From 5da8f2576420d25287a027b21acd83d66782b15a Mon Sep 17 00:00:00 2001
From: Rafael Gomes <rafaelgomesgouve@gmail.com>
Date: Wed, 22 Jul 2026 00:55:00 -0300
Subject: [PATCH 1/3] feat(cli): add project-aware global launcher

---
 .github/dependabot.yml            | 39 +++++++++++++++++
 packages/cli/bin/dotreact.js      |  9 +++-
 packages/cli/src/index.ts         | 11 ++++-
 packages/cli/src/launcher.test.ts | 56 ++++++++++++++++++++++++
 packages/cli/src/launcher.ts      | 72 +++++++++++++++++++++++++++++++
 scripts/smoke-published-cli.mjs   | 13 ++++--
 6 files changed, 194 insertions(+), 6 deletions(-)
 create mode 100644 packages/cli/src/launcher.test.ts
 create mode 100644 packages/cli/src/launcher.ts

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f6b65e2..5b510a8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,16 +5,47 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    groups:
+      react-runtime:
+        patterns:
+          - react
+          - react-dom
+          - react-server-dom-webpack
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: "@types/node"
+        update-types:
+          - version-update:semver-major
+      - dependency-name: concurrently
+        update-types:
+          - version-update:semver-major
   - package-ecosystem: npm
     directory: /docs
     schedule:
       interval: weekly
     open-pull-requests-limit: 3
+    groups:
+      react-documentation:
+        patterns:
+          - react
+          - react-dom
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: nuget
     directory: /dotnet
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    groups:
+      opentelemetry:
+        patterns:
+          - OpenTelemetry.*
+        update-types:
+          - minor
+          - patch
   - package-ecosystem: nuget
     directory: /examples/crud/Server
     schedule:
@@ -25,8 +56,16 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 3
+    groups:
+      official-actions:
+        patterns:
+          - actions/*
   - package-ecosystem: docker
     directory: /
     schedule:
       interval: weekly
     open-pull-requests-limit: 3
+    ignore:
+      - dependency-name: node
+        update-types:
+          - version-update:semver-major
diff --git a/packages/cli/bin/dotreact.js b/packages/cli/bin/dotreact.js
index c74d2a0..680b7d2 100755
--- a/packages/cli/bin/dotreact.js
+++ b/packages/cli/bin/dotreact.js
@@ -1,3 +1,10 @@
 #!/usr/bin/env node
 
-import "../dist/index.js";
+import { launchDotReact } from "../dist/launcher.js";
+
+try {
+  await launchDotReact();
+} catch (error) {
+  process.stderr.write(`[dotreact] ${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+}
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 9b45058..5199ba4 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -561,6 +561,9 @@ async function doctor(): Promise<void> {
     };
     if (runtime.schemaVersion !== 1 || typeof runtime.frameworkVersion !== "string")
       throw new Error("Managed runtime metadata is invalid. Run dotreact upgrade from a valid framework checkout.");
+    const cliVersion = await frameworkVersion();
+    if (runtime.frameworkVersion !== cliVersion)
+      throw new Error(`DotReact CLI ${cliVersion} cannot diagnose managed runtime ${runtime.frameworkVersion}. Use the project-local CLI.`);
     process.stdout.write(`[dotreact] Managed runtime ${runtime.frameworkVersion}.\n`);
   } else {
     const dependencies = { ...packageJson.dependencies, ...packageJson.devDependencies };
@@ -575,6 +578,9 @@ async function doctor(): Promise<void> {
     if (versions.size !== 1)
       throw new Error("DotReact npm packages must use one aligned framework version. Run dotreact upgrade <version>.");
     const frameworkPackageVersion = [...versions][0]!;
+    const cliVersion = await frameworkVersion();
+    if (frameworkPackageVersion !== cliVersion)
+      throw new Error(`DotReact CLI ${cliVersion} does not match project packages ${frameworkPackageVersion}. Run npm install and use the project-local CLI.`);
     const projectSource = await readFile(resolve(root, "Server/Server.csproj"), "utf8");
     for (const packageName of ["DotReact.Hosting", "DotReact.AppGenerator"]) {
       const reference = new RegExp(`<PackageReference Include="${packageName.replace(".", "\\.")}" Version="([^\"]+)"`, "u")
@@ -918,6 +924,7 @@ async function exportStatic(values: string[]): Promise<void> {
 function help(): void {
   process.stdout.write([
     "DotReact CLI",
+    "  dotreact version                         Show the effective CLI version",
     "  dotreact create <name> [--template starter|minimal]",
     "  dotreact templates",
     "  dotreact generate page <route> [--dry-run]",
@@ -947,7 +954,9 @@ function help(): void {
 }
 
