@quatronic/qore 0.1.3 → 0.1.5

package/dist/cli.js

@@ -1,11 +1,18 @@
 #!/usr/bin/env node
 
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a70250c5-daf4-5ff3-b490-5556ac377549")}catch(e){}}();
+import { createRequire as __qoreCreateRequire } from "node:module"; const require = __qoreCreateRequire(import.meta.url);
+import {
+  addSecretValues,
+  buildScrubContext
+} from "./chunk-QYBDINUC.js";
+
 // src/cli.ts
 import { homedir as homedir2 } from "os";
 import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
 
 // src/cli/io.ts
-import { confirm, select } from "@inquirer/prompts";
+import { confirm, search, select } from "@inquirer/prompts";
 import { createInterface } from "readline";
 
 // src/platform/browser.ts
@@ -129,9 +136,17 @@ function processIo(interactive, stderrTTY = Boolean(process.stderr.isTTY)) {
         throw e;
       }
     },
-    async confirm(message, signal) {
+    async search(message, source) {
+      try {
+        return await search({ message, source: (term) => source(term ?? "") });
+      } catch (e) {
+        if (e.name === "ExitPromptError") throw new CancelledError();
+        throw e;
+      }
+    },
+    async confirm(message, signal, o) {
       try {
-        return await confirm({ message, default: false }, { signal });
+        return await confirm({ message, default: o?.default ?? false }, { signal });
       } catch (e) {
         if (e.name === "ExitPromptError" || e.name === "AbortPromptError") throw new CancelledError();
         throw e;
@@ -312,7 +327,7 @@ function renderDoctorJson(io2, report) {
   return true;
 }
 var SYMBOL = { ok: "\u2713", warn: "!", fail: "\u2717" };
-var TOOL_IDS = ["qore", "node", "git", "github-ssh", "docker"];
+var TOOL_IDS = ["qore", "node", "git", "github-ssh", "docker", "telemetry"];
 var ROW_WIDTH = 80;
 var COL_B = 36;
 function rawLine(r) {
@@ -395,6 +410,23 @@ function argvBeforeSeparator(argv2) {
 function jsonFromArgv(argv2) {
   return argvBeforeSeparator(argv2).some((a) => a === "--json" || a.startsWith("--json="));
 }
+var DOCTOR_CODES = /* @__PURE__ */ new Set([
+  "QORE_DOCKER_MISSING",
+  "QORE_DOCKER_NOT_RUNNING",
+  "QORE_DOCKER_COMPOSE_MISSING",
+  "QORE_NODE_VERSION",
+  "QORE_PACKAGE_MANAGER",
+  "QORE_INSTALL_FAILED",
+  "QORE_PORT_IN_USE",
+  "QORE_SERVICE_UNHEALTHY"
+]);
+var machineFailure = (e) => DOCTOR_CODES.has(e.code) && !(e.code === "QORE_PORT_IN_USE" && e.details?.owner === "qore");
+function needsDoctor(e) {
+  if (!(e instanceof QoreError)) return false;
+  const problems = e.details?.problems;
+  if (Array.isArray(problems)) return problems.some((p) => machineFailure(p));
+  return machineFailure(e);
+}
 function requestLog(ctx) {
   return ctx.opts().verbose ? (line2) => ctx.io.err(line2) : void 0;
 }
@@ -410,7 +442,16 @@ function buildProgram(deps2, io2, signal, register, setExitCode) {
   for (const r of register) r(program, ctx);
   return program;
 }
-async function run(argv2, deps2, io2, signal, register) {
+function commandPath(action) {
+  const names = [];
+  for (let c = action; c?.parent; c = c.parent) names.unshift(c.name());
+  return names.join(" ");
+}
+function isCrash(e) {
+  if (e instanceof QoreError || e instanceof CancelledError || e instanceof CommanderError) return false;
+  return !(e instanceof Error && (e.name === "CancelledError" || e.name === "QoreError"));
+}
+async function run(argv2, deps2, io2, signal, register, hooks = {}) {
   const json2 = jsonFromArgv(argv2);
   const parseIo = json2 ? { ...io2, err: () => {
   } } : io2;
@@ -418,6 +459,13 @@ async function run(argv2, deps2, io2, signal, register) {
   const program = buildProgram(deps2, parseIo, signal, register, (code) => {
     state.exitCode = code;
   });
+  program.hook("preAction", async (_program, action) => {
+    state.command = action.name();
+    try {
+      await hooks.onCommand?.(commandPath(action));
+    } catch {
+    }
+  });
   try {
     await program.parseAsync(argv2, { from: "user" });
     return state.exitCode ?? 0;
@@ -428,8 +476,15 @@ async function run(argv2, deps2, io2, signal, register) {
       if (json2) io2.out(JSON.stringify({ ok: false, error: { code: "QORE_CONTEXT_INVALID", message: e.message } }));
       return 2;
     }
+    if (isCrash(e)) {
+      try {
+        hooks.onCrash?.(e);
+      } catch {
+      }
+    }
     const opts = program.opts();
     renderError(io2, e, Boolean(opts.json), pc2.isColorSupported && opts.color !== false);
+    if (!opts.json && needsDoctor(e) && state.command !== "doctor") io2.err("Run qore doctor for a full check of your machine.");
     return exitCodeFor(e);
   }
 }
@@ -513,6 +568,9 @@ async function loadMeta(deps2, apiOrigin, refresh) {
   });
   return { meta, cached: false };
 }
+async function metaFor(deps2, apiOrigin) {
+  return (await loadMeta(deps2, apiOrigin, false)).meta;
+}
 async function ensureCapability(deps2, apiOrigin, capability) {
   const first = await loadMeta(deps2, apiOrigin, false);
   let meta = first.meta;
@@ -754,8 +812,7 @@ async function openSession(deps2, portal, command, onRequest) {
 // src/core/workspace/apps.ts
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var tenantCandidates = (tenants) => tenants.map((t) => ({ kind: "tenant", id: t.id, slug: t.slug, name: t.name }));
-async function resolveAppRef(deps2, session, arg, tenantFlag) {
-  if (UUID.test(arg)) return { appId: arg, tenant: null };
+async function resolveTenant(deps2, session, tenantFlag, whatFor) {
   const me = await session.api.get("/api/cli/v1/me");
   let tenant;
   if (tenantFlag) {
@@ -779,11 +836,16 @@ async function resolveAppRef(deps2, session, arg, tenantFlag) {
   } else if (me.tenants.length === 1) {
     tenant = { id: me.tenants[0].id, slug: me.tenants[0].slug };
   } else {
-    throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${arg}" in?`, {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `Which tenant is "${whatFor}" in?`, {
       hint: "Run `qore tenant use <slug>`, or pass --tenant <slug>.",
       candidates: tenantCandidates(me.tenants)
     });
   }
+  return { tenant, me };
+}
+async function resolveAppRef(deps2, session, arg, tenantFlag) {
+  if (UUID.test(arg)) return { appId: arg, tenant: null };
+  const { tenant } = await resolveTenant(deps2, session, tenantFlag, arg);
   try {
     const { id } = await session.api.get(
       `/api/cli/v1/tenants/${encodeURIComponent(tenant.id)}/apps/resolve?slug=${encodeURIComponent(arg)}`
@@ -806,7 +868,7 @@ async function resolveAppRef(deps2, session, arg, tenantFlag) {
 }
 
 // src/core/workspace/apply.ts
-import { join as join4, relative } from "path";
+import { join as join4 } from "path";
 
 // src/core/context/cache.ts
 import { join as join2 } from "path";
@@ -956,7 +1018,7 @@ async function trust(deps2, root, moduleId) {
 }
 
 // src/core/workspace/plan.ts
-import { join as join3 } from "path";
+import { join as join3, relative } from "path";
 var SEGMENT = /^[A-Za-z0-9_.-]+$/;
 function isSupportedRepoUrl(repoUrl) {
   let u;
@@ -981,6 +1043,13 @@ function cloneUrl(repoUrl, protocol) {
   const u = new URL(repoUrl);
   return `git@${u.hostname}:${u.pathname.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/, "")}.git`;
 }
+function conflictText(cwd, action) {
+  const dir2 = relative(cwd, action.dir) || ".";
+  const notRepo = action.reason === "not a git repository";
+  const what = notRepo ? "it is not a git repository" : action.origin ? `its origin is ${action.origin}, not ${action.module.repoUrl}` : "it has no origin remote";
+  const message = notRepo ? `${dir2} is not a git repository` : action.origin ? `${dir2} holds another repository (its origin is ${action.origin}, not ${action.module.repoUrl})` : `${dir2} has no origin remote`;
+  return { message, hint: `Move ${dir2} aside (${what}), then run \`qore sync\`.` };
+}
 function planWorkspace(root, modules, dirs, strayRepos2) {
   const actions = modules.map((module) => {
     const dir2 = join3(root, module.slug);
@@ -997,6 +1066,10 @@ function planWorkspace(root, modules, dirs, strayRepos2) {
   const slugs = new Set(modules.map((m) => m.slug));
   return { actions, removed: strayRepos2.filter((s) => !slugs.has(s)) };
 }
+function cloneProtocol(dirs) {
+  const origins = Object.values(dirs).flatMap((d) => d.remotes.filter((r) => r.name === "origin").map((r) => r.url));
+  return origins.some((u) => /^(git@|ssh:\/\/)/.test(u)) ? "ssh" : "https";
+}
 
