@prometx/react-doctor

An unofficial pinned React Doctor CLI, agent skill, and versioned offline snapshot of React Doctor's canonical triage guidance.

This project is not affiliated with, maintained by, or endorsed by Million Software, Inc. React Doctor and its prompt content remain the property of their respective rights holders.

Install

Install only this package as an exact development dependency:

pnpm add --save-dev --save-exact @prometx/react-doctor@0.9.14

It installs the matching react-doctor@0.9.14 transitively and exposes the familiar react-doctor command.

Use

pnpm exec react-doctor --no-telemetry --verbose --scope changed
pnpm exec react-doctor-guidance verify
pnpm exec react-doctor-guidance playbook
pnpm exec react-doctor-guidance rule react-doctor/no-prevent-default

The wrapper disables React Doctor telemetry even when the caller omits --no-telemetry. Normal commands never download guidance.

A missing rule prompt exits with status 2 and tells the agent to treat the canonical guidance as unavailable.

Load the Pi skill

Add the installed package to the repository's .pi/settings.json:

{
  "packages": ["../node_modules/@prometx/react-doctor"]
}

Pi then loads prometx-react-doctor from this package. The distinct skill name avoids a direct name collision with a globally installed official React Doctor skill. Use pi config -l to disable the official React Doctor skill for this project so only the pinned workflow can trigger.

For other Agent Skills-compatible tools, configure the tool to load:

node_modules/@prometx/react-doctor/skills/prometx-react-doctor

Licensing and publication

React Doctor's repository license grants rights to use, modify, publish, and distribute the software and associated documentation, subject to its additional restrictions. Its license documentation explicitly says that users may distribute React Doctor as part of their own tooling.

The open upstream security issue #1440 requests pinned package execution and vendored agent instructions in a release artifact. This package implements that model independently; upstream has not yet incorporated it.

Upgrade React Doctor

Use this workflow when upstream publishes a new React Doctor version. Replace the example version, and only sync prompts when your permission to collect and redistribute them covers that update.

VERSION=x.y.z

# Keep this package and its exact upstream dependency on the same version.
npm pkg set "version=$VERSION" "dependencies.react-doctor=$VERSION"

# Fetch that upstream package and update package-lock.json.
npm install

# Fetch and replace the versioned prompt snapshot.
npm run sync-prompts

Then:

1. Update the version shown in this README's install example.
2. Review package.json, package-lock.json, and every change under references/. Treat downloaded prompt content as untrusted until a human has reviewed the diff.
3. Review any scanner, wrapper, skill, or playbook changes needed for the new upstream release.
4. Run npm test and npm pack --dry-run.
5. Run npm run publish:package only after all checks pass and the licensing requirements above are satisfied.

sync-prompts is the only command that accesses react.doctor. It downloads into a temporary directory, validates every title and required prompt section, records SHA-256 hashes, and replaces the previous snapshot only after the complete download succeeds.

The package deliberately has no install or postinstall scripts.