 try {
-  if (command === "create") await create(args[0], optionValue(args, "--template"));
+  if (command === "version" || command === "--version" || command === "-v")
+    process.stdout.write(`${await frameworkVersion()}\n`);
+  else if (command === "create") await create(args[0], optionValue(args, "--template"));
   else if (command === "templates") process.stdout.write("Available templates:\n  starter  SSR, hydration, actions, Docker and Azure health checks\n  minimal  One SSR page, hydration, boundaries and production runtime\n");
   else if (command === "generate" || command === "add") await generate(args);
   else if (command === "sync") await sync(args);
diff --git a/packages/cli/src/launcher.test.ts b/packages/cli/src/launcher.test.ts
new file mode 100644
index 0000000..73feef3
--- /dev/null
+++ b/packages/cli/src/launcher.test.ts
@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { resolveProjectCli } from "./launcher.js";
+
+function temporaryProject(): string {
+  return mkdtempSync(path.join(tmpdir(), "dotreact-launcher-"));
+}
+
+test("global launcher selects the nearest explicitly declared project CLI", () => {
+  const root = temporaryProject();
+  try {
+    const localBin = path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "bin", "dotreact.js");
+    mkdirSync(path.dirname(localBin), { recursive: true });
+    mkdirSync(path.join(root, "app", "reports"), { recursive: true });
+    writeFileSync(path.join(root, "package.json"), JSON.stringify({
+      devDependencies: { "@rafagouveia/dotreact-cli": "0.1.3" }
+    }));
+    writeFileSync(localBin, "#!/usr/bin/env node\n");
+    assert.equal(resolveProjectCli(path.join(root, "app", "reports"), path.join(root, "global.js")), localBin);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("global launcher does not execute undeclared or current package bins", () => {
+  const root = temporaryProject();
+  try {
+    const localBin = path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "bin", "dotreact.js");
+    mkdirSync(path.dirname(localBin), { recursive: true });
+    writeFileSync(localBin, "#!/usr/bin/env node\n");
+    writeFileSync(path.join(root, "package.json"), JSON.stringify({ dependencies: {} }));
+    assert.equal(resolveProjectCli(root, path.join(root, "global.js")), undefined);
+
+    writeFileSync(path.join(root, "package.json"), JSON.stringify({
+      dependencies: { "@rafagouveia/dotreact-cli": "0.1.3" }
+    }));
+    assert.equal(resolveProjectCli(root, localBin), undefined);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("global launcher fails closed when the declared project CLI is not installed", () => {
+  const root = temporaryProject();
+  try {
+    writeFileSync(path.join(root, "package.json"), JSON.stringify({
+      devDependencies: { "@rafagouveia/dotreact-cli": "0.1.3" }
+    }));
+    assert.throws(() => resolveProjectCli(root, path.join(root, "global.js")), /Run npm install/u);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
diff --git a/packages/cli/src/launcher.ts b/packages/cli/src/launcher.ts
new file mode 100644
index 0000000..4356f98
--- /dev/null
+++ b/packages/cli/src/launcher.ts
@@ -0,0 +1,72 @@
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { dirname, parse, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const cliPackageName = "@rafagouveia/dotreact-cli";
+const delegationGuard = "DOTREACT_CLI_DELEGATED";
+const currentBin = resolve(dirname(fileURLToPath(import.meta.url)), "../bin/dotreact.js");
+
+interface PackageManifest {
+  readonly dependencies?: Readonly<Record<string, string>>;
+  readonly devDependencies?: Readonly<Record<string, string>>;
+  readonly optionalDependencies?: Readonly<Record<string, string>>;
+}
+
+function canonicalPath(path: string): string {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return resolve(path);
+  }
+}
+
+function declaresCli(manifest: PackageManifest): boolean {
+  return manifest.dependencies?.[cliPackageName] !== undefined
+    || manifest.devDependencies?.[cliPackageName] !== undefined
+    || manifest.optionalDependencies?.[cliPackageName] !== undefined;
+}
+
+/**
+ * Finds the nearest explicitly declared project-local CLI. Merely placing a
+ * similarly named file below node_modules is not enough to make the global
+ * launcher execute it.
+ */
+export function resolveProjectCli(startDirectory: string, launcherBin = currentBin): string | undefined {
+  let directory = resolve(startDirectory);
+  const volumeRoot = parse(directory).root;
+  while (true) {
+    const packagePath = resolve(directory, "package.json");
+    if (existsSync(packagePath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(packagePath, "utf8")) as PackageManifest;
+        if (declaresCli(manifest)) {
+          const candidate = resolve(directory, "node_modules", "@rafagouveia", "dotreact-cli", "bin", "dotreact.js");
+          if (existsSync(candidate) && canonicalPath(candidate) !== canonicalPath(launcherBin)) return candidate;
+          if (!existsSync(candidate) && process.env[delegationGuard] !== "1")
+            throw new Error(`DotReact CLI is declared by ${packagePath} but is not installed. Run npm install.`);
+        }
+      } catch (error) {
+        if (error instanceof Error && error.message.startsWith("DotReact CLI is declared")) throw error;
+        // The CLI command itself will provide the project diagnostic. A broken
+        // package manifest must never redirect execution to an arbitrary file.
+      }
+    }
+    if (directory === volumeRoot) return undefined;
+    directory = dirname(directory);
+  }
+}
+
+export async function launchDotReact(): Promise<void> {
+  const localCli = process.env[delegationGuard] === "1" ? undefined : resolveProjectCli(process.cwd());
+  if (localCli !== undefined) {
+    const result = spawnSync(process.execPath, [localCli, ...process.argv.slice(2)], {
+      env: { ...process.env, [delegationGuard]: "1" },
+      stdio: "inherit"
+    });
+    if (result.error) throw result.error;
+    process.exitCode = result.status ?? 1;
+    return;
+  }
+  await import("./index.js");
+}
diff --git a/scripts/smoke-published-cli.mjs b/scripts/smoke-published-cli.mjs
index acbbe2f..b082562 100644
--- a/scripts/smoke-published-cli.mjs
+++ b/scripts/smoke-published-cli.mjs
@@ -38,8 +38,13 @@ await waitForPackage();
 
