react-doctor 0.5.8-dev.f4e8e4b → 0.5.8-dev.f69f216

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6a2c86b6-c3a8-5e50-8e7b-daef840df200")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="fabe3e34-b40f-514e-a5af-fa68a36365ae")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -26,7 +26,7 @@ import tty from "node:tty";
 import { codeFrameColumns } from "@babel/code-frame";
 import Conf from "conf";
 import basePrompts from "prompts";
-import { SKILL_MANIFEST_FILE, detectInstalledSkillAgents, getSkillAgentConfig, getSkillAgentTypes, installSkillsFromSource } from "agent-install";
+import { SKILL_MANIFEST_FILE, detectInstalledSkillAgents, getSkillAgentConfig, getSkillAgentTypes, installSkillsFromSource, isSkillAgentType } from "agent-install";
 import { generateCode, loadFile, writeFile } from "magicast";
 import { getConfigFromVariableDeclaration, getDefaultExportOptions } from "magicast/helpers";
 //#region \0rolldown/runtime.js
@@ -9041,7 +9041,7 @@ const composePassthrough = /* @__PURE__ */ dual(2, (left, right) => (input) => {
 * @since 2.0.0
 */
 const Scheduler = /* @__PURE__ */ Reference("effect/Scheduler", { defaultValue: () => new MixedScheduler() });
-const setImmediate = "setImmediate" in globalThis ? (f) => {
+const setImmediate$1 = "setImmediate" in globalThis ? (f) => {
 	const timer = globalThis.setImmediate(f);
 	return () => globalThis.clearImmediate(timer);
 } : (f) => {
@@ -9085,7 +9085,7 @@ var PriorityBuckets = class {
 var MixedScheduler = class {
 	executionMode;
 	setImmediate;
-	constructor(executionMode = "async", setImmediateFn = setImmediate) {
+	constructor(executionMode = "async", setImmediateFn = setImmediate$1) {
 		this.executionMode = executionMode;
 		this.setImmediate = setImmediateFn;
 	}
@@ -9110,7 +9110,7 @@ var MixedSchedulerDispatcher = class {
 	tasks = /* @__PURE__ */ new PriorityBuckets();
 	running = void 0;
 	setImmediate;
-	constructor(setImmediateFn = setImmediate) {
+	constructor(setImmediateFn = setImmediate$1) {
 		this.setImmediate = setImmediateFn;
 	}
 	/**
@@ -36862,6 +36862,7 @@ const DOCS_URL = "https://react.doctor/docs";
 const DOCS_RULES_BASE_URL = `${DOCS_URL}/rules`;
 const FETCH_TIMEOUT_MS = 1e4;
 const GITHUB_VIEWER_PERMISSION_TIMEOUT_MS = 2e3;
+const SPAWN_ARGS_MAX_LENGTH_CHARS = 24e3;
 const PER_WORKER_MEM_BUDGET_BYTES = 1024 * 1024 * 1024;
 const DEFAULT_BRANCH_CANDIDATES = ["main", "master"];
 const ADOPTABLE_LINT_CONFIG_FILENAMES = [".oxlintrc.json", ".eslintrc.json"];
@@ -36946,6 +36947,7 @@ const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
 const LINT_PHASE_TIMEOUT_MS = 3e5;
 const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
+const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
 const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
 const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
 const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
@@ -37679,7 +37681,10 @@ for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_N
 	NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
 }
 const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
-const canonicalizeRuleKey = (ruleKey) => LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey] ?? ruleKey;
+const canonicalizeRuleKey = (ruleKey) => {
+	const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
+	return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
+};
 const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
 const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
 	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
@@ -38553,7 +38558,7 @@ const resolveScanConcurrency = (requested) => {
 	if (!Number.isFinite(requested) || requested < 1) return 1;
 	return Math.min(Math.floor(requested), 32);
 };
-const readSystemFacts = () => ({
+const readSystemFacts$1 = () => ({
 	availableCores: os.availableParallelism(),
 	totalMemoryBytes: os.totalmem(),
 	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
@@ -38574,7 +38579,7 @@ const readSystemFacts = () => ({
 * `facts` is injectable so tests exercise core-bound, memory-bound, cgroup-
 * limited, and ceiling cases without mocking `os` or the filesystem.
 */
-const resolveAutoScanConcurrency = (facts = readSystemFacts()) => {
+const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
 	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
@@ -38765,6 +38770,12 @@ const BOOLEAN_FIELD_NAMES = [
 	"adoptExistingLintConfig"
 ];
 const STRING_FIELD_NAMES = ["rootDir"];
+const STRING_ARRAY_FIELD_NAMES = [
+	"projects",
+	"textComponents",
+	"rawTextWrapperComponents",
+	"serverAuthFunctionNames"
+];
 const SURFACE_CONTROL_FIELD_NAMES = [
 	"includeTags",
 	"excludeTags",
@@ -38866,6 +38877,7 @@ const validateConfigTypes = (config) => {
 	const validated = { ...config };
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
+	for (const fieldName of STRING_ARRAY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateStringArrayField(fieldName, value));
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
 	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
@@ -40128,7 +40140,10 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy)
 	}
 	return true;
 };
-const checkSecurityScan = (rootDirectory, options = {}) => {
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
+const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? buildCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
 	const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
@@ -40143,7 +40158,7 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 			committedFilesOnly: rule.committedFilesOnly === true
 		}];
 	});
-	if (enabledScanRules.length === 0) return [];
+	if (enabledScanRules.length === 0) return null;
 	const diagnostics = [];
 	const seen = /* @__PURE__ */ new Set();
 	const gitIgnoredCache = /* @__PURE__ */ new Map();
@@ -40155,15 +40170,34 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 		}
 		return status === true;
 	};
-	for (const file of collectSecurityScanFiles(rootDirectory)) for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
-		if (committedFilesOnly && isFileGitIgnored(file)) continue;
-		const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
-		const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
-		if (seen.has(key)) continue;
-		seen.add(key);
-		diagnostics.push(diagnostic);
+	const scanFile = (file) => {
+		for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
+			if (committedFilesOnly && isFileGitIgnored(file)) continue;
+			const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
+			const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			diagnostics.push(diagnostic);
+		}
+	};
+	return {
+		scanFile,
+		diagnostics
+	};
+};
+const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const session = createSecurityScanSession(rootDirectory, options);
+	if (session === null) return [];
+	let filesSinceYield = 0;
+	for (const file of collectSecurityScanFiles(rootDirectory)) {
+		session.scanFile(file);
+		filesSinceYield += 1;
+		if (filesSinceYield >= 16) {
+			filesSinceYield = 0;
+			await yieldToEventLoop();
+		}
 	}
-	return diagnostics;
+	return session.diagnostics;
 };
 var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {}, argv = p.argv || [], env = p.env || {};
@@ -40396,6 +40430,74 @@ const collectDeadCodeIgnorePatterns = (rootDirectory) => {
 	return [...seen].filter((pattern) => pattern.length > 0);
 };
 const collectDeadCodeEntryPatterns = (rootDirectory) => [...new Set(collectKnipPatterns(rootDirectory, "entry"))].filter((pattern) => pattern.length > 0);
+const readSystemFacts = () => ({
+	availableCores: os.availableParallelism(),
+	totalMemoryBytes: os.totalmem(),
+	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
+});
+/**
+* How many real deslop dead-code child processes may run at once, across the
+* concurrent per-project `runInspect` fibers of one CLI run. The cap is the
+* smaller of the core count and the number of `DEAD_CODE_WORKER_MEM_BUDGET_BYTES`
+* workers that fit in available memory, floored at 1.
+*
+* On a roomy dev box / CI runner this resolves high enough that every
+* concurrently-scanned project still spawns its own worker (no serialization vs
+* the prior uncapped behavior); on a memory-constrained runner it collapses
+* toward 1, so the `withDeadCodeWorkerSlot` semaphore serializes the spawns
+* instead of oversubscribing memory with N simultaneous children — the global
+* cap the per-project spawn path lacked.