 // src/core/workspace/diagnose.ts
 var ACCESS_CODES = /* @__PURE__ */ new Set(["QORE_GITHUB_NOT_LINKED", "QORE_REPO_NO_ACCESS", "QORE_REPO_ACCESS_PENDING"]);
@@ -1072,15 +1145,8 @@ function toFailure(slug, e) {
   throw e;
 }
 function conflictResult(deps2, action) {
-  const dir2 = relative(deps2.cwd, action.dir) || ".";
-  const what = action.reason === "not a git repository" ? "it is not a git repository" : action.origin ? `its origin is ${action.origin}, not ${action.module.repoUrl}` : "it has no origin remote";
-  const message = action.reason === "not a git repository" ? `${dir2} is not a git repository` : action.origin ? `${dir2} holds another repository (its origin is ${action.origin}, not ${action.module.repoUrl})` : `${dir2} has no origin remote`;
-  return {
-    slug: action.module.slug,
-    status: "conflict",
-    reason: action.reason,
-    error: { code: "QORE_WORKSPACE_CONFLICT", message, hint: `Move ${dir2} aside (${what}), then run \`qore sync\`.` }
-  };
+  const { message, hint } = conflictText(deps2.cwd, action);
+  return { slug: action.module.slug, status: "conflict", reason: action.reason, error: { code: "QORE_WORKSPACE_CONFLICT", message, hint } };
 }
 async function applyActions(deps2, o) {
   const cache = new ResolutionCache(join4(deps2.config.dir, "cache"), deps2.now);
@@ -1221,8 +1287,8 @@ async function readAt(dir2) {
 async function readWorkspace(dir2) {
   return readAt(dir2);
 }
-async function findWorkspace(start, home) {
-  let dir2 = resolve(start);
+async function findWorkspace(start2, home) {
+  let dir2 = resolve(start2);
   const stop = resolve(home);
   for (; ; ) {
     const ws = await readAt(dir2);
@@ -1382,8 +1448,34 @@ async function resolveApp(deps2, io2, session, appArg, tenantFlag) {
     return resolveAppRef(deps2, session, appArg, slug);
   }
 }
+async function pickApp(deps2, io2, session, tenantFlag) {
+  if (!io2.interactive) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", "An app is required", {
+      hint: "Pass an app slug: `qore clone <app>`. Interactively, omitting it opens a picker."
+    });
+  }
+  let tenant, me;
+  try {
+    ({ tenant, me } = await resolveTenant(deps2, session, tenantFlag, "the app you want to clone"));
+  } catch (e) {
+    if (!(e instanceof QoreError) || e.code !== "QORE_CONTEXT_REQUIRED" && e.code !== "QORE_TENANT_ACCESS_LOST" || !e.candidates?.length) throw e;
+    const slug = await io2.select("Select a tenant", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.slug })));
+    ({ tenant, me } = await resolveTenant(deps2, session, slug, "the app you want to clone"));
+  }
+  const apps = me.tenants.find((t) => t.id === tenant.id)?.apps ?? [];
+  if (apps.length === 0) {
+    throw new QoreError("QORE_CONTEXT_REQUIRED", `No apps in ${tenant.slug} to clone`, {
+      hint: "Run `qore whoami` to see what you have access to."
+    });
+  }
+  const app = await io2.search("Select an app", (term) => {
+    const q = term.toLowerCase();
+    return apps.filter((a) => !q || a.slug.toLowerCase().includes(q) || a.name.toLowerCase().includes(q)).map((a) => ({ name: `${a.name} (${a.slug})`, value: a.slug }));
+  });
+  return { tenant: tenant.slug, app };
+}
 function registerClone(program, ctx) {
-  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("<app>", "app slug or id").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
+  program.command("clone").description("Clone an app's modules into a new workspace directory").argument("[app]", "app slug or id (omit to pick one interactively)").argument("[dir]", "target directory (default: the app's slug)").option("--tenant <slug>", "tenant the app slug belongs to, when it is not your active one").addOption(new Option("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (appArg, dirArg, flags) => {
     const { deps: deps2, io: io2 } = ctx;
     const g = ctx.opts();
     const cfg = await deps2.config.read();
@@ -1391,7 +1483,9 @@ function registerClone(program, ctx) {
     const onRequest = g.verbose ? (l) => io2.err(l) : void 0;
     const session = await openSession(deps2, portal, "clone", onRequest);
     await ensureCapability(deps2, portal.apiOrigin, "app.modules");
-    const ref = await resolveApp(deps2, io2, session, appArg, flags.tenant);
+    const picked = appArg === void 0 ? await pickApp(deps2, io2, session, flags.tenant) : void 0;
+    const appSlug = picked?.app ?? appArg;
+    const ref = await resolveApp(deps2, io2, session, appSlug, picked?.tenant ?? flags.tenant);
     const app = await session.api.get(`/api/cli/v1/apps/${encodeURIComponent(ref.appId)}/modules`);
     if (dirArg === void 0 && !isSafeSlug(app.app.slug)) throw unsafeSlugError(app.app.slug);
     const dirLabel = dirArg ?? app.app.slug;
@@ -1401,7 +1495,7 @@ function registerClone(program, ctx) {
       const ws = await readWorkspace(root);
       if (!ws || ws.appId !== app.app.id || ws.portal !== portal.apiOrigin) {
         throw new QoreError("QORE_WORKSPACE_CONFLICT", `${root} exists and is not the workspace of ${app.app.slug}`, {
-          hint: `Pick another directory: qore clone ${appArg} <dir>.`
+          hint: `Pick another directory: qore clone ${appSlug} <dir>.`
         });
       }
     }
@@ -1438,11 +1532,53 @@ function registerClone(program, ctx) {
   });
 }
 
+// src/core/telemetry/consent.ts
+var ON = /* @__PURE__ */ new Set(["1", "true", "on", "yes"]);
+var DO_NOT_TRACK_EXEMPT = /* @__PURE__ */ new Set(["0", "false"]);
+var norm = (v) => (v ?? "").trim().toLowerCase();
+function resolveConsent(env, cfg) {
+  const dnt = norm(env.DO_NOT_TRACK);
+  if (dnt !== "" && !DO_NOT_TRACK_EXEMPT.has(dnt)) return { enabled: false, source: "DO_NOT_TRACK" };
+  const q = norm(env.QORE_TELEMETRY);
+  if (q !== "") return { enabled: ON.has(q), source: "QORE_TELEMETRY" };
+  if (typeof cfg.telemetry?.enabled === "boolean") return { enabled: cfg.telemetry.enabled, source: "config" };
+  return { enabled: true, source: "default" };
+}
+function needsNotice(cfg, consent) {
+  return consent.enabled && consent.source === "default" && !cfg.telemetry?.noticeShownAt;
+}
+function describeConsent(consent, built) {
+  const state = `crash reports ${consent.enabled ? "on" : "off"} (${consent.source})`;
+  return consent.enabled && !built ? `${state} \xB7 this build has no DSN, nothing is sent` : state;
+}
+
+// src/cli/commands/config.ts
+function registerConfig(program, ctx) {
+  const config = program.command("config").description("Change qore's own settings");
+  config.command("telemetry").description("Show or set crash reporting").argument("[state]", "on or off").action(async (state) => {
+    const { deps: deps2, io: io2 } = ctx;
+    if (state !== void 0 && state !== "on" && state !== "off") {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Unknown telemetry state: ${state}`, { hint: "Use: qore config telemetry on|off" });
+    }
+    if (state) await deps2.config.update((c) => {
+      c.telemetry = { ...c.telemetry, enabled: state === "on" };
+    });
+    const consent = resolveConsent(deps2.env, await deps2.config.read());
+    const built = deps2.sentryDsn !== "";
+    if (ctx.opts().json) {
+      renderJson(io2, { telemetry: { ...consent, built } });
+      return;
+    }
+    io2.out(describeConsent(consent, built));
+    if (state && consent.source !== "config") io2.err(`${consent.source} in your environment overrides this setting.`);
+  });
+}
+
 // src/cli/commands/dev.ts
 import { randomBytes as randomBytes5 } from "crypto";
 import { realpath as realpath5 } from "fs/promises";
 import { constants as constants3 } from "os";
-import { relative as relative6 } from "path";
+import { dirname as dirname6, join as join18, relative as relative6 } from "path";
 import { StringDecoder } from "string_decoder";
 
 // src/core/context/repoConfig.ts
@@ -1515,8 +1651,8 @@ async function readRepoConfig(root) {
 // src/core/context/repoRoot.ts
 import { stat } from "fs/promises";
 import { dirname as dirname2, join as join8, resolve as resolve3 } from "path";
-async function findRepoRoot(start) {
-  let dir2 = resolve3(start);
+async function findRepoRoot(start2) {
+  let dir2 = resolve3(start2);
   for (; ; ) {
     try {
       await stat(join8(dir2, ".git"));
@@ -1801,7 +1937,7 @@ async function resolveModuleContext(deps2, o) {
   });
 }
 var appCandidates = (apps) => apps.map((a) => ({ kind: "app", id: a.id, slug: a.slug, name: a.name }));
-function pickApp(mc, app) {
+function pickApp2(mc, app) {
   const apps = mc.module.apps;
   if (app) {
     const found = apps.find((a) => a.id === app || a.slug === app);
@@ -1821,14 +1957,14 @@ function pickApp(mc, app) {
 
 // src/core/diagnostics/node.ts
 var KEEP_LINES = 50;
-function earlyExitHint(tail, o) {
-  const text = tail.join("\n");
-  const missing = text.match(/Cannot find (?:module|package) '([^']+)'/);
+function exitHint(tail, h) {
+  const text2 = tail.join("\n");
+  const missing = text2.match(/Cannot find (?:module|package) '([^']+)'/);
   if (missing) {
-    return { reason: "missing-module", hint: `A dependency is missing (${missing[1]}). Run \`${o.installCommand}\`, then qore dev again.` };
+    return { reason: "missing-module", hint: `A dependency is missing (${missing[1]}). Run \`${h.installCommand}\`, then qore dev again.` };
   }
-  if (/ZodError:/.test(text)) {
-    const keys = [...text.matchAll(/"path":\s*\[\s*"([^"]+)"/g)].map((m) => m[1]);
+  if (/ZodError:/.test(text2)) {
+    const keys = [...text2.matchAll(/"path":\s*\[\s*"([^"]+)"/g)].map((m) => m[1]);
     if (keys.length > 0) {
       return {
         reason: "invalid-env",
@@ -1837,7 +1973,7 @@ function earlyExitHint(tail, o) {
       };
     }
   }
-  const addrInUse = text.match(/listen EADDRINUSE: address already in use (?:\S*:)?(\d+)/);
+  const addrInUse = text2.match(/listen EADDRINUSE: address already in use (?:\S*:)?(\d+)/);
   if (addrInUse) {
     const port = Number(addrInUse[1]);
     return {
@@ -1846,7 +1982,45 @@ function earlyExitHint(tail, o) {
       hint: `Port ${port} was taken while the server started. Run qore dev again; if it repeats, lsof -iTCP:${port} -sTCP:LISTEN names the holder.`
     };
   }
-  if (/ENOSPC: System limit for number of file watchers reached/.test(text)) {
+  if (/ECONNREFUSED/.test(text2)) {
+    const m = text2.match(/ECONNREFUSED\s+\S*:(\d+)/) ?? text2.match(/code: 'ECONNREFUSED'[^}]*?port: (\d+)/);
+    if (!m) return { reason: "conn-refused", hint: "A connection was refused (ECONNREFUSED) \u2014 a service this module calls is not running." };
+    const port = Number(m[1]);
+    const role = h.ports.get(port);
+    if (role?.kind === "database") {
+      const up = h.runCommand("db:up");
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `The database on :${port} is not accepting connections (ECONNREFUSED). ` + (up ? `Fix: ${up}  (docker compose ps shows its state)` : "docker compose ps shows its state.")
+      };
+    }
+    if (role?.kind === "provider") {
+      return {
+        reason: "conn-refused",
+        port,
+        hint: `${role.key} points at :${port}, where nothing listens (ECONNREFUSED). Start that module \u2014 qore dev in the workspace root starts providers first.`
+      };
+    }
+    return { reason: "conn-refused", port, hint: `Nothing listens on :${port} (ECONNREFUSED) \u2014 a service this module calls is not running.` };
+  }
+  const auth = text2.match(/password authentication failed for user "([^"]+)"/);
+  if (auth) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-auth",
+      hint: `The local database was created with other credentials than the portal now provides (user ${auth[1]}).` + (reset ? ` Fix: ${reset} \u2014 this wipes local data.` : "")
+    };
+  }
+  const relation = text2.match(/relation "([^"]+)" does not exist/);
+  if (relation) {
+    const reset = h.runCommand("db:reset");
+    return {
+      reason: "db-schema",
+      hint: `The database schema is behind the code (relation ${relation[1]} does not exist). Migrations run when the app starts; if they failed above, that error is the cause.` + (reset ? ` To start clean: ${reset} (wipes local data).` : "")
+    };
+  }
+  if (/ENOSPC: System limit for number of file watchers reached/.test(text2)) {
     return {
       reason: "watcher-limit",
       hint: "Linux ran out of file watchers. Raise the limit: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p"
@@ -1862,9 +2036,11 @@ import { dirname as dirname5, join as join12 } from "path";
 async function fetchLocalEnv(deps2, mc, app) {
   await ensureCapability(deps2, mc.portal.apiOrigin, "module.local-env");
   try {
-    return await mc.session.api.get(
+    const local = await mc.session.api.get(
       `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`
     );
+    deps2.registerSecrets(Object.values(local.env));
+    return local;
   } catch (e) {
     if (!(e instanceof QoreError) || e.code !== "QORE_ACCESS_DENIED") throw e;
     if (e.serverCode === "app.access.denied") {
@@ -1947,12 +2123,12 @@ function renderEnv(original, merged) {
   for (const [key, value] of merged) {
     if (!seen.has(key)) appended.push(`${key}=${value}`);
   }
-  let text = out.join("\n");
+  let text2 = out.join("\n");
   if (appended.length) {
-    if (text.length && !text.endsWith("\n")) text += "\n";
-    text += appended.join("\n") + "\n";
+    if (text2.length && !text2.endsWith("\n")) text2 += "\n";
+    text2 += appended.join("\n") + "\n";
   }
-  return text;
+  return text2;
 }
 