 const smokeRoot = await mkdtemp(join(tmpdir(), "dotreact-published-cli-"));
 const projectDirectory = join(smokeRoot, "published-app");
+const globalPrefix = join(smokeRoot, "global-cli");
+const dotreact = process.platform === "win32"
+  ? join(globalPrefix, "dotreact.cmd")
+  : join(globalPrefix, "bin", "dotreact");
 try {
-  run(npm, ["exec", "--yes", `--package=${cliPackage}`, "--", "dotreact", "create", "published-app", "--template", "minimal"], smokeRoot);
+  run(npm, ["install", "--global", cliPackage, `--prefix=${globalPrefix}`, `--registry=${registry}`], smokeRoot);
+  run(dotreact, ["create", "published-app", "--template", "minimal"], smokeRoot);
   if (existsSync(join(projectDirectory, "vendor"))) throw new Error("Published scaffolds must not contain vendored framework source.");
 
   run("dotnet", [
@@ -50,10 +55,10 @@ try {
     "--store-password-in-clear-text"
   ], projectDirectory);
   run(npm, ["install"], projectDirectory);
-  run(npm, ["exec", "--", "dotreact", "doctor"], projectDirectory);
+  run(dotreact, ["doctor"], projectDirectory);
   run(npm, ["run", "typecheck"], projectDirectory);
-  run(npm, ["run", "build"], projectDirectory);
-  process.stdout.write(`[dotreact] ${cliPackage} created, installed, diagnosed and built a clean project.\n`);
+  run(dotreact, ["build"], projectDirectory);
+  process.stdout.write(`[dotreact] ${cliPackage} direct command created, delegated, diagnosed and built a clean project.\n`);
 } finally {
   rmSync(smokeRoot, { recursive: true, force: true });
 }

