@hublo/sentinel 1.5.0-alpha.9 → 1.5.1-alpha.0

package/README.md

@@ -57,7 +57,8 @@ pnpm install   # fetch what --init declared, then commit
 
 With no target named, `--init` adopts every role, in the order that makes the result correct:
 the linter's autofix runs, then the formatter runs **last** and formats everything every role
-wrote. Naming one target (`--init --lint`) adopts just that role and leaves the rest alone.
+wrote. Naming a target (`--init --build`) adopts just that role and leaves the rest alone, with
+one pairing: lint and format are always adopted together, so `--init --lint` adopts oxfmt too.
 
 `--init` writes the config stubs, the `typecheck`/`lint`/... scripts, and pins the `@hublo/sentinel` devDependency into the module (no manual `pnpm add`); it scaffolds a `package.json` for a `project.json`-only module. It also applies, once, the workspace prep that module needs at the root, only when the root's own config shows it is needed (e.g. an i18next singleton override when the repo runs a second TypeScript, a release-age allow-list when the repo uses that pnpm gate). See the [adoption cheat sheet](docs/typescript-adoption.md) for the full list.
 
@@ -137,7 +138,7 @@ The per-tool knowledge (eslint → `eslint.config.js`, tsc → `tsconfig`, …)
 
 **Registry: public npm**, under `@hublo`. We started on **GitHub Packages (private)** and moved off it: it authenticates every consumer, including a one-off run, which is incompatible with the zero-setup adoption above. Public npm needs no consumer auth, so a module adopts sentinel without any `.npmrc` or token. Releases go out through the repo's `publish` workflow, never from a laptop; a prerelease is published under its prerelease dist-tag (`alpha`) and a stable one under `latest`.
 
-**Node.** sentinel needs **Node >= 20.12** (its coloured output uses `util.styleText`, added in 20.12). It fails fast with a clear message on an older runtime rather than crashing. If a project runs on an older Node (e.g. a legacy app on Node 10), run sentinel with a modern Node via `fnm`/`nvm`; you do not need to change the project's own Node.
+**Node.** sentinel needs **Node >= 24.15**, which is the version the monorepo it serves pins in its own `.node-version`. The floor follows the consumer deliberately: a lower one means testing a runtime nobody runs, and it twice let an API through that the types allowed and the runtime did not. It fails fast with a clear message on an older runtime rather than crashing. If a project runs on an older Node (e.g. a legacy app on Node 10), run sentinel with a modern Node via `fnm`/`nvm`; you do not need to change the project's own Node.
 
 **Try it without installing.** A one-off run needs no auth and touches nothing:
 
@@ -171,19 +172,21 @@ throwaway run wants. Once a module has adopted, nothing is fetched any more: the
 - [`docs/build-adoption.md`](docs/build-adoption.md) — moving a React app's Vite toolchain into sentinel: adoption changes the config's IMPORTS and nothing else, what sentinel owns versus what stays the app's, and why reading nothing is what makes losing nothing a guarantee.
 - [`docs/typescript-adoption.md`](docs/typescript-adoption.md) — the adoption cheat sheet: the two adoption steps, the command model (verb x type x location), options, reading a report, and troubleshooting.
 - [`docs/test-adoption.md`](docs/test-adoption.md) — migrating a module from jest to Vitest: the two steps, what the migration rewrites and what it refuses BY NAME, how the baseline gate proves nothing was lost, and the failures worth recognising.
+- [`docs/static-analysis-adoption.md`](docs/static-analysis-adoption.md) — running the static analysis role on a module: the two steps, the four output shapes, how to read each row and where its threshold comes from, declaring an entry point, and the two limits worth knowing before trusting a number.
 - [`docs/typescript-traces.md`](docs/typescript-traces.md) — a **generated, versioned** reference of live command + output traces (every verb, option, config result and edge case) against the mock monorepo. Regenerate after CLI changes with `pnpm docs:traces`.
 
