react-doctor 0.5.8-dev.9f28454 → 0.5.8-dev.a7ad969

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="34e4ad65-2650-5e3e-afd8-191931eb2a47")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="eb7a01bc-f737-5207-b430-b8fee7a1895f")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -26,7 +26,7 @@ import tty from "node:tty";
 import { codeFrameColumns } from "@babel/code-frame";
 import Conf from "conf";
 import basePrompts from "prompts";
-import { SKILL_MANIFEST_FILE, detectInstalledSkillAgents, getSkillAgentConfig, getSkillAgentTypes, installSkillsFromSource } from "agent-install";
+import { SKILL_MANIFEST_FILE, detectInstalledSkillAgents, getSkillAgentConfig, getSkillAgentTypes, installSkillsFromSource, isSkillAgentType } from "agent-install";
 import { generateCode, loadFile, writeFile } from "magicast";
 import { getConfigFromVariableDeclaration, getDefaultExportOptions } from "magicast/helpers";
 //#region \0rolldown/runtime.js
@@ -9041,7 +9041,7 @@ const composePassthrough = /* @__PURE__ */ dual(2, (left, right) => (input) => {
 * @since 2.0.0
 */
 const Scheduler = /* @__PURE__ */ Reference("effect/Scheduler", { defaultValue: () => new MixedScheduler() });
-const setImmediate = "setImmediate" in globalThis ? (f) => {
+const setImmediate$1 = "setImmediate" in globalThis ? (f) => {
 	const timer = globalThis.setImmediate(f);
 	return () => globalThis.clearImmediate(timer);
 } : (f) => {
@@ -9085,7 +9085,7 @@ var PriorityBuckets = class {
 var MixedScheduler = class {
 	executionMode;
 	setImmediate;
-	constructor(executionMode = "async", setImmediateFn = setImmediate) {
+	constructor(executionMode = "async", setImmediateFn = setImmediate$1) {
 		this.executionMode = executionMode;
 		this.setImmediate = setImmediateFn;
 	}
@@ -9110,7 +9110,7 @@ var MixedSchedulerDispatcher = class {
 	tasks = /* @__PURE__ */ new PriorityBuckets();
 	running = void 0;
 	setImmediate;
-	constructor(setImmediateFn = setImmediate) {
+	constructor(setImmediateFn = setImmediate$1) {
 		this.setImmediate = setImmediateFn;
 	}
 	/**
@@ -36862,6 +36862,7 @@ const DOCS_URL = "https://react.doctor/docs";
 const DOCS_RULES_BASE_URL = `${DOCS_URL}/rules`;
 const FETCH_TIMEOUT_MS = 1e4;
 const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
+const SPAWN_ARGS_MAX_LENGTH_CHARS = 24e3;
 const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
 const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
 const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
@@ -36946,6 +36947,7 @@ const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
 const LINT_PHASE_TIMEOUT_MS = 3e5;
 const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
+const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
 const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
 const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
 const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
@@ -37679,7 +37681,10 @@ for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_N
 	NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
 }
 const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
-const canonicalizeRuleKey = (ruleKey) => LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey] ?? ruleKey;
+const canonicalizeRuleKey = (ruleKey) => {
+	const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
+	return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
+};
 const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
 const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
 	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
@@ -38553,7 +38558,7 @@ const resolveScanConcurrency = (requested) => {
 	if (!Number.isFinite(requested) || requested < 1) return 1;
 	return Math.min(Math.floor(requested), 32);
 };
-const readSystemFacts = () => ({
+const readSystemFacts$1 = () => ({
 	availableCores: os.availableParallelism(),
 	totalMemoryBytes: os.totalmem(),
 	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
@@ -38574,7 +38579,7 @@ const readSystemFacts = () => ({
 * `facts` is injectable so tests exercise core-bound, memory-bound, cgroup-
 * limited, and ceiling cases without mocking `os` or the filesystem.
 */
-const resolveAutoScanConcurrency = (facts = readSystemFacts()) => {
+const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
 	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
@@ -38765,6 +38770,12 @@ const BOOLEAN_FIELD_NAMES = [
 	"adoptExistingLintConfig"
 ];
 const STRING_FIELD_NAMES = ["rootDir"];
+const STRING_ARRAY_FIELD_NAMES = [
+	"projects",
+	"textComponents",
+	"rawTextWrapperComponents",
+	"serverAuthFunctionNames"
+];
 const SURFACE_CONTROL_FIELD_NAMES = [
 	"includeTags",
 	"excludeTags",
@@ -38866,6 +38877,7 @@ const validateConfigTypes = (config) => {
 	const validated = { ...config };
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
+	for (const fieldName of STRING_ARRAY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateStringArrayField(fieldName, value));
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
 	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
@@ -40128,7 +40140,10 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy)
 	}
 	return true;
 };
-const checkSecurityScan = (rootDirectory, options = {}) => {
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
+const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? buildCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
 	const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
@@ -40143,7 +40158,7 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 			committedFilesOnly: rule.committedFilesOnly === true
 		}];
 	});
-	if (enabledScanRules.length === 0) return [];
+	if (enabledScanRules.length === 0) return null;
 	const diagnostics = [];
 	const seen = /* @__PURE__ */ new Set();
 	const gitIgnoredCache = /* @__PURE__ */ new Map();
@@ -40155,15 +40170,34 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 		}
 		return status === true;
 	};
-	for (const file of collectSecurityScanFiles(rootDirectory)) for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
-		if (committedFilesOnly && isFileGitIgnored(file)) continue;
-		const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
-		const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
-		if (seen.has(key)) continue;
-		seen.add(key);
-		diagnostics.push(diagnostic);
+	const scanFile = (file) => {
+		for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
+			if (committedFilesOnly && isFileGitIgnored(file)) continue;
+			const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
+			const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			diagnostics.push(diagnostic);
+		}
+	};
+	return {
+		scanFile,
+		diagnostics
+	};
+};
+const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const session = createSecurityScanSession(rootDirectory, options);
+	if (session === null) return [];
+	let filesSinceYield = 0;
+	for (const file of collectSecurityScanFiles(rootDirectory)) {
+		session.scanFile(file);
+		filesSinceYield += 1;
+		if (filesSinceYield >= 16) {
+			filesSinceYield = 0;
+			await yieldToEventLoop();
+		}
 	}
-	return diagnostics;
+	return session.diagnostics;
 };
 var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {}, argv = p.argv || [], env = p.env || {};
@@ -40396,6 +40430,74 @@ const collectDeadCodeIgnorePatterns = (rootDirectory) => {
 	return [...seen].filter((pattern) => pattern.length > 0);
 };
 const collectDeadCodeEntryPatterns = (rootDirectory) => [...new Set(collectKnipPatterns(rootDirectory, "entry"))].filter((pattern) => pattern.length > 0);
+const readSystemFacts = () => ({
+	availableCores: os.availableParallelism(),
+	totalMemoryBytes: os.totalmem(),
+	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
+});
+/**
+* How many real deslop dead-code child processes may run at once, across the
+* concurrent per-project `runInspect` fibers of one CLI run. The cap is the
+* smaller of the core count and the number of `DEAD_CODE_WORKER_MEM_BUDGET_BYTES`
+* workers that fit in available memory, floored at 1.
+*
+* On a roomy dev box / CI runner this resolves high enough that every
+* concurrently-scanned project still spawns its own worker (no serialization vs
+* the prior uncapped behavior); on a memory-constrained runner it collapses
+* toward 1, so the `withDeadCodeWorkerSlot` semaphore serializes the spawns
+* instead of oversubscribing memory with N simultaneous children — the global
+* cap the per-project spawn path lacked.
+*
+* Mirrors `resolveAutoScanConcurrency` (lint), but budgets memory per the
+* heavier dead-code worker. `facts` is injectable for tests.
+*/
+const resolveDeadCodeConcurrency = (facts = readSystemFacts()) => {
+	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
+	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / DEAD_CODE_WORKER_MEM_BUDGET_BYTES);
+	return Math.max(1, Math.min(facts.availableCores, memoryBoundedWorkers));
+};
+let availableSlots = -1;
+const waiters = [];
+const releaseSlot = () => {
+	const nextWaiter = waiters.shift();
+	if (nextWaiter !== void 0) nextWaiter();
+	else availableSlots += 1;
+};
+/**
+* Runs `task` once a dead-code worker slot is free, releasing the slot when the
+* task settles (success or failure). With a high cap (roomy machine) every
+* caller proceeds immediately; with a low cap (constrained runner) callers
+* queue and run as slots free.
+*
+* `abortSignal` short-circuits the WAIT: if it's already aborted, or fires while
+* this caller is queued, the call rejects without acquiring a slot or running
+* `task` — so a cancelled scan (e.g. lint failed) doesn't sit in the queue and
+* then spawn a child only to tear it down. A queued caller that aborts removes
+* its own waiter so a later release never hands a slot to a dead request.