+*
+* Mirrors `resolveAutoScanConcurrency` (lint), but budgets memory per the
+* heavier dead-code worker. `facts` is injectable for tests.
+*/
+const resolveDeadCodeConcurrency = (facts = readSystemFacts()) => {
+	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
+	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / DEAD_CODE_WORKER_MEM_BUDGET_BYTES);
+	return Math.max(1, Math.min(facts.availableCores, memoryBoundedWorkers));
+};
+let availableSlots = -1;
+const waiters = [];
+const releaseSlot = () => {
+	const nextWaiter = waiters.shift();
+	if (nextWaiter !== void 0) nextWaiter();
+	else availableSlots += 1;
+};
+/**
+* Runs `task` once a dead-code worker slot is free, releasing the slot when the
+* task settles (success or failure). With a high cap (roomy machine) every
+* caller proceeds immediately; with a low cap (constrained runner) callers
+* queue and run as slots free.
+*
+* `abortSignal` short-circuits the WAIT: if it's already aborted, or fires while
+* this caller is queued, the call rejects without acquiring a slot or running
+* `task` — so a cancelled scan (e.g. lint failed) doesn't sit in the queue and
+* then spawn a child only to tear it down. A queued caller that aborts removes
+* its own waiter so a later release never hands a slot to a dead request.
+*/
+const withDeadCodeWorkerSlot = async (task, abortSignal) => {
+	if (abortSignal?.aborted) throw new Error("Dead-code worker aborted.");
+	if (availableSlots < 0) availableSlots = resolveDeadCodeConcurrency();
+	if (availableSlots > 0) availableSlots -= 1;
+	else await new Promise((resolve, reject) => {
+		const waiter = () => {
+			abortSignal?.removeEventListener("abort", onAbort);
+			resolve();
+		};
+		const onAbort = () => {
+			const queuedIndex = waiters.indexOf(waiter);
+			if (queuedIndex !== -1) waiters.splice(queuedIndex, 1);
+			reject(/* @__PURE__ */ new Error("Dead-code worker aborted."));
+		};
+		waiters.push(waiter);
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return await task();
+	} finally {
+		releaseSlot();
+	}
+};
 /**
 * Resolves a path to its canonical, symlink-free form, falling back to
 * the input when it cannot be realpath'd (broken symlink, permission
@@ -40686,14 +40788,17 @@ const checkDeadCode = async (options) => {
 	if (!NFS.existsSync(Path.join(rootDirectory, "package.json"))) return [];
 	const entryPatterns = collectDeadCodeEntryPatterns(rootDirectory);
 	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory);
-	const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
-		rootDirectory,
-		entryPatterns,
-		tsConfigPath: resolveTsConfigPath(rootDirectory),
-		ignorePatterns,
-		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
-		parseConcurrency: options.parseConcurrency
-	}), options.workerTimeoutMs ?? 12e4, options.abortSignal));
+	const spawnAndRun = () => {
+		return runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
+			rootDirectory,
+			entryPatterns,
+			tsConfigPath: resolveTsConfigPath(rootDirectory),
+			ignorePatterns,
+			deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
+			parseConcurrency: options.parseConcurrency
+		}), options.workerTimeoutMs ?? 12e4, options.abortSignal);
+	};
+	const result = parseDeadCodeWorkerResult(options.createWorker === void 0 ? await withDeadCodeWorkerSlot(spawnAndRun, options.abortSignal) : await spawnAndRun());
 	const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -41094,43 +41199,46 @@ var Git = class Git extends Service()("react-doctor/Git") {
 		* reason: GitInvocationFailed })` so the rest of the codebase
 		* sees a single failure channel.
 		*/
-		const runCommand = (input) => scoped(gen(function* () {
-			const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
-				cwd: input.directory,
-				env: input.env,
-				extendEnv: true
-			}));
-			const maxStdoutBytes = input.maxStdoutBytes;
-			const stdoutByteCount = yield* make$13(0);
-			const [stdout, stderr, status] = yield* all([
-				mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
-					args: [...input.args],
-					directory: input.directory,
-					cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
-				}) })) : void_)))))),
-				mkString(decodeText(handle.stderr)),
-				handle.exitCode
-			], { concurrency: 3 });
-			return {
-				status,
-				stdout,
-				stderr
-			};
-		})).pipe(catchTag$1("PlatformError", (cause) => {
-			if (input.command !== "git") return succeed$2({
+		const runCommand = (input) => {
+			const foldSpawnFailure = (cause) => input.command !== "git" ? succeed$2({
 				status: 127,
 				stdout: "",
 				stderr: String(cause)
-			});
-			return new ReactDoctorError({ reason: new GitInvocationFailed({
+			}) : fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
 				args: [...input.args],
 				directory: input.directory,
 				cause
-			}) });
-		}), withSpan("git.exec", { attributes: {
-			"git.command": input.command,
-			"git.subcommand": input.args[0] ?? ""
-		} }));
+			}) }));
+			return scoped(gen(function* () {
+				if (!isDirectory(input.directory)) return yield* foldSpawnFailure(`spawn ENOTDIR (cwd is not a directory: ${input.directory})`);
+				const argvLengthChars = input.command.length + 1 + input.args.reduce((total, arg) => total + arg.length + 1, 0);
+				if (argvLengthChars > 24e3) return yield* foldSpawnFailure(`spawn ENAMETOOLONG (${argvLengthChars} argv chars exceed ${SPAWN_ARGS_MAX_LENGTH_CHARS})`);
+				const handle = yield* spawner.spawn(make$1(input.command, [...input.args], {
+					cwd: input.directory,
+					env: input.env,
+					extendEnv: true
+				}));
+				const maxStdoutBytes = input.maxStdoutBytes;
+				const stdoutByteCount = yield* make$13(0);
+				const [stdout, stderr, status] = yield* all([
+					mkString(decodeText(maxStdoutBytes === void 0 ? handle.stdout : handle.stdout.pipe(tap((chunk) => updateAndGet(stdoutByteCount, (total) => total + chunk.length).pipe(flatMap$2((total) => total > maxStdoutBytes ? fail$4(new ReactDoctorError({ reason: new GitInvocationFailed({
+						args: [...input.args],
+						directory: input.directory,
+						cause: /* @__PURE__ */ new Error(`git stdout exceeded ${maxStdoutBytes} bytes`)
+					}) })) : void_)))))),
+					mkString(decodeText(handle.stderr)),
+					handle.exitCode
+				], { concurrency: 3 });
+				return {
+					status,
+					stdout,
+					stderr
+				};
+			})).pipe(catchTag$1("PlatformError", foldSpawnFailure), withSpan("git.exec", { attributes: {
+				"git.command": input.command,
+				"git.subcommand": input.args[0] ?? ""
+			} }));
+		};
 		const runGit = (directory, args) => runCommand({
 			command: "git",
 			args,
@@ -41163,7 +41271,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			"rev-parse",
 			"--verify",
 			branch
-		]).pipe(map$3((result) => result.status === 0));
+		]).pipe(map$3((result) => result.status === 0), catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(false) : fail$4(error)));
 		const headSha = (directory) => runGit(directory, ["rev-parse", "HEAD"]).pipe(map$3((result) => result.status === 0 ? trimOrNull(result.stdout) : null));
 		const mergeBase = (input) => isSafeGitRevision(input.ref) ? runGit(input.directory, [
 			"merge-base",
@@ -41377,7 +41485,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 				]);
 				if (result.status !== 0) return null;
 				return parseChangedLineRanges(result.stdout);
-			}).pipe(withSpan("Git.changedLineRanges"))
+			}).pipe(catch_$1((error) => error.reason._tag === "GitInvocationFailed" ? succeed$2(null) : fail$4(error)), withSpan("Git.changedLineRanges"))
 		});
 	})).pipe(provide$2(layer$3.pipe(provide$2(mergeAll$1(layer$2, layer$1)))));
 	/**
@@ -43854,7 +43962,10 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      diagnostics).