 // src/core/env/pull.ts
@@ -2034,12 +2210,12 @@ async function readOrNull(p) {
     throw e;
   }
 }
-async function writeSecurely(target, text) {
+async function writeSecurely(target, text2) {
   const base = basename2(target);
   const tmpName = base.endsWith(".local") ? `${base.slice(0, -".local".length)}.qore-${randomBytes3(6).toString("hex")}.local` : `${base}.qore-${randomBytes3(6).toString("hex")}.tmp`;
   const tmp = join10(dirname4(target), tmpName);
   try {
-    await writeFile3(tmp, text, { mode: 384, flag: "wx" });
+    await writeFile3(tmp, text2, { mode: 384, flag: "wx" });
     await chmod2(tmp, 384);
     await rename3(tmp, target);
   } finally {
@@ -2124,16 +2300,117 @@ async function devEnv(deps2, o) {
       cause = e;
     }
   }
-  const text = await readOrNull(target);
-  if (text === null || !await isTrusted(deps2, o.root, o.moduleId)) {
+  const text2 = await readOrNull(target);
+  if (text2 === null || !await isTrusted(deps2, o.root, o.moduleId)) {
     throw cause ?? new QoreError("QORE_API_UNREACHABLE", "The portal is unreachable", {
       hint: "The portal is unreachable and there is no env file to start from yet."
     });
   }
-  const env = Object.fromEntries(parseEnv(text));
+  const env = Object.fromEntries(parseEnv(text2));
   return { env, offline: true, envFile: target, port: envPort(env, "PORT"), dbPort: envPort(env, "DB_PORT"), created: false, kept: [] };
 }
 
+// src/core/workspace/access.ts
+function devTeamsOf(am, m) {
+  const own = m.devTeamIds?.length ? am.devTeams.filter((t) => m.devTeamIds.includes(t.id)) : [];
+  return own.length ? own : am.devTeams;
+}
+function askMaintainer(am, m) {
+  const teams = devTeamsOf(am, m);
+  const names = teams.map((t) => t.name);
+  const maintainers = [...new Set(teams.flatMap((t) => t.maintainers))];
+  const who = names.length ? names.join(", ") : "the app's dev team";
+  return { teams: names, maintainers, text: `ask a maintainer of ${who}${maintainers.length ? ` (${maintainers.join(", ")})` : ""}` };
+}
+function notClonedReason(m, am) {
+  if (am && !m.githubLinked) return `GitHub account not linked (${am.accountUrl})`;
+  if (am && m.repoAccess === "none") {
+    const names = devTeamsOf(am, m).map((t) => t.name);
+    return names.length ? `no repository access (dev team ${names.join(", ")})` : "no repository access (ask your tenant owner)";
+  }
+  return "run qore sync";
+}
+
+// src/core/dev/findings.ts
+var plural = (n, one, many) => n === 1 ? one : many;
+function modulesMissing(o) {
+  const actionFor = new Map(o.actions.map((a) => [a.module.slug, a]));
+  const findings = [];
+  const fixable = [];
+  const blocked = [];
+  const reasons = {};
+  const own = (m, reason, rest) => {
+    reasons[m.slug] = reason;
+    return { code: "dev.modules-missing", severity: "warn", module: m.slug, modules: [m.slug], message: `${m.slug} is not cloned \u2014 ${reason}`, ...rest };
+  };
+  for (const m of o.missing) {
+    const a = actionFor.get(m.slug);
+    if (a && a.kind !== "clone") {
+      if (a.kind === "conflict") {
+        const c = conflictText(o.cwd, a);
+        blocked.push(own(m, c.message, { action: { command: c.hint } }));
+      } else if (a.kind === "unsupported") {
+        blocked.push(own(m, "its repository URL is not supported", { action: { command: unsupportedRepoUrlError(m.slug, "").hint } }));
+      } else {
+        blocked.push(own(m, a.reason ?? "no repository yet", { why: "It will not run in this session." }));
+      }
+    } else if (o.am !== null && (!m.githubLinked || m.repoAccess === "none")) {
+      const am = o.am;
+      blocked.push(own(m, notClonedReason(m, am), { action: { command: !m.githubLinked ? `Link your GitHub account: ${am.accountUrl}` : askMaintainer(am, m).text } }));
+    } else fixable.push(m);
+  }
+  if (fixable.length > 0) {
+    const slugs = fixable.map((m) => m.slug);
+    const deps2 = slugs.flatMap((s) => (o.consumers[s] ?? []).map((c) => `${c} depends on ${s}`));
+    findings.push({
+      code: "dev.modules-missing",
+      severity: "warn",
+      message: `${fixable.length} ${plural(fixable.length, "module of this app is", "modules of this app are")} not cloned: ${slugs.join(", ")}`,
+      why: deps2.length > 0 ? `${deps2.join("; ")}.` : `${plural(fixable.length, "It", "They")} will not run in this session.`,
+      modules: slugs,
+      action: o.am ? { command: "qore sync", fix: "sync" } : { command: "qore sync" }
+    });
+  }
+  return { findings: [...findings, ...blocked], fixable, reasons };
+}
+function strayClone(name, appName) {
+  return { code: "dev.stray-clone", severity: "info", module: name, message: `${name} is no longer part of ${appName} \u2014 you can remove the directory.` };
+}
+function repoBehind(slug, s, o) {
+  if (!s.ok || !s.upstream || !s.behind) return null;
+  return {
+    code: "dev.repo-behind",
+    severity: "warn",
+    module: slug,
+    message: `${slug} is ${s.behind} ${plural(s.behind, "commit", "commits")} behind ${s.upstreamRef ?? "its upstream"} (as of your last fetch).`,
+    action: { command: o.workspace ? "qore sync --pull" : "git pull" }
+  };
+}
+function servicesMissing(slug, env, recipe, o) {
+  const db = envPort(env, "DB_PORT");
+  if (db === null || recipe.services.length > 0 || !o.servicesFlag || o.configured) return null;
+  return {
+    code: "dev.services-missing",
+    severity: "warn",
+    module: slug,
+    message: `The portal gives ${slug} a database (DB_PORT=${db}), but ${slug} has no db:up script \u2014 no database will be started.`,
+    why: "This repository is probably older than its template.",
+    action: { command: 'add a "db:up" script (see the current app template), or set dev.services in .qore.json' }
+  };
+}
+function providerDown(o) {
+  const single = o.providers.length === 1 && o.keys.length === 1;
+  return {
+    code: "dev.provider-down",
+    severity: "warn",
+    module: o.slug,
+    modules: o.providers,
+    message: single ? `${o.providers[0]} is not running \u2014 ${o.keys[0]} points at :${o.ports.get(o.keys[0])}, where nothing listens.` : `${o.keys.join(", ")} ${plural(o.keys.length, "points", "point")} at ports nothing listens on (depends on: ${o.providers.join(", ")}).`,
+    why: single ? `${o.slug} will start, but calls to ${o.providers[0]} will fail. Qore does not fall back to staging.` : `${o.slug} will start, but calls through ${o.keys.join(", ")} will fail. Qore does not fall back to staging.`,
+    action: { command: o.fix }
+  };
+}
+
 // src/core/dev/project.ts
 import { access, readFile as readFile5 } from "fs/promises";
 import { join as join13 } from "path";
@@ -2252,10 +2529,10 @@ function classifyComposeVersion(r) {
 // src/core/diagnostics/postgres.ts
 var INCOMPATIBLE = /database files are incompatible with server|Counter to that, there appears to be PostgreSQL data in|in 18\+, these Docker images are configured to store database data/;
 function classifyComposeLogs(logs, o) {
-  const text = logs.join("\n");
-  if (!INCOMPATIBLE.test(text)) return null;
+  const text2 = logs.join("\n");
+  if (!INCOMPATIBLE.test(text2)) return null;
   const details = { reason: "pg-data-version" };
-  const m = text.match(/initialized by PostgreSQL version (\d+).*this version (\d+)/);
+  const m = text2.match(/initialized by PostgreSQL version (\d+).*this version (\d+)/);
   if (m) {
     details.found = m[1];
     details.expected = m[2];
@@ -2345,6 +2622,7 @@ function nodeVersionError(found, range, slug) {
 // src/core/dev/preflight.ts
 var pmMajor = (v) => v ? v.split(".")[0] : "latest";
 var GRACE_MS = 1e4;
+var secs = (ms) => `${Math.round(ms / 1e3)} s`;
 async function runTool(deps2, cmd, args, o) {
   if (o.signal.aborted) throw new CancelledError();
   const tail = [];
@@ -2401,11 +2679,16 @@ async function checkNode(deps2, r, pkg, slug, signal) {
   return found;
 }
 async function installIfNeeded(deps2, r, slug, onLine, report, signal) {
-  report({ module: slug, step: "install", status: "start" });
-  if (!r.install || !await needsInstall(r.root, r.pm)) {
-    report({ module: slug, step: "install", status: "skip" });
+  if (!r.install) {
+    report({ module: slug, step: "install", status: "skip", detail: "disabled" });
+    return;
+  }
+  if (!await needsInstall(r.root, r.pm)) {
+    report({ module: slug, step: "install", status: "skip", detail: "up to date" });
     return;
   }
+  report({ module: slug, step: "install", status: "start" });
+  const began = deps2.now().getTime();
   const { cmd, args } = installArgs(r.pm);
   const res = await runTool(deps2, cmd, args, { cwd: r.root, env: deps2.env, onLine, signal });
   if (res.code !== 0) {
@@ -2414,7 +2697,7 @@ async function installIfNeeded(deps2, r, slug, onLine, report, signal) {
     if (err.details?.reason === "outdated-lockfile") throw err;
     throw new QoreError("QORE_INSTALL_FAILED", `${command} failed in ${slug}`, { hint: err.hint, details: err.details });
   }
-  report({ module: slug, step: "install", status: "done" });
+  report({ module: slug, step: "install", status: "done", detail: secs(deps2.now().getTime() - began) });
 }
 async function portInUseError(deps2, o) {
   const owner = await deps2.ports.owner(o.port);
@@ -2477,7 +2760,12 @@ async function composeFailure(deps2, r, slug, env, signal, message, command, std
   });
 }
 async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine, report) {
-  report({ module: slug, step: "services", status: "start" });
+  if (r.services.length === 0) {
+    report({ module: slug, step: "services", status: "skip" });
+    return;
+  }
+  report({ module: slug, step: "services", status: "start", ...dbPort !== null ? { detail: `:${dbPort}` } : {} });
+  const began = deps2.now().getTime();
   if (r.dockerServices) {
     const res = await runTool(deps2, "docker", ["info", "--format", "{{.ServerVersion}}"], { cwd: r.root, env, onLine, signal });
     const dockerErr = classifyDockerInfo(res, deps2.platform);
@@ -2497,7 +2785,7 @@ async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine
       throw await composeFailure(deps2, r, slug, env, signal, `${script} failed in ${slug}`, `${cmd} ${args.join(" ")}`, res.tail);
     }
   }
-  if (dbPort !== null && r.services.length > 0) {
+  if (dbPort !== null) {
     const ok2 = await deps2.ports.waitFor(dbPort, waitMs, signal);
     if (signal.aborted) throw new CancelledError();
     if (!ok2) {
@@ -2513,7 +2801,8 @@ async function startServices(deps2, r, slug, env, dbPort, waitMs, signal, onLine
       );
     }
   }
-  report({ module: slug, step: "services", status: "done" });
+  const took = secs(deps2.now().getTime() - began);
+  report({ module: slug, step: "services", status: "done", detail: dbPort !== null ? `:${dbPort} (${took})` : `(${took})` });
 }
 async function checkPort(deps2, o) {
   if (o.port === null) return;
@@ -2568,6 +2857,44 @@ async function leftoverOwnsPort(deps2, run4, port) {
   return false;
 }
 