+*/
+const withDeadCodeWorkerSlot = async (task, abortSignal) => {
+	if (abortSignal?.aborted) throw new Error("Dead-code worker aborted.");
+	if (availableSlots < 0) availableSlots = resolveDeadCodeConcurrency();
+	if (availableSlots > 0) availableSlots -= 1;
+	else await new Promise((resolve, reject) => {
+		const waiter = () => {
+			abortSignal?.removeEventListener("abort", onAbort);
+			resolve();
+		};
+		const onAbort = () => {
+			const queuedIndex = waiters.indexOf(waiter);
+			if (queuedIndex !== -1) waiters.splice(queuedIndex, 1);
+			reject(/* @__PURE__ */ new Error("Dead-code worker aborted."));
+		};
+		waiters.push(waiter);
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return await task();
+	} finally {
+		releaseSlot();
+	}
+};
 /**
 * Resolves a path to its canonical, symlink-free form, falling back to
 * the input when it cannot be realpath'd (broken symlink, permission
@@ -40686,14 +40788,17 @@ const checkDeadCode = async (options) => {
 	if (!NFS.existsSync(Path.join(rootDirectory, "package.json"))) return [];
 	const entryPatterns = collectDeadCodeEntryPatterns(rootDirectory);
 	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory);
-	const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
-		rootDirectory,
-		entryPatterns,
-		tsConfigPath: resolveTsConfigPath(rootDirectory),
-		ignorePatterns,
-		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
-		parseConcurrency: options.parseConcurrency
-	}), options.workerTimeoutMs ?? 12e4, options.abortSignal));
+	const spawnAndRun = () => {
+		return runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
+			rootDirectory,
+			entryPatterns,
+			tsConfigPath: resolveTsConfigPath(rootDirectory),
+			ignorePatterns,
+			deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
+			parseConcurrency: options.parseConcurrency
+		}), options.workerTimeoutMs ?? 12e4, options.abortSignal);
+	};
+	const result = parseDeadCodeWorkerResult(options.createWorker === void 0 ? await withDeadCodeWorkerSlot(spawnAndRun, options.abortSignal) : await spawnAndRun());
 	const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -41094,43 +41199,46 @@ var Git = class Git extends Service()("react-doctor/Git") {
 		* reason: GitInvocationFailed })` so the rest of the codebase
 		* sees a single failure channel.
 		*/
-		const runCommand = (input) => scoped(gen(function* () {
-			const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
-				cwd: input.directory,
-				env: input.env,
-				extendEnv: true
-			}));
-			const maxStdoutBytes = input.maxStdoutBytes;
-			const stdoutByteCount = yield* make$13(0);
-			const [stdout, stderr, status] = yield* all([
-				mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
-					args: [...input.args],
-					directory: input.directory,
-					cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
-				}) })) : void_)))))),
-				mkString(decodeText(handle.stderr)),
-				handle.exitCode
-			], { concurrency: 3 });
-			return {
-				status,
-				stdout,
-				stderr
-			};
-		})).pipe(catchTag$1("PlatformError", (cause) => {
-			if (input.command !== "git") return succeed$2({
+		const runCommand = (input) => {
+			const foldSpawnFailure = (cause) => input.command !== "git" ? succeed$2({
 				status: 127,
 				stdout: "",
 				stderr: String(cause)
-			});
-			return new ReactDoctorError({ reason: new GitInvocationFailed({
+			}) : fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
 				args: [...input.args],
 				directory: input.directory,
 				cause
-			}) });
-		}), withSpan("git.exec", { attributes: {
-			"git.command": input.command,
-			"git.subcommand": input.args[0] ?? ""
-		} }));
+			}) }));
+			return scoped(gen(function* () {
+				if (!isDirectory(input.directory)) return yield* foldSpawnFailure(`spawn ENOTDIR (cwd is not a directory: ${input.directory})`);
+				const argvLengthChars = input.command.length + 1 + input.args.reduce((total, arg) => total + arg.length + 1, 0);
+				if (argvLengthChars > 24e3) return yield* foldSpawnFailure(`spawn ENAMETOOLONG (${argvLengthChars} argv chars exceed ${SPAWN_ARGS_MAX_LENGTH_CHARS})`);
+				const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
+					cwd: input.directory,
+					env: input.env,
+					extendEnv: true
+				}));
+				const maxStdoutBytes = input.maxStdoutBytes;
+				const stdoutByteCount = yield* make$13(0);
+				const [stdout, stderr, status] = yield* all([
+					mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
+						args: [...input.args],
+						directory: input.directory,
+						cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
+					}) })) : void_)))))),
+					mkString(decodeText(handle.stderr)),
+					handle.exitCode
+				], { concurrency: 3 });
+				return {
+					status,
+					stdout,
+					stderr
+				};
+			})).pipe(catchTag$1("PlatformError", foldSpawnFailure), withSpan("git.exec", { attributes: {
+				"git.command": input.command,
+				"git.subcommand": input.args[0] ?? ""
+			} }));
+		};
 		const runGit = (directory, args) => runCommand({
 			command: "git",
 			args,
@@ -41163,7 +41271,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			"rev-parse",
 			"--verify",
 			branch
-		]).pipe(map$3((result) => result.status === 0));
+		]).pipe(map$3((result) => result.status === 0), catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(false) : fail$4(error)));
 		const headSha = (directory) => runGit(directory, ["rev-parse", "HEAD"]).pipe(map$3((result) => result.status === 0 ? trimOrNull(result.stdout) : null));
 		const mergeBase = (input) => isSafeGitRevision(input.ref) ? runGit(input.directory, [
 			"merge-base",
@@ -41377,7 +41485,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				]);
 				if (result.status !== 0) return null;
 				return parseChangedLineRanges(result.stdout);
-			}).pipe(withSpan("Git.changedLineRanges"))
+			}).pipe(catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(null) : fail$4(error)), withSpan("Git.changedLineRanges"))
 		});
 	})).pipe(provide$2(layer$3.pipe(provide$2(mergeAll$1(layer$2, layer$1)))));
 	/**
@@ -43854,7 +43962,10 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      diagnostics).
 *   2. beforeLint hook (e.g. CLI renders the project-detection block)
 *   3. environment checks (reduced-motion + pnpm hardening +
-*      expo/react-native + security scan), collected synchronously
+*      expo/react-native), collected synchronously. The heavier
+*      content-regex security scan is forked instead (like supply-chain
+*      below) and joined before the concat, so its CPU overlaps lint
+*      rather than blocking the event loop before it.
 *   4. The supply-chain check (Socket.dev) is forked onto a background
 *      fiber so its ~100% network-bound time overlaps the ~100%
 *      CPU/subprocess-bound lint pass below, collapsing two serial
@@ -43874,7 +43985,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      order, so terminal output is identical either way; supply-chain
 *      rides alongside without a spinner.