From 273f9ef13aa23ef40216c9223ac245dfdba3d13c Mon Sep 17 00:00:00 2001
From: Rafael Gomes <rafaelgomesgouve@gmail.com>
Date: Wed, 22 Jul 2026 01:12:19 -0300
Subject: [PATCH 2/3] feat(release): prepare direct CLI workflow 0.1.4

---
 README.md                                     | 35 ++++++----
 docs/adr/005-drx-pages-and-server-actions.md  |  6 +-
 .../006-drx-layouts-and-semantic-checking.md  |  3 +-
 ...pp-router.md => 014-unified-app-router.md} |  7 +-
 docs/compatibility.md                         |  9 ++-
 docs/private-packages.md                      | 20 ++++--
 docs/scripts/generate-english-catalog.mjs     | 11 +++
 docs/src/components.tsx                       |  2 +-
 docs/src/content.en.catalog.ts                | 41 ++++++++---
 docs/src/content.guides.tsx                   |  6 +-
 docs/src/content.tsx                          | 20 ++++--
 dotnet/Directory.Build.props                  |  8 +--
 .../DotReact.Hosting/DotReact.Hosting.csproj  |  4 +-
 .../DotReact.AppGenerator.Tests.csproj        |  2 +-
 .../DotReact.AspNetCore.Tests.csproj          |  2 +-
 .../DotReact.TypeGen.Tests.csproj             |  2 +-
 examples/crud/package.json                    | 14 ++--
 examples/rsc/package.json                     |  4 +-
 examples/starter/README.md                    | 20 +++---
 .../starter/docs/ai/06-WORKFLOW-RECIPES.md    | 14 ++--
 examples/starter/package.json                 | 16 ++---
 package-lock.json                             | 68 +++++++++----------
 package.json                                  |  4 +-
 packages/adapter/package.json                 |  2 +-
 packages/cli/package.json                     |  2 +-
 packages/cli/src/index.test.ts                | 16 ++---
 packages/cli/src/index.ts                     |  2 +-
 packages/cli/src/launcher.test.ts             | 50 ++++++++++++++
 packages/cli/src/launcher.ts                  | 32 ++++++---
 packages/client/package.json                  |  2 +-
 packages/font/package.json                    |  2 +-
 packages/image/package.json                   |  2 +-
 packages/protocol/package.json                |  2 +-
 packages/renderer/package.json                |  6 +-
 packages/rsc/package.json                     |  2 +-
 packages/script/package.json                  |  4 +-
 packages/vite/package.json                    |  4 +-
 scripts/package-npm.test.mjs                  |  4 +-
 38 files changed, 288 insertions(+), 162 deletions(-)
 rename docs/adr/{006-unified-app-router.md => 014-unified-app-router.md} (92%)

diff --git a/README.md b/README.md
index c9a5116..95522d0 100644
--- a/README.md
+++ b/README.md
@@ -8,9 +8,9 @@ DotReact is an experimental full-stack framework that keeps ASP.NET Core in
 charge of HTTP, authentication, services, and data while React renders the UI
 on the server and hydrates it in the browser.
 
-This repository contains a reusable pre-release framework, CLI scaffold and three
+This repository contains a reusable experimental framework, CLI scaffold and three
 reference applications. The runtime boundary and production lifecycle are
-implemented; coordinated private npm and NuGet packages are available at version `0.1.3`.
+implemented; coordinated private npm and NuGet packages are available at version `0.1.4`.
 Public surfaces follow the repository's [compatibility and deprecation policy](COMPATIBILITY.md).
 
 The source is licensed under [MPL 2.0](LICENSE). Applications may use DotReact,
@@ -86,22 +86,31 @@ the counter proves that React hydrated the same tree in the browser.
 
