perf(react-doctor): cut install graph from 32 to 15 packages

[aidenybai]

Summary

npm i react-doctor previously pulled in 32 packages. After this change it pulls 15 — a 17-package (53%) reduction in the transitive install graph, with no functional change.

	Before	After
Direct deps	8	5
Total packages installed	32	15
npm install (warm cache, local)	2.34s	0.86s
dist/cli.js size	260 KB	445 KB
dist/cli.js gzip	~62 KB	~106 KB

Total node_modules size is unchanged (~45 MB), because the heavy hitters — typescript (~24 MB) and oxlint's native binding (~14 MB) — must stay external. The win is purely in the number of tarballs the package manager has to fetch, extract, and link.

What changed

1. commander and ora are now inlined into dist/cli.js.
   They're pure-ESM leaf packages that bundle cleanly via tsdown's deps.alwaysBundle. Moved from dependencies to devDependencies. This kills the entire ora transitive chain (cli-cursor, cli-spinners, log-symbols, signal-exit, stdin-discarder, string-width, strip-ansi, is-interactive, is-unicode-supported, chalk, …).

2. picocolors removed from dependencies entirely.
   It was already inlined into dist/cli.js and dist/index.js via @react-doctor/core (which is a workspace devDependency and gets bundled into the published artifact). The runtime install was a duplicate.

3. prompts stays external on purpose.
   src/cli/utils/prompts.ts monkey-patches prompts/lib/elements/multiselect through createRequire. That patch needs to run against the same constructor instance that basePrompts(…) uses internally, which means we need a copy on disk to require().

4. agent-install stays external on purpose.
   Its mcp helper (re-exported from the root entry) pulls in jsonc-parser, which ships its main entry as a UMD bundle whose require("./impl/format") calls don't survive Rolldown's CJS handler. Bundling it produced a runtime Cannot find module './impl/format' crash. Leaving agent-install external sidesteps the issue.

Files

• packages/react-doctor/vite.config.ts — set deps.alwaysBundle: ["commander", "ora"] and explicitly list the externals (agent-install, oxlint, oxlint-plugin-react-doctor, prompts, typescript).
• packages/react-doctor/package.json — moved commander and ora to devDependencies; removed picocolors.
• pnpm-lock.yaml — regenerated.

Verification

• pnpm typecheck, pnpm lint, pnpm format:check, pnpm test (1204 tests across 100 files) all green.
• Smoke test: node packages/react-doctor/bin/react-doctor.js . against a small React project still produces the expected diagnostics.
• Smoke test: react-doctor install --dry-run -y still detects agents and would install — exercises the agent-install external path.
• Verified the externals in dist/cli.js exactly match the new dependencies: typescript, prompts, oxlint-plugin-react-doctor, agent-install (plus oxlint invoked via child_process).
• Verified the externals in dist/index.js (the react-doctor/api entry) are just typescript and oxlint-plugin-react-doctor — programmatic API consumers no longer pull commander/ora/picocolors into their own dep graphs either.

Not in scope

• typescript (~24 MB) is the single biggest install cost. It's used in one place (resolveUseCallBinding for the react-hooks(rules-of-hooks) use() suppression heuristic). Demoting it to an optional peer dep with a fallback is a bigger, behavior-changing refactor and is left for a follow-up.
• oxlint's native binding is also large but unavoidable — it's the linter we shell out to.

  

[reactreview]

✅ No new issues

^{Reviewed by reactreview for commit 54d4d04. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
react-doctor-website	Ready	Preview, Comment	May 22, 2026 3:05am