile : Path.resolve(rootDirectory, candidateFile));
+		} catch {
+			continue;
+		}
+		for (const moduleSource of PROJECT_INDEX_MODULE_SOURCES) if (sourceBuffer.includes(`"${moduleSource}"`) || sourceBuffer.includes(`'${moduleSource}'`)) foundModuleSources.add(moduleSource);
+		if (foundModuleSources.size === PROJECT_INDEX_MODULE_SOURCES.length) break;
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return [...foundModuleSources].sort();
+};
 /**
 * Balanced LPT (longest-processing-time-first) lint batch planner. Where
-* `batchIncludePaths` greedily fills 100-file batches and leaves a small
-* remainder batch (617 files → 6×100 + 17, so the parallel pool's wall clock
-* is set by whichever 100-file chunk happened to collect the most work while
+* `batchIncludePaths` greedily fills fixed-size batches and leaves a small
+* remainder batch, so the parallel pool's wall clock is set by whichever
+* full chunk happened to collect the most work while
 * the remainder's worker idles), this planner keeps the SAME mandatory batch
 * count — `ceil(files / OXLINT_MAX_FILES_PER_BATCH)`, the JS-plugin
 * perf-cliff / native-binding SIGABRT guard — and assigns files largest-first,
@@ -75989,7 +76407,7 @@ const validateRuleRegistration = () => {
 */
 const planLintBatches = ({ baseArgs, files, sizeByFile }) => {
 	if (files.length === 0) return [];
-	const batchCount = Math.ceil(files.length / 100);
+	const batchCount = Math.ceil(files.length / 200);
 	const maxFilesPerBatch = Math.ceil(files.length / batchCount);
 	const baseArgsLengthChars = estimateArgsLength(baseArgs);
 	const descendingSizeIndexes = [...files.keys()].sort((leftIndex, rightIndex) => (sizeByFile.get(files[rightIndex]) ?? 0) - (sizeByFile.get(files[leftIndex]) ?? 0));
@@ -76518,6 +76936,7 @@ const runOxlint = async (options) => {
 		await yieldToEventLoop();
 		const sizedScanFiles = includePaths === void 0 ? listSourceFilesWithSize(rootDirectory) : null;
 		const candidateFiles = includePaths !== void 0 ? includePaths : (sizedScanFiles ?? []).map((entry) => entry.path);
+		const projectIndexModuleSources = includePaths === void 0 && options.deadlineEpochMs === void 0 ? await collectProjectIndexModuleSources(rootDirectory, candidateFiles) : void 0;
 		unpluginAutoImportGlobalScopes = collectUnpluginAutoImportGlobalScopes({
 			rootDirectory,
 			candidateFiles
@@ -76540,6 +76959,7 @@ const runOxlint = async (options) => {
 			runtimeGlobals,
 			unpluginAutoImportGlobalScopes,
 			serverAuthFunctionNames,
+			projectIndexModuleSources,
 			severityControls,
 			userPlugins,
 			disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
@@ -77007,10 +77427,10 @@ const translateProjectInfoError = (cause, directory) => {
 	}) });
 };
 var Project = class Project extends Service()("react-doctor/Project") {
-	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (directory) {
+	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (input) {
 		return yield* try_({
-			try: () => discoverProject(directory),
-			catch: (cause) => translateProjectInfoError(cause, directory)
+			try: () => discoverProject(input.directory, { sourceFileCount: input.sourceFileCount }),
+			catch: (cause) => translateProjectInfoError(cause, input.directory)
 		});
 	}) }));
 	static layerOf = (projectInfo) => succeed$3(Project, Project.of({ discover: () => succeed$2(projectInfo) }));
@@ -77595,9 +78015,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
-	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (totalTimeoutMs) => checkSupplyChain({
-		...input,
-		totalTimeoutMs
+	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (configuredTimeoutMs) => checkSupplyChain({
+		rootDirectory: input.rootDirectory,
+		userConfig: input.userConfig,
+		totalTimeoutMs: input.timeoutMs ?? configuredTimeoutMs
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
 	static layerOf = (diagnostics) => succeed$3(SupplyChain, SupplyChain.of({ run: () => fromIterable$1(diagnostics) }));
 };
@@ -77632,10 +78053,6 @@ const NO_HOOKS = {
 	beforeLint: () => void_,
 	afterLint: () => void_
 };
-const filterMapNullable = (transform) => fromPredicateOption((value) => {
-	const result = transform(value);
-	return result === null ? none() : some(result);
-});
 const fileReader = (filesService, rootDirectory) => (filePath) => {
 	const lines = runSync(filesService.readLines({
 		filePath,
@@ -77659,7 +78076,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      The GitHub viewer-permission lookup is forked onto a background
 *      fiber here and joined late (it feeds score metadata, not
 *      diagnostics).
-*   2. beforeLint hook (e.g. CLI renders the project-detection block)
+*   2. beforeLint hook (e.g. CLI records project telemetry)
 *   3. environment checks (reduced-motion + pnpm hardening +
 *      expo/react-native), collected synchronously. The heavier
 *      content-regex security scan is forked instead (like supply-chain
@@ -77672,13 +78089,11 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      `SupplyChainOverlapTimeoutMs` (measured from fork) so a hung
 *      socket can't drag out its join; on timeout it fails open to no
 *      diagnostics — the same outcome class as a Socket outage.
-*   5. Linter.run runs; DeadCode.run runs concurrently (forked child
-*      fiber) ONLY when the memory gate has headroom to run the 8 GB
-*      dead-code child alongside the oxlint workers — or when overlap is
-*      forced via REACT_DOCTOR_DEAD_CODE_OVERLAP. Otherwise dead-code
-*      runs sequentially after lint, exactly as it did pre-overlap. The
-*      fiber is joined (or interrupted, SIGKILLing its worker, on lint
-*      failure) before diagnostics are concatenated. The afterLint hook
+*   5. Linter.run runs; DeadCode.run forks only when
+*      REACT_DOCTOR_DEAD_CODE_OVERLAP=on. The default "auto" and explicit
+*      "off" paths stay sequential. The fiber is joined (or interrupted,
+*      SIGKILLing its worker, on lint failure) before diagnostics are
+*      concatenated. The afterLint hook
 *      fires between lint and dead-code. Progress spinner labels AND the
 *      final diagnostic / score order stay independent of execution
 *      order, so terminal output is identical either way; supply-chain
@@ -77713,8 +78128,28 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const partialFailuresRef = yield* LintPartialFailures;
 	const resolvedConfig = yield* configService.resolve(input.directory);
 	const scanDirectory = resolvedConfig.resolvedDirectory;
-	const project = yield* projectService.discover(scanDirectory);
+	const excludedProjectDirectories = (input.excludedProjectDirectories ?? []).map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, scanDirectory));
+	const excludedProjectRelativePaths = excludedProjectDirectories.map((excludedDirectory) => Path.relative(scanDirectory, excludedDirectory).replaceAll("\\", "/"));
+	const isExcludedProjectDiagnostic = (diagnostic) => {
+		const relativeFilePath = toNormalizedRelativePath(diagnostic.filePath, scanDirectory);
+		return excludedProjectRelativePaths.some((excludedRelativePath) => relativeFilePath === excludedRelativePath || relativeFilePath.startsWith(`${excludedRelativePath}/`));
+	};
+	const precomputedSourceFiles = input.suppressScanSummary === true || excludedProjectDirectories.length > 0 ? yield* filesService.listSourceFilesCooperative({
+		rootDirectory: scanDirectory,
+		signal: input.signal
+	}) : null;
+	const includedPrecomputedSourceFiles = precomputedSourceFiles !== null && excludedProjectDirectories.length > 0 ? filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: precomputedSourceFiles,
+		excludedDirectories: excludedProjectDirectories
+	}) : precomputedSourceFiles;
+	const sourceFileCount = excludedProjectDirectories.length > 0 ? includedPrecomputedSourceFiles?.length : input.precomputedSourceFileCount ?? includedPrecomputedSourceFiles?.length;
+	const project = yield* projectService.discover({
+		directory: scanDirectory,
+		sourceFileCount
+	});
 	if (!isAnalyzableProject(project)) return yield* new ReactDoctorError({ reason: new NoReactDependency({ directory: scanDirectory }) });
+	const deadCodeSourceFileCount = input.retainExcludedProjectDeadCodeDiagnostics === true && precomputedSourceFiles !== null ? precomputedSourceFiles.length : project.sourceFileCount;
 	const [repo, sha, defaultBranch] = yield* all([
 		gitService.githubRepo(scanDirectory).pipe(orElseSucceed(() => null)),
 		gitService.headSha(scanDirectory).pipe(orElseSucceed(() => null)),
@@ -77725,11 +78160,16 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		directory: scanDirectory,
 		repo
 	}).pipe(orElseSucceed(() => null)) : succeed$2(null));
-	const lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
-	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
+	let lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config, includedPrecomputedSourceFiles ?? void 0);
+	if (excludedProjectDirectories.length > 0) lintIncludePaths = filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory)),
+		excludedDirectories: excludedProjectDirectories
+	});
+	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
-	yield* beforeLint(project, lintIncludePaths ?? void 0);
+	yield* beforeLint(project);
 	const isDiffMode = input.includePaths.length > 0;
 	const showWarnings = input.warnings ?? resolvedConfig.config?.warnings ?? true;
 	const transform = buildDiagnosticPipeline({
@@ -77739,7 +78179,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		respectInlineDisables: input.respectInlineDisables,
 		showWarnings
 	});
-	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(filterMapNullable(transform.apply)));
+	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(fromPredicateOption((diagnostic) => {
+		const filteredDiagnostic = transform.apply(diagnostic);
+		return filteredDiagnostic === null ? none() : some(filteredDiagnostic);
+	})));
 	const applyPerElementPipeline = (rawStream) => filterPerElementPipeline(rawStream).pipe(tap((diagnostic) => reporterService.emit(diagnostic)));
 	const envCollected = yield* runCollect(applyPerElementPipeline(fromIterable$1(isDiffMode ? [] : [
 		...checkReducedMotion(scanDirectory),
@@ -77749,17 +78192,31 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkReactNativeProject(scanDirectory, project)
 	])));
 	const securityScanFailedRef = yield* make$13(false);
-	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise(() => checkSecurityScanCooperative(scanDirectory, {
+	let didSecurityScanReachDeadline = false;
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise((signal) => checkSecurityScanCooperative(scanDirectory, {
 		project,
 		ignoredTags: input.ignoredTags,
 		includedTags: input.includedTags,
-		includeTagDefaults: input.includeTagDefaults
+		includeTagDefaults: input.includeTagDefaults,
+		excludedDirectories: new Set(excludedProjectDirectories),
+		deadlineEpochMs: input.deadlineEpochMs,
+		signal,
+		onDeadlineExceeded: () => {
+			didSecurityScanReachDeadline = true;
+		}
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), catch_$1(() => set(securityScanFailedRef, true).pipe(as(empty$4))))))).pipe(withSpan("SecurityScan.run")));
+	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
+	const capOptionalToDeadline = (phaseTimeoutMs) => {
+		if (input.deadlineEpochMs === void 0) return phaseTimeoutMs;
+		const remainingBudgetMs = remainingDeadlineBudgetMs(input.deadlineEpochMs);
+		return phaseTimeoutMs === null ? remainingBudgetMs : Math.min(phaseTimeoutMs, remainingBudgetMs);
+	};
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
-	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
+	const supplyChainOverlapTimeout = capToDeadline(yield* SupplyChainOverlapTimeoutMs);
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
+		userConfig: resolvedConfig.config,
+		timeoutMs: supplyChainOverlapTimeout
 	}))).pipe(map$3((diagnostics) => ({
 		diagnostics,
 		timedOut: false
@@ -77783,46 +78240,49 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const scanConcurrency = resolveScanConcurrency(yield* OxlintConcurrency);
 	const lintPhaseTimeoutMs = yield* LintPhaseTimeoutMs;
 	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
-	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
-	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
 	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeOverlapMode = yield* DeadCodeOverlap;
 	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
 	const deadCodeParseConcurrency = shouldOverlapDeadCode ? Math.max(1, Math.floor(scanConcurrency * DEAD_CODE_OVERLAP_PARSE_SHARE)) : void 0;
 	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
-	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
-		rootDirectory: scanDirectory,
-		parseConcurrency: deadCodeParseConcurrency,
-		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
-		onCacheOutcome: (didHitCache) => {
-			deadCodeCacheHit = didHitCache;
-		},
-		onSummaryCacheStats: (stats) => {
-			deadCodeSummaryCacheHits = stats.hits;
-			deadCodeSummaryCacheMisses = stats.misses;
-		}
-	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
-		yield* set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
-		});
-		return empty$4;
-	})))))).pipe(timeoutOption(deadCodeTimeout.phaseTimeoutMs), flatMap$2(match$3({
-		onNone: () => set(deadCodeFailure, {
-			didFail: true,
-			reason: `Dead-code analysis exceeded ${Math.round(deadCodeTimeout.phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
-		}).pipe(as([])),
-		onSome: succeed$2
-	})));
+	const buildCollectDeadCode = (deadCodeTimeout) => {
+		const collectDeadCode = runCollect(applyPerElementPipeline(deadCodeService.run({
+			rootDirectory: scanDirectory,
+			parseConcurrency: deadCodeParseConcurrency,
+			workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
+			onCacheOutcome: (didHitCache) => {
+				deadCodeCacheHit = didHitCache;
+			},
+			onSummaryCacheStats: (stats) => {
+				deadCodeSummaryCacheHits = stats.hits;
+				deadCodeSummaryCacheMisses = stats.misses;
+			}
+		}).pipe(filter((diagnostic) => input.retainExcludedProjectDeadCodeDiagnostics === true || !isExcludedProjectDiagnostic(diagnostic)), catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
+			yield* set(deadCodeFailure, {
+				didFail: true,
+				reason: error.message
+			});
+			return empty$4;
+		}))))));
+		const phaseTimeoutMs = deadCodeTimeout.phaseTimeoutMs;
+		if (phaseTimeoutMs === null) return collectDeadCode;
+		return collectDeadCode.pipe(timeoutOption(phaseTimeoutMs), flatMap$2(match$3({
+			onNone: () => set(deadCodeFailure, {
+				didFail: true,
+				reason: `Dead-code analysis exceeded ${Math.round(phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
+			}).pipe(as([])),
+			onSome: succeed$2
+		})));
+	};
 	const overlapDeadCodeTimeout = resolveDeadCodeTimeout({
-		sourceFileCount: project.sourceFileCount,
+		sourceFileCount: deadCodeSourceFileCount,
 		deadCodeConcurrency: deadCodeParseConcurrency ?? scanConcurrency,
 		fullConcurrency: scanConcurrency
 	});
 	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
 		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
-		phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs))
+		phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
@@ -77873,7 +78333,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		});
 		return empty$4;
 	}))));
-	const lintCollected = dedupeRelatedDiagnostics(yield* runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream)).pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
+	const collectLintDiagnostics = runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream));
+	const lintCollected = dedupeRelatedDiagnostics(yield* lintPhaseTimeoutMs === null ? collectLintDiagnostics : collectLintDiagnostics.pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
 		onNone: () => set(lintFailure, {
 			didFail: true,
 			reason: `Lint analysis exceeded ${lintPhaseTimeoutMs / MILLISECONDS_PER_SECOND}s and was skipped.`,
@@ -77903,13 +78364,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	} else {
 		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
 		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
-			sourceFileCount: totalFileCount,
+			sourceFileCount: input.retainExcludedProjectDeadCodeDiagnostics === true ? deadCodeSourceFileCount : totalFileCount,
 			deadCodeConcurrency: scanConcurrency,
 			fullConcurrency: scanConcurrency
 		});
 		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
 			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
-			phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs))
+			phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 		});
 	}
 	const deadCodeFailureState = lintFailureState.didFail ? {
@@ -77953,7 +78414,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		metadata: scoreMetadata
 	});
 	const lintPartialFailures = yield* get$2(partialFailuresRef);
-	const securityScanFailed = yield* get$2(securityScanFailedRef);
+	const didSecurityScanFail = yield* get$2(securityScanFailedRef);
+	const securityScanFailed = didSecurityScanFail || didSecurityScanReachDeadline;
+	let securityScanFailureReason = null;
+	if (didSecurityScanReachDeadline) securityScanFailureReason = "Security scan reached the max scan duration; findings collected before the deadline were preserved.";
+	else if (didSecurityScanFail) securityScanFailureReason = "Security scan failed and was skipped.";
 	return {
 		project,
 		userConfig: resolvedConfig.config,
@@ -77976,6 +78441,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
 		securityScanFailed,
+		securityScanFailureReason,
 		lintCacheHitFileCount,
 		lintCacheTotalFileCount,
 		lintSidecarReplayedFileCount,
@@ -77991,7 +78457,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	"inspect.runDeadCode": input.runDeadCode,
 	"inspect.isCi": input.isCi,
 	"inspect.scoreSurface": input.scoreSurface ?? "score"
-} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })))));
+} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => {
+	if (scanDeadlineMs === null) return scanProgram;
+	return scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })));
+}));
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -78103,16 +78572,6 @@ var NodeResolver = class NodeResolver extends Service()("react-doctor/NodeResolv
 	});
 };
 /**
-* Zip-Slip defense: relative paths come from git (`diff --name-only`), which
-* normalizes during ordinary adds, but a crafted index/pack/symlinked tree can
-* smuggle `..` segments that escape the temp root. Resolve against the temp dir
-* and reject anything that lands outside before writing.
