Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.claude/skills/pre-pr-review/SKILL.md:
- Around line 205-221: The ordered list items for "Vet:", "Test:", and "Build
check:" use explicit numeric prefixes (10., 11., 12.) which triggers
markdownlint MD029; change those numeric prefixes to "1." for each list entry so
the markdown uses the allowed repeating "1." ordered-list style (locate the
three list entries titled "Vet:", "Test:", and "Build check:" in SKILL.md and
update their prefixes accordingly).
- Around line 90-92: The change missed categorizing module files under the cli
rules, so add patterns for cli/go.mod and cli/go.sum to the existing rule set
(either extend the cli_go rule to include "cli/go.mod" and "cli/go.sum" or
create/merge a specific cli_module rule) so Go checks and Go-agent selection run
for dependency-only updates; update the rule names referenced (cli_go,
cli_config) and any file-glob logic that determines Phase 2 vet/test/build
selection to include these module filenames.

In @.github/ISSUE_TEMPLATE/installer-failure.yml:
- Around line 31-36: Update the OS options list under the "options:" key to
include "Windows (arm64)" alongside the existing entries so Windows arm64 users
can select the correct installer; locate the options block that currently lists
"macOS (Apple Silicon / arm64)", "macOS (Intel / amd64)", "Linux (amd64)",
"Linux (arm64)", and "Windows (amd64)" and add a new entry "Windows (arm64)" to
that list.

In @.github/workflows/ci.yml:
- Around line 35-46: The CI matrix currently lists path filters for jobs like
python, dashboard, and docker but omits workflow files, allowing changes under
.github/workflows/** to bypass CI; update the workflow file so the path filters
include '.github/workflows/**' (add it alongside the existing entries under the
same filter grouping that contains 'src/**'/'web/**'/'docker/**') to ensure PRs
that only modify workflow logic trigger the matrix jobs.

In @.github/workflows/cli.yml:
- Around line 55-58: The CI workflows use actions/setup-go with caching which
triggered cache-poisoning warnings; for each job using that action (lint, test,
build, vuln — and confirm release already disables cache) update the setup-go
step (the uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 block)
to include cache: false (or remove cache-related inputs like
cache-dependency-path/go.sum) to disable caching, or alternatively add a concise
justification comment above the step explaining why you accept the risk
(read-only permissions/no artifact publishing) to suppress the warning; apply
the change to the occurrences referenced (around the setup-go blocks at the
other locations).
- Around line 148-149: The "Install govulncheck" step currently uses go install
golang.org/x/vuln/cmd/govulncheck@latest which should be pinned to an explicit
release; update that run command to use a concrete version tag (for example
replace `@latest` with a specific version like `@v0.5.0` or your chosen vetted
release) so the workflow installs a reproducible govulncheck binary, and
optionally document the selected version in a variable or comment for future
updates.

In @.pre-commit-config.yaml:
- Around line 61-62: Remove the extra blank line between the golangci-lint and
mypy hooks in the pre-commit configuration so hooks are separated by a single
blank line consistent with the rest of the file; locate the consecutive blank
lines that appear immediately after the "golangci-lint" hook entry and delete
one so only one empty line remains before the "mypy" hook.

In `@cli/cmd/init.go`:
- Around line 13-17: The init command currently hardcodes created compose image
tags to "latest"; change it to use the CLI build version as the default tag and
only fall back to "latest" for dev builds. In the init command handler (e.g.,
initCmd / NewInitCmd) obtain the build version (the package-level version
variable or equivalent), pass that tag into the compose generator (functions
like compose.NewCompose / compose.Generate or the struct that builds
compose.yml) and update the flag/default logic so if version is empty or
contains "dev" you use "latest", otherwise use the exact build version string as
the image tag; adjust any places around lines ~139-148 that set the tag default
to implement this behavior. Ensure the change propagates to compose output so
generated compose.yml embeds the chosen tag.

In `@cli/cmd/logs.go`:
- Around line 58-64: The validation currently allows zero because it only
rejects n < 0 while the error message says "positive integer"; update the
validation in the tail parsing block (the tail variable derived from logTail,
where strconv.Atoi is called) to reject zero as well by changing the check to
treat n <= 0 as invalid, so the code returns the existing error message `--tail
must be a positive integer or 'all'` when n is 0 or negative.