 *   6. Join the supply-chain fiber, then assemble the diagnostics in a
-*      FIXED order (env, supply-chain, lint, dead-code) so the output is
+*      FIXED order (env, security-scan, supply-chain, lint, dead-code) so the output is
 *      byte-identical regardless of which fiber settled first. The
 *      viewer-permission fiber is joined later, during score-metadata
 *      assembly (it feeds score metadata, not diagnostics). The per-element
@@ -43935,12 +44046,12 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkPnpmHardening(scanDirectory),
 		...checkReactServerComponentsAdvisory(scanDirectory, project),
 		...checkExpoProject(scanDirectory, project),
-		...checkReactNativeProject(scanDirectory, project),
-		...checkSecurityScan(scanDirectory, {
-			project,
-			ignoredTags: input.ignoredTags
-		})
+		...checkReactNativeProject(scanDirectory, project)
 	])));
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(promise(() => checkSecurityScanCooperative(scanDirectory, {
+		project,
+		ignoredTags: input.ignoredTags
+	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)))))).pipe(withSpan("SecurityScan.run")));
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
 	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
@@ -44076,9 +44187,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	else yield* scanProgress.succeed(`Scanned ${scannedFilesLabel} in ${scanElapsedSeconds}s${workerCountSuffix}`);
 	const supplyChainResult = yield* join(supplyChainFiber);
 	const supplyChainCollected = supplyChainResult.diagnostics;
+	const securityScanCollected = yield* join(securityScanFiber);
 	yield* reporterService.finalize;
 	const finalDiagnostics = sortDiagnosticsStable(assignFixGroups([
 		...envCollected,
+		...securityScanCollected,
 		...supplyChainCollected,
 		...lintCollected,
 		...deadCodeCollected
@@ -44617,6 +44730,61 @@ const computeConfigFingerprint = (projectDirectory, version) => {
 	}
 	return crypto.createHash("sha1").update(parts.join("|")).digest("hex");
 };
+const AI_TRAINING_ENV_VARS = [
+	["HF_DATASETS_CACHE", "huggingface"],
+	["HF_HOME", "huggingface"],
+	["HUGGINGFACE_HUB_CACHE", "huggingface"],
+	["SPACE_ID", "huggingface-spaces"],
+	["CUDA_VISIBLE_DEVICES", "cuda"],
+	["NVIDIA_VISIBLE_DEVICES", "nvidia"],
+	["ROCR_VISIBLE_DEVICES", "rocm"],
+	["TPU_NAME", "google-tpu"],
+	["WANDB_RUN_ID", "wandb"],
+	["WANDB_SWEEP_ID", "wandb"],
+	["MLFLOW_RUN_ID", "mlflow"],
+	["MLFLOW_TRACKING_URI", "mlflow"],
+	["COMET_EXPERIMENT_KEY", "comet"],
+	["NEPTUNE_RUN_ID", "neptune"],
+	["CLEARML_TASK_ID", "clearml"],
+	["DVC_STAGE", "dvc"],
+	["RAY_WORKER_PROCESS", "ray"],
+	["RAY_ADDRESS", "ray"],
+	["MUJOCO_GL", "mujoco"],
+	["MUJOCO_PATH", "mujoco"],
+	["GYM_DISABLE_ENV_CHECKER", "gymnasium"],
+	["SM_TRAINING_ENV", "sagemaker"],
+	["TRAINING_JOB_ARN", "sagemaker"],
+	["SAGEMAKER_BASE_DIR", "sagemaker"],
+	["AZUREML_RUN_ID", "azure-ml"],
+	["AZURE_ML_MODEL_DIR", "azure-ml"],
+	["CLOUD_ML_PROJECT_ID", "vertex-ai"],
+	["VERTEX_AI_LOG_LEVEL", "vertex-ai"],
+	["DET_MASTER", "determined-ai"],
+	["LIGHTNING_USER_ID", "lightning-ai"],
+	["FLYTE_INTERNAL_EXECUTION_ID", "flyte"],
+	["ARGO_WORKFLOW_NAME", "argo-workflows"],
+	["KFP_POD_NAME", "kubeflow-pipelines"],
+	["KAGGLE_KERNEL_RUN_TYPE", "kaggle"],
+	["COLAB_BACKEND_VERSION", "google-colab"],
+	["DATABRICKS_RUNTIME_VERSION", "databricks"],
+	["DAYTONA_WS_ID", "daytona"],
+	["DAYTONA_WS_NAME", "daytona"],
+	["E2B_SANDBOX_ID", "e2b"],
+	["MODAL_FUNCTION_ID", "modal"],
+	["MODAL_TASK_ID", "modal"],
+	["RUNPOD_POD_ID", "runpod"],
+	["REPLICATE_USERNAME", "replicate"],
+	["VAST_CONTAINERLABEL", "vast-ai"],
+	["HARBOR_URL", "harbor"],
+	["HARBOR_HOSTNAME", "harbor"],
+	["SWE_BENCH_TASK", "swe-bench"],
+	["SWEBENCH_TASK", "swe-bench"],
+	["SWE_AGENT_MODEL", "swe-agent"]
+];
+const detectAiTrainingEnvironment = () => {
+	for (const [envVar, label] of AI_TRAINING_ENV_VARS) if (process.env[envVar]) return label;
+	return null;
+};
 const groupBy = (items, keyFn) => {
 	const groups = /* @__PURE__ */ new Map();
 	for (const item of items) {
@@ -44860,6 +45028,7 @@ const NANOSECONDS_PER_SECOND = 1000000000n;
 const METRIC = {
 	cliInvoked: "cli.invoked",
 	cliError: "cli.error",
+	cliEnvironmentError: "cli.env_error",
 	projectDetected: "project.detected",
 	projectPathSelected: "project.path_selected",
 	projectConfigSelected: "project.config_selected",
@@ -44889,7 +45058,9 @@ const METRIC = {
 	lspSessionStarted: "lsp.session.started",
 	lspScanCompleted: "lsp.scan.completed",
 	lspScanDuration: "lsp.scan.duration",
-	lspScanDiagnostics: "lsp.scan.diagnostics"
+	lspScanDiagnostics: "lsp.scan.diagnostics",
+	aiTrainingWarningShown: "ai.training.warning_shown",
+	jsonOutUsed: "json.out_used"
 };
 //#endregion
 //#region src/cli/utils/noop-console.ts
@@ -44932,7 +45103,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.5.8-dev.9f28454";
+const VERSION = "0.5.8-dev.a7ad969";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -44970,12 +45141,13 @@ const installSilentConsole = () => {
 		"trace"
 	]) target[key] = source[key];
 };
-const enableJsonMode = ({ compact, directory }) => {
+const enableJsonMode = ({ compact, directory, outputFile }) => {
 	context = {
 		compact,
 		directory,
 		startTime: performance$1.now(),
-		mode: "full"
+		mode: "full",
+		outputFile: outputFile ?? null
 	};
 	installSilentConsole();
 };
@@ -44988,7 +45160,11 @@ const setJsonReportMode = (mode) => {
 };
 const writeJsonReport = (report) => {
 	const serialized = context?.compact ? JSON.stringify(report) : JSON.stringify(report, null, 2);
-	process.stdout.write(`${serialized}\n`);
+	if (context?.outputFile) {
+		const resolvedPath = Path.resolve(context.outputFile);
+		NFS.mkdirSync(Path.dirname(resolvedPath), { recursive: true });
+		NFS.writeFileSync(resolvedPath, `${serialized}\n`);
+	} else process.stdout.write(`${serialized}\n`);
 };
 const writeJsonErrorReport = (error, sentryEventId) => {
 	if (!context) return;
@@ -45296,13 +45472,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.8-dev.9f28454`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.8-dev.a7ad969`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.8-dev.9f28454") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.8-dev.a7ad969") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -48898,6 +49074,25 @@ const shouldBlockCi = (diagnostics, blockingLevel) => {
 */
 const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g, "_");
 //#endregion
+//#region src/cli/utils/with-namespace.ts
+/**
+* Prefixes every key in a flat attribute group with `namespace.`, so a logical
+* group (scan config, diagnostics rollup, score, …) carries one dotted
+* namespace applied in a single place rather than hand-spelled into each key —
+* which is how the wide event drifted into a flat, half-namespaced soup. The
+* dotted prefix is what makes the attributes tree up in Sentry's attribute
+* browser and stay group-/filter-/aggregate-able in the Spans dataset.
+*
+* Value types are preserved verbatim (numbers stay numbers so Sentry infers a
+* numeric attribute and `p75(...)`/`avg(...)` work; `null` is kept so
+* `toSpanAttributes` can drop absent signals rather than coerce them).