 ## Architecture: `target → runner → preset`
 
 Every check is described by three layers:
 
-| Layer                | Flag                        | What it is                                  | Examples                                                                                                                                                     |
-| -------------------- | --------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **target** (role)    | `--lint`, `--typescript`, … | the _kind_ of check, stable                 | `lint` `format` `typescript` `build` `dev` `test` `static-analysis` `runtime-analysis`                                                                       |
-| **runner** (adapter) | `--runner=<tool>`           | the _tool_ behind the target, swappable     | lint: `eslint`/`biome`/`oxlint` · types: `tsc`/`tsgo` · build: `vite` · test: `vitest`                                                                       |
-| **preset** (preset)  | detected / `--preset`       | the _variant_ per stack (strict by default) | `react` `nest` `node` `svelte` (svelte: lint + format; no tsconfig preset yet, so the TypeScript role stands aside on those modules and the other two adopt) |
+| Layer                | Flag                        | What it is                                         | Examples                                                                                                                                                     |
+| -------------------- | --------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **target** (role)    | `--lint`, `--typescript`, … | the _kind_ of check, stable                        | `lint` `format` `typescript` `build` `dev` `test` `static-analysis` `runtime-analysis`                                                                       |
+| **runner** (adapter) | `--runner=<tool>`           | the _tool_ behind the target, swappable            | lint: `eslint`/`biome`/`oxlint` · types: `tsc`/`tsgo` · build: `vite` · test: `vitest`                                                                       |
+| **shape** (output)   | `--output=<shape>`          | what a reporting role WRITES, not what it measures | `console` (default, writes nothing) `html` `json` `markdown`; roles that do not report ignore it                                                             |
+| **preset** (preset)  | detected / `--preset`       | the _variant_ per stack (strict by default)        | `react` `nest` `node` `svelte` (svelte: lint + format; no tsconfig preset yet, so the TypeScript role stands aside on those modules and the other two adopt) |
 
-A run is `target × runner × preset`, e.g. `sentinel --run --lint --runner=eslint` from the `host-admin` dir.
+A run is `target × runner × preset`, e.g. `sentinel --run --lint --runner=eslint` from the `host-admin` dir. The shape is not part of that identity: it decides what the run WRITES, not what it does.
 
 - `--runner` is an **optional override on a central default**. `sentinel --lint` uses the configured default runner, so swapping a tool globally is a one-place change; `--runner=biome` overrides for a single run (great for benchmarking eslint vs biome vs oxlint, and for gradual migration).
 - The **preset is detected** from the module's dependencies (deterministic: a framework dep → its preset, else `node`), and **`--preset` overrides it**. Detection can be wrong where deps are hoisted at the repo root (it returns `node`), so pass `--preset` for `--init` (that is where the preset is chosen). `--run`/`--report` don't depend on it, they run the tool on the committed config.
@@ -410,6 +413,7 @@ OPTIONS    --module <name>    from the root: scope to one module
            --ci               from the root: affected only; non-zero exit on failure
            --fix              auto-fix where applicable
            --dry-run          preview a --init without writing
+           --rehearse         with --dry-run: run the autofixes in a copy, name the source they rewrite
            --json             machine-readable output (report / inspect / status / --dry-run)
            -- <tool options>  --run only: pass the rest to the tool itself (one type)
 

package/dist/bin/sentinel.js

@@ -1,11 +1,6 @@
 #!/usr/bin/env node
 import {
-  LONG_RUNNING_TARGETS,
-  PRESET_NAMES,
   PresetUnsupportedError,
-  SWEEPABLE_TARGETS,
-  TARGETS,
-  VERBS,
   availableTargets,
   buildConfigFile,
   correctingSignal,
@@ -13,35 +8,157 @@ import {
   describeFramework,
   dispatch,
   palette,
+  presetNotInstalledYet,
   registerAdapters,
   resolve
-} from "../chunk-OZZICSSZ.js";
+} from "../chunk-CL7HOHTU.js";
 import {
   resolveContext
-} from "../chunk-KLEXJFJ6.js";
+} from "../chunk-I2WDZNPR.js";
 import {
   ensureWorkspacePrep,
   findWorkspaceRoot,
   inspectWorkspacePrep,
   readOwnVersion,
   readProjectPackageJson
-} from "../chunk-YQRDKWSH.js";
-import "../chunk-EDFIVLUA.js";
+} from "../chunk-JRZI5IIN.js";
+import {
+  LONG_RUNNING_TARGETS,
+  OUTPUT_SHAPES,
+  PRESET_NAMES,
+  SWEEPABLE_TARGETS,
+  TARGETS,
+  VERBS
+} from "../chunk-WBDBRGLV.js";
 import "../chunk-O7REVMOC.js";
 import "../chunk-QXFCZON7.js";
 