In `@cli/cmd/root.go`:
- Around line 32-42: The resolveDataDir function currently only resolves
symlinks when a user-supplied dataDir is set; to make behavior consistent,
always run filepath.EvalSymlinks on the final directory (whether from dataDir or
config.DataDir()) and return the resolved path if EvalSymlinks succeeds,
otherwise fall back to the original value; update resolveDataDir to pick the
directory (use dataDir if non-empty else config.DataDir()), then call
filepath.EvalSymlinks on that value and return the resolved path on success, or
the original path on error.

In `@cli/cmd/start.go`:
- Around line 68-75: The health check branch currently prints warnings but still
returns nil; modify the error path after calling health.WaitForHealthy(...) so
the command returns a non-zero exit (e.g., return fmt.Errorf("startup failed:
%w", err)) after printing the diagnostic messages; update the function
containing the call to health.WaitForHealthy (the command Run/RunE handler in
start.go) to propagate the error instead of falling through to a successful
return.

In `@cli/cmd/status.go`:
- Around line 111-129: The status command currently treats any HTTP response
with a JSON body as healthy; update the handling after client.Do(req) to check
resp.StatusCode and treat non-2xx codes as error responses: after reading body
into "body" and unmarshalling into "hr", if resp.StatusCode is not in the
200–299 range print the JSON error plus the HTTP status (e.g., "Backend:
<prettyJSON(hr)> (HTTP <StatusCode>)") and return similarly for non-JSON bodies,
otherwise for 2xx responses keep the existing prettyJSON output; reference
variables/functions resp, resp.StatusCode, body, hr, prettyJSON and ensure the
non-2xx branch is executed before assuming success.

In `@cli/cmd/uninstall.go`:
- Around line 130-140: The uninstall path uses os.Executable() which may return
a symlink so removing that path can leave the real binary behind; update the
removeBinary branch (the code that calls os.Executable() and os.Remove) to
resolve symlinks (use filepath.EvalSymlinks on execPath) before attempting
removal so it matches selfupdate.ReplaceAt behavior, and add "path/filepath" to
imports; preserve the existing error handling/logging but operate on the
evaluated path.
- Around line 107-112: The code calls os.RemoveAll(state.DataDir) without
validating the target; add safety checks in the uninstall logic around
removeData to prevent deleting critical paths: ensure state.DataDir is
non-empty, not "/" or drive root, not the user's home directory, and matches an
expected application data base path or contains an app-specific marker file
before proceeding; if any check fails, return an error and avoid calling
os.RemoveAll(state.DataDir); optionally require an explicit confirmation flag
(e.g., --force) or interactive confirmation via
cmd.OutOrStdout()/cmd.InOrStdin() before performing the removal.

In `@cli/cmd/update.go`:
- Around line 114-120: The restart currently ignores errors from composeRun(...,
"down") and proceeds to composeRun(..., "up", "-d"), risking duplicate
containers; update the restart flow in update.go to abort when composeRun(ctx,
cmd, info, state.DataDir, "down") returns an error by returning a wrapped error
(e.g., return fmt.Errorf("stopping containers: %w", err)) instead of only
logging a warning, or alternatively change the subsequent composeRun up call to
composeRun(ctx, cmd, info, state.DataDir, "up", "-d", "--force-recreate") to
force a clean recreate; locate these calls to composeRun (the "down" and "up"
invocations) and apply one of the two fixes consistently.

In `@cli/internal/compose/compose.yml.tmpl`:
- Around line 65-85: Add a Docker healthcheck to the sandbox service in the
compose template so orchestration can verify it is healthy; update the sandbox
block (service name "sandbox" in compose.yml.tmpl) to include a healthcheck
section (e.g., test, interval, timeout, retries) that runs an appropriate check
for the sandbox container, and if other services depend on it adjust their
depends_on to use condition service_healthy (or compose v3 healthcheck-aware
depends_on) so startup ordering and health gating work correctly.