+*/
+const withNamespace = (namespace, attributes) => {
+	const namespaced = {};
+	for (const [key, value] of Object.entries(attributes)) namespaced[`${namespace}.${key}`] = value;
+	return namespaced;
+};
+//#endregion
 //#region src/cli/utils/build-run-event.ts
 const readEnvBoolean = (name) => {
 	const value = process.env[name];
@@ -48919,12 +49114,12 @@ const buildOutcomeAttributes = (input) => {
 	if (input.result === void 0) {
 		const error = input.error;
 		const known = isReactDoctorError(error);
-		return {
-			outcome: "error",
+		return withNamespace("outcome", {
+			status: "error",
 			exitCode: 1,
 			knownError: known,
 			errorTag: known ? error.reason._tag : error instanceof Error ? error.name : null
-		};
+		});
 	}
 	const result = input.result;
 	const summary = summarizeDiagnostics(result.diagnostics);
@@ -48958,66 +49153,82 @@ const buildOutcomeAttributes = (input) => {
 	}
 	let fixGroupedFindings = 0;
 	for (const count of findingsPerFixGroup.values()) fixGroupedFindings += count;
+	const categoryRollup = {};
+	for (const [category, count] of countByCategory) categoryRollup[`category.${toCategoryKey(category)}`] = count;
 	const attributes = {
-		outcome,
-		exitCode: wouldBlock ? 1 : 0,
-		wouldBlock,
-		blocking: blockingLevel,
-		scanClean: isClean,
-		totalDiagnostics: summary.totalDiagnosticCount,
-		errorCount: summary.errorCount,
-		warningCount: summary.warningCount,
-		affectedFiles: summary.affectedFileCount,
-		diagnosticsInTestFiles,
-		diagnosticsInStoryFiles,
-		distinctRulesFired: countByRule.size,
-		"diag.fixGroups": findingsPerFixGroup.size,
-		"diag.fixGroupedFindings": fixGroupedFindings,
-		topRule,
-		"migration.largestRuleBucketFiles": largestRuleBucket ? largestRuleBucket.fileCount : null,
-		"migration.largestRuleBucketSites": largestRuleBucket ? largestRuleBucket.siteCount : null,
-		"migration.largestRuleBucketRule": largestRuleBucket ? largestRuleBucket.ruleKey : null,
-		scannedFileCount: result.scannedFileCount ?? null,
-		lintCacheHitFiles: result.lintCacheHitFileCount ?? null,
-		lintCacheTotalFiles: result.lintCacheTotalFileCount ?? null,
-		lintCacheHitRatio: result.lintCacheTotalFileCount != null && result.lintCacheTotalFileCount > 0 ? (result.lintCacheHitFileCount ?? 0) / result.lintCacheTotalFileCount : null,
-		elapsedMs: result.elapsedMilliseconds,
-		scanPhaseMs: result.scanElapsedMilliseconds ?? null,
-		score: result.score ? result.score.score : null,
-		scoreLabel: result.score ? result.score.label : null,
-		scoreAvailable: result.score !== null,
-		skippedCheckCount: result.skippedChecks.length,
-		didLintFail: input.didLintFail ?? null,
-		lintFailureReasonKind: input.lintFailureReasonKind ?? null,
-		lintPartialFailureCount: input.lintPartialFailureCount ?? null,
-		lintDroppedFileCount: input.lintDroppedFileCount ?? null,
-		didDeadCodeFail: input.didDeadCodeFail ?? null,
-		supplyChainOverlapTimedOut: input.supplyChainOverlapTimedOut ?? null,
-		deadCodeOverlapped: input.deadCodeOverlapped ?? null
-	};
-	for (const [category, count] of countByCategory) attributes[`diag.category.${toCategoryKey(category)}`] = count;
-	if (result.baselineDelta) {
-		attributes["baseline.new"] = summary.totalDiagnosticCount;
-		attributes["baseline.fixed"] = result.baselineDelta.fixedCount;
-		attributes["baseline.baseTotal"] = result.baselineDelta.baseTotalCount;
-		attributes["baseline.degraded"] = false;
-	} else if (input.gateExempt) attributes["baseline.degraded"] = true;
+		...withNamespace("outcome", {
+			status: outcome,
+			exitCode: wouldBlock ? 1 : 0,
+			wouldBlock,
+			blocking: blockingLevel,
+			clean: isClean,
+			skippedChecks: result.skippedChecks.length
+		}),
+		...withNamespace("diag", {
+			total: summary.totalDiagnosticCount,
+			errors: summary.errorCount,
+			warnings: summary.warningCount,
+			affectedFiles: summary.affectedFileCount,
+			inTestFiles: diagnosticsInTestFiles,
+			inStoryFiles: diagnosticsInStoryFiles,
+			distinctRules: countByRule.size,
+			topRule,
+			fixGroups: findingsPerFixGroup.size,
+			fixGroupedFindings,
+			...categoryRollup
+		}),
+		...withNamespace("score", {
+			value: result.score ? result.score.score : null,
+			label: result.score ? result.score.label : null,
+			available: result.score !== null
+		}),
+		...withNamespace("lint", {
+			failed: input.didLintFail ?? null,
+			failureReasonKind: input.lintFailureReasonKind ?? null,
+			partialFailureCount: input.lintPartialFailureCount ?? null,
+			droppedFileCount: input.lintDroppedFileCount ?? null,
+			cacheHitFiles: result.lintCacheHitFileCount ?? null,
+			cacheTotalFiles: result.lintCacheTotalFileCount ?? null,
+			cacheHitRatio: result.lintCacheTotalFileCount != null && result.lintCacheTotalFileCount > 0 ? (result.lintCacheHitFileCount ?? 0) / result.lintCacheTotalFileCount : null
+		}),
+		...withNamespace("deadCode", {
+			failed: input.didDeadCodeFail ?? null,
+			overlapped: input.deadCodeOverlapped ?? null
+		}),
+		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut ?? null }),
+		...withNamespace("timing", {
+			elapsedMs: result.elapsedMilliseconds,
+			scanMs: result.scanElapsedMilliseconds ?? null
+		}),
+		...withNamespace("migration", {
+			largestRuleBucketFiles: largestRuleBucket ? largestRuleBucket.fileCount : null,
+			largestRuleBucketSites: largestRuleBucket ? largestRuleBucket.siteCount : null,
+			largestRuleBucketRule: largestRuleBucket ? largestRuleBucket.ruleKey : null
+		})
+	};
+	if (result.baselineDelta) Object.assign(attributes, withNamespace("baseline", {
+		new: summary.totalDiagnosticCount,
+		fixed: result.baselineDelta.fixedCount,
+		baseTotal: result.baselineDelta.baseTotalCount,
+		degraded: false
+	}));
+	else if (input.gateExempt) attributes["baseline.degraded"] = true;
 	return attributes;
 };
-const buildCiAttributes = () => {
+const buildActionAttributes = () => {
 	const { githubActorAssociation } = resolveGithubActionsScoreMetadata();
-	return {
+	return withNamespace("action", {
 		actorAssociation: githubActorAssociation ?? null,
 		runnerOs: detectRunnerOs(),
 		comment: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.comment),
 		reviewComments: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.reviewComments),
 		versionPin: resolveVersionPin(process.env[ACTION_INPUT_ENVIRONMENT_VARIABLES.version])
-	};
+	});
 };
-const buildConfigAttributes = (input) => {
+const buildScanAttributes = (input) => {
 	const ruleOverrides = input.userConfig?.rules ?? {};
 	const ruleKeys = Object.keys(ruleOverrides);
-	return {
+	return withNamespace("scan", {
 		mode: input.mode,
 		scope: input.scope,
 		parallel: input.parallel,
@@ -49032,12 +49243,18 @@ const buildConfigAttributes = (input) => {
 		ignoredTagCount: input.ignoredTagCount,
 		hasCustomConfig: input.hasCustomConfig,
 		rulesConfigured: ruleKeys.length,
-		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length
-	};
+		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
+		fileCount: input.result?.scannedFileCount ?? null
+	});
 };
 /**
-* Projects a scan into the flat attribute set for its root span — the canonical
-* per-scan "wide event". Pure and exported so the projection (outcome
+* Projects a scan into the namespaced attribute set for its root span — the
+* canonical per-scan "wide event". Every attribute carries a dotted namespace
+* that groups it by concept (`scan.*` config, `action.*` CI knobs, `outcome.*`
+* verdict, `diag.*` findings, `score.*`, `lint.*`, `deadCode.*`,
+* `supplyChain.*`, `timing.*`, `migration.*`, `baseline.*`) so the attributes
+* tree up in Sentry's attribute browser and stay filter-/group-/aggregate-able
+* in the Spans dataset. Pure and exported so the projection (outcome
 * precedence, rule/category rollups, CI knobs, config shape) is unit-testable
 * without a live Sentry client. `null` values are dropped so absent signals
 * never become misleading `"null"` attributes. The run + project base context
@@ -49046,8 +49263,8 @@ const buildConfigAttributes = (input) => {
 * those don't carry.