 // bin/sentinel.ts
 import { program } from "commander";
 
+// src/core/rehearse.ts
+import { createHash } from "node:crypto";
+import {
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, relative, sep } from "node:path";
+var NOT_COPIED = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function contents(root) {
+  const found = /* @__PURE__ */ new Map();
+  const queue = [root];
+  while (queue.length > 0) {
+    const dir = queue.pop();
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      const path = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!NOT_COPIED.has(entry.name)) queue.push(path);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      found.set(relative(root, path), createHash("sha1").update(readFileSync(path)).digest("hex"));
+    }
+  }
+  return found;
+}
+function stage(moduleDir, scratch) {
+  const root = findWorkspaceRoot(moduleDir);
+  const segments = root === void 0 ? [basename(moduleDir)] : relative(root, moduleDir).split(sep).filter((segment) => segment !== "");
+  let real = root ?? dirname(moduleDir);
+  let shadow = scratch;
+  for (const segment of segments) {
+    for (const entry of root === void 0 ? [] : readdirSync(real)) {
+      if (entry === segment || entry === ".git") continue;
+      symlinkSync(join(real, entry), join(shadow, entry));
+    }
+    real = join(real, segment);
+    shadow = join(shadow, segment);
+    mkdirSync(shadow);
+  }
+  rmSync(shadow, { recursive: true, force: true });
+  cpSync(moduleDir, shadow, {
+    recursive: true,
+    filter: (source) => source === moduleDir || !NOT_COPIED.has(basename(source)) && !lstatSync(source).isSymbolicLink()
+  });
+  if (existsSync(join(moduleDir, "node_modules"))) {
+    symlinkSync(join(moduleDir, "node_modules"), join(shadow, "node_modules"), "dir");
+  }
+  return shadow;
+}
+async function rehearseAfterInit(moduleDir, roles) {
+  const rehearsing = roles.filter((role) => role.adapter.rehearseAfterInit !== void 0);
+  if (rehearsing.length === 0) return [];
+  const scratch = realpathSync(mkdtempSync(join(tmpdir(), "sentinel-rehearsal-")));
+  try {
+    let copy;
+    try {
+      copy = stage(moduleDir, scratch);
+    } catch (error) {
+      const failure = error instanceof Error ? error.message : String(error);
+      return rehearsing.map((role) => ({ target: role.target, rewrites: [], failure }));
+    }
+    const planned = /* @__PURE__ */ new Set();
+    for (const role of roles) {
+      for (const file of role.files) {
+        planned.add(file.path);
+        const target = join(copy, file.path);
+        if (file.deleted) {
+          rmSync(target, { force: true });
+          continue;
+        }
+        mkdirSync(dirname(target), { recursive: true });
+        writeFileSync(target, file.after);
+      }
+    }
+    const results = [];
+    for (const role of rehearsing) {
+      const before = contents(copy);
+      const failure = await role.adapter.rehearseAfterInit?.(
+        {
+          module: basename(moduleDir),
+          cwd: copy,
+          preset: role.preset,
+          ci: false,
+          fix: true,
+          written: role.files.filter((file) => !file.deleted).map((file) => file.path)
+        },
+        moduleDir
+      );
+      const after = contents(copy);
+      const rewrites = [...after].filter(([path, hash]) => before.get(path) !== hash && !planned.has(path)).map(([path]) => path).sort();
+      results.push({
+        target: role.target,
+        rewrites,
+        // The tool names files by the path it read them from, which is the copy. Said as the
+        // module's own paths: the copy is gone by the time anyone reads this.
+        ...failure === void 0 ? {} : { failure: failure.replaceAll(`${copy}/`, "").replaceAll(copy, ".") }
+      });
+    }
+    return results;
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
 // src/roles/build/declined.ts
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 var DEPRECATED_NX_BUILDER = "@nx/webpack:webpack";
 function buildsWithDeprecatedExecutor(cwd2) {
-  const projectJson = join(cwd2, "project.json");
-  if (!existsSync(projectJson)) return false;
+  const projectJson = join2(cwd2, "project.json");
+  if (!existsSync2(projectJson)) return false;
   try {
-    const project = JSON.parse(readFileSync(projectJson, "utf8"));
+    const project = JSON.parse(readFileSync2(projectJson, "utf8"));
     return project.targets?.build?.executor === DEPRECATED_NX_BUILDER;
   } catch {
     return false;
@@ -61,6 +178,30 @@ function explainDecline(cwd2) {
 function asMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
+var ADOPTED_TOGETHER = ["lint", "format"];
+function pairedTargets(named, available) {
+  if (!named.some((type) => ADOPTED_TOGETHER.includes(type))) return [];
+  return ADOPTED_TOGETHER.filter((type) => available.includes(type) && !named.includes(type));
+}
+var NAMED_REWRITES = 10;
+var AUTOFIX_TOOL = { lint: "linter", format: "formatter" };