In `@cli/internal/compose/generate_test.go`:
- Around line 172-182: The current os.ReadFile(golden) error path silently
creates the missing golden file; change it to fail the test when the golden file
is absent unless the UPDATE_GOLDEN env var is set. In the ReadFile error branch
(around variables expected, err, golden, actual) detect os.IsNotExist(err) and
call t.Fatalf("golden file %s missing; run tests with UPDATE_GOLDEN=1 to
regenerate", golden), and only perform the MkdirAll/WriteFile creation when
os.Getenv("UPDATE_GOLDEN") == "1"; keep existing file mode bits and log message
when creating.

In `@cli/internal/compose/generate.go`:
- Around line 86-91: In validateParams, after the existing range checks for
p.BackendPort and p.WebPort, add a check that returns an error if p.BackendPort
== p.WebPort; use a clear error message like "backend and web ports must be
different" and reference p.BackendPort and p.WebPort in the message so callers
know the conflicting values; update validateParams (the function containing the
current range validation) to perform this equality check before successful
return.

In `@cli/internal/config/paths.go`:
- Around line 17-23: DataDir currently falls back to "." when os.UserHomeDir()
fails, which is unsafe; change DataDir() so that on error from os.UserHomeDir()
it logs a warning (use the package logger or log.Printf) including the original
error and then use a safer fallback such as os.TempDir() (or return an error by
changing the signature to DataDir() (string, error) and propagating that)
instead of silently returning a relative "."; update all callers if you change
the signature and ensure you reference DataDir(), os.UserHomeDir(), and
dataDirForOS(...) when making the change.

In `@cli/internal/config/state_test.go`:
- Line 108: The test uses os.Getenv("OS") for platform detection which is
unreliable; replace that condition with runtime.GOOS (e.g., change if
os.Getenv("OS") != "Windows_NT" to if runtime.GOOS != "windows"), update any
casing/expected string accordingly, and add runtime to the imports in
state_test.go so the test reliably detects the OS using the standard library.

In `@cli/internal/config/state.go`:
- Around line 47-50: The missing-file branch (errors.Is(err, os.ErrNotExist))
returns defaults.DataDir = dataDir without normalizing/validating the path,
causing inconsistent behavior versus the later absolute-path validation; update
that branch in state.go to resolve and normalize dataDir (e.g., filepath.Abs +
filepath.Clean) before assigning to DefaultState().DataDir and return an error
if resolution fails so the same absolute-path invariants applied in the later
block (lines ~59-63) are enforced on first-run as well.
- Around line 54-65: The load is unmarshaling into a zero-value State so missing
fields overwrite defaults; instead initialize s with the default configuration
before unmarshaling (e.g., s := DefaultState() or a struct literal with default
ports/log level), then call json.Unmarshal(data, &s) to merge values onto those
defaults; keep the existing DataDir canonicalization/validation (s.DataDir =
filepath.Clean(...), IsAbs check) after the merge.

In `@cli/internal/diagnostics/collect_test.go`:
- Around line 73-80: TestCollectDoesNotPanic uses context.Background() and can
hang if probing stalls; update the test to create a timeout context (e.g., via
context.WithTimeout) and pass that to Collect, ensuring you call the cancel
function with defer to free resources; modify TestCollectDoesNotPanic to
construct ctx, defer cancel, then call Collect(ctx, state) so the test fails
fast instead of hanging.

In `@cli/internal/diagnostics/collect.go`:
- Around line 133-151: The diskInfo function should handle macOS explicitly to
ensure consistent output; add a case for runtime.GOOS == "darwin" inside
diskInfo to run a macOS-friendly command (for example use "df" with flags or
"diskutil info /" depending on desired detail) instead of the default Linux
path, then normalize/trim the output the same way; update the switch to include
case "darwin" and call the chosen command (referencing diskInfo, runtime.GOOS,
name, args, and the existing exec.CommandContext usage) so macOS produces
predictable disk info for later parsing.
- Around line 69-83: The call to http.NewRequestWithContext ignores its error
and may leave req nil; update the health check in collect.go to capture and
handle the error returned by http.NewRequestWithContext(ctx, http.MethodGet,
healthURL, nil) (the local variable req), and on error set r.HealthStatus to
"unreachable" and append a descriptive error to r.Errors (similar to the
client.Do error handling), returning or skipping the request execution if req is
nil so you never call client.Do with a nil request; ensure the logic around
client := &http.Client... and resp handling in the same block remains unchanged.