-*/
-const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
-	const relative = path.relative(parentAbsolutePath, childAbsolutePath);
-	return Boolean(relative) && !relative.startsWith("..") && !path.isAbsolute(relative);
-};
-/**
 * Writes a set of source files (supplied by `readContent` — e.g.
 * `git show <ref>:<path>` for a baseline tree, or `git show :<path>` for the
 * index) into a temp tree that mirrors the project layout, copying the
@@ -78148,7 +78607,7 @@ const materializeSourceTree = (input) => gen(function* () {
 			const sourcePath = path.join(input.directory, subdirectory, configFilename);
 			const targetPath = path.resolve(resolvedTempDirectory, subdirectory, configFilename);
 			if (!isPathInsideDirectory(targetPath, resolvedTempDirectory)) continue;
-			if (fs.existsSync(sourcePath) && !fs.existsSync(targetPath)) {
+			if (isFile(sourcePath) && !fs.existsSync(targetPath)) {
 				fs.mkdirSync(path.dirname(targetPath), { recursive: true });
 				fs.cpSync(sourcePath, targetPath);
 			}
@@ -78400,6 +78859,7 @@ const buildJsonReport = (input) => {
 		directory: input.directory,
 		diff: toJsonDiff(input.diff),
 		projects,
+		...input.skippedProjects && input.skippedProjects.length > 0 ? { skippedProjects: [...input.skippedProjects] } : {},
 		diagnostics: flattenedDiagnostics,
 		summary,
 		elapsedMilliseconds: input.totalElapsedMilliseconds,
@@ -78424,7 +78884,7 @@ const buildSkippedChecks = (input) => {
 	else if (input.lintPartialFailures.length > 0) skippedCheckReasons["lint:partial"] = input.lintPartialFailures.join("; ");
 	if (input.didDeadCodeFail && input.deadCodeFailureReason !== null) skippedCheckReasons["dead-code"] = input.deadCodeFailureReason;
 	if (input.supplyChainOverlapTimedOut) skippedCheckReasons["supply-chain"] = "Supply-chain analysis timed out and was skipped.";
-	if (input.securityScanFailed) skippedCheckReasons["security-scan"] = "Security scan failed and was skipped.";
+	if (input.securityScanFailed) skippedCheckReasons["security-scan"] = input.securityScanFailureReason ?? "Security scan failed and was skipped.";
 	return {
 		skippedChecks,
 		skippedCheckReasons
@@ -78564,6 +79024,33 @@ const getChangedLineRanges = (input) => runPromise(gen(function* () {
 * instead of being improvised per diagnostic.
 */
 const buildRuleDocsUrl = (plugin, rule) => `${DOCS_RULES_BASE_URL}/${plugin}/${rule}`;
+const collectSourceFileCountsByDirectory = async (rootDirectory, projectDirectories, signal) => {
+	const resolvedRootDirectory = Path.resolve(rootDirectory);
+	const sourceFileCounts = /* @__PURE__ */ new Map();
+	const projectDirectoryByRelativePath = /* @__PURE__ */ new Map();
+	for (const projectDirectory of projectDirectories) {
+		const resolvedProjectDirectory = Path.resolve(projectDirectory);
+		const relativeDirectory = Path.relative(resolvedRootDirectory, resolvedProjectDirectory);
+		if (Path.isAbsolute(relativeDirectory) || relativeDirectory.startsWith("..")) continue;
+		sourceFileCounts.set(resolvedProjectDirectory, 0);
+		projectDirectoryByRelativePath.set(relativeDirectory.replaceAll(Path.sep, "/"), resolvedProjectDirectory);
+	}
+	const sourceFilePaths = await listSourceFilesCooperative(resolvedRootDirectory, signal);
+	for (const sourceFilePath of sourceFilePaths) {
+		let relativeDirectory = Path.posix.dirname(sourceFilePath);
+		while (true) {
+			const normalizedRelativeDirectory = relativeDirectory === "." ? "" : relativeDirectory;
+			const projectDirectory = projectDirectoryByRelativePath.get(normalizedRelativeDirectory);
+			if (projectDirectory !== void 0) {
+				sourceFileCounts.set(projectDirectory, (sourceFileCounts.get(projectDirectory) ?? 0) + 1);
+				break;
+			}
+			if (relativeDirectory === ".") break;
+			relativeDirectory = Path.posix.dirname(relativeDirectory);
+		}
+	}
+	return sourceFileCounts;
+};
 const computeConfigFingerprint = (projectDirectory, version) => {
 	const parts = [`v=${version}`];
 	let directory = projectDirectory;
@@ -78583,59 +79070,34 @@ const createOxlintSpawnSlots = (concurrency) => createWorkerSlots({
 	slotCount: resolveScanConcurrency(concurrency),
 	createAbortError: createLintPhaseAbortError
 });
-const AI_TRAINING_ENV_VARS = [
-	["HF_DATASETS_CACHE", "huggingface"],
-	["HF_HOME", "huggingface"],
-	["HUGGINGFACE_HUB_CACHE", "huggingface"],
-	["SPACE_ID", "huggingface-spaces"],
-	["CUDA_VISIBLE_DEVICES", "cuda"],
-	["NVIDIA_VISIBLE_DEVICES", "nvidia"],
-	["ROCR_VISIBLE_DEVICES", "rocm"],
-	["TPU_NAME", "google-tpu"],
+const AI_TRAINING_BY_ENVIRONMENT_VARIABLE = [
 	["WANDB_RUN_ID", "wandb"],
 	["WANDB_SWEEP_ID", "wandb"],
 	["MLFLOW_RUN_ID", "mlflow"],
-	["MLFLOW_TRACKING_URI", "mlflow"],
 	["COMET_EXPERIMENT_KEY", "comet"],
 	["NEPTUNE_RUN_ID", "neptune"],
 	["CLEARML_TASK_ID", "clearml"],
 	["DVC_STAGE", "dvc"],
 	["RAY_WORKER_PROCESS", "ray"],
-	["RAY_ADDRESS", "ray"],
-	["MUJOCO_GL", "mujoco"],
-	["MUJOCO_PATH", "mujoco"],
-	["GYM_DISABLE_ENV_CHECKER", "gymnasium"],
 	["SM_TRAINING_ENV", "sagemaker"],
 	["TRAINING_JOB_ARN", "sagemaker"],
-	["SAGEMAKER_BASE_DIR", "sagemaker"],
 	["AZUREML_RUN_ID", "azure-ml"],
-	["AZURE_ML_MODEL_DIR", "azure-ml"],
-	["CLOUD_ML_PROJECT_ID", "vertex-ai"],
-	["VERTEX_AI_LOG_LEVEL", "vertex-ai"],
-	["DET_MASTER", "determined-ai"],
-	["LIGHTNING_USER_ID", "lightning-ai"],
 	["FLYTE_INTERNAL_EXECUTION_ID", "flyte"],
-	["ARGO_WORKFLOW_NAME", "argo-workflows"],
 	["KFP_POD_NAME", "kubeflow-pipelines"],
 	["KAGGLE_KERNEL_RUN_TYPE", "kaggle"],
 	["COLAB_BACKEND_VERSION", "google-colab"],
-	["DATABRICKS_RUNTIME_VERSION", "databricks"],
 	["DAYTONA_WS_ID", "daytona"],
-	["DAYTONA_WS_NAME", "daytona"],
 	["E2B_SANDBOX_ID", "e2b"],
 	["MODAL_FUNCTION_ID", "modal"],
 	["MODAL_TASK_ID", "modal"],
 	["RUNPOD_POD_ID", "runpod"],
-	["REPLICATE_USERNAME", "replicate"],
 	["VAST_CONTAINERLABEL", "vast-ai"],
-	["HARBOR_URL", "harbor"],
-	["HARBOR_HOSTNAME", "harbor"],
 	["SWE_BENCH_TASK", "swe-bench"],
 	["SWEBENCH_TASK", "swe-bench"],
 	["SWE_AGENT_MODEL", "swe-agent"]
 ];
-const detectAiTrainingEnvironment = () => {
-	for (const [envVar, label] of AI_TRAINING_ENV_VARS) if (process.env[envVar]) return label;
+const detectAiTrainingEnvironment = (environment = process.env) => {
+	for (const [environmentVariable, label] of AI_TRAINING_BY_ENVIRONMENT_VARIABLE) if (environment[environmentVariable]?.trim()) return label;
 	return null;
 };
 const groupBy = (items, keyFn) => {
@@ -78663,16 +79125,17 @@ const groupBy = (items, keyFn) => {
 * a 404. Gate the directive on this predicate.
 */
 const hasPublishedFixRecipe = (diagnostic) => diagnostic.plugin === "react-doctor" && Object.hasOwn(REACT_DOCTOR_RULE_REGISTRY, diagnostic.rule);
-const unionValues = (baseValues, overrideValues) => [...new Set([...baseValues, ...overrideValues])];
+const stringValues = (values) => Array.isArray(values) ? values.filter((value) => typeof value === "string") : [];
+const unionValues = (baseValues, overrideValues) => [...new Set([...stringValues(baseValues), ...stringValues(overrideValues)])];
 const mergeIgnores = (baseIgnore, overrideIgnore) => {
 	const mergedIgnore = {
 		...baseIgnore,
 		...overrideIgnore
 	};
-	if (baseIgnore.rules && overrideIgnore.rules) mergedIgnore.rules = unionValues(baseIgnore.rules, overrideIgnore.rules);
-	if (baseIgnore.files && overrideIgnore.files) mergedIgnore.files = unionValues(baseIgnore.files, overrideIgnore.files);
-	if (baseIgnore.tags && overrideIgnore.tags) mergedIgnore.tags = unionValues(baseIgnore.tags, overrideIgnore.tags);
-	if (baseIgnore.overrides && overrideIgnore.overrides) mergedIgnore.overrides = [...baseIgnore.overrides, ...overrideIgnore.overrides];
+	if (baseIgnore.rules !== void 0 || overrideIgnore.rules !== void 0) mergedIgnore.rules = unionValues(baseIgnore.rules, overrideIgnore.rules);
+	if (baseIgnore.files !== void 0 || overrideIgnore.files !== void 0) mergedIgnore.files = unionValues(baseIgnore.files, overrideIgnore.files);
+	if (baseIgnore.tags !== void 0 || overrideIgnore.tags !== void 0) mergedIgnore.tags = unionValues(baseIgnore.tags, overrideIgnore.tags);
+	if (baseIgnore.overrides !== void 0 || overrideIgnore.overrides !== void 0) mergedIgnore.overrides = [...Array.isArray(baseIgnore.overrides) ? baseIgnore.overrides : [], ...Array.isArray(overrideIgnore.overrides) ? overrideIgnore.overrides : []];
 	return mergedIgnore;
 };
 /**
@@ -78867,6 +79330,21 @@ const NON_INTERACTIVE_ENVIRONMENT_VARIABLES = [
 ];
 const isNonInteractiveEnvironment = () => NON_INTERACTIVE_ENVIRONMENT_VARIABLES.some((envVariable) => Boolean(process.env[envVariable])) || isCodingAgentEnvironment();
 //#endregion
+//#region src/cli/utils/cli-input-error.ts
+/**
+* A mistake in *how the CLI was invoked* — a malformed `<file>:<line>`
+* argument, mutually exclusive flags, or an unknown `--project` name. This is
+* user input, not a react-doctor bug, so `isExpectedUserError` routes it
+* through `handleUserError`: a clean, single-line message with no Sentry
+* report and no "Something went wrong, open a prefilled issue" block.
+*
+* The `message` is rendered verbatim, so it must read as a complete,
+* human-readable sentence that tells the user how to fix their invocation.