 *   2. beforeLint hook (e.g. CLI renders the project-detection block)
 *   3. environment checks (reduced-motion + pnpm hardening +
-*      expo/react-native + security scan), collected synchronously
+*      expo/react-native), collected synchronously. The heavier
+*      content-regex security scan is forked instead (like supply-chain
+*      below) and joined before the concat, so its CPU overlaps lint
+*      rather than blocking the event loop before it.
 *   4. The supply-chain check (Socket.dev) is forked onto a background
 *      fiber so its ~100% network-bound time overlaps the ~100%
 *      CPU/subprocess-bound lint pass below, collapsing two serial
@@ -43874,7 +43985,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      order, so terminal output is identical either way; supply-chain
 *      rides alongside without a spinner.
 *   6. Join the supply-chain fiber, then assemble the diagnostics in a
-*      FIXED order (env, supply-chain, lint, dead-code) so the output is
+*      FIXED order (env, security-scan, supply-chain, lint, dead-code) so the output is
 *      byte-identical regardless of which fiber settled first. The
 *      viewer-permission fiber is joined later, during score-metadata
 *      assembly (it feeds score metadata, not diagnostics). The per-element
@@ -43935,12 +44046,12 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkPnpmHardening(scanDirectory),
 		...checkReactServerComponentsAdvisory(scanDirectory, project),
 		...checkExpoProject(scanDirectory, project),
-		...checkReactNativeProject(scanDirectory, project),
-		...checkSecurityScan(scanDirectory, {
-			project,
-			ignoredTags: input.ignoredTags
-		})
+		...checkReactNativeProject(scanDirectory, project)
 	])));
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(promise(() => checkSecurityScanCooperative(scanDirectory, {
+		project,
+		ignoredTags: input.ignoredTags
+	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)))))).pipe(withSpan("SecurityScan.run")));
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
 	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
@@ -44076,9 +44187,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	else yield* scanProgress.succeed(`Scanned ${scannedFilesLabel} in ${scanElapsedSeconds}s${workerCountSuffix}`);
 	const supplyChainResult = yield* join(supplyChainFiber);
 	const supplyChainCollected = supplyChainResult.diagnostics;
+	const securityScanCollected = yield* join(securityScanFiber);
 	yield* reporterService.finalize;
 	const finalDiagnostics = sortDiagnosticsStable(assignFixGroups([
 		...envCollected,
+		...securityScanCollected,
 		...supplyChainCollected,
 		...lintCollected,
 		...deadCodeCollected
@@ -44617,6 +44730,61 @@ const computeConfigFingerprint = (projectDirectory, version) => {
 	}
 	return crypto.createHash("sha1").update(parts.join("|")).digest("hex");
 };
+const AI_TRAINING_ENV_VARS = [
+	["HF_DATASETS_CACHE", "huggingface"],
+	["HF_HOME", "huggingface"],
+	["HUGGINGFACE_HUB_CACHE", "huggingface"],
+	["SPACE_ID", "huggingface-spaces"],
+	["CUDA_VISIBLE_DEVICES", "cuda"],
+	["NVIDIA_VISIBLE_DEVICES", "nvidia"],
+	["ROCR_VISIBLE_DEVICES", "rocm"],
+	["TPU_NAME", "google-tpu"],
+	["WANDB_RUN_ID", "wandb"],
+	["WANDB_SWEEP_ID", "wandb"],
+	["MLFLOW_RUN_ID", "mlflow"],
+	["MLFLOW_TRACKING_URI", "mlflow"],
+	["COMET_EXPERIMENT_KEY", "comet"],
+	["NEPTUNE_RUN_ID", "neptune"],
+	["CLEARML_TASK_ID", "clearml"],
+	["DVC_STAGE", "dvc"],
+	["RAY_WORKER_PROCESS", "ray"],
+	["RAY_ADDRESS", "ray"],
+	["MUJOCO_GL", "mujoco"],
+	["MUJOCO_PATH", "mujoco"],
+	["GYM_DISABLE_ENV_CHECKER", "gymnasium"],
+	["SM_TRAINING_ENV", "sagemaker"],
+	["TRAINING_JOB_ARN", "sagemaker"],
+	["SAGEMAKER_BASE_DIR", "sagemaker"],
+	["AZUREML_RUN_ID", "azure-ml"],
+	["AZURE_ML_MODEL_DIR", "azure-ml"],
+	["CLOUD_ML_PROJECT_ID", "vertex-ai"],
+	["VERTEX_AI_LOG_LEVEL", "vertex-ai"],
+	["DET_MASTER", "determined-ai"],
+	["LIGHTNING_USER_ID", "lightning-ai"],
+	["FLYTE_INTERNAL_EXECUTION_ID", "flyte"],
+	["ARGO_WORKFLOW_NAME", "argo-workflows"],
+	["KFP_POD_NAME", "kubeflow-pipelines"],
+	["KAGGLE_KERNEL_RUN_TYPE", "kaggle"],
+	["COLAB_BACKEND_VERSION", "google-colab"],
+	["DATABRICKS_RUNTIME_VERSION", "databricks"],
+	["DAYTONA_WS_ID", "daytona"],
+	["DAYTONA_WS_NAME", "daytona"],
+	["E2B_SANDBOX_ID", "e2b"],
+	["MODAL_FUNCTION_ID", "modal"],
+	["MODAL_TASK_ID", "modal"],
+	["RUNPOD_POD_ID", "runpod"],
+	["REPLICATE_USERNAME", "replicate"],
+	["VAST_CONTAINERLABEL", "vast-ai"],
+	["HARBOR_URL", "harbor"],
+	["HARBOR_HOSTNAME", "harbor"],
+	["SWE_BENCH_TASK", "swe-bench"],
+	["SWEBENCH_TASK", "swe-bench"],
+	["SWE_AGENT_MODEL", "swe-agent"]
+];
+const detectAiTrainingEnvironment = () => {
+	for (const [envVar, label] of AI_TRAINING_ENV_VARS) if (process.env[envVar]) return label;
+	return null;
+};
 const groupBy = (items, keyFn) => {
 	const groups = /* @__PURE__ */ new Map();
 	for (const item of items) {
@@ -44702,7 +44870,25 @@ const CI_PROVIDER_BY_ENVIRONMENT_VARIABLE = [
 	["TEAMCITY_VERSION", "teamcity"],
 	["BITBUCKET_BUILD_NUMBER", "bitbucket"],
 	["TRAVIS", "travis"],
-	["DRONE", "drone"]
+	["DRONE", "drone"],
+	["SEMAPHORE", "semaphore"],
+	["APPVEYOR", "appveyor"],
+	["HARNESS_BUILD_ID", "harness"],
+	["BUDDY", "buddy"],
+	["CF_BUILD_ID", "codefresh"],
+	["NETLIFY", "netlify"],
+	["RAILWAY_SERVICE_ID", "railway"],
+	["VERCEL", "vercel"],
+	["CM_BUILD_ID", "codemagic"],
+	["PROW_JOB_ID", "prow"],
+	["AGOLA_GIT_REF", "agola"],
+	["CIRRUS_CI", "cirrus-ci"],
+	["BLACKSMITH_STICKYDISK_TOKEN", "blacksmith"],
+	["WARPBUILD_RUNNER_VERIFICATION_TOKEN", "warpbuild"],
+	["NSC_CACHE_PATH", "namespace"],
+	["UBICLOUD_CACHE_URL", "ubicloud"],
+	["RENDER", "render"],
+	["FLY_APP_NAME", "fly-io"]
 ];
 const GITHUB_ACTION_MARKER_ENVIRONMENT_VARIABLE = "REACT_DOCTOR_GITHUB_ACTION";
 const ACTION_INPUT_ENVIRONMENT_VARIABLES = {
@@ -44720,7 +44906,10 @@ const CODING_AGENT_BY_ENVIRONMENT_VARIABLE = [
 	["CODEX_SANDBOX_NETWORK_DISABLED", "codex"],
 	["OPENCODE", "opencode"],
 	["GOOSE_TERMINAL", "goose"],
-	["AMP_THREAD_ID", "amp"]
+	["AMP_THREAD_ID", "amp"],
+	["CLINE_ACTIVE", "cline"],
+	["AUGMENT_AGENT", "augment"],
+	["TRAE_AI_SHELL_ID", "trae-ai"]
 ];
 const GENERIC_CODING_AGENT_ENVIRONMENT_VARIABLES = ["AGENT_SESSION_ID", "AGENT_THREAD_ID"];
 const CODING_AGENT_ENVIRONMENT_VALUE_VARIABLES = ["AGENT"];
@@ -44839,6 +45028,7 @@ const NANOSECONDS_PER_SECOND = 1000000000n;
 const METRIC = {
 	cliInvoked: "cli.invoked",
 	cliError: "cli.error",
+	cliEnvironmentError: "cli.env_error",
 	projectDetected: "project.detected",
 	projectPathSelected: "project.path_selected",
 	projectConfigSelected: "project.config_selected",
@@ -44868,7 +45058,9 @@ const METRIC = {
 	lspSessionStarted: "lsp.session.started",
 	lspScanCompleted: "lsp.scan.completed",
 	lspScanDuration: "lsp.scan.duration",
-	lspScanDiagnostics: "lsp.scan.diagnostics"
+	lspScanDiagnostics: "lsp.scan.diagnostics",
+	aiTrainingWarningShown: "ai.training.warning_shown",
+	jsonOutUsed: "json.out_used"
 };
 //#endregion
 //#region src/cli/utils/noop-console.ts
@@ -44911,7 +45103,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.5.8-dev.f4e8e4b";
+const VERSION = "0.5.8-dev.f69f216";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -44949,12 +45141,13 @@ const installSilentConsole = () => {
 		"trace"
 	]) target[key] = source[key];