+// src/core/dev/providers.ts
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function connPorts(env) {
+  const out = [];
+  for (const key of Object.keys(env).sort()) {
+    const m = /^CONN_(.+)_URL$/.exec(key);
+    if (!m) continue;
+    let url;
+    try {
+      url = new URL(env[key].trim().replace(/^["']|["']$/g, ""));
+    } catch {
+      continue;
+    }
+    const port = Number(url.port);
+    if (port > 0 && LOCAL_HOSTS.has(url.hostname)) out.push({ key, alias: m[1], port });
+  }
+  return out;
+}
+function deadAliases(env, listening) {
+  return connPorts(env).filter((c) => !listening.has(c.port)).map((c) => c.key);
+}
+function hintContext(recipe, pkg, env) {
+  const { cmd, args } = installArgs(recipe.pm);
+  const ports = /* @__PURE__ */ new Map();
+  for (const c of connPorts(env)) ports.set(c.port, { kind: "provider", key: c.key });
+  const db = envPort(env, "DB_PORT");
+  if (db !== null) ports.set(db, { kind: "database" });
+  return {
+    installCommand: [cmd, ...args].join(" "),
+    runCommand: (script) => {
+      if (pkg.scripts?.[script] === void 0) return null;
+      const r = runArgs(recipe.pm, script);
+      return [r.cmd, ...r.args].join(" ");
+    },
+    ports
+  };
+}
+
 // src/core/dev/runFile.ts
 import { unlink as unlink2 } from "fs/promises";
 import { join as join15 } from "path";
@@ -2621,11 +2948,11 @@ async function moduleContextFor(ctx, flags, command) {
 }
 async function appFor(ctx, mc, app) {
   try {
-    return pickApp(mc, app);
+    return pickApp2(mc, app);
   } catch (e) {
     if (!(e instanceof QoreError) || e.code !== "QORE_APP_AMBIGUOUS" || !ctx.io.interactive) throw e;
     const id = await ctx.io.select("Select an app", mc.module.apps.map((a) => ({ name: a.name, value: a.id })));
-    return pickApp(mc, id);
+    return pickApp2(mc, id);
   }
 }
 function sourceText(mc) {
@@ -2649,13 +2976,32 @@ function contextJson(mc, app) {
   };
 }
 
-// src/cli/devRecover.ts
-var DOCKER_WAIT = { timeoutMs: 12e4, pollMs: 2e3 };
-var STOP_WAIT_MS = 1e4;
-function canRecover(ctx) {
+// src/cli/findings.ts
+function canOffer(ctx) {
   const g = ctx.opts();
   return ctx.io.interactive && !g.json && g.input !== false;
 }
+function findingEvent(f) {
+  const { severity, ...rest } = f;
+  return { type: severity === "info" ? "info" : "warning", ...rest };
+}
+function renderFinding(ctx, f) {
+  if (ctx.opts().json) {
+    ctx.io.out(JSON.stringify(findingEvent(f)));
+    return;
+  }
+  ctx.io.err(`${f.severity === "info" ? "\u2192" : "!"} ${f.message}`);
+  if (f.why) ctx.io.err(`  ${f.why}`);
+  if (f.action) ctx.io.err(`  Fix: ${f.action.command}`);
+}
+async function offerFix(ctx, question, o) {
+  if (!canOffer(ctx)) return false;
+  return ctx.io.confirm(question, o.signal, { default: o.default });
+}
+
+// src/cli/devRecover.ts
+var DOCKER_WAIT = { timeoutMs: 12e4, pollMs: 2e3 };
+var STOP_WAIT_MS = 1e4;
 var daemonDown = (e) => e instanceof QoreError && e.code === "QORE_DOCKER_NOT_RUNNING" && e.details?.reason === "daemon";
 function dockerRecovery(ctx, signal) {
   let answer;
@@ -2663,8 +3009,9 @@ function dockerRecovery(ctx, signal) {
     try {
       await fn();
     } catch (e) {
-      if (!daemonDown(e) || !canRecover(ctx)) throw e;
+      if (!daemonDown(e) || !canOffer(ctx)) throw e;
       answer ??= (async () => {
+        if (!await offerFix(ctx, "Docker is not running. Wait for it to start?", { default: true, signal })) return false;
         ctx.io.err("Waiting for Docker\u2026 (Ctrl+C to stop)");
         const ok2 = await waitForDocker(ctx.deps, { ...at, signal, ...DOCKER_WAIT });
         if (ok2) ctx.io.err("\u2713 Docker is running");
@@ -2680,7 +3027,7 @@ async function stopLeftover(ctx, e, runs, signal) {
   const port = e.details?.port;
   const run4 = runs.find((r) => r.qorePid === e.details?.pid);
   if (!run4 || typeof port !== "number" || !await leftoverOwnsPort(deps2, run4, port)) return false;
-  if (!await io2.confirm(`Stop the previous qore dev (pid ${run4.qorePid})?`, signal)) return false;
+  if (!await offerFix(ctx, `Stop the previous qore dev (pid ${run4.qorePid})?`, { default: false, signal })) return false;
   if (!deps2.launch.signal(run4.qorePid, "SIGTERM")) {
     io2.err(`! pid ${run4.qorePid} could not be signalled`);
     return false;
@@ -2693,7 +3040,7 @@ async function checkPortOrStopLeftover(ctx, o, signal) {
   try {
     await checkPort(ctx.deps, o);
   } catch (e) {
-    if (!(e instanceof QoreError) || e.code !== "QORE_PORT_IN_USE" || e.details?.owner !== "qore" || !canRecover(ctx)) throw e;
+    if (!(e instanceof QoreError) || e.code !== "QORE_PORT_IN_USE" || e.details?.owner !== "qore" || !canOffer(ctx)) throw e;
     const freed = await stopLeftover(ctx, e, o.runs, signal);
     if (signal.aborted) throw new CancelledError();
     if (!freed) throw e;
@@ -2701,6 +3048,42 @@ async function checkPortOrStopLeftover(ctx, o, signal) {
   }
 }
 
+// src/cli/progress.ts
+function text(e, o) {
+  switch (`${e.step}:${e.status}`) {
+    case "pm:done":
+      return `\u2713 ${e.detail}`;
+    case "install:skip":
+      return e.detail === "up to date" ? "\u2713 dependencies up to date" : `- install skipped (${o.installFlag ? "dev.install is false in .qore.json" : "--no-install"})`;
+    case "install:start":
+      return "\u22EF installing dependencies\u2026";
+    case "install:done":
+      return `\u2713 dependencies installed (${e.detail})`;
+    case "env:done":
+      return `\u2713 env  ${e.detail}`;
+    case "services:skip":
+      return o.servicesFlag ? null : "- services skipped (--no-services)";
+    case "services:start":
+      return e.detail ? `\u22EF database  waiting for ${e.detail}\u2026` : "\u22EF starting services\u2026";
+    case "services:done":
+      return e.detail?.startsWith(":") ? `\u2713 database ready on ${e.detail}` : `\u2713 services up ${e.detail}`;
+    case "ports:done":
+      return `\u2713 port ${e.detail} free`;
+    default:
+      return null;
+  }
+}
+function progressReporter(ctx, o) {
+  return (e) => {
+    if (ctx.opts().json) {
+      ctx.io.out(JSON.stringify({ type: "step", ...e }));
+      return;
+    }
+    const line2 = text(e, o);
+    if (line2 !== null) ctx.io.err(o.prefix ? o.prefix(e.module, line2) : line2);
+  };
+}
+
 // src/cli/termination.ts
 var preflightHook = {};
 function preflightTermination(abort, raise) {
@@ -2764,7 +3147,7 @@ async function ensureTrusted(ctx, mc, app, o) {
 // src/cli/commands/devWorkspace.ts
 import { randomBytes as randomBytes4 } from "crypto";
 import { realpath as realpath4 } from "fs/promises";
-import { join as join16, relative as relative5 } from "path";
+import { join as join17, relative as relative5 } from "path";
 
 // src/core/dev/order.ts
 function selectSkips(modules, sel) {
@@ -2869,8 +3252,8 @@ function planDev(modules, sel) {
   }
   const order = sccs.map((_, i) => i).sort((a, b) => minSlug[a].localeCompare(minSlug[b]));
   for (const i of order) visit(i);
-  const start = [];
-  for (const i of orderedSccIndices) start.push(...sccSlugs[i]);
+  const start2 = [];
+  for (const i of orderedSccIndices) start2.push(...sccSlugs[i]);
   const waitFor = {};
   for (const m of starting) {
     const mySccId = sccOf.get(m.id);
@@ -2885,7 +3268,7 @@ function planDev(modules, sel) {
       missingProviders[m.slug] = [...new Set(missing)].sort();
     }
   }
-  return { start, waitFor, cycles, skipped, missingProviders };
+  return { start: start2, waitFor, cycles, skipped, missingProviders };
 }
 
 // src/core/dev/supervisor.ts
@@ -2986,14 +3369,14 @@ function supervise(o) {
       const early = !!e.spawnError || now() - startedAt < EARLY_MS;
       const rawCode = e.spawnError ? null : e.code;
       const rawSignal = e.spawnError ? null : e.signal;
-      const hint = early && rawSignal === null && rawCode !== null && rawCode !== 0 ? earlyExitHint(tails.get(m.slug) ?? [], { installCommand: m.installCmd }) ?? void 0 : void 0;
+      const hint = stopCode === null && rawSignal === null && rawCode !== null && rawCode !== 0 ? exitHint(tails.get(m.slug) ?? [], m.hint) ?? void 0 : void 0;
       emit({ type: "exit", module: m.slug, code: rawCode, signal: rawSignal, early, hint });
       if (code !== 0 && firstFailure === null) firstFailure = code;
       if (o.killOthers) beginStop("kill-others", code);
       checkDone();
     });
   };
-  const start = async (m) => {
+  const start2 = async (m) => {
     const providers = m.waitFor.filter((p) => readiness.has(p));
     const results = await Promise.all(providers.map((p) => readiness.get(p).promise));
     if (stopCode !== null) return;
@@ -3003,7 +3386,7 @@ function supervise(o) {
     });
     launch(m);
   };
-  for (const m of o.modules) void start(m);
+  for (const m of o.modules) void start2(m);
   checkDone();
   return {
     done,
@@ -3019,25 +3402,26 @@ function supervise(o) {
   };
 }
 