+*/
+var CliInputError = class extends Error {
+	name = "CliInputError";
+};
+//#endregion
 //#region src/cli/utils/constants.ts
 const REACT_DOCTOR_CONFIG_PROJECT_NAME = "react-doctor";
 const STAGED_FILES_TEMP_DIR_PREFIX = "react-doctor-staged-";
@@ -78911,7 +79389,7 @@ const BASELINE_FILES_TEMP_DIR_PREFIX = "react-doctor-baseline-";
 const SCAN_RESULT_CACHE_FILENAME = "scan-cache.json";
 const RUN_GIT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
 const GH_DEFAULT_BRANCH_PROBE_TIMEOUT_MS = 5e3;
-const TUI_REPORT_COMPACT_MAX_ROWS = 29;
+const TUI_REPORT_COMPACT_MAX_ROWS = 23;
 const TUI_REPORT_DETAIL_WIDTH_FRACTION = .6;
 const CI_TRUST_COMPANIES = "PayPal, Rippling, and Alibaba";
 const WELCOME_EXPLANATION_HOLD_MS = 1e3;
@@ -78934,8 +79412,11 @@ const METRIC = {
 	scanPhaseDuration: "scan.phase_duration",
 	scanFiles: "scan.files",
 	scanScore: "scan.score",
+	scanScoreRetry: "scan.score_retry",
 	scanClean: "scan.clean",
 	scanCheckSkipped: "scan.check_skipped",
+	scanProjectSkipped: "scan.project_skipped",
+	scanWorkspaceDeadCodeShared: "scan.workspace_deadcode_shared",
 	scanNoReactDetected: "scan.no_react_detected",
 	baselineDegraded: "baseline.degraded",
 	ruleFired: "rule.fired",
@@ -78962,9 +79443,14 @@ const METRIC = {
 	lspScanCompleted: "lsp.scan.completed",
 	lspScanDuration: "lsp.scan.duration",
 	lspScanDiagnostics: "lsp.scan.diagnostics",
-	tuiActionMenuOpened: "tui.action_menu_opened",
 	tuiCompactReportShown: "tui.compact_report_shown",
 	tuiFindingNavigated: "tui.finding_navigated",
+	tuiIssueStreamShown: "tui.issue_stream_shown",
+	tuiProjectPathContextShown: "tui.project_path_context_shown",
+	tuiProjectSelectInlineShown: "tui.project_select_inline_shown",
+	tuiReportActionSelected: "tui.report_action_selected",
+	tuiCancelled: "tui.cancelled",
+	tuiScanInlineShown: "tui.scan_inline_shown",
 	tuiStackedReportCapped: "tui.stacked_report_capped",
 	aiTrainingWarningShown: "ai.training.warning_shown",
 	jsonOutUsed: "json.out_used"
@@ -79010,7 +79496,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.9.3";
+const VERSION = "0.9.4-dev.25dbf6d";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -79054,9 +79540,14 @@ const enableJsonMode = ({ compact, directory, outputFile }) => {
 		directory,
 		startTime: performance$1.now(),
 		mode: "full",
-		outputFile: outputFile ?? null
+		outputFile: null
 	};
 	installSilentConsole();
+	if (outputFile) {
+		const resolvedOutputFile = Path.resolve(outputFile);
+		if (NFS.existsSync(resolvedOutputFile) && !NFS.statSync(resolvedOutputFile).isFile()) throw new CliInputError(`--json-out must point to a file, not ${resolvedOutputFile}.`);
+		context.outputFile = outputFile;
+	}
 };
 const isJsonModeActive = () => context !== null;
 const setJsonReportDirectory = (directory) => {
@@ -79247,6 +79738,104 @@ const buildSentryScope = (runContext = buildRunContext()) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/is-env-flag-enabled.ts
+const isEnvFlagEnabled = (value) => value === "1" || value?.toLowerCase() === "true";
+//#endregion
+//#region src/cli/utils/is-environment-error.ts
+const ENVIRONMENT_ERROR_CODES = new Set([
+	"EACCES",
+	"EIO",
+	"ENOSPC",
+	"ENOTDIR",
+	"EPERM",
+	"EROFS"
+]);
+const ENVIRONMENT_FILESYSTEM_SYSCALLS = new Set([
+	"lstat",
+	"open",
+	"read",
+	"readdir",
+	"readlink",
+	"realpath",
+	"scandir",
+	"stat"
+]);
+const TRANSIENT_FILESYSTEM_ERROR_CODES = new Set([
+	"EBUSY",
+	"ETIMEDOUT",
+	"UNKNOWN"
+]);
+const findEnvironmentError = (error) => {
+	const pendingErrors = [error];
+	const visitedErrors = /* @__PURE__ */ new Set();
+	while (pendingErrors.length > 0) {
+		const currentError = pendingErrors.pop();
+		if (typeof currentError !== "object" || currentError === null) continue;
+		if (visitedErrors.has(currentError)) continue;
+		visitedErrors.add(currentError);
+		if (isErrnoException(currentError) && typeof currentError.code === "string") {
+			const syscall = currentError.syscall ?? "";
+			if (ENVIRONMENT_ERROR_CODES.has(currentError.code) || currentError.code === "ENOENT" && syscall.startsWith("spawn") || TRANSIENT_FILESYSTEM_ERROR_CODES.has(currentError.code) && ENVIRONMENT_FILESYSTEM_SYSCALLS.has(syscall)) return currentError;
+		}
+		if (currentError instanceof Error && currentError.cause !== void 0) pendingErrors.push(currentError.cause);
+		if (isReactDoctorError(currentError) && "cause" in currentError.reason) pendingErrors.push(currentError.reason.cause);
+	}
+	return null;
+};
+const isEnvironmentError = (error) => findEnvironmentError(error) !== null;
+const formatEnvironmentError = (error) => {
+	const environmentError = findEnvironmentError(error);
+	if (!environmentError) return messageFromUnknown(error);
+	switch (environmentError.code) {
+		case "EBUSY": return environmentError.path ? `Resource busy or locked at ${environmentError.path}. Close the process using it and try again.` : "Resource busy or locked. Close the process using it and try again.";
+		case "ENOSPC": return "No space left on device. Free up disk space and try again.";
+		case "EIO": return "I/O error: the filesystem or disk may be failing. Check your system logs.";
+		case "EROFS": return "Read-only filesystem: cannot write to this location.";
+		case "EACCES":
+		case "EPERM": return environmentError.path ? `Permission denied accessing ${environmentError.path}. Check file permissions and try again.` : "Permission denied. Check file permissions and try again.";
+		case "ENOTDIR": return environmentError.path ? `A file exists at ${environmentError.path} or one of its parent paths where a directory was expected.` : "A file exists where a directory was expected.";
+		case "ENOENT": return "Required command not found. Ensure the tool (e.g. git) is installed and on your PATH.";
+		case "ETIMEDOUT": return environmentError.path ? `Timed out accessing ${environmentError.path}. Check the network or cloud drive and try again.` : "Filesystem access timed out. Check the network or cloud drive and try again.";
+		case "UNKNOWN": return environmentError.path ? `The operating system could not access ${environmentError.path}. Check the filesystem and try again.` : "The operating system could not access the filesystem. Check it and try again.";
+		default: return environmentError.message;
+	}
+};
+//#endregion
+//#region src/cli/utils/is-expected-user-error.ts
+/**
+* Whether `error` is an expected, user-actionable failure — the user's project
+* or input, not a react-doctor bug. Such failures must be kept out of crash
+* reporting (Sentry + the alertable error-rate metric) and rendered via
+* `handleUserError` (a plain message — no "Something went wrong", prefilled
+* issue, Discord link, or Sentry reference), since there is no bug to report.
+*
+* Four distinct shapes reach the CLI's catch blocks:
+*
+* - **Project-discovery failures** (`NoReactDependencyError`,
+*   `ProjectNotFoundError`, `PackageJsonNotFoundError`, `NotADirectoryError`,
+*   `AmbiguousProjectError`) arrive as their plain legacy classes (so
+*   `isReactDoctorError` is `false` for them) — narrow with
+*   `isProjectDiscoveryError`. Running react-doctor against a directory that
+*   has no React, or a path that doesn't exist, is the canonical example.
+* - **CLI invocation mistakes** (`CliInputError`): a malformed
+*   `<file>:<line>` argument, mutually exclusive flags, or an unknown
+*   `--project` name.
+* - **Bad `--diff` input** (`GitBaseBranchInvalid` / `GitBaseBranchMissing`)
+*   stays the tagged `ReactDoctorError`, so dispatch on the reason `_tag`.
+* - **Environment failures** (`ENOSPC`, `EIO`, `EROFS`, `EACCES`, `EPERM`,
+*   `ENOTDIR`, plus a `spawn`-scoped `ENOENT` for a missing binary) — disk
+*   full / failing / read-only, permission denied, or a path blocked by a
+*   file. React Doctor cannot fix the user's environment; exit cleanly with an
+*   actionable message instead of crashing. See `is-environment-error.ts` for
+*   why the set stays narrow (codes that usually mean our bug keep reaching
+*   Sentry).
+*
+* This composes the existing core narrowers rather than introducing a new
+* error-shape helper (AGENTS.md): it encodes CLI-layer reporting policy, not
+* knowledge of the `ReactDoctorError` shape.
+*/
+const isExpectedUserError = (error) => error instanceof CliInputError || isProjectDiscoveryError(error) || isEnvironmentError(error) || isReactDoctorError(error) && (error.reason._tag === "GitBaseBranchInvalid" || error.reason._tag === "GitBaseBranchMissing");
+//#endregion
 //#region src/cli/utils/anonymize-text.ts
 /**
 * Free-text fields can carry both a home-directory path (the OS username) and a
@@ -79368,13 +79957,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.3`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.4-dev.25dbf6d`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.3") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.4-dev.25dbf6d") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -79397,7 +79986,6 @@ const shouldEnableSentry = () => {
 	if (process.env.VITEST || process.env.NODE_ENV === "test") return false;
 	return true;
 };
-const isEnvFlagEnabled = (value) => value === "1" || value?.toLowerCase() === "true";
 /**
 * Whether performance traces will actually be recorded — Sentry is live and the
 * resolved sample rate is above zero. Used to gate the per-run root span and
@@ -79440,21 +80028,25 @@ const initializeSentry = () => {
 	isInitialized = true;
 	resolvedTracesSampleRate = isDebugFlagEnabled() ? 1 : resolveTracesSampleRate();
 	const { tags, contexts } = buildSentryScope();
-	Sentry.init({
-		dsn: process.env.SENTRY_DSN || "https://f253d570240a59b8dbd77b7a548ef133@o4510226365743104.ingest.us.sentry.io/4511487817809920",
-		release: resolveSentryRelease(),
-		environment: resolveSentryEnvironment(),
-		sendDefaultPii: false,
-		tracesSampleRate: resolvedTracesSampleRate,
-		debug: isEnvFlagEnabled(process.env.SENTRY_DEBUG),
-		initialScope: {
-			tags,
-			contexts
-		},
-		beforeSend: (event) => scrubSentryEvent(event),
-		beforeSendTransaction: (event) => scrubSentryEvent(event),
-		beforeSendMetric: (metric) => scrubSentryMetric(metric)
-	});
+	try {
+		Sentry.init({
+			dsn: process.env.SENTRY_DSN || "https://f253d570240a59b8dbd77b7a548ef133@o4510226365743104.ingest.us.sentry.io/4511487817809920",
+			release: resolveSentryRelease(),
+			environment: resolveSentryEnvironment(),
+			sendDefaultPii: false,
+			tracesSampleRate: resolvedTracesSampleRate,
+			debug: isEnvFlagEnabled(process.env.SENTRY_DEBUG),
+			initialScope: {
+				tags,
+				contexts
+			},
+			beforeSend: (event, hint) => isExpectedUserError(hint.originalException) ? null : scrubSentryEvent(event),
+			beforeSendTransaction: (event) => scrubSentryEvent(event),
+			beforeSendMetric: (metric) => scrubSentryMetric(metric)
+		});
+	} catch {
+		resolvedTracesSampleRate = 0;
+	}
 };
 //#endregion
 //#region src/cli/utils/cli-logger.ts
@@ -83013,27 +83605,21 @@ const prompts = (questions, options = {}) => {
 //#endregion
 //#region src/cli/utils/to-span-attributes.ts
 /**
-* Converts a Sentry tag map (which permits `null` to denote an absent signal)
-* into Sentry/OTel span attributes, which only accept primitives. `null` values
-* are dropped rather than coerced, so an absent signal doesn't become a
-* misleading `"null"` attribute.
+* Converts a Sentry tag map (which permits `null`/`undefined` to denote an
+* absent signal) into Sentry/OTel span attributes, which only accept primitives.
+* Missing values are dropped rather than coerced, so an absent signal doesn't
+* become a misleading `"null"` or `"undefined"` attribute.
 */
 const toSpanAttributes = (tags) => {
 	const attributes = {};
-	for (const [key, value] of Object.entries(tags)) if (value !== null) attributes[key] = value;
+	for (const [key, value] of Object.entries(tags)) if (value != null) attributes[key] = value;
 	return attributes;
 };
 //#endregion
 //#region src/cli/utils/record-metric.ts
-const cleanAttributes = (attributes) => {
-	const cleaned = {};
-	if (!attributes) return cleaned;
-	for (const [key, value] of Object.entries(attributes)) if (value !== null && value !== void 0) cleaned[key] = value;
-	return cleaned;
-};
 const withRunAttributes = (attributes) => ({
 	...toSpanAttributes(buildSentryScope().tags),
-	...cleanAttributes(attributes)
+	...toSpanAttributes(attributes ?? {})
 });
 /**
 * Emits a Sentry counter. A guarded, swallow-on-throw no-op unless the CLI's
@@ -90775,34 +91361,6 @@ const runCiConfig = async (options = {}) => {
 	});
 };
 //#endregion
-//#region src/cli/utils/is-environment-error.ts
-const ENVIRONMENT_ERROR_CODES = new Set([
-	"ENOSPC",
-	"EIO",
-	"EROFS",
-	"EACCES",
-	"EPERM",
-	"ENOTDIR"
-]);
-const isEnvironmentError = (error) => {
-	if (!isErrnoException(error) || typeof error.code !== "string") return false;
-	if (error.code === "ENOENT") return error.syscall?.startsWith("spawn") ?? false;
-	return ENVIRONMENT_ERROR_CODES.has(error.code);
-};
-const formatEnvironmentError = (error) => {
-	if (!isErrnoException(error)) return messageFromUnknown(error);
-	switch (error.code) {
-		case "ENOSPC": return "No space left on device. Free up disk space and try again.";
-		case "EIO": return "I/O error: the filesystem or disk may be failing. Check your system logs.";
-		case "EROFS": return "Read-only filesystem: cannot write to this location.";
-		case "EACCES":
-		case "EPERM": return error.path ? `Permission denied accessing ${error.path}. Check file permissions and try again.` : "Permission denied. Check file permissions and try again.";
-		case "ENOTDIR": return error.path ? `A file exists at ${error.path} or one of its parent paths where a directory was expected.` : "A file exists where a directory was expected.";
-		case "ENOENT": return "Required command not found. Ensure the tool (e.g. git) is installed and on your PATH.";
-		default: return error.message;
-	}
-};
-//#endregion
 //#region src/cli/utils/handle-error.ts
 const OTLP_ENDPOINT_ENVIRONMENT_VARIABLE = "REACT_DOCTOR_OTLP_ENDPOINT";
 const OTLP_AUTH_HEADER_ENVIRONMENT_VARIABLE = "REACT_DOCTOR_OTLP_AUTH_HEADER";
@@ -90904,56 +91462,6 @@ const handleUserError = (error, options = {}) => {
 	process.exitCode = 1;
 };
 //#endregion
-//#region src/cli/utils/cli-input-error.ts
-/**
-* A mistake in *how the CLI was invoked* — a malformed `<file>:<line>`
-* argument, mutually exclusive flags, or an unknown `--project` name. This is
-* user input, not a react-doctor bug, so `isExpectedUserError` routes it
-* through `handleUserError`: a clean, single-line message with no Sentry
-* report and no "Something went wrong, open a prefilled issue" block.