 };
-const enableJsonMode = ({ compact, directory }) => {
+const enableJsonMode = ({ compact, directory, outputFile }) => {
 	context = {
 		compact,
 		directory,
 		startTime: performance$1.now(),
-		mode: "full"
+		mode: "full",
+		outputFile: outputFile ?? null
 	};
 	installSilentConsole();
 };
@@ -44967,7 +45160,11 @@ const setJsonReportMode = (mode) => {
 };
 const writeJsonReport = (report) => {
 	const serialized = context?.compact ? JSON.stringify(report) : JSON.stringify(report, null, 2);
-	process.stdout.write(`${serialized}\n`);
+	if (context?.outputFile) {
+		const resolvedPath = Path.resolve(context.outputFile);
+		NFS.mkdirSync(Path.dirname(resolvedPath), { recursive: true });
+		NFS.writeFileSync(resolvedPath, `${serialized}\n`);
+	} else process.stdout.write(`${serialized}\n`);
 };
 const writeJsonErrorReport = (error, sentryEventId) => {
 	if (!context) return;
@@ -45275,13 +45472,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.8-dev.f4e8e4b`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.5.8-dev.f69f216`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.8-dev.f4e8e4b") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.5.8-dev.f69f216") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -48877,6 +49074,25 @@ const shouldBlockCi = (diagnostics, blockingLevel) => {
 */
 const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g, "_");
 //#endregion
+//#region src/cli/utils/with-namespace.ts
+/**
+* Prefixes every key in a flat attribute group with `namespace.`, so a logical
+* group (scan config, diagnostics rollup, score, …) carries one dotted
+* namespace applied in a single place rather than hand-spelled into each key —
+* which is how the wide event drifted into a flat, half-namespaced soup. The
+* dotted prefix is what makes the attributes tree up in Sentry's attribute
+* browser and stay group-/filter-/aggregate-able in the Spans dataset.
+*
+* Value types are preserved verbatim (numbers stay numbers so Sentry infers a
+* numeric attribute and `p75(...)`/`avg(...)` work; `null` is kept so
+* `toSpanAttributes` can drop absent signals rather than coerce them).
+*/
+const withNamespace = (namespace, attributes) => {
+	const namespaced = {};
+	for (const [key, value] of Object.entries(attributes)) namespaced[`${namespace}.${key}`] = value;
+	return namespaced;
+};
+//#endregion
 //#region src/cli/utils/build-run-event.ts
 const readEnvBoolean = (name) => {
 	const value = process.env[name];
@@ -48898,12 +49114,12 @@ const buildOutcomeAttributes = (input) => {
 	if (input.result === void 0) {
 		const error = input.error;
 		const known = isReactDoctorError(error);
-		return {
-			outcome: "error",
+		return withNamespace("outcome", {
+			status: "error",
 			exitCode: 1,
 			knownError: known,
 			errorTag: known ? error.reason._tag : error instanceof Error ? error.name : null
-		};
+		});
 	}
 	const result = input.result;
 	const summary = summarizeDiagnostics(result.diagnostics);
@@ -48937,66 +49153,82 @@ const buildOutcomeAttributes = (input) => {
 	}
 	let fixGroupedFindings = 0;
 	for (const count of findingsPerFixGroup.values()) fixGroupedFindings += count;
+	const categoryRollup = {};
+	for (const [category, count] of countByCategory) categoryRollup[`category.${toCategoryKey(category)}`] = count;
 	const attributes = {
-		outcome,
-		exitCode: wouldBlock ? 1 : 0,
-		wouldBlock,
-		blocking: blockingLevel,
-		scanClean: isClean,
-		totalDiagnostics: summary.totalDiagnosticCount,
-		errorCount: summary.errorCount,
-		warningCount: summary.warningCount,
-		affectedFiles: summary.affectedFileCount,
-		diagnosticsInTestFiles,
-		diagnosticsInStoryFiles,
-		distinctRulesFired: countByRule.size,
-		"diag.fixGroups": findingsPerFixGroup.size,
-		"diag.fixGroupedFindings": fixGroupedFindings,
-		topRule,
-		"migration.largestRuleBucketFiles": largestRuleBucket ? largestRuleBucket.fileCount : null,
-		"migration.largestRuleBucketSites": largestRuleBucket ? largestRuleBucket.siteCount : null,
-		"migration.largestRuleBucketRule": largestRuleBucket ? largestRuleBucket.ruleKey : null,
-		scannedFileCount: result.scannedFileCount ?? null,
-		lintCacheHitFiles: result.lintCacheHitFileCount ?? null,
-		lintCacheTotalFiles: result.lintCacheTotalFileCount ?? null,
-		lintCacheHitRatio: result.lintCacheTotalFileCount != null && result.lintCacheTotalFileCount > 0 ? (result.lintCacheHitFileCount ?? 0) / result.lintCacheTotalFileCount : null,
-		elapsedMs: result.elapsedMilliseconds,
-		scanPhaseMs: result.scanElapsedMilliseconds ?? null,
-		score: result.score ? result.score.score : null,
-		scoreLabel: result.score ? result.score.label : null,
-		scoreAvailable: result.score !== null,
-		skippedCheckCount: result.skippedChecks.length,
-		didLintFail: input.didLintFail ?? null,
-		lintFailureReasonKind: input.lintFailureReasonKind ?? null,
-		lintPartialFailureCount: input.lintPartialFailureCount ?? null,
-		lintDroppedFileCount: input.lintDroppedFileCount ?? null,
-		didDeadCodeFail: input.didDeadCodeFail ?? null,
-		supplyChainOverlapTimedOut: input.supplyChainOverlapTimedOut ?? null,
-		deadCodeOverlapped: input.deadCodeOverlapped ?? null
-	};
-	for (const [category, count] of countByCategory) attributes[`diag.category.${toCategoryKey(category)}`] = count;
-	if (result.baselineDelta) {
-		attributes["baseline.new"] = summary.totalDiagnosticCount;
-		attributes["baseline.fixed"] = result.baselineDelta.fixedCount;
-		attributes["baseline.baseTotal"] = result.baselineDelta.baseTotalCount;
-		attributes["baseline.degraded"] = false;
-	} else if (input.gateExempt) attributes["baseline.degraded"] = true;
+		...withNamespace("outcome", {
+			status: outcome,
+			exitCode: wouldBlock ? 1 : 0,
+			wouldBlock,
+			blocking: blockingLevel,
+			clean: isClean,
+			skippedChecks: result.skippedChecks.length
+		}),
+		...withNamespace("diag", {
+			total: summary.totalDiagnosticCount,
+			errors: summary.errorCount,
+			warnings: summary.warningCount,
+			affectedFiles: summary.affectedFileCount,
+			inTestFiles: diagnosticsInTestFiles,
+			inStoryFiles: diagnosticsInStoryFiles,
+			distinctRules: countByRule.size,
+			topRule,
+			fixGroups: findingsPerFixGroup.size,
+			fixGroupedFindings,
+			...categoryRollup
+		}),
+		...withNamespace("score", {
+			value: result.score ? result.score.score : null,
+			label: result.score ? result.score.label : null,
+			available: result.score !== null
+		}),
+		...withNamespace("lint", {
+			failed: input.didLintFail ?? null,
+			failureReasonKind: input.lintFailureReasonKind ?? null,
+			partialFailureCount: input.lintPartialFailureCount ?? null,
+			droppedFileCount: input.lintDroppedFileCount ?? null,
+			cacheHitFiles: result.lintCacheHitFileCount ?? null,
+			cacheTotalFiles: result.lintCacheTotalFileCount ?? null,
+			cacheHitRatio: result.lintCacheTotalFileCount != null && result.lintCacheTotalFileCount > 0 ? (result.lintCacheHitFileCount ?? 0) / result.lintCacheTotalFileCount : null
+		}),
+		...withNamespace("deadCode", {
+			failed: input.didDeadCodeFail ?? null,
+			overlapped: input.deadCodeOverlapped ?? null
+		}),
+		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut ?? null }),
+		...withNamespace("timing", {
+			elapsedMs: result.elapsedMilliseconds,
+			scanMs: result.scanElapsedMilliseconds ?? null
+		}),