 */
 const buildRunEventAttributes = (input) => toSpanAttributes({
-	...buildConfigAttributes(input),
-	...buildCiAttributes(),
+	...buildScanAttributes(input),
+	...buildActionAttributes(),
 	...buildOutcomeAttributes(input)
 });
 /**
@@ -49711,6 +49928,7 @@ const CI_PITCH_EVENT = "ci-pitch";
 const ACTION_UPGRADE_EVENT = "action-upgrade-v2";
 const SETUP_HINT_EVENT = "setup-hint";
 const HANDOFF_TARGET_PREFERENCE_ID = "handoff-target";
+const INSTALL_AGENTS_PREFERENCE_ID = "install-agents";
 const foldLegacyDecisions = (projects, legacy, eventId) => {
 	for (const [hash, record] of Object.entries(legacy ?? {})) {
 		const existing = projects[hash] ?? { rootDirectory: record.rootDirectory ?? "" };
@@ -50374,7 +50592,7 @@ const readPackageJson = (projectRoot) => {
 		return null;
 	}
 };
-const writeJsonFile$1 = (filePath, value) => {
+const writeJsonFile = (filePath, value) => {
 	NFS.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
 };
 const packageHasDependency = (projectRoot, dependencyName) => {
@@ -51094,7 +51312,8 @@ const getStagedSourceFiles = async (directory) => {
 		return [...await runPromise(gen(function* () {
 			return yield* (yield* StagedFiles).discoverSourceFiles(directory);
 		}).pipe(provide(stagedFilesLayer)))];
-	} catch {
+	} catch (error) {
+		cliLogger.warn(`Failed to discover staged files: ${error instanceof Error ? error.message : String(error)}`);
 		return [];
 	}
 };
@@ -51113,6 +51332,35 @@ const materializeStagedFiles = async (directory, stagedFiles, tempDirectory) =>
 	};
 };
 //#endregion
+//#region src/cli/utils/is-environment-error.ts
+const isNodeSystemError = (error) => error instanceof Error && typeof error.code === "string";
+const ENVIRONMENT_ERROR_CODES = new Set([
+	"ENOSPC",
+	"EIO",
+	"EROFS",
+	"EACCES",
+	"EPERM",
+	"ENOTDIR"
+]);
+const isEnvironmentError = (error) => {
+	if (!isNodeSystemError(error)) return false;
+	if (error.code === "ENOENT") return error.syscall?.startsWith("spawn") ?? false;
+	return error.code !== void 0 && ENVIRONMENT_ERROR_CODES.has(error.code);
+};
+const formatEnvironmentError = (error) => {
+	if (!isNodeSystemError(error)) return error instanceof Error ? error.message : String(error);
+	switch (error.code) {
+		case "ENOSPC": return "No space left on device. Free up disk space and try again.";
+		case "EIO": return "I/O error: the filesystem or disk may be failing. Check your system logs.";
+		case "EROFS": return "Read-only filesystem: cannot write to this location.";
+		case "EACCES":
+		case "EPERM": return error.path ? `Permission denied accessing ${error.path}. Check file permissions and try again.` : "Permission denied. Check file permissions and try again.";
+		case "ENOTDIR": return error.path ? `A file exists at ${error.path} or one of its parent paths where a directory was expected.` : "A file exists where a directory was expected.";
+		case "ENOENT": return "Required command not found. Ensure the tool (e.g. git) is installed and on your PATH.";
+		default: return error.message;
+	}
+};
+//#endregion
 //#region src/cli/utils/handle-error.ts
 const OTLP_ENDPOINT_ENVIRONMENT_VARIABLE = "REACT_DOCTOR_OTLP_ENDPOINT";
 const OTLP_AUTH_HEADER_ENVIRONMENT_VARIABLE = "REACT_DOCTOR_OTLP_AUTH_HEADER";
@@ -51195,15 +51443,19 @@ const handleError = (error, options = {}) => {
 	process.exitCode = 1;
 };
 /**
-* Renderer for expected, user-actionable failures — a bad `--diff` value or
-* a base branch that isn't fetched. Prints just the (already human-readable)
-* message — no "Something went wrong", prefilled issue, Discord link, or
-* Sentry reference — because there is no bug to report.
+* Renderer for expected, user-actionable failures — a bad `--diff` value,
+* a base branch that isn't fetched, or environment errors like disk-full or
+* permission-denied. Prints just the (already human-readable) message — no
+* "Something went wrong", prefilled issue, Discord link, or Sentry reference
+* — because there is no bug to report.
 */
 const handleUserError = (error, options = {}) => {
+	const isEnvError = isEnvironmentError(error);
+	if (isEnvError) recordCount(METRIC.cliEnvironmentError, 1, { code: error.code ?? "unknown" });
+	const message = isEnvError ? formatEnvironmentError(error) : formatErrorForReport(error);
 	runSync(gen(function* () {
 		yield* error$1("");
-		yield* error$1(highlighter.error(formatErrorForReport(error)));
+		yield* error$1(highlighter.error(message));
 		yield* error$1("");
 	}));
 	if (options.shouldExit !== false) process.exit(1);
@@ -51218,7 +51470,7 @@ const handleUserError = (error, options = {}) => {
 * `handleUserError` (a plain message — no "Something went wrong", prefilled
 * issue, Discord link, or Sentry reference), since there is no bug to report.
 *
-* Three distinct shapes reach the CLI's catch blocks:
+* Four distinct shapes reach the CLI's catch blocks:
 *
 * - **Project-discovery failures** (`NoReactDependencyError`,
 *   `ProjectNotFoundError`, `PackageJsonNotFoundError`, `NotADirectoryError`,
@@ -51231,12 +51483,19 @@ const handleUserError = (error, options = {}) => {
 *   `--project` name.
 * - **Bad `--diff` input** (`GitBaseBranchInvalid` / `GitBaseBranchMissing`)
 *   stays the tagged `ReactDoctorError`, so dispatch on the reason `_tag`.
+* - **Environment failures** (`ENOSPC`, `EIO`, `EROFS`, `EACCES`, `EPERM`,
+*   `ENOTDIR`, plus a `spawn`-scoped `ENOENT` for a missing binary) — disk
+*   full / failing / read-only, permission denied, or a path blocked by a
+*   file. React Doctor cannot fix the user's environment; exit cleanly with an
+*   actionable message instead of crashing. See `is-environment-error.ts` for
+*   why the set stays narrow (codes that usually mean our bug keep reaching
+*   Sentry).
 *
 * This composes the existing core narrowers rather than introducing a new
 * error-shape helper (AGENTS.md): it encodes CLI-layer reporting policy, not
 * knowledge of the `ReactDoctorError` shape.
 */
-const isExpectedUserError = (error) => error instanceof CliInputError || isProjectDiscoveryError(error) || isReactDoctorError(error) && (error.reason._tag === "GitBaseBranchInvalid" || error.reason._tag === "GitBaseBranchMissing");
+const isExpectedUserError = (error) => error instanceof CliInputError || isProjectDiscoveryError(error) || isEnvironmentError(error) || isReactDoctorError(error) && (error.reason._tag === "GitBaseBranchInvalid" || error.reason._tag === "GitBaseBranchMissing");
 //#endregion
 //#region src/cli/utils/build-handoff-payload.ts
 const buildHandoffPayload = (input) => {
@@ -51317,6 +51576,20 @@ const detectAvailableAgents = async () => {
 	const detected = new Set([...detectPathAvailableAgents(), ...await detectInstalledSkillAgents()]);
 	return getSkillAgentTypes().filter((agent) => agent !== "universal" && detected.has(agent));
 };
+const DEFAULT_INSTALL_AGENTS = [
+	"claude-code",
+	"cursor",
+	"codex",
+	"opencode"
+];
+const computeDefaultSelectedAgents = (detectedAgents, rememberedAgents) => {
+	const detected = new Set(detectedAgents);
+	const remembered = rememberedAgents.filter((agent) => detected.has(agent));
+	if (remembered.length > 0) return remembered;
+	const defaults = DEFAULT_INSTALL_AGENTS.filter((agent) => detected.has(agent));
+	if (defaults.length > 0) return defaults;
+	return detectedAgents.length === 1 ? [...detectedAgents] : [];
+};
 //#endregion
 //#region src/cli/utils/install-doctor-script.ts
 const DOCTOR_SCRIPT_NAME = "doctor";
@@ -51398,7 +51671,7 @@ const installDoctorScript = (options) => {
 		};
 	})();
 	const scriptStatus = scriptTarget.status;
-	if (scriptStatus === "created") writeJsonFile$1(packageJsonPath, {
+	if (scriptStatus === "created") writeJsonFile(packageJsonPath, {
 		...packageJson,
 		scripts: {
 			...isRecord$1(scripts) ? scripts : {},