-*
-* The `message` is rendered verbatim, so it must read as a complete,
-* human-readable sentence that tells the user how to fix their invocation.
-*/
-var CliInputError = class extends Error {
-	name = "CliInputError";
-};
-//#endregion
-//#region src/cli/utils/is-expected-user-error.ts
-/**
-* Whether `error` is an expected, user-actionable failure — the user's project
-* or input, not a react-doctor bug. Such failures must be kept out of crash
-* reporting (Sentry + the alertable error-rate metric) and rendered via
-* `handleUserError` (a plain message — no "Something went wrong", prefilled
-* issue, Discord link, or Sentry reference), since there is no bug to report.
-*
-* Four distinct shapes reach the CLI's catch blocks:
-*
-* - **Project-discovery failures** (`NoReactDependencyError`,
-*   `ProjectNotFoundError`, `PackageJsonNotFoundError`, `NotADirectoryError`,
-*   `AmbiguousProjectError`) arrive as their plain legacy classes (so
-*   `isReactDoctorError` is `false` for them) — narrow with
-*   `isProjectDiscoveryError`. Running react-doctor against a directory that
-*   has no React, or a path that doesn't exist, is the canonical example.
-* - **CLI invocation mistakes** (`CliInputError`): a malformed
-*   `<file>:<line>` argument, mutually exclusive flags, or an unknown
-*   `--project` name.
-* - **Bad `--diff` input** (`GitBaseBranchInvalid` / `GitBaseBranchMissing`)
-*   stays the tagged `ReactDoctorError`, so dispatch on the reason `_tag`.
-* - **Environment failures** (`ENOSPC`, `EIO`, `EROFS`, `EACCES`, `EPERM`,
-*   `ENOTDIR`, plus a `spawn`-scoped `ENOENT` for a missing binary) — disk
-*   full / failing / read-only, permission denied, or a path blocked by a
-*   file. React Doctor cannot fix the user's environment; exit cleanly with an
-*   actionable message instead of crashing. See `is-environment-error.ts` for
-*   why the set stays narrow (codes that usually mean our bug keep reaching
-*   Sentry).
-*
-* This composes the existing core narrowers rather than introducing a new
-* error-shape helper (AGENTS.md): it encodes CLI-layer reporting policy, not
-* knowledge of the `ReactDoctorError` shape.
-*/
-const isExpectedUserError = (error) => error instanceof CliInputError || isProjectDiscoveryError(error) || isEnvironmentError(error) || isReactDoctorError(error) && (error.reason._tag === "GitBaseBranchInvalid" || error.reason._tag === "GitBaseBranchMissing");
-//#endregion
 //#region src/cli/utils/print-branded-header.ts
 /**
 * Single branded line every command prints first when not in JSON
@@ -91050,6 +91558,19 @@ const ciInstallAction = (options) => runCiCommand("install", runCiInstall, optio
 const ciUpgradeAction = (options) => runCiCommand("upgrade", runCiUpgrade, options);
 const ciConfigAction = (options) => runCiCommand("config", runCiConfig, options);
 //#endregion
+//#region src/cli/utils/active-scan-abort-registry.ts
+const activeScanAbortControllers = /* @__PURE__ */ new Set();
+const activeScanAbortRegistry = {
+	register: (controller) => {
+		activeScanAbortControllers.add(controller);
+		return () => activeScanAbortControllers.delete(controller);
+	},
+	abortAll: () => {
+		for (const controller of activeScanAbortControllers) controller.abort();
+		activeScanAbortControllers.clear();
+	}
+};
+//#endregion
 //#region src/cli/utils/sentry-tracer.ts
 const toHrTime = (epochNanoseconds) => [Number(epochNanoseconds / NANOSECONDS_PER_SECOND), Number(epochNanoseconds % NANOSECONDS_PER_SECOND)];
 const SPAN_KIND_TO_OTEL = {
@@ -91466,7 +91987,14 @@ const isInspectResultComplete = (result) => isScanComplete({
 	skippedCheckReasonCount: Object.keys(result.skippedCheckReasons ?? {}).length
 });
 //#endregion
+//#region src/cli/utils/resolve-score-unavailable-reason.ts
+const resolveScoreUnavailableReason = (input) => {
+	if (input.isScoreDisabled) return "disabled";
+	return input.isAnalysisIncomplete ? "analysis-incomplete" : "api-unavailable";
+};
+//#endregion
 //#region src/cli/utils/scan-result-cache.ts
+const createScanResultCacheInvocationState = () => ({ repositoryIdentityByRoot: /* @__PURE__ */ new Map() });
 const CACHE_DISABLED_VALUES = new Set(["1", "true"]);
 const TOOLCHAIN_PACKAGE_SPECIFIERS = [
 	"oxlint/package.json",
@@ -91551,7 +92079,7 @@ const buildDirtyPathContentFingerprint = (absolutePath, statusCode) => {
 	if (stats.size > 10485760) return null;
 	return hashFileContents(absolutePath);
 };
-const buildWorktreeFingerprint = (projectDirectory) => {
+const buildWorktreeFingerprint = (projectDirectory, repositoryRoot) => {
 	const statusOutput = runGit(projectDirectory, [
 		"status",
 		"--porcelain=v1",
@@ -91563,8 +92091,6 @@ const buildWorktreeFingerprint = (projectDirectory) => {
 	const statusEntries = parseWorktreeStatusRecords(statusOutput);
 	if (statusEntries === null) return null;
 	if (statusEntries.length > 300) return null;
-	const repositoryRoot = runGit(projectDirectory, ["rev-parse", "--show-toplevel"]);
-	if (repositoryRoot === null) return null;
 	const dirtyEntries = [];
 	for (const statusEntry of statusEntries) {
 		const contentFingerprint = buildDirtyPathContentFingerprint(path.join(repositoryRoot, statusEntry.path), statusEntry.statusCode);
@@ -91580,6 +92106,20 @@ const buildWorktreeFingerprint = (projectDirectory) => {
 		return firstSortKey < secondSortKey ? -1 : firstSortKey > secondSortKey ? 1 : 0;
 	});
 };
+const resolveRepositoryCacheIdentity = (projectDirectory, invocationState) => {
+	const repositoryRoot = runGit(projectDirectory, ["rev-parse", "--show-toplevel"]);
+	if (repositoryRoot === null) return null;
+	const cachedIdentity = invocationState.repositoryIdentityByRoot.get(repositoryRoot);
+	if (cachedIdentity !== void 0) return cachedIdentity;
+	const worktreeFingerprint = buildWorktreeFingerprint(projectDirectory, repositoryRoot);
+	const headSha = readHeadSha(repositoryRoot);
+	const identity = worktreeFingerprint === null || headSha === null ? null : {
+		headSha,
+		worktreeFingerprint
+	};
+	invocationState.repositoryIdentityByRoot.set(repositoryRoot, identity);
+	return identity;
+};
 const DOTENV_FILE_NAME_PATTERN = /^\.env(\.|$)/;
 const resolveDotenvFingerprint = (projectDirectory) => {
 	try {
@@ -91674,16 +92214,14 @@ const resolveToolchainFingerprint = (nodeBinaryPath) => {
 const buildScanResultCacheKey = (input) => {
 	if (isCacheGloballyDisabled()) return null;
 	if (!isGitIdentityTrustworthy(input.projectDirectory)) return null;
-	const worktreeFingerprint = buildWorktreeFingerprint(input.projectDirectory);
-	if (worktreeFingerprint === null) return null;
-	const headSha = readHeadSha(input.projectDirectory);
-	if (headSha === null) return null;
+	const repositoryIdentity = resolveRepositoryCacheIdentity(input.projectDirectory, input.invocationState);
+	if (repositoryIdentity === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
 		schemaVersion: 6,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
-		headSha,
-		worktreeFingerprint,
+		headSha: repositoryIdentity.headSha,
+		worktreeFingerprint: repositoryIdentity.worktreeFingerprint,
 		dotenvFingerprint: resolveDotenvFingerprint(input.projectDirectory),
 		reactDoctorVersion: input.version,
 		nodeVersion: process.version,
@@ -91697,6 +92235,8 @@ const buildScanResultCacheKey = (input) => {
 			deadCode: input.options.deadCode,
 			supplyChain: input.options.supplyChain,
 			includePaths: [...input.options.includePaths].sort(),
+			excludedProjectDirectories: [...input.options.excludedProjectDirectories ?? []].sort(),
+			retainExcludedProjectDeadCodeDiagnostics: input.options.retainExcludedProjectDeadCodeDiagnostics ?? false,
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
 			warnings: input.options.warnings,
@@ -91774,8 +92314,8 @@ const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g
 * browser and stay group-/filter-/aggregate-able in the Spans dataset.
 *
 * Value types are preserved verbatim (numbers stay numbers so Sentry infers a
-* numeric attribute and `p75(...)`/`avg(...)` work; `null` is kept so
-* `toSpanAttributes` can drop absent signals rather than coerce them).
+* numeric attribute and `p75(...)`/`avg(...)` work; `null`/`undefined` are kept
+* so `toSpanAttributes` can drop absent signals rather than coerce them).
 */
 const withNamespace = (namespace, attributes) => {
 	const namespaced = {};
@@ -91841,7 +92381,7 @@ const buildCacheAttributes = (input) => {
 	const warmth = knownSubsystemCount > 0 ? reuseRatioSum / knownSubsystemCount : null;
 	const temperature = warmth !== null && warmth > 0 ? "warm" : isCacheGloballyDisabled() ? "disabled" : "cold";
 	return withNamespace("cache", {
-		wholeRepoHit: input.wholeRepoCacheHit ?? null,
+		wholeRepoHit: input.wholeRepoCacheHit,
 		temperature,
 		warmth
 	});
@@ -91963,33 +92503,37 @@ const buildOutcomeAttributes = (input) => {
 		...withNamespace("score", {
 			value: result.score ? result.score.score : null,
 			label: result.score ? result.score.label : null,
-			available: result.score !== null
+			available: result.score !== null,
+			unavailableReason: result.score === null ? resolveScoreUnavailableReason({
+				isScoreDisabled: input.noScore,
+				isAnalysisIncomplete: input.didLintFail === true || input.didDeadCodeFail === true
+			}) : null
 		}),
 		...withNamespace("lint", {
-			failed: input.didLintFail ?? null,
-			failureReasonKind: input.lintFailureReasonKind ?? null,
-			partialFailureCount: input.lintPartialFailureCount ?? null,
-			droppedFileCount: input.lintDroppedFileCount ?? null,
-			deadlineSkippedFileCount: input.lintDeadlineSkippedFileCount ?? null,
-			cacheHitFiles: result.lintCacheHitFileCount ?? null,
-			cacheTotalFiles: result.lintCacheTotalFileCount ?? null,
+			failed: input.didLintFail,
+			failureReasonKind: input.lintFailureReasonKind,
+			partialFailureCount: input.lintPartialFailureCount,
+			droppedFileCount: input.lintDroppedFileCount,
+			deadlineSkippedFileCount: input.lintDeadlineSkippedFileCount,
+			cacheHitFiles: result.lintCacheHitFileCount,
+			cacheTotalFiles: result.lintCacheTotalFileCount,
 			cacheHitRatio: ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount),
-			sidecarReplayedFiles: result.lintSidecarReplayedFileCount ?? null,
-			sidecarTotalFiles: result.lintSidecarTotalFileCount ?? null,
+			sidecarReplayedFiles: result.lintSidecarReplayedFileCount,
+			sidecarTotalFiles: result.lintSidecarTotalFileCount,
 			sidecarReplayRatio: ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)
 		}),
 		...withNamespace("deadCode", {
-			failed: input.didDeadCodeFail ?? null,
-			overlapped: input.deadCodeOverlapped ?? null,
-			cacheHit: result.deadCodeCacheHit ?? null,
-			summaryCacheHits: result.deadCodeSummaryCacheHits ?? null,
-			summaryCacheMisses: result.deadCodeSummaryCacheMisses ?? null
+			failed: input.didDeadCodeFail,
+			overlapped: input.deadCodeOverlapped,
+			cacheHit: result.deadCodeCacheHit,
+			summaryCacheHits: result.deadCodeSummaryCacheHits,
+			summaryCacheMisses: result.deadCodeSummaryCacheMisses
 		}),
-		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut ?? null }),
-		...withNamespace("securityScan", { failed: input.securityScanFailed ?? null }),
+		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut }),
+		...withNamespace("securityScan", { failed: input.securityScanFailed }),
 		...withNamespace("timing", {
 			elapsedMs: result.elapsedMilliseconds,
-			scanMs: result.scanElapsedMilliseconds ?? null
+			scanMs: result.scanElapsedMilliseconds
 		}),
 		...withNamespace("migration", {
 			largestRuleBucketFiles: largestRuleBucket ? largestRuleBucket.fileCount : null,
@@ -92001,7 +92545,7 @@ const buildOutcomeAttributes = (input) => {
 		new: summary.totalDiagnosticCount,
 		fixed: result.baselineDelta.fixedCount,
 		baseTotal: result.baselineDelta.baseTotalCount,
-		crossFileMatches: result.baselineDelta.crossFileMatchCount ?? null,
+		crossFileMatches: result.baselineDelta.crossFileMatchCount,
 		degraded: false
 	}));
 	else if (input.gateExempt) attributes["baseline.degraded"] = true;
@@ -92010,7 +92554,7 @@ const buildOutcomeAttributes = (input) => {
 const buildActionAttributes = () => {
 	const { githubActorAssociation } = resolveGithubActionsScoreMetadata();
 	return withNamespace("action", {
-		actorAssociation: githubActorAssociation ?? null,
+		actorAssociation: githubActorAssociation,
 		runnerOs: detectRunnerOs(),
 		comment: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.comment),
 		reviewComments: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.reviewComments),
@@ -92024,7 +92568,7 @@ const buildScanAttributes = (input) => {
 		mode: input.mode,
 		scope: input.scope,
 		parallel: input.parallel,
-		workerCount: input.workerCount ?? null,
+		workerCount: input.workerCount,
 		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
 		deadCode: input.deadCode,
@@ -92038,10 +92582,10 @@ const buildScanAttributes = (input) => {
 		hasCustomConfig: input.hasCustomConfig,
 		rulesConfigured: ruleKeys.length,
 		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
-		fileCount: input.result?.scannedFileCount ?? null,
-		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length ?? null,
-		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length ?? null,
-		multilineDiagnosticCount: input.result?.diagnostics.filter((diagnostic) => (diagnostic.endLine ?? diagnostic.line) > diagnostic.line).length ?? null
+		fileCount: input.result?.scannedFileCount,
+		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length,
+		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length,
+		multilineDiagnosticCount: input.result?.diagnostics.filter((diagnostic) => (diagnostic.endLine ?? diagnostic.line) > diagnostic.line).length
 	});
 };
 /**
@@ -92053,11 +92597,11 @@ const buildScanAttributes = (input) => {
 * tree up in Sentry's attribute browser and stay filter-/group-/aggregate-able
 * in the Spans dataset. Pure and exported so the projection (outcome
 * precedence, rule/category rollups, CI knobs, config shape) is unit-testable
-* without a live Sentry client. `null` values are dropped so absent signals
-* never become misleading `"null"` attributes. The run + project base context
-* (version, command, ci/provider, framework, …) is already on the span from
-* `withSentryRunSpan` / `recordSentryProjectContext`, so this adds only what
-* those don't carry.