-// src/core/workspace/access.ts
-function devTeamsOf(am, m) {
-  const own = m.devTeamIds?.length ? am.devTeams.filter((t) => m.devTeamIds.includes(t.id)) : [];
-  return own.length ? own : am.devTeams;
-}
-function askMaintainer(am, m) {
-  const teams = devTeamsOf(am, m);
-  const names = teams.map((t) => t.name);
-  const maintainers = [...new Set(teams.flatMap((t) => t.maintainers))];
-  const who = names.length ? names.join(", ") : "the app's dev team";
-  return { teams: names, maintainers, text: `ask a maintainer of ${who}${maintainers.length ? ` (${maintainers.join(", ")})` : ""}` };
-}
-function notClonedReason(m, am) {
-  if (am && !m.githubLinked) return `GitHub account not linked (${am.accountUrl})`;
-  if (am && m.repoAccess === "none") {
-    const names = devTeamsOf(am, m).map((t) => t.name);
-    return names.length ? `no repository access (dev team ${names.join(", ")})` : "no repository access (ask your tenant owner)";
+// src/core/workspace/stray.ts
+import { lstat as lstat2, readdir } from "fs/promises";
+import { join as join16 } from "path";
+async function strayRepos(root, slugs) {
+  let entries;
+  try {
+    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
   }
-  return "run qore sync";
+  const names = [];
+  for (const name of entries) {
+    if (slugs.has(name)) continue;
+    try {
+      await lstat2(join16(root, name, ".git"));
+      names.push(name);
+    } catch {
+    }
+  }
+  return names.sort();
 }
 