@@ -51969,32 +52242,59 @@ const setUpGitHubActions = async (options) => {
 	return didCreateWorkflow;
 };
 //#endregion
+//#region src/cli/utils/install-agents-preference.ts
+const INSTALL_AGENTS_PREFERENCE = {
+	id: INSTALL_AGENTS_PREFERENCE_ID,
+	scope: "global"
+};
+const PREFERENCE_SEPARATOR = ",";
+const readInstallAgents = (options = {}) => {
+	const stored = readPreference(INSTALL_AGENTS_PREFERENCE, {}, options);
+	if (stored === null) return [];
+	return stored.split(PREFERENCE_SEPARATOR).map((entry) => entry.trim()).filter((entry) => isSkillAgentType(entry));
+};
+const rememberInstallAgents = (agents, options = {}) => writePreference(INSTALL_AGENTS_PREFERENCE, agents.join(PREFERENCE_SEPARATOR), {}, options);
+//#endregion
 //#region src/cli/utils/install-agent-hooks.ts
 const CLAUDE_AGENT = "claude-code";
 const CURSOR_AGENT = "cursor";
 const CLAUDE_SETTINGS_RELATIVE_PATH = ".claude/settings.json";
-const CLAUDE_HOOK_RELATIVE_PATH = ".claude/hooks/react-doctor.sh";
-const CLAUDE_HOOK_COMMAND = "sh \"$CLAUDE_PROJECT_DIR/.claude/hooks/react-doctor.sh\"";
+const CLAUDE_HOOK_RELATIVE_PATH = ".claude/hooks/react-doctor.mjs";
+const CLAUDE_HOOK_COMMAND = "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/react-doctor.mjs\"";
 const CURSOR_HOOKS_RELATIVE_PATH = ".cursor/hooks.json";
-const CURSOR_HOOK_RELATIVE_PATH = ".cursor/hooks/react-doctor.sh";
+const CURSOR_HOOK_RELATIVE_PATH = ".cursor/hooks/react-doctor.mjs";
+const CURSOR_HOOK_COMMAND = "node .cursor/hooks/react-doctor.mjs";
 const CURSOR_HOOK_MATCHER = "Write|Edit|MultiEdit|ApplyPatch";
 const CURSOR_HOOKS_SCHEMA_VERSION = 1;
-const JSON_INDENT_SPACES$1 = 2;
 const isSupportedAgent = (agent) => agent === CLAUDE_AGENT || agent === CURSOR_AGENT;
 const readJsonFile = (filePath, fallback) => {
 	if (!NFS.existsSync(filePath)) return fallback;
 	const content = NFS.readFileSync(filePath, "utf8").trim();
 	if (content.length === 0) return fallback;
-	return JSON.parse(content);
+	try {
+		return JSON.parse(content);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new CliInputError(`Could not parse ${filePath}: the file contains invalid JSON. Fix the syntax errors in this file and re-run the install command.`);
+		throw error;
+	}
 };
-const writeJsonFile = (filePath, value) => {
-	NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
-	NFS.writeFileSync(filePath, `${JSON.stringify(value, null, JSON_INDENT_SPACES$1)}\n`);
+const ensureDirectoryExists = (directoryPath) => {
+	try {
+		NFS.mkdirSync(directoryPath, { recursive: true });
+	} catch (error) {
+		const code = error.code;
+		if (code === "EACCES" || code === "EPERM") throw new CliInputError(`Could not create directory ${directoryPath}: permission denied. Ensure you have write permissions for this location and re-run the install command.`);
+		if (code === "ENOTDIR" || code === "EEXIST") throw new CliInputError(`Could not create directory ${directoryPath}: a file exists at this path or one of its parent paths. Remove the conflicting file and re-run the install command.`);
+		throw error;
+	}
+};
+const writeJsonFileWithDirectoryCheck = (filePath, value) => {
+	ensureDirectoryExists(Path.dirname(filePath));
+	writeJsonFile(filePath, value);
 };
 const writeHookScript = (filePath) => {
-	NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
+	ensureDirectoryExists(Path.dirname(filePath));
 	NFS.writeFileSync(filePath, buildAgentHookScript());
-	NFS.chmodSync(filePath, 493);
 };
 const hasClaudeHookCommand = (groups) => groups.some((group) => (group.hooks ?? []).some((hook) => hook.command === CLAUDE_HOOK_COMMAND));
 const installClaudeHook = (projectRoot) => {
@@ -52008,14 +52308,14 @@ const installClaudeHook = (projectRoot) => {
 		command: CLAUDE_HOOK_COMMAND
 	}] });
 	hooks.PostToolBatch = postToolBatchHooks;
-	writeJsonFile(settingsPath, {
+	writeJsonFileWithDirectoryCheck(settingsPath, {
 		...settings,
 		hooks
 	});
 	writeHookScript(hookPath);
 	return [settingsPath, hookPath];
 };
-const hasCursorHookCommand = (handlers) => handlers.some((handler) => handler.command === CURSOR_HOOK_RELATIVE_PATH);
+const hasCursorHookCommand = (handlers) => handlers.some((handler) => handler.command === CURSOR_HOOK_COMMAND);
 const installCursorHook = (projectRoot) => {
 	const configPath = Path.join(projectRoot, CURSOR_HOOKS_RELATIVE_PATH);
 	const hookPath = Path.join(projectRoot, CURSOR_HOOK_RELATIVE_PATH);
@@ -52023,12 +52323,12 @@ const installCursorHook = (projectRoot) => {
 	const hooks = { ...config.hooks ?? {} };
 	const postToolUseHooks = [...hooks.postToolUse ?? []];
 	if (!hasCursorHookCommand(postToolUseHooks)) postToolUseHooks.push({
-		command: CURSOR_HOOK_RELATIVE_PATH,
+		command: CURSOR_HOOK_COMMAND,
 		matcher: CURSOR_HOOK_MATCHER,
 		timeout: 120
 	});
 	hooks.postToolUse = postToolUseHooks;
-	writeJsonFile(configPath, {
+	writeJsonFileWithDirectoryCheck(configPath, {
 		...config,
 		version: config.version ?? CURSOR_HOOKS_SCHEMA_VERSION,
 		hooks
@@ -52037,102 +52337,111 @@ const installCursorHook = (projectRoot) => {
 	return [configPath, hookPath];
 };
 const buildAgentHookScript = () => [
-	"#!/bin/sh",
-	"set -u",
+	"import { readFileSync, writeFileSync, unlinkSync } from 'node:fs';",
+	"import { tmpdir } from 'node:os';",
+	"import { join, dirname } from 'node:path';",
+	"import { fileURLToPath } from 'node:url';",
+	"import { spawnSync } from 'node:child_process';",
 	"",
-	"input_file=$(mktemp \"${TMPDIR:-/tmp}/react-doctor-agent-hook.XXXXXX\")",
-	"output_file=$(mktemp \"${TMPDIR:-/tmp}/react-doctor-agent-hook-output.XXXXXX\")",
-	"trap 'rm -f \"$input_file\" \"$output_file\"' EXIT",
-	"cat > \"$input_file\"",
+	"const __filename = fileURLToPath(import.meta.url);",
+	"const __dirname = dirname(__filename);",
 	"",
-	"script_dir=$(CDPATH= cd \"$(dirname \"$0\")\" && pwd)",
-	"project_root=${CLAUDE_PROJECT_DIR:-}",
-	"if [ -z \"$project_root\" ]; then",
-	"  project_root=$(CDPATH= cd \"$script_dir/../..\" && pwd)",
-	"fi",
-	"if ! cd \"$project_root\"; then",
-	"  exit 0",
-	"fi",
+	"const EDIT_TOOL_NAMES = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'ApplyPatch']);",
 	"",
-	"should_scan() {",
-	"  if ! command -v node >/dev/null 2>&1; then",
-	"    return 0",
-	"  fi",
+	"const readStdin = () => {",
+	"  try {",
+	"    return readFileSync(0, 'utf8');",
+	"  } catch {",
+	"    return '';",
+	"  }",
+	"};",
 	"",
-	"  node - \"$input_file\" <<'NODE'",
-	"const fs = require('node:fs');",
-	"const inputPath = process.argv[2];",
-	"const editToolNames = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit', 'ApplyPatch']);",
-	"try {",
-	"  const input = JSON.parse(fs.readFileSync(inputPath, 'utf8') || '{}');",
+	"const shouldScan = (input) => {",
 	"  const eventName = input.hook_event_name || input.eventName || input.event_name;",
 	"  if (eventName === 'PostToolBatch') {",
 	"    const toolCalls = Array.isArray(input.tool_calls) ? input.tool_calls : [];",
-	"    process.exit(toolCalls.some((toolCall) => editToolNames.has(toolCall.tool_name)) ? 0 : 10);",
+	"    return toolCalls.some((toolCall) => EDIT_TOOL_NAMES.has(toolCall.tool_name));",
 	"  }",
 	"  const toolName = input.tool_name || input.toolName || input.tool;",
-	"  process.exit(!toolName || editToolNames.has(toolName) ? 0 : 10);",
-	"} catch {",
-	"  process.exit(0);",
-	"}",
-	"NODE",
-	"}",
+	"  return !toolName || EDIT_TOOL_NAMES.has(toolName);",
+	"};",
 	"",
-	"run_react_doctor() {",
-	"  if [ -x ./node_modules/.bin/react-doctor ]; then",
-	"    ./node_modules/.bin/react-doctor --verbose --scope changed --blocking warning --no-score",
-	"    return",
-	"  fi",
+	"const runReactDoctor = (outputPath) => {",
+	"  // Each candidate is a single shell command string (not an args array):",
+	"  // `shell: true` is required to run the Windows `.cmd` shims, and an args",