+* without a live Sentry client. `null`/`undefined` values are dropped so absent
+* signals never become misleading `"null"`/`"undefined"` attributes. The run +
+* project base context (version, command, ci/provider, framework, …) is already
+* on the span from `withSentryRunSpan` / `recordSentryProjectContext`, so this
+* adds only what those don't carry.
 */
 const buildRunEventAttributes = (input) => toSpanAttributes({
 	...buildScanAttributes(input),
@@ -92531,8 +93075,35 @@ const createDiagnosticEvidenceReader = (rootDirectory, options = {}) => {
 //#endregion
 //#region src/cli/utils/build-no-score-message.ts
 const ENTERPRISE_CONTACT_HINT = `Want something custom to your company? Contact us at ${ENTERPRISE_CONTACT_URL}.`;
-const buildNoScoreMessage = (isScoreDisabled, disabledMessage) => {
-	return `${isScoreDisabled ? disabledMessage ?? "Score disabled by --no-score." : "Score unavailable (could not reach the score API)."} ${ENTERPRISE_CONTACT_HINT}`;
+const buildNoScoreMessage = (input) => {
+	const unavailableReason = resolveScoreUnavailableReason({
+		isScoreDisabled: input.isScoreDisabled,
+		isAnalysisIncomplete: input.isAnalysisIncomplete ?? false
+	});
+	let reason;
+	switch (unavailableReason) {
+		case "disabled":
+			reason = input.disabledMessage ?? "Score disabled by --no-score.";
+			break;
+		case "analysis-incomplete":
+			reason = "Score not shown because lint or dead-code analysis could not complete.";
+			break;
+		case "api-unavailable":
+			reason = "Score unavailable (could not reach the score API).";
+			break;
+	}
+	return `${reason} ${ENTERPRISE_CONTACT_HINT}`;
+};
+//#endregion
+//#region src/cli/utils/has-incomplete-score-analysis.ts
+const hasIncompleteScoreAnalysis = (skippedChecks) => skippedChecks.includes("lint") || skippedChecks.includes("dead-code");
+//#endregion
+//#region src/cli/utils/build-empty-report-message.ts
+const buildEmptyReportMessage = (input) => {
+	const categoryFilters = [...input.categoryFilters];
+	if (categoryFilters.length > 0) return `No issues found in category ${categoryFilters.join(", ")}!`;
+	if (input.demotedDiagnosticCount > 0) return `No issues found! (${input.demotedDiagnosticCount} demoted from the ${input.outputSurface} surface — see config.surfaces.)`;
+	return "No issues found!";
 };
 //#endregion
 //#region src/cli/utils/render-agent-guidance.ts
@@ -93279,9 +93850,6 @@ const markOnboardingComplete = (options = {}) => {
 	if (isGatePending(ONBOARDING_GATE, {}, options)) recordGate(ONBOARDING_GATE, {}, options);
 };
 //#endregion
-//#region src/cli/utils/render-project-detection.ts
-const printProjectDetection = (_input) => void_;
-//#endregion
 //#region src/cli/utils/colorize-by-score.ts
 const colorizeByScore = (text, score) => {
 	if (score >= 75) return highlighter.success(text);
@@ -93495,6 +94063,26 @@ const printNoScoreHeader = (noScoreMessage) => gen(function* () {
 	yield* log("");
 });
 //#endregion
+//#region src/cli/utils/build-footer-description-lines.ts
+const FOOTER_DESCRIPTION_INDENT = "  ";
+const buildFooterDescriptionLines = (description) => {
+	return wrapTextToWidth(description, resolveMeasureWidth(2)).map((line) => highlighter.dim(`${FOOTER_DESCRIPTION_INDENT}${line}`));
+};
+//#endregion
+//#region src/cli/utils/build-footer-link-lines.ts
+const buildFooterLinkLines = ({ shareUrl }) => [
+	...shareUrl === null ? [] : [
+		`  ${highlighter.bold("Share:")} ${highlighter.info(shareUrl)}`,
+		...buildFooterDescriptionLines("Tell others how you did on socials"),
+		""
+	],
+	`  ${highlighter.bold("Docs:")} ${highlighter.info(DOCS_URL)}`,
+	...buildFooterDescriptionLines("Learn more about fixing issues, setting up CI/CD, and configuring rules with a config file"),
+	"",
+	`  ${highlighter.bold("GitHub:")} ${highlighter.info(CANONICAL_GITHUB_URL)}`,
+	...buildFooterDescriptionLines("Report issues and star the repository!")
+];
+//#endregion
 //#region src/cli/utils/write-diagnostics-directory.ts
 const ruleDumpFileName = (ruleKey) => ruleKey.replace(/\//g, "--") + ".txt";
 const readPreviousRuleDumpFileNames = (directory) => {
@@ -93515,11 +94103,6 @@ const writeDiagnosticsDirectory = (diagnostics, outputDirectory) => {
 };
 //#endregion
 //#region src/cli/utils/render-summary.ts
-const FOOTER_DESCRIPTION_INDENT = "  ";
-const printFooterDescription = (description) => gen(function* () {
-	const wrapWidth = resolveMeasureWidth(2);
-	for (const line of wrapTextToWidth(description, wrapWidth)) yield* log(highlighter.dim(`${FOOTER_DESCRIPTION_INDENT}${line}`));
-});
 const buildShareUrl = (diagnostics, scoreResult, projectName) => {
 	const errorCount = diagnostics.filter((diagnostic) => diagnostic.severity === "error").length;
 	const warningCount = diagnostics.filter((diagnostic) => diagnostic.severity === "warning").length;
@@ -93536,17 +94119,8 @@ const printFooter = (input) => gen(function* () {
 	yield* log("");
 	yield* log(buildSectionDivider());
 	yield* log("");
-	if (!input.isOffline) {
-		const shareUrl = buildShareUrl(input.diagnostics, input.scoreResult, input.projectName);
-		yield* log(`  ${highlighter.bold("Share:")} ${highlighter.info(shareUrl)}`);
-		yield* printFooterDescription("Tell others how you did on socials");
-		yield* log("");
-	}
-	yield* log(`  ${highlighter.bold("Docs:")} ${highlighter.info(DOCS_URL)}`);
-	yield* printFooterDescription("Learn more about fixing issues, setting up CI/CD, and configuring rules with a config file");
-	yield* log("");
-	yield* log(`  ${highlighter.bold("GitHub:")} ${highlighter.info(CANONICAL_GITHUB_URL)}`);
-	yield* printFooterDescription("Report issues and star the repository!");
+	const shareUrl = input.isOffline ? null : buildShareUrl(input.diagnostics, input.scoreResult, input.projectName);
+	for (const line of buildFooterLinkLines({ shareUrl })) yield* log(line);
 });
 const printDiagnosticsDump = (diagnostics, outputDirectory, verbose, stream = "stdout") => gen(function* () {
 	const writtenDirectory = yield* try_({
@@ -93643,9 +94217,6 @@ const resolveCliCategories = (categoryFlag) => {
 //#endregion
 //#region src/inspect.ts
 const silentConsole = makeNoopConsole();
-const runConsole = (effect) => {
-	runSync(effect);
-};
 const recordOnboardingCompletion = (options) => {
 	const forceOnboarding = isOnboardingForced();
 	if (shouldRecordOnboarding({
@@ -93655,7 +94226,6 @@ const recordOnboardingCompletion = (options) => {
 		isNonInteractiveEnvironment: options.isNonInteractiveEnvironment
 	})) markOnboardingComplete();
 };
-const formatCategorySelection = (categoryFilters) => [...categoryFilters].join(", ");
 const buildChangedLineMatcher = (directory, changedLineRanges) => {
 	const rangesByFile = /* @__PURE__ */ new Map();
 	for (const entry of changedLineRanges) rangesByFile.set(toForwardSlashes(entry.file), entry.ranges);
@@ -93705,7 +94275,10 @@ const mergeInspectOptions = (inputOptions, userConfig) => {
 		maxDurationMs: inputOptions.maxDurationMs ?? null,
 		baseline: inputOptions.baseline ?? null,
 		changedLineRanges: inputOptions.changedLineRanges ?? null,
-		supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false
+		supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false,
+		excludedProjectDirectories: inputOptions.excludedProjectDirectories ?? [],
+		retainExcludedProjectDeadCodeDiagnostics: inputOptions.retainExcludedProjectDeadCodeDiagnostics ?? false,
+		precomputedSourceFileCount: inputOptions.precomputedSourceFileCount
 	};
 };
 const deriveScope = (options) => {
@@ -93738,13 +94311,14 @@ const inspectWithOxlintRuntime = async (directory, inputOptions, oxlintRuntime)
 	const deadlineEpochMs = inputOptions.deadlineEpochMs ?? (inputOptions.maxDurationMs != null ? Date.now() + inputOptions.maxDurationMs : null);
 	const isConcurrentScan = inputOptions.concurrentScan === true;
 	if (!isConcurrentScan) resetSentryRunState();
-	const hasConfigOverride = inputOptions.configOverride !== void 0;
+	const configOverride = inputOptions.configOverride;
+	const hasConfigOverride = configOverride !== void 0;
 	let scanDirectory;
 	let userConfig;
 	let configSourceDirectory;
 	if (hasConfigOverride) {
 		scanDirectory = directory;
-		userConfig = inputOptions.configOverride ?? null;
+		userConfig = configOverride;
 		configSourceDirectory = inputOptions.configSourceDirectory ?? null;
 	} else {
 		const scanTarget = await resolveScanTarget(directory);
@@ -93777,11 +94351,22 @@ const inspectWithOxlintRuntime = async (directory, inputOptions, oxlintRuntime)
 };
 const createInvocationInspect = (requestedOxlintConcurrency) => {
 	const concurrency = resolveScanConcurrency(requestedOxlintConcurrency ?? runSync(OxlintConcurrency));
-	const oxlintRuntime = {
-		concurrency,
-		spawnSlots: createOxlintSpawnSlots(concurrency)
+	const spawnSlots = createOxlintSpawnSlots(concurrency);
+	const scanResultCacheInvocationState = createScanResultCacheInvocationState();
+	return async (directory, inputOptions = {}) => {
+		const abortController = new AbortController();
+		const unregisterAbortController = activeScanAbortRegistry.register(abortController);
+		try {
+			return await inspectWithOxlintRuntime(directory, inputOptions, {
+				concurrency,
+				spawnSlots,
+				abortSignal: abortController.signal,
+				scanResultCacheInvocationState
+			});
+		} finally {
+			unregisterAbortController();
+		}
 	};
-	return (directory, inputOptions = {}) => inspectWithOxlintRuntime(directory, inputOptions, oxlintRuntime);
 };
 const inspect = async (directory, inputOptions = {}) => createInvocationInspect(inputOptions.concurrency)(directory, inputOptions);
 const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(lintPartialFailures) + countDeadlineSkippedFiles(lintPartialFailures);
@@ -93794,12 +94379,27 @@ const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(
 */
 const runBaselineComparison = async (params) => {
 	const tempDirectory = mkdtempSync(path.join(tmpdir(), BASELINE_FILES_TEMP_DIR_PREFIX));
+	const baselineIncludePaths = filterPathsOutsideDirectories({
+		rootDirectory: params.directory,
+		relativePaths: params.options.includePaths,
+		excludedDirectories: params.options.excludedProjectDirectories
+	});
+	const baselineBaseFiles = params.baseFiles ? filterPathsOutsideDirectories({
+		rootDirectory: params.directory,
+		relativePaths: params.baseFiles,
+		excludedDirectories: params.options.excludedProjectDirectories
+	}) : void 0;
+	const baselineHeadFiles = params.headFiles ? filterPathsOutsideDirectories({
+		rootDirectory: params.directory,
+		relativePaths: params.headFiles,
+		excludedDirectories: params.options.excludedProjectDirectories
+	}) : void 0;
 	const snapshot = await materializeBaselineFiles({
 		directory: params.directory,
 		ref: params.baselineRef,
-		files: params.options.includePaths,
-		baseFiles: params.baseFiles,
-		headFiles: params.headFiles,
+		files: baselineIncludePaths,
+		baseFiles: baselineBaseFiles,
+		headFiles: baselineHeadFiles,
 		tempDirectory
 	}).catch((error) => {
 		rmSync(tempDirectory, {
@@ -93821,7 +94421,7 @@ const runBaselineComparison = async (params) => {
 		const baseFiles = new Set(snapshot.baseFiles.map(toForwardSlashes));
 		const trackedHeadFiles = new Set(snapshot.headFiles.map(toForwardSlashes));
 		const expectedHeadFiles = new Set(trackedHeadFiles);
-		for (const filePath of params.options.includePaths) {
+		for (const filePath of baselineIncludePaths) {
 			const normalizedFilePath = toForwardSlashes(filePath);
 			if (!baseFiles.has(normalizedFilePath)) expectedHeadFiles.add(normalizedFilePath);
 		}
@@ -93858,8 +94458,9 @@ const runBaselineComparison = async (params) => {
 			resolveLocalGithubViewerPermission: false,
 			suppressScanSummary: true,
 			supplyChainManifestChanged: params.options.supplyChainManifestChanged,
-			deadlineEpochMs: params.deadlineEpochMs ?? void 0
-		}, {}).pipe(provide(baseLayers), provideService$2(PerFileLintCacheEnabled, false), provideService$2(SidecarLintCacheEnabled, false), provideService$2(Console, silentConsole))));
+			deadlineEpochMs: params.deadlineEpochMs ?? void 0,
+			signal: params.oxlintRuntime.abortSignal
+		}, {}).pipe(provide(baseLayers), provideService$2(PerFileLintCacheEnabled, false), provideService$2(SidecarLintCacheEnabled, false), provideService$2(Console, silentConsole))), { signal: params.oxlintRuntime.abortSignal });
 		if (baseOutput.didLintFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
 		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(snapshot.untrackedFiles.map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
 		const delta = computeDiagnosticDelta({
@@ -93887,6 +94488,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	const isDiffMode = options.includePaths.length > 0;
 	const resolvedNodeBinaryPath = await resolveOxlintNode(options.lint, options.scoreOnly || options.silent);
 	const lintBindingMissing = options.lint && !resolvedNodeBinaryPath;
+	await yieldToEventLoop();
 	const cacheKey = buildScanResultCacheKey({
 		projectDirectory: directory,
 		version: VERSION,
@@ -93894,19 +94496,14 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		options,
 		userConfig,
 		hasConfigOverride,
-		configSourceDirectory
+		configSourceDirectory,
+		invocationState: oxlintRuntime.scanResultCacheInvocationState
 	});
 	const scanResultCache = cacheKey === null ? null : createScanResultCache(directory);