 // src/cli/devOutput.ts
@@ -3135,18 +3519,6 @@ async function workspaceContext(ctx, ws) {
     return { am: { app: last.app, accountUrl: "", devTeams: [], modules }, online: null, offlineCause: e };
   }
 }
-function deadAliases(env, ports) {
-  return Object.keys(env).filter((k) => {
-    if (!/^CONN_(.+)_URL$/.test(k)) return false;
-    let port;
-    try {
-      port = Number(new URL(env[k].trim().replace(/^["']|["']$/g, "")).port);
-    } catch {
-      return false;
-    }
-    return port > 0 && !ports.has(port);
-  }).sort();
-}
 async function pool(items, n, fn) {
   let next = 0;
   const results = await Promise.allSettled(Array.from({ length: Math.min(n, items.length) }, async () => {
@@ -3157,7 +3529,7 @@ async function pool(items, n, fn) {
 }
 async function workspaceDev(ctx, ws, f, waitTimeout) {
   const ready = await inPreflight(ctx.deps.signals, ctx.signal, (p) => prepareWorkspace(ctx, ws, f, waitTimeout, p));
-  await superviseAll(ctx, ws, ready.units, ready.waitFor, ready.o);
+  await superviseAll(ctx, ws, ready.units, ready.waitFor, ready.o, ready.notRunning);
 }
 async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
   const { deps: deps2, io: io2 } = ctx;
@@ -3202,22 +3574,48 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
       continue;
     }
     try {
-      dirs[m.slug] = await deps2.git.inspect(join16(ws.root, m.slug));
+      dirs[m.slug] = await deps2.git.inspect(join17(ws.root, m.slug));
       safe.push(m);
     } catch (e) {
       if (!(e instanceof QoreError) || e.code === "QORE_GIT_UNAVAILABLE") throw e;
       problems.push(withDetails(e, { module: m.slug }));
     }
   }
-  const present = new Map(planWorkspace(ws.root, safe, dirs, []).actions.filter((a) => a.kind === "present").map((a) => [a.module.slug, a.dir]));
   const bySlug = new Map(safe.map((m) => [m.slug, m]));
-  const plan = planDev(safe.map((m) => ({
-    id: m.id,
-    slug: m.slug,
-    present: present.has(m.slug),
-    canWrite: m.access === "write" || m.access === "maintain",
-    dependsOn: m.dependsOn
-  })), { only: slugList(f.only), skip: slugList(f.skip) });
+  const computePlan = () => {
+    const present2 = new Map(planWorkspace(ws.root, safe, dirs, []).actions.filter((a) => a.kind === "present").map((a) => [a.module.slug, a.dir]));
+    const plan2 = planDev(safe.map((m) => ({
+      id: m.id,
+      slug: m.slug,
+      present: present2.has(m.slug),
+      canWrite: m.access === "write" || m.access === "maintain",
+      dependsOn: m.dependsOn
+    })), { only: slugList(f.only), skip: slugList(f.skip) });
+    return { present: present2, plan: plan2 };
+  };
+  let { present, plan } = computePlan();
+  const missingFindings = () => {
+    const missing2 = plan.skipped.filter((s) => s.reason === "not-cloned").map((s) => bySlug.get(s.slug));
+    const consumers = {};
+    for (const [consumer, providers] of Object.entries(plan.missingProviders)) {
+      for (const p2 of providers) (consumers[p2] ??= []).push(consumer);
+    }
+    const actions = planWorkspace(ws.root, missing2, dirs, []).actions;
+    return modulesMissing({ missing: missing2, actions, cwd: deps2.cwd, consumers, am: online ? am : null });
+  };
+  const missing = missingFindings();
+  for (const finding of missing.findings) renderFinding(ctx, finding);
+  const canSync = online !== null && missing.findings.some((x) => x.action?.fix === "sync");
+  if (canSync && await offerFix(ctx, `Clone ${missing.fixable.map((m) => m.slug).join(", ")} now with qore sync?`, { default: true, signal: ctx.signal })) {
+    const actions = planWorkspace(ws.root, missing.fixable, dirs, []).actions;
+    const results = await applyActions(deps2, { portal: online.portal, app: am, actions, protocol: cloneProtocol(dirs), onResult: () => {
+    } });
+    renderResults(io2, results, false);
+    for (const r of results) if (r.status === "cloned") dirs[r.slug] = await deps2.git.inspect(join17(ws.root, r.slug));
+    ({ present, plan } = computePlan());
+  }
+  for (const name of await strayRepos(ws.root, new Set(am.modules.map((m) => m.slug)))) renderFinding(ctx, strayClone(name, am.app.name));
+  if (ctx.signal.aborted) throw new CancelledError();
   for (const s of plan.skipped) {
     const m = bySlug.get(s.slug);
     if (s.reason === "no-write") {
@@ -3226,8 +3624,10 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
         `- ${s.slug}  no write access \u2014 local secrets need write; ${ask.text}`,
         { type: "skip", module: s.slug, reason: s.reason, devTeams: ask.teams, maintainers: ask.maintainers }
       );
+    } else if (s.reason === "not-cloned") {
+      if (json2) io2.out(JSON.stringify({ type: "skip", module: s.slug, reason: s.reason }));
     } else {
-      note(`- ${s.slug}  ${s.reason === "not-cloned" ? `not cloned \u2014 ${notClonedReason(m, online ? am : void 0)}` : "excluded"}`, { type: "skip", module: s.slug, reason: s.reason });
+      note(`- ${s.slug}  excluded`, { type: "skip", module: s.slug, reason: s.reason });
     }
   }
   for (const c of plan.cycles) warn(`${c.join(", ")} depend on each other \u2014 they start together, without waiting`, { modules: c });
@@ -3262,8 +3662,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
     else if (l.stream === "stdout") io2.out(prefix(slug, l.line));
     else io2.err(prefix(slug, l.line));
   };
-  const report = () => {
-  };
+  const report = progressReporter(ctx, { prefix: json2 ? void 0 : prefix, installFlag: f.install, servicesFlag: f.services });
   for (const u of units) {
     await attempt(u.m.slug, async () => {
       u.cfg = await readRepoConfig(u.dir);
@@ -3285,13 +3684,27 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
   const withRecipe = units.filter((u) => u.recipe && u.trusted);
   for (const name of [...new Set(withRecipe.map((u) => u.recipe.pm.name))]) {
     const users = withRecipe.filter((u) => u.recipe.pm.name === name);
-    const pmOk = await attempt(users[0].m.slug, () => checkPackageManager(deps2, users[0].recipe, () => {
-    }, p.signal));
-    for (const u of users) u.pmOk = pmOk;
+    let version = null;
+    const pmOk = await attempt(users[0].m.slug, async () => {
+      version = await checkPackageManager(deps2, users[0].recipe, () => {
+      }, p.signal);
+    });
+    for (const u of users) {
+      u.pmOk = pmOk;
+      u.pmVersion = version;
+    }
   }
   for (const u of withRecipe) {
-    const nodeOk = await attempt(u.m.slug, () => checkNode(deps2, u.recipe, u.pkg, u.m.slug, p.signal));
+    const nodeOk = await attempt(u.m.slug, async () => {
+      u.node = await checkNode(deps2, u.recipe, u.pkg, u.m.slug, p.signal);
+    });
     u.pmOk = u.pmOk && nodeOk;
+    if (u.pmOk) report({
+      module: u.m.slug,
+      step: "pm",
+      status: "done",
+      detail: `${u.recipe.pm.name}${u.pmVersion ? ` ${u.pmVersion}` : ""}${u.node ? ` \xB7 node ${u.node}` : ""}`
+    });
   }
   await pool(units.filter((u) => u.pmOk && u.trusted), INSTALL_PARALLELISM, async (u) => {
     u.installed = await attempt(u.m.slug, () => installIfNeeded(deps2, u.recipe, u.m.slug, onLine(u.m.slug), report, p.signal));
@@ -3337,11 +3750,21 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
         { module: slug, keys: dev.kept }
       );
     }
+    report({ module: slug, step: "env", status: "done", detail: relative5(rootReal, dev.envFile) });
+    const services = servicesMissing(slug, dev.env, u.recipe, { servicesFlag: f.services, configured: u.cfg.dev?.services !== void 0 });
+    if (services) renderFinding(ctx, services);
+    try {
+      const behind = repoBehind(slug, await deps2.git.status(u.dir), { workspace: true });
+      if (behind) renderFinding(ctx, behind);
+    } catch {
+    }
     if (u.installed) {
       const env = { ...deps2.env, ...dev.env };
       await attempt(slug, () => withDocker({ cwd: u.dir, env }, () => startServices(deps2, u.recipe, slug, env, dev.dbPort, waitTimeout * 1e3, p.signal, onLine(slug), report)));
     }
-    await attempt(slug, () => checkPortOrStopLeftover(ctx, { slug, port: dev.port, key: "PORT", runs }, p.signal));
+    if (await attempt(slug, () => checkPortOrStopLeftover(ctx, { slug, port: dev.port, key: "PORT", runs }, p.signal)) && dev.port !== null) {
+      report({ module: slug, step: "ports", status: "done", detail: String(dev.port) });
+    }
   }
   if (p.signal.aborted) throw new CancelledError();
   const byPort = /* @__PURE__ */ new Map();
@@ -3369,7 +3792,7 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
   if (online && units.every((u) => !u.dev.offline)) {
     const envFile = (m) => {
       const u = units.find((x) => x.m.id === m.id);
-      return u ? relative5(rootReal, u.dev.envFile) : join16(m.slug, moduleDefaults(m.type).envFile);
+      return u ? relative5(rootReal, u.dev.envFile) : join17(m.slug, moduleDefaults(m.type).envFile);
     };
     await saveLastStart(deps2, ws.root, {
       schemaVersion: 1,
@@ -3390,9 +3813,14 @@ async function prepareWorkspace(ctx, ws, f, waitTimeout, p) {
     });
   }
   if (p.signal.aborted) throw new CancelledError();
-  return { units, waitFor: plan.waitFor, o: { waitTimeout, killOthers: Boolean(f.killOthers), json: json2, color, prefix } };
+  const { reasons } = missingFindings();
+  const notRunning = plan.skipped.filter((s) => s.reason !== "excluded").map((s) => {
+    const m = bySlug.get(s.slug);
+    return { slug: s.slug, reason: s.reason === "no-write" ? `no write access \u2014 ${askMaintainer(am, m).text}` : `not cloned \u2014 ${reasons[s.slug] ?? "Fix: qore sync"}` };
+  });
+  return { units, waitFor: plan.waitFor, notRunning, o: { waitTimeout, killOthers: Boolean(f.killOthers), json: json2, color, prefix } };
 }
-async function superviseAll(ctx, ws, units, waitFor, o) {
+async function superviseAll(ctx, ws, units, waitFor, o, notRunning) {
   const { deps: deps2, io: io2 } = ctx;
   const startedAt = deps2.now().toISOString();
   const began = /* @__PURE__ */ new Map();
@@ -3414,9 +3842,9 @@ async function superviseAll(ctx, ws, units, waitFor, o) {
       case "line":
         return e.stream === "stdout" ? io2.out(o.prefix(e.module, e.line)) : io2.err(o.prefix(e.module, e.line));
       case "start":
-        return io2.err(`\u25B6 ${e.module}${e.pid === null ? "" : ` (pid ${e.pid})`}`);
+        return io2.err(`\u25B6 starting ${e.module}${e.pid === null ? "" : ` (pid ${e.pid})`}`);
       case "ready":
-        return io2.err(`\u2713 ${e.module} is listening on ${e.port}`);
+        return io2.err(`\u2713 ${e.module} ready`);
       case "provider-missing":
         return io2.err(`! ${e.provider} did not come up within ${o.waitTimeout} s (or exited); starting ${e.module} anyway \u2014 see its output above`);
       case "stopping":
@@ -3428,23 +3856,45 @@ async function superviseAll(ctx, ws, units, waitFor, o) {
         const how = e.signal ? `was ended by ${e.signal}` : `exited with code ${e.code}`;
         io2.err(`${e.code === 0 ? "\u25A0" : "\u2717"} ${e.module} ${how}${after}`);
         if (e.hint) io2.err(`  \u2192 ${e.hint.hint}`);
+        if (e.code !== 0 && !o.killOthers && (ref.sup?.children().length ?? 0) > 0) {
+          io2.err(`  Restart it on its own: qore dev --only ${e.module}   (in another terminal; the others keep running)`);
+        }
         return;
       }
     }
   };
+  const withPort = new Set(units.filter((u) => u.dev.port !== null).map((u) => u.m.slug));
+  const readyPorts = /* @__PURE__ */ new Map();
+  let summarized = false;
+  const summarize = () => {
+    if (summarized || o.json || readyPorts.size < withPort.size) return;
+    summarized = true;
+    const width = Math.max(0, ...[...readyPorts.keys(), ...notRunning.map((n) => n.slug)].map((s2) => s2.length));
+    io2.err(notRunning.length === 0 ? "\u2714 All modules running:" : "\u2714 Running:");
+    for (const slug of [...readyPorts.keys()].sort()) io2.err(`  ${slug.padEnd(width)}   http://localhost:${readyPorts.get(slug)}`);
+    if (notRunning.length > 0) {
+      io2.err("! Not running:");
+      for (const n of notRunning) io2.err(`  ${n.slug.padEnd(width)}   ${n.reason}`);
+    }
+  };
+  const crashed = /* @__PURE__ */ new Map();
   const onEvent = (e) => {
     if (e.type === "start") {
       began.set(e.module, deps2.now().getTime());
       writeRun();
     }
     if (e.type === "stopping") stopping = true;
+    if (e.type === "ready") readyPorts.set(e.module, e.port);
+    if (e.type === "exit" && !stopping && (e.code !== 0 || e.signal !== null)) {
+      crashed.set(e.module, { code: e.code, signal: e.signal, ms: deps2.now().getTime() - (began.get(e.module) ?? deps2.now().getTime()) });
+    }
     if (o.json) io2.out(JSON.stringify(e));
     else render(e);
+    if (e.type === "ready") summarize();
   };
   const s = ref.sup = supervise({
     modules: units.map((u) => {
       const { cmd, args } = runArgs(u.recipe.pm, u.recipe.script);
-      const { cmd: installCmd, args: installArgv } = installArgs(u.recipe.pm);
       return {
         slug: u.m.slug,
         cmd,
@@ -3452,7 +3902,7 @@ async function superviseAll(ctx, ws, units, waitFor, o) {
         cwd: u.dir,
         port: u.dev.port,
         waitFor: waitFor[u.m.slug] ?? [],
-        installCmd: [installCmd, ...installArgv].join(" "),
+        hint: hintContext(u.recipe, u.pkg, u.dev.env),
         env: { ...deps2.env, ...u.dev.env, ...o.color ? { FORCE_COLOR: "1" } : {} }
       };
     }),
@@ -3474,6 +3924,11 @@ async function superviseAll(ctx, ws, units, waitFor, o) {
     if (ctx.signal.aborted) onAbort();
     writeRun();
     ctx.setExitCode(await s.done);
+    if (!o.json && crashed.size > 0) {
+      const stopped = units.map((u) => u.m.slug).filter((s2) => !crashed.has(s2)).sort();
+      const what = [...crashed].map(([s2, c]) => `${s2} (${c.code === null && c.signal === null ? "could not be started" : `${c.signal ?? `code ${c.code}`}, after ${humanAge(Math.round(c.ms / 1e3))}`})`).join(", ");
+      io2.err(`${stopped.length ? `\u25A0 stopped: ${stopped.join(", ")}   ` : ""}\u2717 crashed: ${what}`);
+    }
   } finally {
     deps2.signals.off("SIGTERM", onTerm);
     deps2.signals.off("SIGHUP", onHup);
@@ -3543,6 +3998,48 @@ function parseWaitTimeout(raw) {
   return n;
 }
 var str2 = (v) => typeof v === "string" && v.length > 0;
+var SHELL_SAFE = /^[A-Za-z0-9_./,:@%+=-]*$/;
+var shellQuote = (s) => SHELL_SAFE.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
+function cdAndDev(home, dir2) {
+  if (/^[A-Za-z]:[\\/]|^\\\\/.test(dir2)) return `cd ${/\s/.test(dir2) ? `"${dir2}"` : dir2} && qore dev`;
+  const h = home.length > 1 ? home.replace(/\/+$/, "") : home;
+  let target = shellQuote(dir2);
+  if (h && dir2 === h) target = "~";
+  else if (h && dir2.startsWith(h + "/")) target = `~/${shellQuote(dir2.slice(h.length + 1))}`;
+  return `cd ${target} && qore dev`;
+}
+async function providerFindings(ctx, root, mc, app, env) {
+  const { deps: deps2 } = ctx;
+  try {
+    if (!(await metaFor(deps2, mc.portal.apiOrigin)).capabilities.includes("app.modules")) return null;
+    const am = await mc.session.api.get(`/api/cli/v1/apps/${encodeURIComponent(app.id)}/modules`);
+    const self = am.modules.find((m) => m.id === mc.module.id);
+    const providers = am.modules.filter((m) => self?.dependsOn.includes(m.id));
+    if (providers.length === 0) return null;
+    const conns = connPorts(env);
+    const listening = /* @__PURE__ */ new Set();
+    for (const c of conns) if (await deps2.ports.inUse(c.port)) listening.add(c.port);
+    const keys = deadAliases(env, listening);
+    if (keys.length === 0) return null;
+    const ws = await findWorkspace(root, deps2.home);
+    let fix = `qore clone ${app.slug}`;
+    if (ws && ws.appId === app.id) fix = cdAndDev(deps2.home, ws.root);
+    else if (providers.length === 1) {
+      const sibling = join18(dirname6(root), providers[0].slug);
+      if ((await deps2.git.inspect(sibling)).isRepo) fix = cdAndDev(deps2.home, sibling);
+    }
+    return providerDown({
+      slug: mc.module.slug,
+      providers: providers.map((p) => p.slug),
+      keys,
+      ports: new Map(conns.map((c) => [c.key, c.port])),
+      fix
+    });
+  } catch (e) {
+    if (e instanceof QoreError) return null;
+    throw e;
+  }
+}
 function usableLast2(last) {
   if (!last || last.kind !== "module") return false;
   const m = last.module;
@@ -3567,8 +4064,9 @@ async function devContext(ctx, f, root) {
 }
 async function moduleDev(ctx, f, waitTimeout) {
   const { deps: deps2, io: io2 } = ctx;
-  const { root, slug, recipe, env, port } = await inPreflight(deps2.signals, ctx.signal, (p) => prepareModule(ctx, f, waitTimeout, p));
+  const { root, slug, recipe, env, port, pkg, devEnv: devEnv2 } = await inPreflight(deps2.signals, ctx.signal, (p) => prepareModule(ctx, f, waitTimeout, p));
   const { cmd, args } = runArgs(recipe.pm, recipe.script);
+  io2.err(`\u25B6 starting ${slug}${port === null ? "" : ` \u2014 http://localhost:${port}`}`);
   const startedAt = deps2.now();
   await writeRunFile(deps2, root, {
     schemaVersion: 1,
@@ -3589,10 +4087,9 @@ async function moduleDev(ctx, f, waitTimeout) {
     await removeRunFile(deps2, root);
   }
   const ms = deps2.now().getTime() - startedAt.getTime();
-  if (exit.code !== 0 && exit.signal === null && ms < EARLY_EXIT_MS) {
-    io2.err(`\u2717 ${slug} exited after ${Math.round(ms / 1e3)} s with code ${exit.code ?? 1} \u2014 its output above says why.`);
-    const { cmd: installCmd, args: installArgv } = installArgs(recipe.pm);
-    const hint = earlyExitHint(tee.lines(), { installCommand: [installCmd, ...installArgv].join(" ") });
+  if (exit.code !== 0 && exit.signal === null) {
+    io2.err(ms < EARLY_EXIT_MS ? `\u2717 ${slug} exited after ${Math.round(ms / 1e3)} s with code ${exit.code ?? 1} \u2014 its output above says why.` : `\u2717 ${slug} exited with code ${exit.code ?? 1}.`);
+    const hint = exitHint(tee.lines(), hintContext(recipe, pkg, devEnv2));
     if (hint) io2.err(`  \u2192 ${hint.hint}`);
   }
   if (exit.signal) {
@@ -3637,11 +4134,16 @@ async function prepareModule(ctx, f, waitTimeout, p) {
   });
   const runs = [await leftoverRun(deps2, root)].filter((r) => r !== null);
   const onLine = (l) => l.stream === "stdout" ? io2.out(l.line) : io2.err(l.line);
-  const report = () => {
-  };
-  await checkPackageManager(deps2, recipe, () => {
+  const report = progressReporter(ctx, { installFlag: f.install, servicesFlag: f.services });
+  const pmVersion = await checkPackageManager(deps2, recipe, () => {
   }, p.signal);
-  await checkNode(deps2, recipe, pkg, slug, p.signal);
+  const nodeVersion = await checkNode(deps2, recipe, pkg, slug, p.signal);
+  report({
+    module: slug,
+    step: "pm",
+    status: "done",
+    detail: `${recipe.pm.name}${pmVersion ? ` ${pmVersion}` : ""}${nodeVersion ? ` \xB7 node ${nodeVersion}` : ""}`
+  });
   await installIfNeeded(deps2, recipe, slug, onLine, report, p.signal);
   let dev;
   try {
@@ -3663,9 +4165,22 @@ async function prepareModule(ctx, f, waitTimeout, p) {
   if (dev.kept.length) {
     io2.err(`! ${dev.kept.length} key(s) differ locally and were kept: ${dev.kept.join(", ")} \u2014 qore env pull --use-portal takes the portal's values`);
   }
+  report({ module: slug, step: "env", status: "done", detail: dev.offline ? `${envFile}  (as last written \u2014 offline)` : envFile });
   const env = { ...deps2.env, ...dev.env };
   await dockerRecovery(ctx, p.signal)({ cwd: root, env }, () => startServices(deps2, recipe, slug, env, dev.dbPort, waitTimeout * 1e3, p.signal, onLine, report));
   await checkPortOrStopLeftover(ctx, { slug, port: dev.port, key: "PORT", runs }, p.signal);
+  if (dev.port !== null) report({ module: slug, step: "ports", status: "done", detail: String(dev.port) });
+  if (c.online && !dev.offline) {
+    const provider = await providerFindings(ctx, root, c.online.mc, c.online.app, dev.env);
+    if (provider) renderFinding(ctx, provider);
+  }
+  const services = servicesMissing(slug, dev.env, recipe, { servicesFlag: f.services, configured: cfg.dev?.services !== void 0 });
+  if (services) renderFinding(ctx, services);
+  try {
+    const behind = repoBehind(slug, await deps2.git.status(root), { workspace: false });
+    if (behind) renderFinding(ctx, behind);
+  } catch {
+  }
   if (c.online && !dev.offline) {
     const { mc, app } = c.online;
     const { id, name, type, access: access2, tenant, apps } = mc.module;
@@ -3688,7 +4203,15 @@ async function prepareModule(ctx, f, waitTimeout, p) {
     });
   }
   if (p.signal.aborted) throw new CancelledError();
-  return { root, slug, recipe, env, port: dev.port };
+  return { root, slug, recipe, env, port: dev.port, pkg, devEnv: dev.env };
+}
+
+// src/cli/commands/debugTelemetry.ts
+function registerDebugTelemetry(program, ctx) {
+  program.command("debug-telemetry", { hidden: true }).description("Send a test crash report").option("--crash", "throw an unexpected error").action((o) => {
+    if (o.crash) throw new Error(`qore debug-telemetry crash in ${ctx.deps.home} token=debug-telemetry-secret`);
+    if (ctx.opts().json) renderJson(ctx.io, { crash: false });
+  });
 }
 