+		...withNamespace("migration", {
+			largestRuleBucketFiles: largestRuleBucket ? largestRuleBucket.fileCount : null,
+			largestRuleBucketSites: largestRuleBucket ? largestRuleBucket.siteCount : null,
+			largestRuleBucketRule: largestRuleBucket ? largestRuleBucket.ruleKey : null
+		})
+	};
+	if (result.baselineDelta) Object.assign(attributes, withNamespace("baseline", {
+		new: summary.totalDiagnosticCount,
+		fixed: result.baselineDelta.fixedCount,
+		baseTotal: result.baselineDelta.baseTotalCount,
+		degraded: false
+	}));
+	else if (input.gateExempt) attributes["baseline.degraded"] = true;
 	return attributes;
 };
-const buildCiAttributes = () => {
+const buildActionAttributes = () => {
 	const { githubActorAssociation } = resolveGithubActionsScoreMetadata();
-	return {
+	return withNamespace("action", {
 		actorAssociation: githubActorAssociation ?? null,
 		runnerOs: detectRunnerOs(),
 		comment: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.comment),
 		reviewComments: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.reviewComments),
 		versionPin: resolveVersionPin(process.env[ACTION_INPUT_ENVIRONMENT_VARIABLES.version])
-	};
+	});
 };
-const buildConfigAttributes = (input) => {
+const buildScanAttributes = (input) => {
 	const ruleOverrides = input.userConfig?.rules ?? {};
 	const ruleKeys = Object.keys(ruleOverrides);
-	return {
+	return withNamespace("scan", {
 		mode: input.mode,
 		scope: input.scope,
 		parallel: input.parallel,
@@ -49011,12 +49243,18 @@ const buildConfigAttributes = (input) => {
 		ignoredTagCount: input.ignoredTagCount,
 		hasCustomConfig: input.hasCustomConfig,
 		rulesConfigured: ruleKeys.length,
-		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length
-	};
+		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
+		fileCount: input.result?.scannedFileCount ?? null
+	});
 };
 /**
-* Projects a scan into the flat attribute set for its root span — the canonical
-* per-scan "wide event". Pure and exported so the projection (outcome
+* Projects a scan into the namespaced attribute set for its root span — the
+* canonical per-scan "wide event". Every attribute carries a dotted namespace
+* that groups it by concept (`scan.*` config, `action.*` CI knobs, `outcome.*`
+* verdict, `diag.*` findings, `score.*`, `lint.*`, `deadCode.*`,
+* `supplyChain.*`, `timing.*`, `migration.*`, `baseline.*`) so the attributes
+* tree up in Sentry's attribute browser and stay filter-/group-/aggregate-able
+* in the Spans dataset. Pure and exported so the projection (outcome
 * precedence, rule/category rollups, CI knobs, config shape) is unit-testable
 * without a live Sentry client. `null` values are dropped so absent signals
 * never become misleading `"null"` attributes. The run + project base context
@@ -49025,8 +49263,8 @@ const buildConfigAttributes = (input) => {
 * those don't carry.
 */
 const buildRunEventAttributes = (input) => toSpanAttributes({
-	...buildConfigAttributes(input),
-	...buildCiAttributes(),
+	...buildScanAttributes(input),
+	...buildActionAttributes(),
 	...buildOutcomeAttributes(input)
 });
 /**
@@ -49689,6 +49927,8 @@ const ONBOARDING_EVENT = "onboarding";
 const CI_PITCH_EVENT = "ci-pitch";
 const ACTION_UPGRADE_EVENT = "action-upgrade-v2";
 const SETUP_HINT_EVENT = "setup-hint";
+const HANDOFF_TARGET_PREFERENCE_ID = "handoff-target";
+const INSTALL_AGENTS_PREFERENCE_ID = "install-agents";
 const foldLegacyDecisions = (projects, legacy, eventId) => {
 	for (const [hash, record] of Object.entries(legacy ?? {})) {
 		const existing = projects[hash] ?? { rootDirectory: record.rootDirectory ?? "" };
@@ -49807,6 +50047,14 @@ const recordGate = (gate, target = {}, options = {}) => updateCliState((state) =
 		}
 	}
 })), options);
+const readPreference = (preference, target = {}, options = {}) => readCliState((state) => selectScope(state, preference, target.projectRoot)?.preferences?.[preference.id] ?? null, null, options);
+const writePreference = (preference, value, target = {}, options = {}) => updateCliState((state) => updateScope(state, preference, target.projectRoot, (scope) => ({
+	...scope,
+	preferences: {
+		...scope.preferences,
+		[preference.id]: value
+	}
+})), options);
 const isMigrationPending = (migration, target = {}, options = {}) => {
 	if (migration.scope === "project" && target.projectRoot === void 0) return false;
 	return readCliState((state) => {
@@ -50344,7 +50592,7 @@ const readPackageJson = (projectRoot) => {
 		return null;
 	}
 };
-const writeJsonFile$1 = (filePath, value) => {
+const writeJsonFile = (filePath, value) => {
 	NFS.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`);
 };
 const packageHasDependency = (projectRoot, dependencyName) => {
@@ -51064,7 +51312,8 @@ const getStagedSourceFiles = async (directory) => {
 		return [...await runPromise(gen(function* () {
 			return yield* (yield* StagedFiles).discoverSourceFiles(directory);
 		}).pipe(provide(stagedFilesLayer)))];
-	} catch {
+	} catch (error) {
+		cliLogger.warn(`Failed to discover staged files: ${error instanceof Error ? error.message : String(error)}`);
 		return [];
 	}
 };
@@ -51083,6 +51332,35 @@ const materializeStagedFiles = async (directory, stagedFiles, tempDirectory) =>
 	};
 };
 //#endregion
+//#region src/cli/utils/is-environment-error.ts
+const isNodeSystemError = (error) => error instanceof Error && typeof error.code === "string";
+const ENVIRONMENT_ERROR_CODES = new Set([
+	"ENOSPC",
+	"EIO",
+	"EROFS",
+	"EACCES",
+	"EPERM",
+	"ENOTDIR"
+]);
+const isEnvironmentError = (error) => {
+	if (!isNodeSystemError(error)) return false;
+	if (error.code === "ENOENT") return error.syscall?.startsWith("spawn") ?? false;
+	return error.code !== void 0 && ENVIRONMENT_ERROR_CODES.has(error.code);
+};
+const formatEnvironmentError = (error) => {
+	if (!isNodeSystemError(error)) return error instanceof Error ? error.message : String(error);
+	switch (error.code) {
+		case "ENOSPC": return "No space left on device. Free up disk space and try again.";
+		case "EIO": return "I/O error: the filesystem or disk may be failing. Check your system logs.";
+		case "EROFS": return "Read-only filesystem: cannot write to this location.";
+		case "EACCES":
+		case "EPERM": return error.path ? `Permission denied accessing ${error.path}. Check file permissions and try again.` : "Permission denied. Check file permissions and try again.";
+		case "ENOTDIR": return error.path ? `A file exists at ${error.path} or one of its parent paths where a directory was expected.` : "A file exists where a directory was expected.";
+		case "ENOENT": return "Required command not found. Ensure the tool (e.g. git) is installed and on your PATH.";
+		default: return error.message;
+	}
+};
+//#endregion
 //#region src/cli/utils/handle-error.ts
 const OTLP_ENDPOINT_ENVIRONMENT_VARIABLE = "REACT_DOCTOR_OTLP_ENDPOINT";
 const OTLP_AUTH_HEADER_ENVIRONMENT_VARIABLE = "REACT_DOCTOR_OTLP_AUTH_HEADER";
@@ -51165,15 +51443,19 @@ const handleError = (error, options = {}) => {
 	process.exitCode = 1;
 };
 /**
-* Renderer for expected, user-actionable failures — a bad `--diff` value or
-* a base branch that isn't fetched. Prints just the (already human-readable)
-* message — no "Something went wrong", prefilled issue, Discord link, or
-* Sentry reference — because there is no bug to report.