 ## Create a project
 
-Using the published private CLI package:
+Authenticate the private feed once, then install the CLI launcher once:
 
 ```powershell
-npm exec --yes --package=@rafagouveia/dotreact-cli@0.1.3 -- dotreact create my-app --template starter
+npm install --global @rafagouveia/dotreact-cli@0.1.4 --registry=https://npm.pkg.github.com
+dotreact create my-app --template starter
 cd my-app
 npm install
-npm run dev
+dotreact doctor
+dotreact dev
 ```
 
 Generated projects pin the CLI, browser runtime, renderer, Vite integration,
 NuGet hosting libraries and local TypeGen tool to one exact DotReact version.
+The global command automatically delegates to that project-local CLI, so a
+machine can work on projects using different DotReact versions without drift.
 Framework source is not copied into product repositories. Use
 `dotreact upgrade <version>` to align every runtime surface before reinstalling
 and running the release gates.
 
-Private prerelease packages are hosted under the `rafagouveia` GitHub Packages
+CI should continue using package scripts or `npm exec -- dotreact`: it must not
+depend on a mutable global installation. If the shell cannot find the launcher,
+verify `Get-Command dotreact` after reopening it; the project-local fallback is
+`npm exec -- dotreact doctor`.
+
+Private 0.x packages are hosted under the `rafagouveia` GitHub Packages
 namespace. Publishing remains manual and opt-in; normal CI never republishes a
 package. See [Private GitHub Packages](docs/private-packages.md)
 for package coordinates, token permissions, local archive validation and cost
@@ -126,13 +135,13 @@ resulting lockfile before the first push.
 Inside a generated project, the complete lifecycle is:
 
 ```powershell
-npm exec -- dotreact doctor
-npm exec -- dotreact dev
-npm exec -- dotreact generate page catalog/[slug]
-npm exec -- dotreact generate action SaveCatalog
-npm exec -- dotreact sync
-npm exec -- dotreact check
-npm exec -- dotreact build
+dotreact doctor
+dotreact dev
+dotreact generate page catalog/[slug]
+dotreact generate action SaveCatalog
+dotreact sync
+dotreact check
+dotreact build
 dotreact workspace status
 dotreact workspace reveal
 dotreact workspace focus
diff --git a/docs/adr/005-drx-pages-and-server-actions.md b/docs/adr/005-drx-pages-and-server-actions.md
index e45fc29..8e7d5ad 100644
--- a/docs/adr/005-drx-pages-and-server-actions.md
+++ b/docs/adr/005-drx-pages-and-server-actions.md
@@ -2,7 +2,9 @@
 
 ## Status
 
-Accepted for the first opt-in vertical slice.
+Superseded for new applications by ADR 014. This document preserves the first
+opt-in slice and its security decisions; current scaffolds use the unified
+`app/` router.
 
 ## Decision
 
@@ -23,7 +25,7 @@ and emits three deterministic artifacts: TypeScript contracts, typed action
 clients and a backend manifest. The existing explicit TypeGen and
 `MapDotReactPage` APIs remain supported.
 
-The Vite plugin scans only `src/pages/**/*.drx`, resolves canonical paths,
+The original Vite plugin scanned only `src/pages/**/*.drx`, resolved canonical paths,
 rejects a pages root outside the application, ignores escaping symlinks and
 builds `virtual:dotreact/pages` from static imports. Request data is never used
 to construct a filesystem path or import specifier.
diff --git a/docs/adr/006-drx-layouts-and-semantic-checking.md b/docs/adr/006-drx-layouts-and-semantic-checking.md