+function describeUnrehearsed(target) {
+  return `the ${target} autofix runs on adoption and can rewrite source, as moving to another ${AUTOFIX_TOOL[target] ?? "tool"} does; add --rehearse to name the files (it runs the pass in a throwaway copy, as long as the real one)`;
+}
+function describeRehearsal(target, rewrites, failure) {
+  const pass = `the ${target} autofix`;
+  const said = failure === void 0 ? "" : ` (it also reported: ${failure})`;
+  if (rewrites.length === 0) {
+    if (failure === void 0) return `${pass} would rewrite nothing beyond the files above`;
+    if (presetNotInstalledYet(failure)) {
+      return `${pass} cannot be rehearsed yet: its preset is not installed in this module, which is expected before the first \`pnpm install\`. After it, this dry-run names what it rewrites`;
+    }
+    return `could not rehearse ${pass}, so what it rewrites is not known: ${failure}`;
+  }
+  const named = rewrites.slice(0, NAMED_REWRITES).join(", ");
+  const rest = rewrites.length - NAMED_REWRITES;
+  return `${pass} would rewrite ${rewrites.length} file${rewrites.length === 1 ? "" : "s"} beyond the ones above: ${rest > 0 ? `${named} and ${rest} more` : named}${said}`;
+}
 async function runInit(ctx) {
   const { modules, scope } = resolveContext(ctx.cwd, { module: ctx.module, ci: false });
   const [module] = modules;
@@ -78,7 +219,24 @@ async function runInit(ctx) {
       );
     }
   }
-  const toRun = ctx.targets.filter((type) => available.includes(type)).sort((a, b) => Number(a === "format") - Number(b === "format"));
+  const named = ctx.targets.filter((type) => available.includes(type));
+  const paired = pairedTargets(named, available);
+  const toRun = [...named, ...paired].sort(
+    (a, b) => Number(a === "format") - Number(b === "format")
+  );
+  for (const type of paired) {
+    process.stderr.write(
+      palette(process.stderr).dim(
+        `  adopting --${type} too: lint and format are adopted together, see the lint adoption guide
+`
+      )
+    );
+  }
+  const outcomes = [];
+  const record = (outcome) => {
+    outcomes.push(outcome);
+  };
+  const planned = [];
   let worst = 0;
   for (const type of toRun) {
     try {
@@ -89,12 +247,14 @@ async function runInit(ctx) {
         cwd: module.root,
         preset: ctx.preset,
         dryRun: ctx.dryRun,
-        json: ctx.json
+        json: ctx.json,
+        record,
+        planned: (role) => planned.push(role)
       });
       worst = Math.max(worst, code);
     } catch (error) {
       if (error instanceof PresetUnsupportedError) {
-        if (ctx.targetsExplicit) {
+        if (ctx.targetsExplicit && !paired.includes(type)) {
           const hint = type === "build" ? explainDecline(module.root) : ` Pass --preset if it was detected wrongly (hoisted dependencies make detection fall back to "node").`;
           process.stderr.write(
             `
@@ -103,14 +263,36 @@ sentinel (${type}): this module's preset is "${error.preset}", and --${type} has
           );
           worst = Math.max(worst, 1);
         }
+        record({
+          role: type,
+          status: "unsupported",
+          reason: `this module's preset is "${error.preset}", and --${type} has no adapter for it.`
+        });
         continue;
       }
       process.stderr.write(`
 sentinel (${type}): ${asMessage(error)}
 `);
+      record({ role: type, status: "failed", reason: asMessage(error) });
       worst = Math.max(worst, 1);
     }
   }
+  if (ctx.dryRun && worst === 0 && !ctx.rehearse && !ctx.json) {
+    for (const { target } of planned.filter((role) => role.adapter.rehearseAfterInit)) {
+      process.stderr.write(`  dry run: ${describeUnrehearsed(target)}
+`);
+    }
+  }
+  if (ctx.dryRun && worst === 0 && ctx.rehearse) {
+    for (const { target, rewrites, failure } of await rehearseAfterInit(module.root, planned)) {
+      const outcome = outcomes.find((entry) => entry.role === target);
+      if (outcome !== void 0) outcome.rewrites = rewrites;
+      if (ctx.json) continue;
+      process.stderr.write(`  dry run: ${describeRehearsal(target, rewrites, failure)}
+`);
+    }
+  }
+  let workspace = [];
   if (worst === 0) {
     const root = findWorkspaceRoot(module.root);
     if (root) {
@@ -123,6 +305,7 @@ sentinel (${type}): ${asMessage(error)}
         // Same rule for the report directory: only when the STATIC ANALYSIS role adopted.
         analysedModule: toRun.includes("static-analysis")
       });
+      workspace = changes;
       const prefix = ctx.dryRun ? "  dry run: " : "  ";
       for (const change of changes) process.stderr.write(`${prefix}${change}
 `);
@@ -133,6 +316,15 @@ sentinel (${type}): ${asMessage(error)}
       }
     }
   }
+  if (ctx.json) {
+    process.stdout.write(
+      JSON.stringify(
+        { dryRun: ctx.dryRun, module: module.name, roles: outcomes, workspace },
+        null,
+        2
+      ) + "\n"
+    );
+  }
   return worst;
 }
 