+	"  // array with `shell: true` trips Node's DEP0190. A missing command exits",
+	"  // 127 via the shell (no ENOENT error), so fall through on that. With no",
+	"  // runner found, exit 0 silently — stdout is parsed as the hook's JSON.",
+	"  const commands = [",
+	"    './node_modules/.bin/react-doctor --verbose --scope changed --blocking warning --no-score',",
+	"    'react-doctor --verbose --scope changed --blocking warning --no-score',",
+	"    'pnpm dlx react-doctor@latest --verbose --scope changed --blocking warning --no-score',",
+	"    'npx --yes react-doctor@latest --verbose --scope changed --blocking warning --no-score',",
+	"  ];",
 	"",
-	"  if command -v react-doctor >/dev/null 2>&1; then",
-	"    react-doctor --verbose --scope changed --blocking warning --no-score",
-	"    return",
-	"  fi",
+	"  for (const command of commands) {",
+	"    const result = spawnSync(command, { encoding: 'utf8', shell: true });",
+	"    if (result.error?.code === 'ENOENT' || result.status === 127) continue;",
+	"    try {",
+	"      writeFileSync(outputPath, (result.stdout || '') + (result.stderr || ''));",
+	"    } catch {}",
+	"    return result.status;",
+	"  }",
 	"",
-	"  if command -v pnpm >/dev/null 2>&1; then",
-	"    pnpm dlx react-doctor@latest --verbose --scope changed --blocking warning --no-score",
-	"    return",
-	"  fi",
+	"  return 0;",
+	"};",
 	"",
-	"  if command -v npx >/dev/null 2>&1; then",
-	"    npx --yes react-doctor@latest --verbose --scope changed --blocking warning --no-score",
-	"    return",
-	"  fi",
+	"const cleanup = (...paths) => {",
+	"  for (const path of paths) {",
+	"    try { unlinkSync(path); } catch {}",
+	"  }",
+	"};",
 	"",
-	"  printf '%s\\n' 'react-doctor: command not found; skipping agent hook scan.'",
-	"  return 0",
-	"}",
+	"const main = () => {",
+	"  let input;",
+	"  try {",
+	"    const stdinContent = readStdin();",
+	"    input = JSON.parse(stdinContent || '{}');",
+	"  } catch {",
+	"    input = {};",
+	"  }",
 	"",
-	"if ! should_scan; then",
-	"  exit 0",
-	"fi",
+	"  if (!shouldScan(input)) {",
+	"    process.exit(0);",
+	"  }",
 	"",
-	"if run_react_doctor > \"$output_file\" 2>&1; then",
-	"  exit 0",
-	"fi",
+	"  const projectRoot = process.env.CLAUDE_PROJECT_DIR || join(__dirname, '../..');",
+	"  const outputPath = join(tmpdir(), `react-doctor-agent-hook-output-${process.pid}.txt`);",
 	"",
-	"node - \"$input_file\" \"$output_file\" <<'NODE'",
-	"const fs = require('node:fs');",
-	"const inputPath = process.argv[2];",
-	"const outputPath = process.argv[3];",
-	"const readInput = () => {",
 	"  try {",
-	"    return JSON.parse(fs.readFileSync(inputPath, 'utf8') || '{}');",
+	"    process.chdir(projectRoot);",
 	"  } catch {",
-	"    return {};",
+	"    process.exit(0);",
+	"  }",
+	"",
+	"  const scanResult = runReactDoctor(outputPath);",
+	"  if (scanResult === 0) {",
+	"    cleanup(outputPath);",
+	"    process.exit(0);",
+	"  }",
+	"",
+	"  const scanOutput = readFileSync(outputPath, 'utf8').trim();",
+	"  cleanup(outputPath);",
+	"",
+	"  if (!scanOutput) {",
+	"    process.exit(0);",
+	"  }",
+	"",
+	"  const message = `React Doctor found issues in the changed files. Review this output and fix the regressions before finishing. For confirmed issues that cannot be fixed now, create GitHub issues with the rule, file/line, confidence, impact, and proposed fix.\\n\\n${scanOutput}`;",
+	"",
+	"  if (input.hook_event_name === 'PostToolBatch') {",
+	"    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PostToolBatch', additionalContext: message } }));",
+	"  } else {",
+	"    console.log(JSON.stringify({ additional_context: message }));",
 	"  }",
 	"};",
-	"const input = readInput();",
-	"const scanOutput = fs.readFileSync(outputPath, 'utf8').trim();",
-	"if (!scanOutput) process.exit(0);",
-	"const message = `React Doctor found issues in the changed files. Review this output and fix the regressions before finishing. For confirmed issues that cannot be fixed now, create GitHub issues with the rule, file/line, confidence, impact, and proposed fix.\\n\\n${scanOutput}`;",
-	"if (input.hook_event_name === 'PostToolBatch') {",
-	"  console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PostToolBatch', additionalContext: message } }));",
-	"} else {",
-	"  console.log(JSON.stringify({ additional_context: message }));",
-	"}",
-	"NODE",
-	""
+	"",
+	"main();"
 ].join("\n");
 const installReactDoctorAgentHooks = (options) => {
 	const installedAgents = [];
@@ -52264,7 +52573,7 @@ const installPackageJsonHook = (options, strategy) => {
 		parent = cloned;
 	}
 	parent[leafKey] = strategy.leafShape === "array" ? appendArrayCommand(parent[leafKey]) : appendStringCommand(parent[leafKey]);
-	writeJsonFile$1(packageJsonPath, nextPackageJson);
+	writeJsonFile(packageJsonPath, nextPackageJson);
 	removeLegacyManagedRunner(options.projectRoot);
 	return {
 		hookPath: packageJsonPath,
@@ -52847,6 +53156,9 @@ const runInstallReactDoctor = async (options = {}) => {
 	const shouldUpgradeWorkflow = canUpgradeWorkflow && (Boolean(options.yes) || upgradePromptOutcome === "yes");
 	if (upgradePromptOutcome === "no" && !options.dryRun) recordActionUpgradeDecision(projectRoot, "declined");
 	if ((ciPromptOutcome === "yes" || ciPromptOutcome === "no") && !options.dryRun) recordCiPromptDecision(projectRoot, ciPromptOutcome === "yes" ? "accepted" : "declined");
+	const rememberedAgents = options.lastSelectedAgents ?? readInstallAgents();
+	const defaultSelectedAgents = computeDefaultSelectedAgents(detectedAgents, rememberedAgents);
+	const usedRememberedAgents = rememberedAgents.some((agent) => detectedAgents.includes(agent));
 	const selectedAgents = skipPrompts ? detectedAgents : (await prompt({
 		type: "multiselect",
 		name: "agents",
@@ -52854,12 +53166,13 @@ const runInstallReactDoctor = async (options = {}) => {
 		choices: detectedAgents.map((agent) => ({
 			title: getSkillAgentConfig(agent).displayName,
 			value: agent,
-			selected: true
+			selected: defaultSelectedAgents.includes(agent)
 		})),
 		instructions: false,
 		min: 1
 	}, promptOptions)).agents ?? [];
 	if (selectedAgents.length === 0) return;
+	if (!skipPrompts && !options.dryRun) rememberInstallAgents(selectedAgents);
 	let dependencyResult;
 	if (!options.dryRun) {
 		await installReactDoctorSkillStep(sourceDir, selectedAgents, projectRoot);
@@ -52918,6 +53231,8 @@ const runInstallReactDoctor = async (options = {}) => {
 	}
 	recordCount(METRIC.installCompleted, 1, {
 		agentsCount: selectedAgents.length,
+		agentsDetected: detectedAgents.length,
+		usedRememberedAgents,
 		gitHook: shouldInstallGitHook,
 		agentHooks: shouldInstallAgentHooks,
 		workflow: didInstallWorkflow,
@@ -52952,6 +53267,26 @@ const CLI_AGENT_AUTO_FLAGS = {
 	codex: ["--yolo"],
 	cursor: ["--force"]
 };
+const resolveCursorBundledNode = () => {
+	if (!isWindows) return null;
+	const localAppData = process.env.LOCALAPPDATA;
+	if (!localAppData) return null;
+	const cursorAgentRoot = Path.join(localAppData, "cursor-agent", "versions");
+	try {
+		const versions = NFS.readdirSync(cursorAgentRoot);
+		if (versions.length === 0) return null;
+		const sortedVersions = versions.sort((a, b) => b.localeCompare(a, void 0, { numeric: true }));
+		for (const version of sortedVersions) try {
+			const bundledNodePath = Path.join(cursorAgentRoot, version, "node.exe");
+			const entryScriptPath = Path.join(cursorAgentRoot, version, "index.js");
+			if (NFS.statSync(bundledNodePath).isFile() && NFS.statSync(entryScriptPath).isFile()) return {
+				command: bundledNodePath,
+				args: [entryScriptPath]
+			};
+		} catch {}
+	} catch {}
+	return null;
+};
 const resolveWindowsCmdEntryScript = (command) => {
 	if (!isWindows) return null;