 // src/cli/commands/doctor.ts
@@ -3696,14 +4219,14 @@ import pc3 from "picocolors";
 
 // src/core/doctor/checks.ts
 import { realpath as realpath6 } from "fs/promises";
-import { basename as basename3, join as join17 } from "path";
+import { basename as basename3, join as join19 } from "path";
 
 // src/core/diagnostics/ssh.ts
 var SSH_TEST_ARGS = ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5", "git@github.com"];
 var COMMAND = "ssh -T git@github.com";
 function classifySshTest(r) {
-  const text = r.tail.join("\n");
-  const hi = /Hi ([^!\s]+)! You've successfully authenticated/.exec(text);
+  const text2 = r.tail.join("\n");
+  const hi = /Hi ([^!\s]+)! You've successfully authenticated/.exec(text2);
   if (hi) return { ok: true, user: hi[1] };
   const details = { protocol: "ssh" };
   if (r.spawnError) {
@@ -3712,13 +4235,13 @@ function classifySshTest(r) {
       details: { ...details, reason: "ssh-missing" }
     }) };
   }
-  if (/Permission denied \(publickey\)/.test(text)) {
+  if (/Permission denied \(publickey\)/.test(text2)) {
     return { ok: false, error: new QoreError("QORE_GIT_AUTH", "GitHub refused your SSH key", {
       hint: "Add your key to GitHub (https://github.com/settings/keys) and your ssh agent, or keep cloning over https.",
       details
     }) };
   }
-  if (/Host key verification failed/.test(text)) {
+  if (/Host key verification failed/.test(text2)) {
     return { ok: false, error: new QoreError("QORE_GIT_AUTH", "ssh could not verify github.com's host key", {
       hint: `Run \`${COMMAND}\` once to accept its host key (or to see why it changed).`,
       details: { ...details, reason: "host-key" }
@@ -3893,9 +4416,9 @@ async function moduleBody(deps2, m, runs, signal) {
   let env = null;
   await part(async () => {
     const target = await resolveTarget(m.root, cfg.envFile ?? moduleDefaults(m.type).envFile);
-    const text = await readOrNull(target);
-    if (text === null) return { status: "warn", label: "port unknown (run qore env pull)" };
-    env = Object.fromEntries(parseEnv(text));
+    const text2 = await readOrNull(target);
+    if (text2 === null) return { status: "warn", label: "port unknown (run qore env pull)" };
+    env = Object.fromEntries(parseEnv(text2));
     const port = envPort(env, "PORT");
     if (port === null) return { status: "warn", label: `port unknown (no PORT in ${basename3(target)})` };
     if (!await deps2.ports.inUse(port)) return { status: "ok", label: `port ${port} free` };
@@ -3976,6 +4499,12 @@ async function resolveRepoModule(deps2, session, portal, meta, root) {
   }
   return session.api.get(`/api/cli/v1/modules/${encodeURIComponent(ids[0])}`);
 }
+function checkTelemetry(deps2, cfg) {
+  const built = deps2.sentryDsn !== "";
+  if (!cfg) return ok("crash reports off (config unreadable)", { enabled: false, source: "config", reason: "unreadable", built });
+  const consent = resolveConsent(deps2.env, cfg);
+  return ok(describeConsent(consent, built), { enabled: consent.enabled, source: consent.source, built });
+}
 async function runDoctor(deps2, o = {}) {
   const signal = o.signal ?? new AbortController().signal;
   const toolMs = o.toolTimeoutMs ?? TOOL_TIMEOUT_MS;
@@ -3995,12 +4524,14 @@ async function runDoctor(deps2, o = {}) {
     return r;
   };
   let cfg;
+  let cfgReadable = true;
   try {
     cfg = await deps2.config.read();
   } catch (e) {
     if (isCancel(e, signal)) throw e;
     await push("config", "tools", () => withError("fail", errorLabel(e), e));
     cfg = { schemaVersion: 1, profiles: {} };
+    cfgReadable = false;
   }
   let ws = null;
   let wsError = null;
@@ -4022,6 +4553,7 @@ async function runDoctor(deps2, o = {}) {
   await push("git", "tools", () => checkGit(deps2, signal, toolMs));
   await push("github-ssh", "tools", () => checkGithubSsh(deps2, signal, toolMs));
   await push("docker", "tools", () => checkDocker(deps2, signal, toolMs));
+  await push("telemetry", "tools", () => checkTelemetry(deps2, cfgReadable ? cfg : null));
   const sessions = /* @__PURE__ */ new Map();
   let loggedIn = [];
   try {
@@ -4114,7 +4646,7 @@ async function workspaceModule(deps2, ws, am, m, runs, signal, push, perModule)
     await push(`module:${m.slug}`, "workspace", () => ({ status: "warn", label: "not a safe directory name \u2014 skipped" }), m.slug);
     return;
   }
-  const mod = { root: join17(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
+  const mod = { root: join19(ws.root, m.slug), slug: m.slug, type: m.type, id: m.id, access: m.access };
   let prepared = null;
   await push(`module:${m.slug}`, "workspace", async () => {
     const info = await deps2.git.inspect(mod.root);
@@ -4146,7 +4678,7 @@ function registerDoctor(program, ctx) {
 // src/cli/commands/env.ts
 import { randomBytes as randomBytes6 } from "crypto";
 import { chmod as chmod3, realpath as realpath7 } from "fs/promises";
-import { dirname as dirname6, join as join18, relative as relative7 } from "path";
+import { dirname as dirname7, join as join20, relative as relative7 } from "path";
 var maskLen = (v) => v === void 0 ? "(unset)" : `\u2022\u2022\u2022\u2022 (${v.length} chars)`;
 function registerEnv(program, ctx) {
   const env = program.command("env").description("Local environment");
@@ -4163,7 +4695,7 @@ function registerEnv(program, ctx) {
     const target = f.target ? await resolveTarget(mc.repoRoot, f.target, deps2.cwd) : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile);
     await ensureTrusted(ctx, mc, app, { yes: f.yes });
     const existing = await readOrNull(target);
-    const example = existing === null ? await readOrNull(join18(dirname6(target), ".env.example")) : null;
+    const example = existing === null ? await readOrNull(join20(dirname7(target), ".env.example")) : null;
     const local = await fetchLocalEnv(deps2, mc, app);
     const inputs = {
       existing,
@@ -4300,9 +4832,9 @@ async function createOidc(opts) {
         throw mapOidcError(e, host);
       }
     },
-    async pollDevice(start, signal) {
+    async pollDevice(start2, signal) {
       try {
-        const t = await oc.pollDeviceAuthorizationGrant(config, start.handle, void 0, { signal });
+        const t = await oc.pollDeviceAuthorizationGrant(config, start2.handle, void 0, { signal });
         return toTokenSet(t);
       } catch (e) {
         throw mapOidcError(e, host);
@@ -4329,14 +4861,14 @@ async function createOidc(opts) {
 // src/core/auth/login.ts
 async function deviceLogin(opts) {
   await opts.store.getRefresh();
-  const start = await opts.oidc.startDevice(LOGIN_SCOPE);
+  const start2 = await opts.oidc.startDevice(LOGIN_SCOPE);
   const stopPoll = new AbortController();
   const settled = new AbortController();
-  const poll = opts.oidc.pollDevice(start, AbortSignal.any([opts.signal, stopPoll.signal])).finally(() => settled.abort());
+  const poll = opts.oidc.pollDevice(start2, AbortSignal.any([opts.signal, stopPoll.signal])).finally(() => settled.abort());
   poll.catch(() => {
   });
   try {
-    await opts.onCode(start, settled.signal);
+    await opts.onCode(start2, settled.signal);
   } catch (e) {
     stopPoll.abort();
     const late = await poll.catch(() => null);
@@ -4562,8 +5094,7 @@ function registerStatus(program, ctx) {
 }
 
 // src/cli/commands/sync.ts
-import { lstat as lstat2, readdir } from "fs/promises";
-import { join as join19, relative as relative8 } from "path";
+import { join as join21, relative as relative8 } from "path";
 import { Option as Option2 } from "commander";
 function asFailure2(slug, e) {
   if (e instanceof QoreError && e.code !== "QORE_GIT_UNAVAILABLE") {
@@ -4571,24 +5102,6 @@ function asFailure2(slug, e) {
   }
   throw e;
 }
-async function strayRepos(root, slugs) {
-  let entries;
-  try {
-    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
-  } catch {
-    return [];
-  }
-  const names = [];
-  for (const name of entries) {
-    if (slugs.has(name)) continue;
-    try {
-      await lstat2(join19(root, name, ".git"));
-      names.push(name);
-    } catch {
-    }
-  }
-  return names.sort();
-}
 function registerSync(program, ctx) {
   program.command("sync").description("Clone new modules, fetch present ones, report removed and re-pointed ones").option("--pull", "fast-forward every clean present repository with an upstream").addOption(new Option2("--protocol <https|ssh>", "clone URL protocol").choices(["https", "ssh"]).default("https")).action(async (flags) => {
     const { deps: deps2, io: io2 } = ctx;
@@ -4613,7 +5126,7 @@ function registerSync(program, ctx) {
         continue;
       }
       try {
-        dirs[m.slug] = await deps2.git.inspect(join19(ws.root, m.slug));
+        dirs[m.slug] = await deps2.git.inspect(join21(ws.root, m.slug));
         modulesForPlan.push(m);
       } catch (e) {
         earlyFailures.push(asFailure2(m.slug, e));
@@ -4753,9 +5266,111 @@ var COMMANDS = [
   registerClone,
   registerSync,
   registerVersion,
-  registerDoctor
+  registerConfig,
+  registerDoctor,
+  registerDebugTelemetry
 ];
 