@@ -148,7 +340,7 @@ async function runValidate(ctx) {
     );
   }
   if (!ctx.targets.includes("test")) return 1;
-  const { validateModuleTests } = await import("../validate-AWWMBSH5.js");
+  const { validateModuleTests } = await import("../validate-S6PIOVAH.js");
   const outcomes = modules.flatMap(
     (module) => validateModuleTests(module.name, module.root)
   );
@@ -549,7 +741,7 @@ async function runVerb(ctx) {
 }
 
 // src/shared/node-version.ts
-var MIN_NODE = "20.12.0";
+var MIN_NODE = "24.15.0";
 function parts(version) {
   const [major = 0, minor = 0, patch = 0] = version.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
   return [major, minor, patch];
@@ -583,8 +775,8 @@ var TARGET_HELP = {
   build: "build",
   dev: "dev server (long-running: never swept by an unqualified --run)",
   test: "tests",
-  "static-analysis": "cycles, complexity, duplication, centrality",
-  "runtime-analysis": "bundle, Lighthouse, web vitals",
+  "static-analysis": "duplication, dead code, complexity, import graph, file size, bundle weight",
+  "runtime-analysis": "Lighthouse, web vitals",
   arch: "architecture boundaries"
 };
 program.name("sentinel").description("One CLI that guards code health: presets, analysis, and arch checks.").version(readOwnVersion()).configureHelp({ sortOptions: false }).showSuggestionAfterError(true).showHelpAfterError('(run "sentinel --help" for usage)').addHelpText(
@@ -603,9 +795,12 @@ program.name("sentinel").description("One CLI that guards code health: presets,
 ).option("--report", "deprecated: use --run --json").option("--status", "deprecated: use --inspect").option(
   "--module <name>",
   "from the workspace root: scope to one module (omit = all; inside a module dir, drop this)"
-).option("--preset <name>", `the stack preset to apply (${PRESET_NAMES.join(", ")})`).option("--flavour <name>", "deprecated: use --preset").option("--runner <tool>", "override the default runner (e.g. eslint, biome)").option("--ci", "CI mode: from the root, only the affected modules; non-zero exit on failure").option("--fix", "auto-fix where applicable").option("--dry-run", "preview the changes without writing (--init)").option("--json", "machine-readable output, for every verb").option(
+).option("--preset <name>", `the stack preset to apply (${PRESET_NAMES.join(", ")})`).option("--flavour <name>", "deprecated: use --preset").option("--runner <tool>", "override the default runner (e.g. eslint, biome)").option("--ci", "CI mode: from the root, only the affected modules; non-zero exit on failure").option("--fix", "auto-fix where applicable").option("--dry-run", "preview the changes without writing (--init)").option(
+  "--rehearse",
+  "with --init --dry-run: run the lint and format autofixes in a throwaway copy and name the source they rewrite (as slow as the real pass)"
+).option("--json", "machine-readable output, for every verb").option(
   "--output <shape>",
-  "output shape for a role that writes reports (console, json, html); console by default"