index 5529e20..6fd5ec1 100644
--- a/docs/adr/006-drx-layouts-and-semantic-checking.md
+++ b/docs/adr/006-drx-layouts-and-semantic-checking.md
@@ -2,7 +2,8 @@
 
 ## Status
 
-Accepted for the second opt-in DRX slice.
+Accepted. ADR 014 moved the canonical pages root from `src/pages` to `app/`;
+the composition and semantic-checking guarantees in this record remain current.
 
 ## Decision
 
diff --git a/docs/adr/006-unified-app-router.md b/docs/adr/014-unified-app-router.md
similarity index 92%
rename from docs/adr/006-unified-app-router.md
rename to docs/adr/014-unified-app-router.md
index da4bca7..4e86715 100644
--- a/docs/adr/006-unified-app-router.md
+++ b/docs/adr/014-unified-app-router.md
@@ -1,9 +1,10 @@
-# ADR 006: Unified app router
+# ADR 014: Unified app router
 
 ## Status
 
-Accepted for the 0.2 development line. The legacy `src/pages` plus attributed
-loader model remains supported for compatibility during the deprecation window.
+Accepted and shipped in the 0.1.x scaffold. The legacy `src/pages` plus
+attributed loader model remains a compatibility surface, but it is not generated
+for new applications.
 
 ## Context
 
diff --git a/docs/compatibility.md b/docs/compatibility.md
index 029a6b1..9a4fcd7 100644
--- a/docs/compatibility.md
+++ b/docs/compatibility.md
@@ -4,11 +4,14 @@
 |---|---|---|---|---|---|
 | 0.1.x experimental | 10.x | 24.x recommended; 22.19+ supported | 19.2.x | 8.1.x | 7.0.x |
 
-Protocol version 1 is currently required on both sides. Generated projects use
-private GitHub npm and NuGet packages pinned to the same exact DotReact version;
+Buffered SSR uses protocol v1 and streaming SSR negotiates protocol v2. The C#
+host and Node renderer must come from the same coordinated DotReact release;
+unknown protocol versions fail closed instead of falling back silently.
+Generated projects use private GitHub npm and NuGet packages pinned to the same exact DotReact version;
 the local TypeGen tool is pinned to that version as well. `dotreact upgrade`
 aligns those three surfaces without rewriting application source. Every upgrade
-must regenerate contracts and pass `dotreact check` before deployment.
+must regenerate contracts and pass `dotreact check` before deployment. A
+one-time global launcher delegates to the exact CLI installed by each project.
 
 Supported development hosts are Windows and Linux. The production container is
 Linux-based and targets Azure App Service custom containers and Azure Container
diff --git a/docs/private-packages.md b/docs/private-packages.md
index 930f5f6..9ccd130 100644
--- a/docs/private-packages.md
+++ b/docs/private-packages.md
@@ -1,6 +1,6 @@
 # Private GitHub Packages
 
-DotReact prerelease packages are published in the `rafagouveia` GitHub Packages
+DotReact private 0.x packages are published in the `rafagouveia` GitHub Packages
 namespace. Publishing new immutable versions is manual and disabled by default.
 
 ## Package coordinates
@@ -67,15 +67,27 @@ For another private repository, grant that repository access on each package's
 GitHub **Manage Actions access** page; `packages: read` alone cannot bypass a
 package that has not shared access with the consuming repository.
 
-Create a project without cloning the framework repository:
+Install the launcher once and create a project without cloning the framework
+repository:
 