+* Renderer for expected, user-actionable failures — a bad `--diff` value,
+* a base branch that isn't fetched, or environment errors like disk-full or
+* permission-denied. Prints just the (already human-readable) message — no
+* "Something went wrong", prefilled issue, Discord link, or Sentry reference
+* — because there is no bug to report.
 */
 const handleUserError = (error, options = {}) => {
+	const isEnvError = isEnvironmentError(error);
+	if (isEnvError) recordCount(METRIC.cliEnvironmentError, 1, { code: error.code ?? "unknown" });
+	const message = isEnvError ? formatEnvironmentError(error) : formatErrorForReport(error);
 	runSync(gen(function* () {
 		yield* error$1("");
-		yield* error$1(highlighter.error(formatErrorForReport(error)));
+		yield* error$1(highlighter.error(message));
 		yield* error$1("");
 	}));
 	if (options.shouldExit !== false) process.exit(1);
@@ -51188,7 +51470,7 @@ const handleUserError = (error, options = {}) => {
 * `handleUserError` (a plain message — no "Something went wrong", prefilled
 * issue, Discord link, or Sentry reference), since there is no bug to report.
 *
-* Three distinct shapes reach the CLI's catch blocks:
+* Four distinct shapes reach the CLI's catch blocks:
 *
 * - **Project-discovery failures** (`NoReactDependencyError`,
 *   `ProjectNotFoundError`, `PackageJsonNotFoundError`, `NotADirectoryError`,
@@ -51201,12 +51483,19 @@ const handleUserError = (error, options = {}) => {
 *   `--project` name.
 * - **Bad `--diff` input** (`GitBaseBranchInvalid` / `GitBaseBranchMissing`)
 *   stays the tagged `ReactDoctorError`, so dispatch on the reason `_tag`.
+* - **Environment failures** (`ENOSPC`, `EIO`, `EROFS`, `EACCES`, `EPERM`,
+*   `ENOTDIR`, plus a `spawn`-scoped `ENOENT` for a missing binary) — disk
+*   full / failing / read-only, permission denied, or a path blocked by a
+*   file. React Doctor cannot fix the user's environment; exit cleanly with an
+*   actionable message instead of crashing. See `is-environment-error.ts` for
+*   why the set stays narrow (codes that usually mean our bug keep reaching
+*   Sentry).
 *
 * This composes the existing core narrowers rather than introducing a new
 * error-shape helper (AGENTS.md): it encodes CLI-layer reporting policy, not
 * knowledge of the `ReactDoctorError` shape.
 */
-const isExpectedUserError = (error) => error instanceof CliInputError || isProjectDiscoveryError(error) || isReactDoctorError(error) && (error.reason._tag === "GitBaseBranchInvalid" || error.reason._tag === "GitBaseBranchMissing");
+const isExpectedUserError = (error) => error instanceof CliInputError || isProjectDiscoveryError(error) || isEnvironmentError(error) || isReactDoctorError(error) && (error.reason._tag === "GitBaseBranchInvalid" || error.reason._tag === "GitBaseBranchMissing");
 //#endregion
 //#region src/cli/utils/build-handoff-payload.ts
 const buildHandoffPayload = (input) => {
@@ -51287,6 +51576,20 @@ const detectAvailableAgents = async () => {
 	const detected = new Set([...detectPathAvailableAgents(), ...await detectInstalledSkillAgents()]);
 	return getSkillAgentTypes().filter((agent) => agent !== "universal" && detected.has(agent));
 };
+const DEFAULT_INSTALL_AGENTS = [
+	"claude-code",
+	"cursor",
+	"codex",
+	"opencode"
+];
+const computeDefaultSelectedAgents = (detectedAgents, rememberedAgents) => {
+	const detected = new Set(detectedAgents);
+	const remembered = rememberedAgents.filter((agent) => detected.has(agent));
+	if (remembered.length > 0) return remembered;
+	const defaults = DEFAULT_INSTALL_AGENTS.filter((agent) => detected.has(agent));
+	if (defaults.length > 0) return defaults;
+	return detectedAgents.length === 1 ? [...detectedAgents] : [];
+};
 //#endregion
 //#region src/cli/utils/install-doctor-script.ts
 const DOCTOR_SCRIPT_NAME = "doctor";
@@ -51368,7 +51671,7 @@ const installDoctorScript = (options) => {
 		};
 	})();
 	const scriptStatus = scriptTarget.status;
-	if (scriptStatus === "created") writeJsonFile$1(packageJsonPath, {
+	if (scriptStatus === "created") writeJsonFile(packageJsonPath, {
 		...packageJson,
 		scripts: {
 			...isRecord$1(scripts) ? scripts : {},
@@ -51544,6 +51847,14 @@ const recordCiPromptDecision = (projectRoot, outcome, options = {}) => recordGat
 	outcome
 }, options);
 //#endregion
+//#region src/cli/utils/handoff-target-preference.ts
+const HANDOFF_TARGET_PREFERENCE = {
+	id: HANDOFF_TARGET_PREFERENCE_ID,
+	scope: "global"
+};
+const readHandoffTarget = (options = {}) => readPreference(HANDOFF_TARGET_PREFERENCE, {}, options);
+const rememberHandoffTarget = (target, options = {}) => writePreference(HANDOFF_TARGET_PREFERENCE, target, {}, options);
+//#endregion
 //#region src/cli/utils/open-url.ts
 const resolveOpenCommand = (url) => {
 	if (process$1.platform === "darwin") return {
@@ -51931,6 +52242,19 @@ const setUpGitHubActions = async (options) => {
 	return didCreateWorkflow;
 };
 //#endregion
+//#region src/cli/utils/install-agents-preference.ts
+const INSTALL_AGENTS_PREFERENCE = {
+	id: INSTALL_AGENTS_PREFERENCE_ID,
+	scope: "global"
+};
+const PREFERENCE_SEPARATOR = ",";
+const readInstallAgents = (options = {}) => {
+	const stored = readPreference(INSTALL_AGENTS_PREFERENCE, {}, options);
+	if (stored === null) return [];
+	return stored.split(PREFERENCE_SEPARATOR).map((entry) => entry.trim()).filter((entry) => isSkillAgentType(entry));
+};
+const rememberInstallAgents = (agents, options = {}) => writePreference(INSTALL_AGENTS_PREFERENCE, agents.join(PREFERENCE_SEPARATOR), {}, options);
+//#endregion
 //#region src/cli/utils/install-agent-hooks.ts
 const CLAUDE_AGENT = "claude-code";
 const CURSOR_AGENT = "cursor";
@@ -51941,20 +52265,34 @@ const CURSOR_HOOKS_RELATIVE_PATH = ".cursor/hooks.json";
 const CURSOR_HOOK_RELATIVE_PATH = ".cursor/hooks/react-doctor.sh";
 const CURSOR_HOOK_MATCHER = "Write|Edit|MultiEdit|ApplyPatch";
 const CURSOR_HOOKS_SCHEMA_VERSION = 1;
-const JSON_INDENT_SPACES$1 = 2;
 const isSupportedAgent = (agent) => agent === CLAUDE_AGENT || agent === CURSOR_AGENT;
 const readJsonFile = (filePath, fallback) => {
 	if (!NFS.existsSync(filePath)) return fallback;
 	const content = NFS.readFileSync(filePath, "utf8").trim();
 	if (content.length === 0) return fallback;
-	return JSON.parse(content);
+	try {