In `@cli/internal/docker/client_test.go`:
- Around line 39-40: The test expects FreeBSD to return a systemctl hint but
FreeBSD uses rc.d/service; update the DaemonHint behavior to handle "freebsd"
explicitly (function DaemonHint) and return a FreeBSD-appropriate hint such as
"Start the Docker daemon: service docker start" (or adjust the test in
cli/internal/docker/client_test.go to expect that FreeBSD string), ensuring the
test table entry for "freebsd" is updated to match the new string; modify only
DaemonHint and the test expectation so the default case remains unchanged for
other platforms.

In `@cli/internal/docker/client.go`:
- Around line 90-97: ComposeExec currently discards stdout/stderr so callers get
no context on failure; change ComposeExec (and where it calls composeArgs) to
capture command output (use cmd.CombinedOutput() or set cmd.Stdout/Stderr to a
buffer) and when cmd returns an error wrap/return a new error that includes the
original error plus the captured output (or log the output via the existing
logger) so callers receive stdout/stderr context on failures; ensure the
returned error preserves the underlying exit error and includes the output
string for debugging.

In `@cli/internal/health/check.go`:
- Around line 22-45: The WaitForHealthy function can panic if interval <= 0 and
may never run a probe before timing out; validate interval and run the first
probe immediately: inside WaitForHealthy, check that interval > 0 (return an
error if not) before calling time.NewTicker, perform an initial probe by calling
checkOnce(ctx, url) immediately after the initialDelay select (and handle/return
success if nil, or set lastErr if non-nil), then create the ticker and continue
the loop; reference WaitForHealthy, checkOnce, interval, initialDelay and
time.NewTicker when making these changes.

In `@cli/internal/selfupdate/updater.go`:
- Around line 262-276: The httpGetWithClient function lacks URL scheme
validation which can enable SSRF risks if reused; update httpGetWithClient to
parse the provided url (using net/url.Parse or equivalent), verify the scheme is
either "http" or "https" and that the host is non-empty, and return a clear
error when validation fails before creating the request; keep the existing
behavior (using client.Do, status check, and limited read) otherwise so callers
like Download remain compatible.
- Around line 122-126: The current isUpdateAvailable function wrongly treats any
cur != lat as an update; change isUpdateAvailable to parse both versions with a
semantic version parser (handle and strip leading "v"), treat the special "dev"
token as always up-to-date (return false), compare parsed semver objects
(major/minor/patch and pre-release rules) and only return true if latest >
current; if parsing fails for either version, fall back to a safe comparison
(e.g., use semver-like numeric comparison or string equality) but ensure you do
not return true when current is newer than latest; update references to
isUpdateAvailable accordingly.

In `@cli/scripts/install.ps1`:
- Around line 53-63: Normalize and trim the expected checksum before comparing
to the computed one: after extracting $ExpectedHash from the checksums.txt line
(the ($line -split '\s+')[0] assignment) ensure you apply a Trim() and ToLower()
on $ExpectedHash so that it is compared to $ActualHash (which is already
ToLower()) in the if ($ExpectedHash -ne $ActualHash) check; this prevents false
mismatches due to casing or surrounding whitespace when using Get-Content and
Get-FileHash.

In `@cli/scripts/install.sh`:
- Around line 91-98: The install block assumes INSTALL_DIR exists; ensure the
script creates the directory before moving the binary: check and create
INSTALL_DIR (e.g., with mkdir -p "$INSTALL_DIR") prior to invoking mv/chmod for
"${TMP_DIR}/${BINARY_NAME}" -> "${INSTALL_DIR}/${BINARY_NAME}"; keep existing
permission logic and sudo usage but perform the mkdir step in the same
permission context (use sudo when INSTALL_DIR creation requires elevated rights)
so both branches (writable and non-writable) succeed.

---

Outside diff comments:
In @.pre-commit-config.yaml:
- Around line 54-91: The Go hooks are split across the file (golangci-lint is
separated from go-vet and go-test) which harms readability; reorder the hooks so
mypy and pytest-unit are grouped together and golangci-lint, go-vet, go-test are
grouped together (move the entries with ids golangci-lint, go-vet, and go-test
adjacent to each other) and optionally remove the redundant go-vet hook (id:
go-vet) because golangci-lint already runs vet checks if you want to reduce
pre-push time.