feat: add read-only application diagnostics for agents

[raviships]

Summary

Stage 5a, moved ahead of skill distribution so the skill uses implemented diagnostics; stacked on #242.

• Add doctor --offline: no credential-store, OAuth, API, or shell access.
• Normal doctor uses only existing usable credentials; no refresh/login or unauthenticated health request. Diagnostic error messages omit raw exception content.
• Parse bounded local TypeScript/JSX without execution to observe direct adapters/providers, type-only boundaries, legacy handler options, and known unsafe CORS. Check installed version compatibility and frontend environment destinations.
• Explicit skips for unknown/dynamic mounting, provider ancestry, env loaders, and bucket mapping; doctor is not an app-path verification substitute.
• Share framework classification with installation: Start gets server+React; frontend-only React/Vite gets React only.

Validation

• All 309 CLI tests, typecheck, lint, build, and repository dependency-policy check passed.
• Scoped formatting passed.
• Real TanStack Start example offline smoke detected worktree env symlinks. Added a regression-tested correction to report those as uninspected/skipped, without following them. Follow-up focused 26 tests, lint, typechecked build and the example smoke passed.

No credentials were printed or remotely used, no production resources changed, and no release/deployment performed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
edgestore-docs	Ready	Preview	Sep 7, 2026 11:10am UTC
example-access-control	Ready	Preview	Sep 7, 2026 11:10am UTC
example-components	Ready	Preview	Sep 7, 2026 11:10am UTC