-	const cachedPayload = cacheKey === null ? null : scanResultCache?.lookup(cacheKey) ?? null;
+	const cachedPayload = cacheKey === null || scanResultCache === null ? null : scanResultCache.lookup(cacheKey);
 	if (cachedPayload) {
 		recordSentryProjectContext(cachedPayload.project, rootSentrySpan, { concurrentScan: options.concurrentScan });
 		recordCount(METRIC.projectDetected, 1);
-		await renderCachedProjectDetection({
-			payload: cachedPayload,
-			options,
-			userConfig,
-			isDiffMode
-		});
 		const baselineDegraded = Boolean(options.baseline) && isDiffMode && cachedPayload.baselineDelta === void 0;
 		const result = await renderAndRecordScan({
 			payload: cachedPayload,
@@ -93940,6 +94537,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	});
 	const program = runInspect({
 		directory,
+		precomputedSourceFileCount: options.precomputedSourceFileCount,
 		includePaths: options.includePaths,
 		customRulesOnly: options.customRulesOnly,
 		respectInlineDisables: options.respectInlineDisables,
@@ -93956,26 +94554,19 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		resolveLocalGithubViewerPermission: !options.noScore,
 		suppressScanSummary: options.suppressRendering,
 		supplyChainManifestChanged: options.supplyChainManifestChanged,
-		concurrentScan: options.concurrentScan,
-		deadlineEpochMs: deadlineEpochMs ?? void 0
-	}, { beforeLint: (projectInfo, lintIncludePaths) => gen(function* () {
+		deadlineEpochMs: deadlineEpochMs ?? void 0,
+		signal: oxlintRuntime.abortSignal,
+		excludedProjectDirectories: options.excludedProjectDirectories,
+		retainExcludedProjectDeadCodeDiagnostics: options.retainExcludedProjectDeadCodeDiagnostics
+	}, { beforeLint: (projectInfo) => sync(() => {
 		recordSentryProjectContext(projectInfo, rootSentrySpan, { concurrentScan: options.concurrentScan });
 		recordCount(METRIC.projectDetected, 1);
-		if (options.scoreOnly || options.suppressRendering) return;
-		const lintSourceFileCount = lintIncludePaths?.length ?? projectInfo.sourceFileCount;
-		yield* printProjectDetection({
-			projectInfo,
-			userConfig,
-			isDiffMode,
-			includePaths: options.includePaths,
-			lintSourceFileCount
-		});
 	}) });
-	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService$2(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)));
+	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService$2(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)), { signal: oxlintRuntime.abortSignal });
 	const didLintFail = lintBindingMissing || output.didLintFail;
 	const lintFailureReason = lintBindingMissing ? `oxlint native binding not found for Node ${process.version}; expected one matching ${OXLINT_NODE_REQUIREMENT}` : output.lintFailureReason;
-	if (!options.scoreOnly && !options.uiLayers && !lintBindingMissing && output.didLintFail && lintFailureReason !== null) if (output.lintFailureReasonKind === "native-binding-missing") runConsole(log(highlighter.gray(`  Upgrade to Node ${OXLINT_NODE_REQUIREMENT} or run: npx -p oxlint@latest react-doctor@latest`)));
-	else runConsole(error$1(highlighter.error(lintFailureReason)));
+	if (!options.scoreOnly && !options.uiLayers && !lintBindingMissing && output.didLintFail && lintFailureReason !== null) if (output.lintFailureReasonKind === "native-binding-missing") runSync(log(highlighter.gray(`  Upgrade to Node ${OXLINT_NODE_REQUIREMENT} or run: npx -p oxlint@latest react-doctor@latest`)));
+	else runSync(error$1(highlighter.error(lintFailureReason)));
 	let inspectDiagnostics = output.diagnostics;
 	let baselineDelta;
 	if (options.baseline && isDiffMode && !didLintFail && countIncompleteLintFiles(output.lintPartialFailures) === 0) {
@@ -94025,6 +94616,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		lintFailureReasonKind: lintBindingMissing ? "native-binding-missing" : output.lintFailureReasonKind,
 		supplyChainOverlapTimedOut: output.supplyChainOverlapTimedOut,
 		securityScanFailed: output.securityScanFailed,
+		securityScanFailureReason: output.securityScanFailureReason,
 		suppressedRuleCounts: output.suppressedRuleCounts
 	};
 	if (cacheKey !== null && scanResultCache !== null && shouldStoreScanPayload(payload) && !baselineDegraded) scanResultCache.store(cacheKey, payload);
@@ -94050,16 +94642,6 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	return result;
 };
 const runMaybeSilent = (effect, silent) => silent ? effect.pipe(provideService$2(Console, silentConsole)) : effect;
-const renderCachedProjectDetection = async (input) => {
-	if (input.options.scoreOnly || input.options.suppressRendering) return;
-	await runPromise(runMaybeSilent(printProjectDetection({
-		projectInfo: input.payload.project,
-		userConfig: input.userConfig,
-		isDiffMode: input.isDiffMode,
-		includePaths: input.options.includePaths,
-		lintSourceFileCount: input.payload.scannedFileCount
-	}), input.options.silent));
-};
 const renderAndRecordScan = async (input) => {
 	const result = await runPromise(runMaybeSilent(finalizeAndRender({
 		options: input.options,
@@ -94075,6 +94657,7 @@ const renderAndRecordScan = async (input) => {
 		deadCodeFailureReason: input.payload.deadCodeFailureReason,
 		supplyChainOverlapTimedOut: input.payload.supplyChainOverlapTimedOut,
 		securityScanFailed: input.payload.securityScanFailed ?? false,
+		securityScanFailureReason: input.payload.securityScanFailureReason ?? null,
 		directory: input.payload.directory,
 		scannedFileCount: input.payload.scannedFileCount,
 		scannedFilePaths: input.payload.scannedFilePaths,
@@ -94126,7 +94709,7 @@ const renderAndRecordScan = async (input) => {
 	return result;
 };
 const finalizeAndRender = (input) => gen(function* () {
-	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, supplyChainOverlapTimedOut, securityScanFailed, directory, scannedFileCount, scannedFilePaths, analyzedFiles, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, lintSidecarReplayedFileCount, lintSidecarTotalFileCount, deadCodeCacheHit, deadCodeSummaryCacheHits, deadCodeSummaryCacheMisses, baselineDelta } = input;
+	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, supplyChainOverlapTimedOut, securityScanFailed, securityScanFailureReason, directory, scannedFileCount, scannedFilePaths, analyzedFiles, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, lintSidecarReplayedFileCount, lintSidecarTotalFileCount, deadCodeCacheHit, deadCodeSummaryCacheHits, deadCodeSummaryCacheMisses, baselineDelta } = input;
 	const { skippedChecks, skippedCheckReasons } = buildSkippedChecks({
 		didLintFail,
 		lintFailureReason,
@@ -94134,10 +94717,15 @@ const finalizeAndRender = (input) => gen(function* () {
 		didDeadCodeFail,
 		deadCodeFailureReason,
 		supplyChainOverlapTimedOut,
-		securityScanFailed
+		securityScanFailed,
+		securityScanFailureReason
 	});
 	const hasSkippedChecks = skippedChecks.length > 0;
-	const noScoreMessage = buildNoScoreMessage(options.noScore, options.scoreDisabledMessage);
+	const noScoreMessage = buildNoScoreMessage({
+		isScoreDisabled: options.noScore,
+		isAnalysisIncomplete: hasIncompleteScoreAnalysis(skippedChecks),
+		disabledMessage: options.scoreDisabledMessage
+	});
 	const buildResult = () => ({
 		diagnostics: [...diagnostics],
 		score,
@@ -94183,9 +94771,11 @@ const finalizeAndRender = (input) => gen(function* () {
 		if (hasSkippedChecks) {
 			const skippedLabel = skippedChecks.join(" and ");
 			yield* warn$1(highlighter.warn(`No issues detected, but ${skippedLabel} checks failed — results are incomplete.`));
-		} else if (options.categoryFilters.size > 0) yield* log(highlighter.success(`No issues found in category ${formatCategorySelection(options.categoryFilters)}!`));
-		else if (demotedDiagnosticCount > 0) yield* log(highlighter.success(`No issues found! (${demotedDiagnosticCount} demoted from the ${options.outputSurface} surface — see config.surfaces.)`));
-		else yield* log(highlighter.success("No issues found!"));
+		} else yield* log(highlighter.success(buildEmptyReportMessage({
+			categoryFilters: options.categoryFilters,
+			demotedDiagnosticCount,
+			outputSurface: options.outputSurface
+		})));
 		yield* log("");
 		yield* pause;
 		if (hasSkippedChecks) {
@@ -94265,6 +94855,32 @@ const materializeStagedFiles = async (input) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/deduplicate-project-scans.ts
+const deduplicateProjectScans = (projectScans) => {
+	const uniqueProjectScans = [];
+	const seenDirectories = /* @__PURE__ */ new Set();
+	for (const projectScan of projectScans) {
+		if (seenDirectories.has(projectScan.directory)) continue;
+		seenDirectories.add(projectScan.directory);
+		uniqueProjectScans.push(projectScan);
+	}
+	return uniqueProjectScans;
+};
+//#endregion
+//#region src/cli/utils/collect-project-source-file-counts.ts
+const collectProjectSourceFileCounts = async (rootDirectory, projectDirectories) => {
+	const abortController = new AbortController();
+	const unregisterAbortController = activeScanAbortRegistry.register(abortController);
+	try {
+		return await collectSourceFileCountsByDirectory(rootDirectory, projectDirectories, abortController.signal);
+	} finally {
+		unregisterAbortController();
+	}
+};
+//#endregion
+//#region src/cli/utils/format-skipped-projects-message.ts
+const formatSkippedProjectsMessage = (projectCount) => `${projectCount} ${projectCount === 1 ? "project was" : "projects were"} skipped because the max scan duration was reached.`;
+//#endregion
 //#region src/cli/utils/is-share-opted-out.ts
 const isShareOptedOut = (scans, flagNoScore) => Boolean(flagNoScore) || scans.some((scan) => Boolean(scan.config?.noScore) || scan.config?.share === false);
 //#endregion
@@ -94276,7 +94892,7 @@ const buildHandoffPayload = (input) => {
 	try {
 		outputDirectory = writeDiagnosticsDirectory([...input.diagnostics], input.outputDirectory);
 	} catch {}
-	const lines = [`Fix the top ${topGroups.length} React Doctor ${topGroups.length === 1 ? "issue" : "issues"} in ${input.projectName} on this pass — leave the rest for a follow-up.`, ""];
+	const lines = [`Review and fix the top ${topGroups.length} React Doctor ${topGroups.length === 1 ? "finding" : "findings"} in ${input.projectName}. Leave the rest for a follow-up.`, ""];
 	topGroups.forEach(([ruleKey, ruleDiagnostics], index) => {
 		const representative = ruleDiagnostics[0];
 		const severityLabel = representative.severity === "error" ? "ERROR" : "WARN";
@@ -94304,7 +94920,7 @@ const buildHandoffPayload = (input) => {
 		const ruleSummaries = deferredMigrationBuckets.map((bucket) => `${bucket.title} (${bucket.fileCount} files)`).join(", ");
 		lines.push(`Some of the rest are migration-scale (span dozens of files): ${ruleSummaries}. For each, fix a representative sample, confirm the recipe holds, and get the code owner's sign-off before changing the rest in one pass.`, "");
 	}
-	lines.push("Then work through the rest from the full results above.");
+	lines.push("Stop after this pass. Summarize the remaining findings for a follow-up.");
 	return lines.join("\n");
 };
 //#endregion
@@ -94514,20 +95130,20 @@ const resolveOpenCommand = (url) => {
 		args: [url]
 	};
 };
-const openUrl = (url) => {
+const openUrl = (url) => new Promise((resolve) => {
 	try {
 		const { command, args } = resolveOpenCommand(url);
 		const child = spawn(command, args, {
 			detached: true,
 			stdio: "ignore"
 		});
-		child.on("error", () => {});
+		child.once("spawn", () => resolve(true));
+		child.once("error", () => resolve(false));
 		child.unref();
-		return true;
 	} catch {
-		return false;
+		resolve(false);
 	}
-};
+});
 //#endregion
 //#region src/cli/utils/ask-add-to-github-actions.ts
 const CI_YES_CHOICE = "ci-yes";
@@ -94568,7 +95184,7 @@ const askAddToGitHubActions = async (prompt = prompts) => {
 		if (ciChoice === void 0) return "cancel";
 		if (ciChoice === CI_YES_CHOICE) return "yes";
 		if (ciChoice === CI_NO_CHOICE) return "no";
-		const opened = openUrl(GITHUB_ACTIONS_SETUP_URL);
+		const opened = await openUrl(GITHUB_ACTIONS_SETUP_URL);
 		cliLogger.log(opened ? `Opened ${highlighter.info(GITHUB_ACTIONS_SETUP_URL)} in your browser.` : `Visit ${highlighter.info(GITHUB_ACTIONS_SETUP_URL)} to learn more.`);
 		cliLogger.break();
 	}
@@ -95665,7 +96281,7 @@ const runInstallReactDoctor = async (options = {}) => {
 	const shouldInstallGitHook = gitHookPath != null && (Boolean(options.yes) || !didSkipOptionalSetup && selectedSetupActions.includes(SETUP_OPTION_GIT_HOOK));
 	const shouldInstallAgentHooks = Boolean(options.agentHooks) || !didSkipOptionalSetup && selectedSetupActions.includes(SETUP_OPTION_AGENT_HOOKS);
 	if (!options.dryRun) {
-		if (shouldInstallGitHook && gitHookTarget !== null && gitHookTarget !== void 0) installReactDoctorGitHookStep(gitHookTarget);
+		if (shouldInstallGitHook && gitHookTarget != null) installReactDoctorGitHookStep(gitHookTarget);
 		if (shouldInstallAgentHooks) installReactDoctorAgentHooksStep(projectRoot, selectedAgents);
 	}
 	if (options.dryRun) {
@@ -96283,6 +96899,27 @@ const resolveCliInspectOptions = (flags, userConfig) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/resolve-workspace-dead-code-owner.ts
+const resolveWorkspaceDeadCodeOwner = (input) => {
+	if (!input.isRootDeadCodeEnabled) return null;
+	const resolvedRootDirectory = Path.resolve(input.rootDirectory);