+  "output shape for a role that writes reports (console, json, html, markdown); console by default"
 ).option(
   "--max-diagnostics <n>",
   "cap the diagnostics embedded per module in --report (0 = no cap)",
@@ -665,6 +860,22 @@ function parseFlavour(value) {
   }
   return value;
 }
+function parseOutput(value, json) {
+  if (value === void 0) return void 0;
+  const asked = typeof value === "string" ? value.split(",").map((one) => one.trim()).filter((one) => one !== "") : [];
+  const unknown = asked.filter((one) => !OUTPUT_SHAPES.includes(one));
+  if (asked.length === 0 || unknown.length > 0) {
+    return program.error(
+      `sentinel: unknown --output ${unknown.map((one) => JSON.stringify(one)).join(", ") || JSON.stringify(value)}. Supported: ${OUTPUT_SHAPES.join(", ")}; several at once with a comma.`
+    );
+  }
+  if (json && asked.some((one) => one !== "json")) {
+    return program.error(
+      `sentinel: --json already selects the json shape, so it cannot be combined with --output ${JSON.stringify(value)}. Use one or the other.`
+    );
+  }
+  return asked.join(",");
+}
 function asMessage2(err) {
   return err instanceof Error ? err.message : String(err);
 }
@@ -688,6 +899,11 @@ if (opts.all && namedTargets.length > 0) {
 }
 var targets = opts.all || namedTargets.length === 0 ? [...SWEEPABLE_TARGETS] : namedTargets;
 var targetsExplicit = !(opts.all || namedTargets.length === 0);
+if (namedTargets.includes("static-analysis") && (verb === "report" || verb === "run" && opts.json)) {
+  program.error(
+    `sentinel: --static-analysis writes its own report, so ${verb === "report" ? "--report" : "--json"} has nothing to add to it. Run it bare for the console report, or with --output json|html|markdown for the files.`
+  );
+}
 var maxDiagnostics = Number(opts.maxDiagnostics);
 if (!Number.isInteger(maxDiagnostics) || maxDiagnostics < 0) {
   program.error(
@@ -697,6 +913,11 @@ if (!Number.isInteger(maxDiagnostics) || maxDiagnostics < 0) {
 if (opts.dryRun && verb !== "init") {
   program.error("--dry-run only applies to --init (the read verbs never write).");
 }
+if (opts.rehearse && !opts.dryRun) {
+  program.error(
+    "--rehearse only applies to --init --dry-run: the real --init runs the autofix passes themselves."
+  );
+}
 if (toolArgs.length > 0) {
   if (verb !== "run") {
     program.error(
@@ -734,8 +955,9 @@ async function main() {
     json: Boolean(opts.json),
     // `--json` stays the engine-wide machine-readable flag, so it also selects the json shape for
     // a role that writes reports: two ways to ask for the same thing would be a trap.
-    output: typeof opts.output === "string" ? opts.output : opts.json ? "json" : void 0,
+    output: parseOutput(opts.output, Boolean(opts.json)) ?? (opts.json ? "json" : void 0),
     dryRun: Boolean(opts.dryRun),
+    rehearse: Boolean(opts.rehearse),
     fail: (message) => program.error(message)
   };
   const exitCode = verb === "init" ? await runInit(context) : verb === "validate" ? await runValidate(context) : await runVerb(context);