+		return JSON.parse(content);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw new CliInputError(`Could not parse ${filePath}: the file contains invalid JSON. Fix the syntax errors in this file and re-run the install command.`);
+		throw error;
+	}
 };
-const writeJsonFile = (filePath, value) => {
-	NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
-	NFS.writeFileSync(filePath, `${JSON.stringify(value, null, JSON_INDENT_SPACES$1)}\n`);
+const ensureDirectoryExists = (directoryPath) => {
+	try {
+		NFS.mkdirSync(directoryPath, { recursive: true });
+	} catch (error) {
+		const code = error.code;
+		if (code === "EACCES" || code === "EPERM") throw new CliInputError(`Could not create directory ${directoryPath}: permission denied. Ensure you have write permissions for this location and re-run the install command.`);
+		if (code === "ENOTDIR" || code === "EEXIST") throw new CliInputError(`Could not create directory ${directoryPath}: a file exists at this path or one of its parent paths. Remove the conflicting file and re-run the install command.`);
+		throw error;
+	}
+};
+const writeJsonFileWithDirectoryCheck = (filePath, value) => {
+	ensureDirectoryExists(Path.dirname(filePath));
+	writeJsonFile(filePath, value);
 };
 const writeHookScript = (filePath) => {
-	NFS.mkdirSync(Path.dirname(filePath), { recursive: true });
+	ensureDirectoryExists(Path.dirname(filePath));
 	NFS.writeFileSync(filePath, buildAgentHookScript());
 	NFS.chmodSync(filePath, 493);
 };
@@ -51970,7 +52308,7 @@ const installClaudeHook = (projectRoot) => {
 		command: CLAUDE_HOOK_COMMAND
 	}] });
 	hooks.PostToolBatch = postToolBatchHooks;
-	writeJsonFile(settingsPath, {
+	writeJsonFileWithDirectoryCheck(settingsPath, {
 		...settings,
 		hooks
 	});
@@ -51990,7 +52328,7 @@ const installCursorHook = (projectRoot) => {
 		timeout: 120
 	});
 	hooks.postToolUse = postToolUseHooks;
-	writeJsonFile(configPath, {
+	writeJsonFileWithDirectoryCheck(configPath, {
 		...config,
 		version: config.version ?? CURSOR_HOOKS_SCHEMA_VERSION,
 		hooks
@@ -52226,7 +52564,7 @@ const installPackageJsonHook = (options, strategy) => {
 		parent = cloned;
 	}
 	parent[leafKey] = strategy.leafShape === "array" ? appendArrayCommand(parent[leafKey]) : appendStringCommand(parent[leafKey]);
-	writeJsonFile$1(packageJsonPath, nextPackageJson);
+	writeJsonFile(packageJsonPath, nextPackageJson);
 	removeLegacyManagedRunner(options.projectRoot);
 	return {
 		hookPath: packageJsonPath,
@@ -52809,6 +53147,9 @@ const runInstallReactDoctor = async (options = {}) => {
 	const shouldUpgradeWorkflow = canUpgradeWorkflow && (Boolean(options.yes) || upgradePromptOutcome === "yes");
 	if (upgradePromptOutcome === "no" && !options.dryRun) recordActionUpgradeDecision(projectRoot, "declined");
 	if ((ciPromptOutcome === "yes" || ciPromptOutcome === "no") && !options.dryRun) recordCiPromptDecision(projectRoot, ciPromptOutcome === "yes" ? "accepted" : "declined");
+	const rememberedAgents = options.lastSelectedAgents ?? readInstallAgents();
+	const defaultSelectedAgents = computeDefaultSelectedAgents(detectedAgents, rememberedAgents);
+	const usedRememberedAgents = rememberedAgents.some((agent) => detectedAgents.includes(agent));
 	const selectedAgents = skipPrompts ? detectedAgents : (await prompt({
 		type: "multiselect",
 		name: "agents",
@@ -52816,12 +53157,13 @@ const runInstallReactDoctor = async (options = {}) => {
 		choices: detectedAgents.map((agent) => ({
 			title: getSkillAgentConfig(agent).displayName,
 			value: agent,
-			selected: true
+			selected: defaultSelectedAgents.includes(agent)
 		})),
 		instructions: false,
 		min: 1
 	}, promptOptions)).agents ?? [];
 	if (selectedAgents.length === 0) return;
+	if (!skipPrompts && !options.dryRun) rememberInstallAgents(selectedAgents);
 	let dependencyResult;
 	if (!options.dryRun) {
 		await installReactDoctorSkillStep(sourceDir, selectedAgents, projectRoot);
@@ -52880,6 +53222,8 @@ const runInstallReactDoctor = async (options = {}) => {
 	}
 	recordCount(METRIC.installCompleted, 1, {
 		agentsCount: selectedAgents.length,
+		agentsDetected: detectedAgents.length,
+		usedRememberedAgents,
 		gitHook: shouldInstallGitHook,
 		agentHooks: shouldInstallAgentHooks,
 		workflow: didInstallWorkflow,
@@ -52914,6 +53258,26 @@ const CLI_AGENT_AUTO_FLAGS = {
 	codex: ["--yolo"],
 	cursor: ["--force"]
 };
+const resolveCursorBundledNode = () => {
+	if (!isWindows) return null;
+	const localAppData = process.env.LOCALAPPDATA;
+	if (!localAppData) return null;
+	const cursorAgentRoot = Path.join(localAppData, "cursor-agent", "versions");
+	try {
+		const versions = NFS.readdirSync(cursorAgentRoot);
+		if (versions.length === 0) return null;
+		const sortedVersions = versions.sort((a, b) => b.localeCompare(a, void 0, { numeric: true }));
+		for (const version of sortedVersions) try {
+			const bundledNodePath = Path.join(cursorAgentRoot, version, "node.exe");
+			const entryScriptPath = Path.join(cursorAgentRoot, version, "index.js");
+			if (NFS.statSync(bundledNodePath).isFile() && NFS.statSync(entryScriptPath).isFile()) return {
+				command: bundledNodePath,
+				args: [entryScriptPath]
+			};
+		} catch {}
+	} catch {}
+	return null;
+};
 const resolveWindowsCmdEntryScript = (command) => {
 	if (!isWindows) return null;
 	const pathDirectories = (process.env.PATH ?? "").split(Path.delimiter).filter(Boolean);
@@ -52933,11 +53297,10 @@ const resolveWindowsCmdEntryScript = (command) => {
 	}
 	return null;
 };
-const spawnAgent = (command, args, cwd, shell = false) => new Promise((resolve, reject) => {
+const spawnAgent = (command, args, cwd) => new Promise((resolve, reject) => {
 	const child = spawn(command, [...args], {
 		cwd,
-		stdio: "inherit",
-		shell
+		stdio: "inherit"
 	});
 	child.on("error", reject);
 	child.on("close", (code) => resolve(code ?? 0));
@@ -52946,6 +53309,10 @@ const launchCliAgent = async (agentId, prompt, cwd) => {
 	const binary = CLI_AGENT_BINARIES[agentId];
 	const agentArgs = [...CLI_AGENT_AUTO_FLAGS[agentId], prompt];
 	if (isWindows) {
+		if (agentId === "cursor") {
+			const cursorResolution = resolveCursorBundledNode();
+			if (cursorResolution) return spawnAgent(cursorResolution.command, [...cursorResolution.args, ...agentArgs], cwd);
+		}
 		const entryScript = resolveWindowsCmdEntryScript(binary);
 		if (entryScript) return spawnAgent(process.execPath, [entryScript, ...agentArgs], cwd);
 	}
@@ -53078,29 +53445,34 @@ const handoffToAgent = async (input) => {