+	return input.projectDirectories.find((projectDirectory) => Path.resolve(projectDirectory) === resolvedRootDirectory) ?? null;
+};
+//#endregion
+//#region src/cli/utils/retry-missing-project-scores.ts
+const retryMissingProjectScores = async (projectScans) => mapWithConcurrency(projectScans, 64, async (projectScan) => {
+	if (!(projectScan.result.score === null && !projectScan.isScoreDisabled && !hasIncompleteScoreAnalysis(projectScan.result.skippedChecks))) return projectScan;
+	const score = await calculateScore(filterScansForSurface([projectScan], "score"));
+	recordCount(METRIC.scanScoreRetry, 1, { succeeded: score !== null });
+	return score === null ? projectScan : {
+		...projectScan,
+		result: {
+			...projectScan.result,
+			score
+		}
+	};
+});
+//#endregion
 //#region src/cli/utils/resolve-project-relative-directory.ts
 /**
 * The scanned project's directory relative to the diff root, forward-slashed —
@@ -96343,6 +96980,16 @@ const resolveProjectChangedLineRanges = (rootDirectory, projectDirectory, ranges
 	});
 };
 //#endregion
+//#region src/cli/utils/resolve-project-scan.ts
+const resolveProjectScan = async (rootScanTarget, projectDirectory) => {
+	const projectScanTarget = projectDirectory === rootScanTarget.resolvedDirectory ? rootScanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
+	return {
+		directory: projectScanTarget.resolvedDirectory,
+		config: projectDirectory === rootScanTarget.resolvedDirectory ? rootScanTarget.userConfig : mergeReactDoctorConfigs(rootScanTarget.userConfig, projectScanTarget.userConfig ?? void 0),
+		configSourceDirectory: projectScanTarget.userConfig?.plugins === void 0 ? rootScanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory
+	};
+};
+//#endregion
 //#region src/cli/utils/build-diagnostic-issue-url.ts
 const formatRuleIdentifier = (diagnostic) => `${diagnostic.plugin}/${diagnostic.rule}`;
 const buildDiagnosticIssueBody = (input) => {
@@ -96485,7 +97132,7 @@ const resolveExplainTargetDirectory = async (filePath, context) => {
 	if (context.projectFlag) {
 		const matchedDirectories = await selectProjects(context.resolvedDirectory, context.projectFlag, true);
 		if (matchedDirectories.length === 0) return context.resolvedDirectory;
-		if (matchedDirectories.length > 1) throw new Error(`--explain takes a single project; --project resolved to ${matchedDirectories.length} projects.`);
+		if (matchedDirectories.length > 1) throw new Error(`why takes a single project; --project resolved to ${matchedDirectories.length} projects.`);
 		return matchedDirectories[0];
 	}
 	return findOwningProjectDirectory(context.resolvedDirectory, filePath);
@@ -96704,6 +97351,15 @@ const filterCompletedScansByCategories = (completedScans, categoryFilters) => {
 		}
 	}));
 };
+const reportSkippedProjects = (input) => {
+	input.skippedProjects.sort((left, right) => left.directory.localeCompare(right.directory));
+	if (input.skippedProjects.length === 0) return;
+	recordCount(METRIC.scanProjectSkipped, input.skippedProjects.length, { reason: "max-duration" });
+	if (!input.isQuiet) {
+		cliLogger.warn(formatSkippedProjectsMessage(input.skippedProjects.length));
+		cliLogger.break();
+	}
+};
 /**
 * Post-scan finalization shared by the staged-arm and project-loop
 * paths of `inspectAction`: emit the JSON report (when in JSON mode)
@@ -96718,7 +97374,7 @@ const filterCompletedScansByCategories = (completedScans, categoryFilters) => {
 */
 const finalizeScans = (input) => {
 	const baselineDeltas = input.completedScans.flatMap((scan) => scan.result.baselineDelta ? [scan.result.baselineDelta] : []);
-	const baselineComputed = input.completedScans.length > 0 && input.completedScans.every((scan) => scan.result.baselineDelta !== void 0);
+	const baselineComputed = input.skippedProjects.length === 0 && input.completedScans.length > 0 && input.completedScans.every((scan) => scan.result.baselineDelta !== void 0);
 	const baselineDegraded = input.baselineIntended && !baselineComputed;
 	const mode = baselineDegraded ? "diff" : input.mode;
 	const isReactDetected = input.completedScans.some((scan) => hasReactRuntime(scan.result.project));
@@ -96739,6 +97395,7 @@ const finalizeScans = (input) => {
 			mode,
 			diff: input.diff,
 			scans: jsonCompletedScans,
+			skippedProjects: input.skippedProjects,
 			totalElapsedMilliseconds: performance$1.now() - input.startTime,
 			baseline,
 			baselineDegraded
@@ -96777,16 +97434,16 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 	const requestedDirectory = Path.resolve(directory);
 	const startTime = performance$1.now();
 	let scanStartupSpinner = null;
-	if (isJsonMode) {
-		enableJsonMode({
-			compact: Boolean(flags.jsonCompact),
-			directory: requestedDirectory,
-			outputFile: flags.jsonOut
-		});
-		if (flags.jsonOut) recordCount(METRIC.jsonOutUsed, 1);
-	}
-	recordCount(METRIC.cliInvoked, 1, { command: invocationCommand });
 	try {
+		if (isJsonMode) {
+			enableJsonMode({
+				compact: Boolean(flags.jsonCompact),
+				directory: requestedDirectory,
+				outputFile: flags.jsonOut
+			});
+			if (flags.jsonOut) recordCount(METRIC.jsonOutUsed, 1);
+		}
+		recordCount(METRIC.cliInvoked, 1, { command: invocationCommand });
 		validateModeFlags(flags);
 		if (flags.staged) setJsonReportMode("staged");
 		await maybeMigrateLegacyConfig(requestedDirectory, {
@@ -96859,16 +97516,16 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 				return;
 			}
 			const buildProjectScanContext = async (projectDirectory) => {
-				const projectScanTarget = projectDirectory === resolvedDirectory ? scanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
-				const scanDirectory = projectScanTarget.resolvedDirectory;
+				const projectScan = await resolveProjectScan(scanTarget, projectDirectory);
+				const scanDirectory = projectScan.directory;
 				const treeRelativeDirectory = resolveProjectRelativeDirectory(resolvedDirectory, scanDirectory);
 				if (treeRelativeDirectory === null) return null;
 				return {
 					projectDirectory,
 					scanDirectory,
 					treeRelativeDirectory,
-					projectConfig: projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0),
-					projectConfigSourceDirectory: projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory
+					projectConfig: projectScan.config,
+					projectConfigSourceDirectory: projectScan.configSourceDirectory
 				};
 			};
 			const projectScanContexts = [];
@@ -96955,6 +97612,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 				includePaths: resolveProjectSourceFilePaths(resolvedDirectory, projectScan.scanDirectory, projectScan.stagedFiles.filter((stagedFile) => materializedStagedFiles.has(stagedFile)))
 			})).filter((projectRun) => projectRun.includePaths.length > 0);
 			const isMultiProject = stagedProjectRuns.length > 1;
+			const skippedProjects = [];
 			if (stagedProjectRuns.length === 0) {
 				snapshot.cleanup();
 				reportNothingToScan({
@@ -96970,6 +97628,13 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 			const scanStagedProject = async (projectRun) => {
 				const { projectScan, includePaths } = projectRun;
+				if (scanDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(scanDeadlineEpochMs) === 0) {
+					skippedProjects.push({
+						directory: projectScan.scanDirectory,
+						reason: "max-duration"
+					});
+					return null;
+				}
 				const projectTempDirectory = Path.join(snapshot.tempDirectory, projectScan.treeRelativeDirectory);
 				const scanResult = await inspectProject(projectTempDirectory, {
 					...scanOptions,
@@ -97010,7 +97675,11 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			});
 			const completedScans = stagedBatch.completedScans;
 			try {
-				if (!isQuiet && isMultiProject) {
+				reportSkippedProjects({
+					skippedProjects,
+					isQuiet
+				});
+				if (!isQuiet && isMultiProject && completedScans.length > 0) {
 					const showShareLink = !isShareOptedOut(completedScans, scanOptions.noScore) && !scanOptions.isCi;
 					await runPromise(printMultiProjectSummary({
 						completedScans,
@@ -97028,6 +97697,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 			finalizeScans({
 				completedScans,
+				skippedProjects,
 				mode: "staged",
 				diff: null,
 				baselineIntended: false,
@@ -97103,12 +97773,28 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 			cliLogger.break();
 		}
-		const isMultiProject = projectDirectories.length > 1;
-		const scanProject = async (projectDirectory) => {
-			const projectScanTarget = projectDirectory === resolvedDirectory ? scanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
-			const scanDirectory = projectScanTarget.resolvedDirectory;
-			const projectConfig = projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0);
-			const projectConfigSourceDirectory = projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory;
+		const projectScans = deduplicateProjectScans(await Promise.all(projectDirectories.map((projectDirectory) => resolveProjectScan(scanTarget, projectDirectory))));
+		const isMultiProject = projectScans.length > 1;
+		const rootProjectScan = projectScans.find((projectScan) => Path.resolve(projectScan.directory) === Path.resolve(resolvedDirectory));
+		const workspaceDeadCodeOwner = resolveWorkspaceDeadCodeOwner({
+			rootDirectory: resolvedDirectory,
+			projectDirectories: projectScans.map((projectScan) => projectScan.directory),
+			isRootDeadCodeEnabled: scanOptions.deadCode ?? rootProjectScan?.config?.deadCode ?? true
+		});
+		if (workspaceDeadCodeOwner !== null) recordCount(METRIC.scanWorkspaceDeadCodeShared, 1, { projectCount: projectScans.length });
+		const precomputedSourceFileCounts = isMultiProject && !isDiffMode ? await collectProjectSourceFileCounts(resolvedDirectory, projectScans.map((projectScan) => projectScan.directory)) : null;
+		const skippedProjects = [];
+		const scanProject = async (projectScan) => {
+			if (scanDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(scanDeadlineEpochMs) === 0) {
+				skippedProjects.push({
+					directory: projectScan.directory,
+					reason: "max-duration"
+				});
+				return null;
+			}
+			const scanDirectory = projectScan.directory;
+			const projectConfig = projectScan.config;
+			const ownsWorkspaceDeadCode = scanDirectory === workspaceDeadCodeOwner;
 			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
@@ -97132,12 +97818,16 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			if (!isQuiet && !isMultiProject) cliLogger.dim("  ");
 			const scanResult = await inspectProject(scanDirectory, {
 				...scanOptions,
+				deadCode: workspaceDeadCodeOwner === null ? scanOptions.deadCode : ownsWorkspaceDeadCode,
+				precomputedSourceFileCount: precomputedSourceFileCounts?.get(scanDirectory),
 				deadlineEpochMs: scanDeadlineEpochMs,
 				includePaths,
 				configOverride: projectConfig,
-				configSourceDirectory: projectConfigSourceDirectory ?? void 0,
+				configSourceDirectory: projectScan.configSourceDirectory ?? void 0,
 				suppressRendering: isMultiProject,
 				concurrentScan: isMultiProject,
+				excludedProjectDirectories: projectScans.filter((candidateProjectScan) => isPathInsideDirectory(candidateProjectScan.directory, scanDirectory)).map((candidateProjectScan) => candidateProjectScan.directory),
+				retainExcludedProjectDeadCodeDiagnostics: ownsWorkspaceDeadCode,
 				baseline: baselineRef !== null && projectBaselineBaseFiles !== null && projectBaselineHeadFiles !== null ? {
 					ref: baselineRef,
 					baseFiles: projectBaselineBaseFiles,
@@ -97154,12 +97844,19 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			};
 		};
 		const projectBatch = await runProjectScanBatch({
-			projects: projectDirectories,
+			projects: projectScans,
 			isQuiet,
 			isSilent: scanOptions.silent === true,
 			scanProject
 		});
-		const completedScans = projectBatch.completedScans;
+		const completedScans = await retryMissingProjectScores(projectBatch.completedScans.map((completedScan) => ({
+			...completedScan,
+			isScoreDisabled: scanOptions.noScore ?? completedScan.config?.noScore ?? false
+		})));
+		reportSkippedProjects({
+			skippedProjects,
+			isQuiet
+		});
 		if (!isQuiet && isMultiProject && completedScans.length > 0) {
 			const showShareLink = !isShareOptedOut(completedScans, scanOptions.noScore) && !scanOptions.isCi;
 			await runPromise(printMultiProjectSummary({
@@ -97177,6 +97874,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 		if (flags.outputDir && !didScansWriteDump) await runPromise(printDiagnosticsDump(selectedSurfaceDiagnostics, flags.outputDir, false, isQuiet ? "stderr" : "stdout"));
 		finalizeScans({
 			completedScans,
+			skippedProjects,
 			mode: baselineRef ? "baseline" : isDiffMode ? "diff" : "full",
 			diff: isDiffMode ? diffInfo : null,
 			baselineIntended: scope === "changed" && diffInfo !== null && !diffInfo.isCurrentChanges,
@@ -97261,6 +97959,56 @@ const installAction = async (options, command) => {
 	}
 };
 //#endregion
+//#region src/cli/utils/should-use-tui.ts
+const shouldUseTui = (input) => {
+	if (input.isNonInteractiveEnvironment || !input.stdinIsTty || !input.stdoutIsTty || !input.supportsRawMode || input.nodeMajorVersion < 22 || input.terminalName === "dumb") return false;
+	const flags = input.flags;
+	let requiresStableConfiguredScope = false;
+	if (input.userConfig?.scope !== void 0) requiresStableConfiguredScope = input.userConfig.scope !== "full";