+// src/cli/telemetry/notice.ts
+var NOTICE = [
+  "qore sends anonymous crash reports and a per-run health record to Quatronic, to find and fix bugs.",
+  "Tokens, env values and your home path are removed; no user or tenant is attached.",
+  "Turn it off with `qore config telemetry off`, QORE_TELEMETRY=0 or DO_NOT_TRACK=1. See the Privacy section of the README."
+];
+async function showNoticeOnce(deps2, io2, o) {
+  if (o.json || !io2.interactive || !deps2.sentryDsn) return;
+  try {
+    const cfg = await deps2.config.read();
+    if (!needsNotice(cfg, resolveConsent(deps2.env, cfg))) return;
+    await deps2.config.update((c) => {
+      c.telemetry = { ...c.telemetry, noticeShownAt: deps2.now().toISOString() };
+    });
+  } catch {
+    return;
+  }
+  for (const line2 of NOTICE) io2.err(line2);
+}
+
+// src/cli/telemetry/index.ts
+var CRASH_FLUSH_MS = 2e3;
+var CLEAN_FLUSH_MS = 200;
+var loadSentry = async () => (await import("./sentry-B3MDCAOI.js")).createSdk;
+function createTelemetry(deps2, o) {
+  const load = o.load ?? loadSentry;
+  const flushMs = o.flushMs ?? { crash: CRASH_FLUSH_MS, clean: CLEAN_FLUSH_MS };
+  let sdk = null;
+  let crashed = null;
+  const secrets = [];
+  let scrub = null;
+  return {
+    begin(command) {
+      if (sdk || !deps2.sentryDsn) return;
+      sdk = start(deps2, o.argv, command, load, (ctx) => {
+        scrub = ctx;
+        addSecretValues(ctx, secrets);
+      }).catch(() => null);
+    },
+    crash(e) {
+      crashed ??= { e };
+    },
+    registerSecrets(values) {
+      secrets.push(...values);
+      if (scrub) addSecretValues(scrub, values);
+    },
+    async end(signal) {
+      if (!sdk) return { drained: true };
+      const ms = crashed ? flushMs.crash : flushMs.clean;
+      const work = sdk.then(async (s) => {
+        if (!s) return true;
+        if (crashed) s.crash(crashed.e);
+        return s.end(ms);
+      }).catch(() => false);
+      return { drained: await withDeadline(work, ms, signal) };
+    }
+  };
+}
+async function start(deps2, argv2, command, load, onScrub) {
+  const cfg = await deps2.config.read().catch(() => null);
+  if (!cfg) return null;
+  if (!resolveConsent(deps2.env, cfg).enabled) return null;
+  const create = await load();
+  const scrub = buildScrubContext({ home: deps2.home, platform: deps2.platform, env: deps2.env, argv: argv2, commandWords: command.split(" ") });
+  onScrub(scrub);
+  const sdk = create({
+    dsn: deps2.sentryDsn,
+    environment: deps2.sentryEnvironment,
+    release: deps2.version,
+    tags: { command, "cli.version": deps2.version, "node.version": deps2.nodeVersion, os: deps2.platform, ci: deps2.env.CI ? "true" : "false" },
+    scrub
+  });
+  sdk.start();
+  return sdk;
+}
+function withDeadline(work, ms, signal) {
+  if (signal?.aborted) return Promise.resolve(false);
+  return new Promise((resolve5) => {
+    const done = (v) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      resolve5(v);
+    };
+    const onAbort = () => done(false);
+    const timer = setTimeout(() => done(false), ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    work.then(done, () => done(false));
+  });
+}
+function telemetryHooks(deps2, io2, t, o) {
+  return {
+    onCommand: async (command) => {
+      if (command === "config telemetry") return;
+      await showNoticeOnce(deps2, io2, o);
+      t.begin(command);
+    },
+    onCrash: (e) => t.crash(e)
+  };
+}
+
 // src/cli/updateCheck.ts
 var REGISTRY_URL = "https://registry.npmjs.org/@quatronic%2Fqore/latest";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
@@ -4789,7 +5404,7 @@ async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS)
 
 // src/core/config.ts
 import { readFile as readFile6 } from "fs/promises";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 var empty = () => ({ schemaVersion: 1, profiles: {} });
 var ConfigStore = class {
   constructor(dir2) {
@@ -4797,7 +5412,7 @@ var ConfigStore = class {
   }
   dir;
   get file() {
-    return join20(this.dir, "config.json");
+    return join22(this.dir, "config.json");
   }
   async read() {
     let raw;
@@ -4830,7 +5445,7 @@ var ConfigStore = class {
 import { execFile, execFileSync } from "child_process";
 import { mkdir as mkdir3, readdir as readdir2, stat as stat3 } from "fs/promises";
 import { homedir } from "os";
-import { dirname as dirname7, join as join21 } from "path";
+import { dirname as dirname8, join as join23 } from "path";
 function parseRemotes(stdout) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
@@ -4842,6 +5457,30 @@ function parseRemotes(stdout) {
   }
   return out;
 }
+function parseStatus(stdout) {
+  const s = { ok: true, dirty: false, branch: null, upstream: false };
+  for (const raw of stdout.split("\n")) {
+    const line2 = raw.replace(/\r$/, "");
+    if (line2.startsWith("# branch.head ")) {
+      const name = line2.slice("# branch.head ".length).trim();
+      s.branch = name === "(detached)" ? null : name;
+    } else if (line2.startsWith("# branch.upstream ")) {
+      s.upstream = true;
+      s.upstreamRef = line2.slice("# branch.upstream ".length).trim();
+    } else if (line2.startsWith("# branch.ab ")) {
+      const m = /^# branch\.ab \+(\d+) -(\d+)$/.exec(line2.trim());
+      if (m) {
+        s.ahead = Number(m[1]);
+        s.behind = Number(m[2]);
+      }
+    } else if (line2.startsWith("#")) {
+      continue;
+    } else if (line2.trim().length > 0) {
+      s.dirty = true;
+    }
+  }
+  return s;
+}
 var configuredSshCommand = /* @__PURE__ */ new Map();
 function hasConfiguredSshCommand(repoDir) {
   const key = repoDir ?? "";
@@ -4900,7 +5539,7 @@ async function remotes(repoRoot) {
   return parseRemotes(r.stdout);
 }
 async function clone(url, dir2) {
-  await mkdir3(dirname7(dir2), { recursive: true });
+  await mkdir3(dirname8(dir2), { recursive: true });
   const r = await runGit(["clone", "--", url, dir2]);
   return toResult(r, "git clone");
 }
@@ -4916,22 +5555,7 @@ async function status(repoRoot) {
   const command = "git status --porcelain=v2 --branch";
   const r = await runGit(["--no-optional-locks", "-C", repoRoot, "status", "--porcelain=v2", "--branch"], repoRoot);
   if (r.code !== 0) return { ok: false, stderr: r.stderr, command };
-  let branch = null;
-  let upstream = false;
-  let dirty = false;
-  for (const line2 of r.stdout.split(/\r?\n/)) {
-    if (line2.startsWith("# branch.head ")) {
-      const name = line2.slice("# branch.head ".length).trim();
-      branch = name === "(detached)" ? null : name;
-    } else if (line2.startsWith("# branch.upstream ")) {
-      upstream = true;
-    } else if (line2.startsWith("#")) {
-      continue;
-    } else if (line2.trim().length > 0) {
-      dirty = true;
-    }
-  }
-  return { ok: true, dirty, branch, upstream };
+  return parseStatus(r.stdout);
 }
 async function statOrThrow(path) {
   try {
@@ -4952,7 +5576,7 @@ async function inspect(dir2) {
     throw new QoreError("QORE_INTERNAL", `could not read ${dir2}`, { cause: err });
   }
   const empty2 = entries.length === 0;
-  const isRepo = await statOrThrow(join21(dir2, ".git")) !== void 0;
+  const isRepo = await statOrThrow(join23(dir2, ".git")) !== void 0;
   const dirRemotes = isRepo ? await remotes(dir2) : [];
   return { exists: true, empty: empty2, isRepo, remotes: dirRemotes };
 }
@@ -5014,13 +5638,13 @@ var OsKeychain = class {
 
 // src/platform/lock.ts
 import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join24 } from "path";
 import lockfile from "proper-lockfile";
 function fileLock(dir2) {
   return async (name, fn) => {
-    const locks = join22(dir2, "locks");
+    const locks = join24(dir2, "locks");
     await mkdir4(locks, { recursive: true, mode: 448 });
-    const target = join22(locks, `${name}.lock`);
+    const target = join24(locks, `${name}.lock`);
     await writeFile4(target, "", { flag: "a" });
     let release;
     let compromised;
@@ -5121,6 +5745,10 @@ var crossSpawner = makeSpawner(spawn, process);
 
 // src/platform/launch.ts
 import spawn2 from "cross-spawn";
+var RESET_OR_CLEAR = /\x1Bc|\x1B\[[23]J/g;
+function stripScreenClears(line2) {
+  return line2.includes("\x1B") ? line2.replace(RESET_OR_CLEAR, "") : line2;
+}
 function lineSplitter(stream, onLine) {
   let buf = "";
   return {
@@ -5128,13 +5756,13 @@ function lineSplitter(stream, onLine) {
       buf += chunk;
       let i;
       while ((i = buf.indexOf("\n")) >= 0) {
-        onLine({ stream, line: buf.slice(0, i).replace(/\r$/, "") });
+        onLine({ stream, line: stripScreenClears(buf.slice(0, i).replace(/\r$/, "")) });
         buf = buf.slice(i + 1);
       }
     },
     flush() {
       if (buf) {
-        onLine({ stream, line: buf.replace(/\r$/, "") });
+        onLine({ stream, line: stripScreenClears(buf.replace(/\r$/, "")) });
         buf = "";
       }
     }
@@ -5289,6 +5917,10 @@ var systemPorts = {
   }
 };
 
+// src/buildInfo.ts
+var SENTRY_DSN = true ? "https://50b592efb53dbc1a31cb10d3945c6d52@o4512129906049024.ingest.de.sentry.io/4512174341750864" : "";
+var SENTRY_ENVIRONMENT = true ? "production" : "development";
+
 // src/platform/proxy.ts
 import { execFile as execFile3 } from "child_process";
 
@@ -5351,7 +5983,7 @@ function systemProxy(platform = process.platform) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.3" : "0.0.0-dev";
+var VERSION = true ? "0.1.5" : "0.0.0-dev";
 
 // src/cli.ts
 if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
@@ -5394,6 +6026,11 @@ var deps = {
     process.kill(process.pid, signal);
   },
   pid: process.pid,
+  registerSecrets: (values) => {
+    telemetry.registerSecrets(values);
+  },
+  sentryDsn: SENTRY_DSN,
+  sentryEnvironment: SENTRY_ENVIRONMENT,
   systemProxy: () => systemProxy(process.platform)
 };
 var termination = preflightTermination(() => ac.abort(), deps.raise);
@@ -5404,16 +6041,24 @@ var io = processIo(isInteractive({
   noInput: preSeparatorArgv.includes("--no-input"),
   env: process.env
 }));
-process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS);
-await termination.reRaise(async () => {
+var flushStd = async () => {
   await Promise.all([process.stdout, process.stderr].map((s) => new Promise((r) => {
     s.write("", () => r());
   })));
-});
+};
+var telemetry = createTelemetry(deps, { argv });
+process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS, telemetryHooks(deps, io, telemetry, { json }));
+var { drained } = await telemetry.end(ac.signal);
+await termination.reRaise(flushStd);
 if (!ac.signal.aborted) {
   try {
     await maybeNotifyUpdate(deps, io, { json });
   } catch {
   }
 }
-//# sourceMappingURL=cli.js.map
+if (!drained) {
+  await flushStd();
+  process.exit();
+}
+//# sourceMappingURL=cli.js.map
+//# debugId=a70250c5-daf4-5ff3-b490-5556ac377549