 	const pathDirectories = (process.env.PATH ?? "").split(Path.delimiter).filter(Boolean);
@@ -52971,11 +53306,10 @@ const resolveWindowsCmdEntryScript = (command) => {
 	}
 	return null;
 };
-const spawnAgent = (command, args, cwd, shell = false) => new Promise((resolve, reject) => {
+const spawnAgent = (command, args, cwd) => new Promise((resolve, reject) => {
 	const child = spawn(command, [...args], {
 		cwd,
-		stdio: "inherit",
-		shell
+		stdio: "inherit"
 	});
 	child.on("error", reject);
 	child.on("close", (code) => resolve(code ?? 0));
@@ -52984,6 +53318,10 @@ const launchCliAgent = async (agentId, prompt, cwd) => {
 	const binary = CLI_AGENT_BINARIES[agentId];
 	const agentArgs = [...CLI_AGENT_AUTO_FLAGS[agentId], prompt];
 	if (isWindows) {
+		if (agentId === "cursor") {
+			const cursorResolution = resolveCursorBundledNode();
+			if (cursorResolution) return spawnAgent(cursorResolution.command, [...cursorResolution.args, ...agentArgs], cwd);
+		}
 		const entryScript = resolveWindowsCmdEntryScript(binary);
 		if (entryScript) return spawnAgent(process.execPath, [entryScript, ...agentArgs], cwd);
 	}
@@ -53697,7 +54035,7 @@ const warnDeprecatedDiff = (flags, userConfig) => {
 };
 const warnDiffUnavailable = (requested, isQuiet) => {
 	if (isQuiet) return;
-	if (typeof requested.base === "string") cliLogger.warn(`Could not compute diff against "${requested.base}" (merge-base failed or HEAD has no history). Running full scan.`);
+	if (typeof requested.base === "string") cliLogger.warn(`Could not compute diff against "${requested.base}" (git unavailable, ref not found, or merge-base failed). Running full scan.`);
 	else cliLogger.warn("No feature branch or uncommitted changes detected. Running full scan.");
 	cliLogger.break();
 };
@@ -53894,6 +54232,7 @@ const resolveRequestedProjects = (requestedNames, workspacePackages, rootDirecto
 	return requestedNames.map((requestedName) => {
 		const matched = workspacePackages.find((workspacePackage) => workspacePackage.name === requestedName || Path.basename(workspacePackage.directory) === requestedName);
 		if (matched) return matched.directory;
+		if (Path.basename(rootDirectory) === requestedName) return rootDirectory;
 		const candidateDirectory = Path.resolve(rootDirectory, requestedName);
 		if (isDirectory(candidateDirectory)) {
 			recordCount(METRIC.projectPathSelected);
@@ -54001,67 +54340,15 @@ const warnDeprecatedFailOn = (flags, userConfig) => {
 	cliLogger.warn(`${source} is deprecated; rename it to ${replacement}.`);
 };
 //#endregion
-//#region src/cli/utils/detect-ai-training-environment.ts
-const AI_TRAINING_ENV_VARS = [
-	["HF_DATASETS_CACHE", "huggingface"],
-	["HF_HOME", "huggingface"],
-	["HUGGINGFACE_HUB_CACHE", "huggingface"],
-	["CUDA_VISIBLE_DEVICES", "cuda"],
-	["NVIDIA_VISIBLE_DEVICES", "nvidia"],
-	["WANDB_RUN_ID", "wandb"],
-	["MLFLOW_RUN_ID", "mlflow"],
-	["MLFLOW_TRACKING_URI", "mlflow"],
-	["COMET_EXPERIMENT_KEY", "comet"],
-	["NEPTUNE_RUN_ID", "neptune"],
-	["RAY_WORKER_PROCESS", "ray"],
-	["RAY_ADDRESS", "ray"],
-	["MUJOCO_GL", "mujoco"],
-	["MUJOCO_PATH", "mujoco"],
-	["GYM_DISABLE_ENV_CHECKER", "gymnasium"],
-	["SAGEMAKER_BASE_DIR", "sagemaker"],
-	["AZURE_ML_MODEL_DIR", "azure-ml"],
-	["VERTEX_AI_LOG_LEVEL", "vertex-ai"],
-	["DAYTONA_WS_ID", "daytona"],
-	["DAYTONA_WS_NAME", "daytona"],
-	["E2B_SANDBOX_ID", "e2b"],
-	["MODAL_FUNCTION_ID", "modal"],
-	["MODAL_TASK_ID", "modal"],
-	["RUNPOD_POD_ID", "runpod"],
-	["HARBOR_URL", "harbor"],
-	["HARBOR_HOSTNAME", "harbor"],
-	["SWE_BENCH_TASK", "swe-bench"],
-	["SWEBENCH_TASK", "swe-bench"],
-	["SWE_AGENT_MODEL", "swe-agent"],
-	["KAGGLE_KERNEL_RUN_TYPE", "kaggle"],
-	["COLAB_BACKEND_VERSION", "google-colab"],
-	["DATABRICKS_RUNTIME_VERSION", "databricks"],
-	["SM_TRAINING_ENV", "sagemaker"],
-	["TRAINING_JOB_ARN", "sagemaker"],
-	["AZUREML_RUN_ID", "azure-ml"],
-	["CLOUD_ML_PROJECT_ID", "vertex-ai"],
-	["WANDB_SWEEP_ID", "wandb"],
-	["DVC_STAGE", "dvc"],
-	["CLEARML_TASK_ID", "clearml"],
-	["FLYTE_INTERNAL_EXECUTION_ID", "flyte"],
-	["DET_MASTER", "determined-ai"],
-	["LIGHTNING_USER_ID", "lightning-ai"],
-	["ARGO_WORKFLOW_NAME", "argo-workflows"],
-	["KFP_POD_NAME", "kubeflow-pipelines"],
-	["SPACE_ID", "huggingface-spaces"],
-	["REPLICATE_USERNAME", "replicate"],
-	["VAST_CONTAINERLABEL", "vast-ai"],
-	["TPU_NAME", "google-tpu"],
-	["ROCR_VISIBLE_DEVICES", "rocm"]
-];
-const detectAiTrainingEnvironment = () => {
-	for (const [envVar, label] of AI_TRAINING_ENV_VARS) if (process.env[envVar] !== void 0) return label;
-	return null;
-};
-//#endregion
 //#region src/cli/utils/warn-ai-training-environment.ts
+let didWarnAiTraining = false;
 const warnIfAiTrainingEnvironment = () => {
-	if (detectAiTrainingEnvironment() === null) return;
-	cliLogger.warn("react-doctor detected use in an AI or ML pipeline. This use requires written permission under the react-doctor license — contact founders@million.dev to request access.");
+	if (didWarnAiTraining) return;
+	const detected = detectAiTrainingEnvironment();
+	if (detected === null) return;
+	didWarnAiTraining = true;
+	process.stderr.write(`${highlighter.warn("react-doctor detected use in an AI or ML pipeline. This use requires written permission under the react-doctor license — contact founders@million.dev to request access.")}\n`);
+	recordCount(METRIC.aiTrainingWarningShown, 1, { environment: detected });
 };
 //#endregion
 //#region src/cli/utils/validate-mode-flags.ts
@@ -54147,10 +54434,14 @@ const inspectAction = async (directory, flags) => {
 	const isQuiet = isScoreOnly || isJsonMode;
 	const requestedDirectory = Path.resolve(directory);
 	const startTime = performance$1.now();
-	if (isJsonMode) enableJsonMode({
-		compact: Boolean(flags.jsonCompact),
-		directory: requestedDirectory
-	});
+	if (isJsonMode) {
+		enableJsonMode({
+			compact: Boolean(flags.jsonCompact),
+			directory: requestedDirectory,
+			outputFile: flags.jsonOut
+		});
+		if (flags.jsonOut) recordCount(METRIC.jsonOutUsed, 1);
+	}
 	recordCount(METRIC.cliInvoked, 1, { command: "inspect" });
 	try {
 		validateModeFlags(flags);
@@ -54452,6 +54743,10 @@ const installAction = async (options, command) => {
 			projectRoot: options.cwd ?? process.cwd()
 		});
 	} catch (error) {
+		if (isExpectedUserError(error)) {
+			handleUserError(error);
+			return;
+		}
 		handleError(error, { sentryEventId: await reportErrorToSentry(error) });
 	}
 };
@@ -55084,6 +55379,14 @@ const applyColorPreference = (argv, env = process.env) => {
 	setColorEnabled(enabled);
 };
 //#endregion
+//#region src/cli/utils/ensure-windows-utf8-console.ts
+const ensureWindowsUtf8Console = () => {
+	if (process.platform !== "win32" || !process.stdout.isTTY) return;
+	try {
+		execFileSync("chcp.com", ["65001"], { stdio: "ignore" });
+	} catch {}
+};
+//#endregion
 //#region src/cli/utils/exit-gracefully.ts
 const exitGracefully = () => {
 	try {
@@ -55226,6 +55529,7 @@ const ROOT_FLAG_SPEC = {
 		"--category",
 		"--changed-files-from",
 		"--blocking",
+		"--json-out",
 		"--output-dir",
 		"--fail-on",
 		"--project",
@@ -55416,7 +55720,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CANONICAL_GITHUB_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -55441,6 +55745,7 @@ if (process.argv.includes("-V") && !strippedArgv.includes("-V")) {
 	process.exit(0);
 }
 applyColorPreference(strippedArgv);
+ensureWindowsUtf8Console();
 const argv = normalizeHelpInvocation(strippedArgv, knownCommands);
 Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => program.parseAsync(argv)).then(() => flushSentry()).catch(async (error) => {
 	const isUserError = isExpectedUserError(error);
@@ -55459,4 +55764,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=34e4ad65-2650-5e3e-afd8-191931eb2a47
+//# debugId=eb7a01bc-f737-5207-b430-b8fee7a1895f