+	else if (input.userConfig?.diff !== void 0) requiresStableConfiguredScope = input.userConfig.diff !== false && input.userConfig.diff !== "false";
+	else if (input.userConfig?.base !== void 0) requiresStableConfiguredScope = true;
+	return !(flags.verbose === true || flags.outputDir !== void 0 || flags.score === true || flags.json === true || flags.jsonCompact === true || flags.jsonOut !== void 0 || flags.staged === true || flags.scope !== void 0 || flags.base !== void 0 || flags.includeUntracked === true || flags.diff !== void 0 || flags.changedFilesFrom !== void 0 || flags.debug === true || flags.failOn !== void 0 || requiresStableConfiguredScope);
+};
+//#endregion
+//#region src/cli/commands/scan.ts
+const runScanCommand = async (input) => {
+	if (input.flags.cache === false) process.env.REACT_DOCTOR_NO_CACHE = "1";
+	const nodeMajorVersion = Number(process.versions.node.split(".")[0]);
+	const tuiEnvironment = {
+		flags: input.flags,
+		isNonInteractiveEnvironment: isNonInteractiveEnvironment(),
+		nodeMajorVersion,
+		stdinIsTty: process.stdin.isTTY === true,
+		stdoutIsTty: process.stdout.isTTY === true,
+		supportsRawMode: typeof process.stdin.setRawMode === "function",
+		terminalName: process.env.TERM
+	};
+	if (!shouldUseTui(tuiEnvironment)) {
+		await inspectAction(input.directory, input.flags, input.invocationCommand);
+		return;
+	}
+	await runProjectMigrations(path.resolve(input.directory));
+	const scanTarget = await resolveScanTarget(input.directory, { allowAmbiguous: true });
+	if (!shouldUseTui({
+		...tuiEnvironment,
+		userConfig: scanTarget.userConfig
+	})) {
+		await inspectAction(input.directory, input.flags, input.invocationCommand);
+		return;
+	}
+	recordCount(METRIC.cliInvoked, 1, { command: input.invocationCommand });
+	const { runScanApp } = await import("./run-scan-app-C8iWVgvR.js");
+	const { shouldFail } = await runScanApp({
+		directory: input.directory,
+		scanTarget,
+		options: resolveCliInspectOptions(input.flags, null),
+		projectFlag: input.flags.project,
+		skipPrompts: input.flags.yes ?? false,
+		blocking: input.flags.blocking
+	});
+	if (shouldFail) process.exitCode = 1;
+};
+//#endregion
 //#region src/cli/utils/rule-catalog.ts
 const buildRuleCatalog = () => REACT_DOCTOR_RULES.map((entry) => ({
 	key: entry.key,
@@ -97901,13 +98649,39 @@ const ensureWindowsUtf8Console = () => {
 	} catch {}
 };
 //#endregion
+//#region src/cli/utils/active-tui-renderer.ts
+let activeTuiRenderer = null;
+const registerActiveTuiRenderer = (renderer) => {
+	activeTuiRenderer = renderer;
+	return () => {
+		if (activeTuiRenderer === renderer) activeTuiRenderer = null;
+	};
+};
+const clearActiveTuiRenderer = () => {
+	const renderer = activeTuiRenderer;
+	activeTuiRenderer = null;
+	renderer?.clear();
+};
+//#endregion
 //#region src/cli/utils/exit-gracefully.ts
+let didStartExiting = false;
 const exitGracefully = () => {
+	if (didStartExiting) return process.exit(130);
+	didStartExiting = true;
+	activeScanAbortRegistry.abortAll();
+	clearActiveTuiRenderer();
 	try {
 		if (isJsonModeActive()) writeJsonErrorReport(/* @__PURE__ */ new Error("Scan cancelled by user (SIGINT/SIGTERM)"));
-		else console.log("\nCancelled.\n");
+		else console.log([
+			"",
+			"Cancelled.",
+			"",
+			buildSectionDivider(),
+			"",
+			...buildFooterLinkLines({ shareUrl: null })
+		].join("\n"));
 	} catch {}
-	process.exit(130);
+	flushSentry().finally(() => process.exit(130));
 };
 //#endregion
 //#region src/cli/utils/guard-stdin.ts
@@ -98025,6 +98799,7 @@ const ROOT_FLAG_SPEC = {
 		"--json-compact",
 		"--lint",
 		"--no-color",
+		"--no-cache",
 		"--no-dead-code",
 		"--no-lint",
 		"--no-parallel",
@@ -98148,13 +98923,18 @@ const COMMAND_FLAG_SPECS = new Map([
 		longOptionsWithoutValues: new Set([
 			"--color",
 			"--help",
+			"--no-cache",
 			"--no-color",
 			"--no-dead-code",
 			"--no-score",
 			"--no-supply-chain",
 			"--yes"
 		]),
-		longOptionsWithRequiredValues: new Set(["--blocking", "--project"]),
+		longOptionsWithRequiredValues: new Set([
+			"--blocking",
+			"--max-duration",
+			"--project"
+		]),
 		longOptionsWithOptionalValues: /* @__PURE__ */ new Set(),
 		shortOptionsWithoutValues: new Set(["-h", "-y"]),
 		shortOptionsWithRequiredValues: new Set(["-p"])
@@ -98296,6 +99076,7 @@ ${highlighter.dim("Scope:")}
   Dead-code, supply-chain, external lint-config, custom-plugin, and health-score passes are skipped.
   Standard scan flags such as ${highlighter.info("--scope")}, ${highlighter.info("--project")}, ${highlighter.info("--verbose")}, and ${highlighter.info("--json")} still work.
 `;
+const MAX_DURATION_OPTION_DESCRIPTION = "scan time budget for the whole run, shared across workspace projects: past it, queued projects, remaining lint batches, and dead-code are skipped and partial results are reported (skipped files and projects are listed in the JSON report)";
 const renderCiHelpEpilog = () => `
 ${highlighter.dim("Examples:")}
 ${formatExampleLines([
@@ -98315,8 +99096,12 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS and inline HTML script source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks (honors --project and config `projects`; exits 0 when nothing is staged)").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
-program.action(inspectAction);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("--no-cache", "disable all scan caches for this run").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS and inline HTML script source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks (honors --project and config `projects`; exits 0 when nothing is staged)").option("--max-duration <seconds>", MAX_DURATION_OPTION_DESCRIPTION).option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+program.action((directory = ".", flags) => runScanCommand({
+	directory,
+	flags,
+	invocationCommand: "inspect"
+}));
 program.command("design [directory]").description("Run only the focused UI design diagnostics").addHelpText("after", renderDesignHelpEpilog).action((directory, _options, command) => designAction(directory ?? ".", command.optsWithGlobals()));
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -98337,41 +99122,17 @@ rules.command("category <category> <severity>").description("Set the severity fo
 rules.command("ignore-tag <tag>").description("Skip a whole rule family by tag before linting (e.g. design)").option("-c, --cwd <cwd>", "working directory", process.cwd()).action((tag, _options, command) => rulesIgnoreTagAction(tag, command.optsWithGlobals()));
 rules.command("unignore-tag <tag>").description("Stop ignoring a tag previously skipped via ignore-tag").option("-c, --cwd <cwd>", "working directory", process.cwd()).action((tag, _options, command) => rulesUnignoreTagAction(tag, command.optsWithGlobals()));
 program.command("experimental-lsp", { hidden: false }).description("[experimental] run the React Doctor language server over stdio (for editors)").allowUnknownOption().action(() => {});
-program.command("experimental-tui [directory]", { hidden: true }).description("[experimental] interactive, scrollable scan report").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").option("--no-dead-code", "skip dead-code analysis").option("--no-supply-chain", "skip the dependency supply-chain scan").option("--no-score", "skip the score API, the share URL, and crash reporting").option("-p, --project <names>", "scan specific workspace projects (comma-separated, or *)").option("-y, --yes", "skip the project prompt and scan every discovered project").action(async (directory = ".", _localOptions, command) => {
-	const options = command.optsWithGlobals();
-	const deadCode = options.deadCode === false ? false : void 0;
-	const noScore = options.score === false ? true : void 0;
-	const supplyChain = options.supplyChain === false ? false : void 0;
-	const nodeMajorVersion = Number(process.versions.node.split(".")[0]);
-	if (process.stdout.isTTY !== true || process.stdin.isTTY !== true || isNonInteractiveEnvironment() || nodeMajorVersion < 22) {
-		await inspectAction(directory, {
-			deadCode,
-			score: options.score === false ? false : void 0,
-			supplyChain,
-			project: options.project,
-			yes: options.yes,
-			blocking: options.blocking
-		});
-		return;
-	}
-	recordCount(METRIC.cliInvoked, 1, { command: "experimental-tui" });
-	const { runScanApp } = await import("./run-scan-app-DHRvqfkX.js");
-	const { shouldFail } = await runScanApp({
-		directory,
-		options: {
-			deadCode,
-			noScore,
-			supplyChain
-		},
-		projectFlag: options.project,
-		skipPrompts: options.yes ?? false,
-		blocking: options.blocking
-	});
-	if (shouldFail) process.exitCode = 1;
-});
+program.command("experimental-tui [directory]", { hidden: true }).description("[experimental] interactive, scrollable scan report").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").option("--no-dead-code", "skip dead-code analysis").option("--no-supply-chain", "skip the dependency supply-chain scan").option("--score", "only print the numeric score (for scripts and CI)").option("--no-score", "skip the score API, the share URL, and crash reporting").option("--no-cache", "disable all scan caches for this run").option("--max-duration <seconds>", MAX_DURATION_OPTION_DESCRIPTION).option("-p, --project <names>", "scan specific workspace projects (comma-separated, or *)").option("-y, --yes", "skip the project prompt and scan every discovered project").action((directory = ".", _localOptions, command) => runScanCommand({
+	directory,
+	flags: command.optsWithGlobals(),
+	invocationCommand: "experimental-tui"
+}));
 process.stdout.on("error", (error) => {
 	if (error.code === "EPIPE") process.exit(0);
 });
+process.stderr.on("error", (error) => {
+	if (error.code === "EPIPE") process.exit(0);
+});
 const knownCommands = program.commands.flatMap((command) => [command.name(), ...command.aliases()]);
 const strippedArgv = stripUnknownCliFlags(process.argv);
 if (process.argv.includes("-V") && !strippedArgv.includes("-V")) {
@@ -98395,7 +99156,7 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 	handleError(error, { sentryEventId });
 });
 //#endregion
-export { toForwardSlashes as A, getCategoryImpact as B, buildRulePriorityMap as C, resolveBlockingLevel as D, formatLearnMoreLine as E, TUI_REPORT_DETAIL_WIDTH_FRACTION as F, runPromise as G, mapWithConcurrency as H, isCiEnvironment as I, succeed$3 as J, sync as K, DIAGNOSTIC_CATEGORY_BUCKETS as L, isUnicodeSupported as M, METRIC as N, isReactDoctorWorkflowInstalled as O, TUI_REPORT_COMPACT_MAX_ROWS as P, Progress as R, hasLintHardFailure as S, formatFixRecipeLine as T, mergeReactDoctorConfigs as U, highlighter as V, resolveScanTarget as W, canAnimateOnboarding as _, resolveCliInspectOptions as a, buildCodeFrame as b, detectLaunchableAgents as c, launchCliAgent as d, isShareOptedOut as f, doctorFace as g, easeOutCubic as h, selectProjects as i, findNearestPackageDirectory as j, recordCount as k, CLI_AGENT_BINARIES as l, printFooter as m, shouldFailScanGate as n, countUniqueScannedFiles as o, createInvocationInspect as p, void_ as q, discoverWorkspacePackages as r, setUpGitHubActions as s, exitGracefully as t, copyToClipboard as u, computeProjectedScore as v, buildSortedRuleGroups as w, buildNoScoreMessage as x, formatElapsedTime as y, Reporter as z };
+export { TUI_REPORT_DETAIL_WIDTH_FRACTION as $, shouldRecordOnboarding as A, buildSortedRuleGroups as B, createInvocationInspect as C, markOnboardingComplete as D, doctorFace as E, buildEmptyReportMessage as F, recordCount as G, formatLearnMoreLine as H, hasIncompleteScoreAnalysis as I, findNearestPackageDirectory as J, recordDistribution as K, buildNoScoreMessage as L, computeProjectedScore as M, formatElapsedTime as N, canAnimateOnboarding as O, buildCodeFrame as P, TUI_REPORT_COMPACT_MAX_ROWS as Q, hasLintHardFailure as R, deduplicateProjectScans as S, easeOutCubic as T, resolveBlockingLevel as U, formatFixRecipeLine as V, isReactDoctorWorkflowInstalled as W, CI_TRUST_COMPANIES as X, isUnicodeSupported as Y, METRIC as Z, launchCliAgent as _, succeed$3 as _t, selectProjects as a, buildRuleDocsUrl as at, formatSkippedProjectsMessage as b, resolveWorkspaceDeadCodeOwner as c, highlighter as ct, countUniqueScannedFiles as d, remainingDeadlineBudgetMs as dt, isCiEnvironment as et, setUpGitHubActions as f, resolveScanTarget as ft, copyToClipboard as g, void_ as gt, CLI_AGENT_BINARIES as h, sync as ht, discoverWorkspacePackages as i, Reporter as it, filterDiagnosticsByCategories as j, isOnboardingForced as k, resolveCliInspectOptions as l, isPathInsideDirectory as lt, detectLaunchableAgents as m, runPromise as mt, registerActiveTuiRenderer as n, GITHUB_ACTIONS_SETUP_URL as nt, resolveProjectScan as o, getCategoryImpact as ot, openUrl as p, yieldToEventLoop as pt, toForwardSlashes as q, shouldFailScanGate as r, Progress as rt, retryMissingProjectScores as s, hasPublishedFixRecipe as st, exitGracefully as t, DIAGNOSTIC_CATEGORY_BUCKETS as tt, filterScansForSurface as u, mapWithConcurrency as ut, buildHandoffPayload as v, printFooter as w, collectProjectSourceFileCounts as x, isShareOptedOut as y, buildRulePriorityMap as z };
 
 //# sourceMappingURL=cli.js.map
-//# debugId=707bd0ef-8490-5120-ba82-f65ad0b490e1
+//# debugId=e74e6a68-20e1-59fe-8db0-62b87e8fe049