 		outcome: "ci-suppressed",
 		diagnosticsCount: input.diagnostics.length
 	});
+	const choices = [
+		...(await detectLaunchableAgents()).map((agentId) => ({
+			title: getSkillAgentConfig(agentId).displayName,
+			description: `Open ${CLI_AGENT_BINARIES[agentId]} here with the top issues as a prompt`,
+			value: agentId
+		})),
+		{
+			title: "Copy prompt to clipboard",
+			description: "Paste into any agent or chat",
+			value: CLIPBOARD_CHOICE
+		},
+		{
+			title: "Skip",
+			description: "Don't hand off",
+			value: SKIP_CHOICE
+		}
+	];
+	const rememberedTarget = readHandoffTarget();
+	const rememberedChoiceIndex = choices.findIndex((choice) => choice.value === rememberedTarget);
+	const initial = rememberedChoiceIndex >= 0 ? rememberedChoiceIndex : 0;
 	const { handoffTarget } = await prompts({
 		type: "select",
 		name: "handoffTarget",
 		message: "What would you like to do next?",
-		choices: [
-			...(await detectLaunchableAgents()).map((agentId) => ({
-				title: getSkillAgentConfig(agentId).displayName,
-				description: `Open ${CLI_AGENT_BINARIES[agentId]} here with the top issues as a prompt`,
-				value: agentId
-			})),
-			{
-				title: "Copy prompt to clipboard",
-				description: "Paste into any agent or chat",
-				value: CLIPBOARD_CHOICE
-			},
-			{
-				title: "Skip",
-				description: "Don't hand off",
-				value: SKIP_CHOICE
-			}
-		],
-		initial: 0
+		choices,
+		initial
 	}, { onCancel: () => true });
+	if (handoffTarget !== void 0) rememberHandoffTarget(handoffTarget);
 	let handoffOutcome = "launch";
 	if (handoffTarget === void 0) handoffOutcome = "cancel";
 	else if (handoffTarget === SKIP_CHOICE) handoffOutcome = "skip";
@@ -53108,7 +53480,9 @@ const handoffToAgent = async (input) => {
 	recordCount(METRIC.agentHandoff, 1, {
 		outcome: handoffOutcome,
 		agent: handoffOutcome === "launch" ? handoffTarget : void 0,
-		diagnosticsCount: input.diagnostics.length
+		diagnosticsCount: input.diagnostics.length,
+		defaultRemembered: rememberedChoiceIndex >= 0,
+		keptDefault: handoffTarget === choices[initial].value
 	});
 	if (handoffTarget === void 0 || handoffTarget === SKIP_CHOICE) return;
 	const payload = buildHandoffPayload({
@@ -53652,7 +54026,7 @@ const warnDeprecatedDiff = (flags, userConfig) => {
 };
 const warnDiffUnavailable = (requested, isQuiet) => {
 	if (isQuiet) return;
-	if (typeof requested.base === "string") cliLogger.warn(`Could not compute diff against "${requested.base}" (merge-base failed or HEAD has no history). Running full scan.`);
+	if (typeof requested.base === "string") cliLogger.warn(`Could not compute diff against "${requested.base}" (git unavailable, ref not found, or merge-base failed). Running full scan.`);
 	else cliLogger.warn("No feature branch or uncommitted changes detected. Running full scan.");
 	cliLogger.break();
 };
@@ -53849,6 +54223,7 @@ const resolveRequestedProjects = (requestedNames, workspacePackages, rootDirecto
 	return requestedNames.map((requestedName) => {
 		const matched = workspacePackages.find((workspacePackage) => workspacePackage.name === requestedName || Path.basename(workspacePackage.directory) === requestedName);
 		if (matched) return matched.directory;
+		if (Path.basename(rootDirectory) === requestedName) return rootDirectory;
 		const candidateDirectory = Path.resolve(rootDirectory, requestedName);
 		if (isDirectory(candidateDirectory)) {
 			recordCount(METRIC.projectPathSelected);
@@ -53956,6 +54331,17 @@ const warnDeprecatedFailOn = (flags, userConfig) => {
 	cliLogger.warn(`${source} is deprecated; rename it to ${replacement}.`);
 };
 //#endregion
+//#region src/cli/utils/warn-ai-training-environment.ts
+let didWarnAiTraining = false;
+const warnIfAiTrainingEnvironment = () => {
+	if (didWarnAiTraining) return;
+	const detected = detectAiTrainingEnvironment();
+	if (detected === null) return;
+	didWarnAiTraining = true;
+	process.stderr.write(`${highlighter.warn("react-doctor detected use in an AI or ML pipeline. This use requires written permission under the react-doctor license — contact founders@million.dev to request access.")}\n`);
+	recordCount(METRIC.aiTrainingWarningShown, 1, { environment: detected });
+};
+//#endregion
 //#region src/cli/utils/validate-mode-flags.ts
 const usedDiffAlias = (flags) => flags.diff !== void 0 && flags.diff !== false && flags.diff !== "false" && flags.diff !== "";
 const usedScope = (flags) => typeof flags.scope === "string" && flags.scope.length > 0;
@@ -54039,10 +54425,14 @@ const inspectAction = async (directory, flags) => {
 	const isQuiet = isScoreOnly || isJsonMode;
 	const requestedDirectory = Path.resolve(directory);
 	const startTime = performance$1.now();
-	if (isJsonMode) enableJsonMode({
-		compact: Boolean(flags.jsonCompact),
-		directory: requestedDirectory
-	});
+	if (isJsonMode) {
+		enableJsonMode({
+			compact: Boolean(flags.jsonCompact),
+			directory: requestedDirectory,
+			outputFile: flags.jsonOut
+		});
+		if (flags.jsonOut) recordCount(METRIC.jsonOutUsed, 1);
+	}
 	recordCount(METRIC.cliInvoked, 1, { command: "inspect" });
 	try {
 		validateModeFlags(flags);
@@ -54056,6 +54446,7 @@ const inspectAction = async (directory, flags) => {
 		setJsonReportDirectory(resolvedDirectory);
 		warnDeprecatedFailOn(flags, userConfig);
 		warnDeprecatedDiff(flags, userConfig);
+		warnIfAiTrainingEnvironment();
 		if (scanTarget.didRedirectViaRootDir && !isQuiet) {
 			cliLogger.dim(`Redirected to ${highlighter.info(toRelativePath(resolvedDirectory, requestedDirectory))} via react-doctor config "rootDir".`);
 			cliLogger.break();
@@ -54343,6 +54734,10 @@ const installAction = async (options, command) => {
 			projectRoot: options.cwd ?? process.cwd()
 		});
 	} catch (error) {
+		if (isExpectedUserError(error)) {
+			handleUserError(error);
+			return;
+		}
 		handleError(error, { sentryEventId: await reportErrorToSentry(error) });
 	}
 };
@@ -55117,6 +55512,7 @@ const ROOT_FLAG_SPEC = {
 		"--category",
 		"--changed-files-from",
 		"--blocking",
+		"--json-out",
 		"--output-dir",
 		"--fail-on",
 		"--project",
@@ -55307,7 +55703,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CANONICAL_GITHUB_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -55350,4 +55746,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=6a2c86b6-c3a8-5e50-8e7b-daef840df200
+//# debugId=fabe3e34-b40f-514e-a5af-fa68a36365ae