Thanks for the rebase, Hassan. The merge is clean now and on my side cargo check --workspace, clippy on cli/graph, and the cli/graph/core lib tests all pass.

The conceptual approach is solid: broken-extends fallback, subdir-aware base root, and current-side config all address real bugs. Three robustness improvements before merge:

1. crates/graph/src/resolve/specifier.rs:496 (and 509, 1300)

The ? propagates None out of the whole function on a single read failure, so a TOCTOU on any tsconfig in the chain (deleted or moved between chain build and this loop) abandons resolution for the remaining entries. Same pattern at line 509 and at line 1300 in try_tsconfig_root_dirs.

Suggest:

let Some(json) = read_tsconfig_json(tsconfig_path) else { continue; };

2. crates/graph/src/resolve/specifier.rs:285 glob_values_match

Bare directory include patterns like "include": ["src"] get passed to Glob::new as a literal path, which only matches the directory entry itself, not files under it. TypeScript expands a bare directory as <dir>/**/* (with implicit .ts/.tsx/etc). Result: configs with bare-directory includes get silently skipped during references chain traversal.

When a pattern resolves to an existing directory and contains no glob metacharacters, append /**/* before building the glob.

3. crates/cli/src/audit.rs:671 base_analysis_root

If current_root.canonicalize() succeeds but git_root doesn't match (race, unusual symlink layering, or a parent dir replaced mid-run), strip_prefix fails silently and the base audit runs against the worktree root instead of the expected subdirectory, producing a wrong-but-passing result.

Worth a tracing::warn! on the strip_prefix failure path so a misbehaving setup is at least visible in --explain.

Great feedback! The code should be fully airtight now (hopefully)

Released in v2.66.1. Thanks @M-Hassan-Raza.