 ```powershell
-npm exec --yes --package=@rafagouveia/dotreact-cli@0.1.3 -- dotreact create my-app --template starter
+npm install --global @rafagouveia/dotreact-cli@0.1.4 --registry=https://npm.pkg.github.com
+dotreact version
+dotreact create my-app --template starter
 cd my-app
 npm install
-npm exec -- dotreact doctor
+dotreact doctor
 ```
 
+The global executable is only a launcher. Inside a project, it locates the
+nearest `package.json` that explicitly declares `@rafagouveia/dotreact-cli` and
+executes that installed local version. If dependencies are missing it fails
+closed and asks for `npm install`; it never silently runs a different global
+version. `npm exec -- dotreact doctor` remains the no-global fallback and is the
+recommended form for CI. With nvm/fnm, global packages belong to the active Node
+installation, so reinstall the launcher after switching Node versions if
+`Get-Command dotreact` no longer resolves it.
+
 ## Cost controls
 
 GitHub Free currently includes a private Packages allowance. Configure a GitHub
diff --git a/docs/scripts/generate-english-catalog.mjs b/docs/scripts/generate-english-catalog.mjs
index 55739b6..9f78d57 100644
--- a/docs/scripts/generate-english-catalog.mjs
+++ b/docs/scripts/generate-english-catalog.mjs
@@ -103,7 +103,14 @@ async function generate(expected, missing, stale, current) {
 }
 
 function normalizeTechnicalTranslation(source, translation) {
+  if (/^(?:dotreact(?:\s+.*)?|virtual:dotreact\/[A-Za-z0-9_./-]+|@rafagouveia\/dotreact-[A-Za-z0-9_-]+)$/u.test(source))
+    return source;
   let result = translation;
+  result = result
+    .replaceAll("dotreat", "dotreact")
+    .replaceAll("doreact", "dotreact")
+    .replaceAll("Dotreat", "DotReact")
+    .replaceAll("Doreact", "DotReact");
   if (/\bbanco|bancos\b/iu.test(source))
     result = result.replace(/\bbank(?:ing)?\b/giu, "database").replace(/\bbanks\b/giu, "databases");
   if (/\bhidrat/iu.test(source))
@@ -117,6 +124,9 @@ function normalizeTechnicalTranslation(source, translation) {
 
 function hasTerminologyError(source, translation) {
   if (typeof translation !== "string") return false;
+  if (/\b(?:doreact|dotreat)\b/iu.test(translation)) return true;
+  const protectedTokens = source.match(/(?:virtual:dotreact\/[A-Za-z0-9_./-]+|@rafagouveia\/dotreact-[A-Za-z0-9_-]+|\bdotreact(?:\s+[a-z][a-z-]*)?)/gu) ?? [];
+  if (protectedTokens.some(token => !translation.includes(token))) return true;
   if (/\bbanco|bancos\b/iu.test(source) && /\bbank(?:ing|s)?\b/iu.test(translation)) return true;
   if (/\bhidrat/iu.test(source) && /\bmoistur/iu.test(translation)) return true;
   if (/\bporta\b/iu.test(source) && /\bdoor\b/iu.test(translation)) return true;
@@ -153,6 +163,7 @@ function shouldKeep(value) {
   if (/^\d+(?:\.\d+)?$/u.test(value)) return true;
   if (/^[A-Z0-9_.+/@:[\]()-]{2,}$/u.test(value)) return true;
   if (/^(?:C#|React|TypeScript|PowerShell|Terminal|Program\.cs|page\.drx|package\.json)$/u.test(value)) return true;
+  if (/^(?:dotreact(?:\s+.*)?|virtual:dotreact\/|@rafagouveia\/dotreact-)/u.test(value)) return true;
   if (/^(?:app|src|Server|Domain|Application|Infrastructure|Presentation|public|vendor)\//u.test(value)) return true;
   return false;
 }
diff --git a/docs/src/components.tsx b/docs/src/components.tsx
index 640c26c..570fbdb 100644
--- a/docs/src/components.tsx
+++ b/docs/src/components.tsx
@@ -115,7 +115,7 @@ export function CliLab() {
       <label>{locale === "pt" ? "Projeto" : "Project"}
         <input value={name} onChange={event => setName(event.target.value)} />
       </label>
-      <CodeBlock label="Terminal" code={`npm run create -- create ${safeName} --template ${template}\ncd ${safeName}\nnpm install\ndotreact doctor\ndotreact dev`} />
+      <CodeBlock label="Terminal" code={`dotreact create ${safeName} --template ${template}\ncd ${safeName}\nnpm install\ndotreact doctor\ndotreact dev`} />
     </div>
   );
 }
diff --git a/docs/src/content.en.catalog.ts b/docs/src/content.en.catalog.ts
index b2f78ea..56d4796 100644
--- a/docs/src/content.en.catalog.ts
+++ b/docs/src/content.en.catalog.ts
@@ -79,6 +79,7 @@ export const englishText: Readonly<Record<string, string>> = {
   ". Ele executa antes da conclusão da request e pode redirecionar, reescrever ou alterar headers. No DotReact essa responsabilidade não fica no renderer: ela usa o pipeline ASP.NET Core, que é a entrada pública e possui DI, autenticação, autorização, rate limiting e observabilidade.": ". It executes before the request is complete and can redirect, rewrite or change headers. In DotReact, this responsibility does not rest with the renderer: it uses the ASP.NET Core pipeline, which is the public input and has DI, authentication, authorization, rate limiting and observability.",
   ". Ele tem duração absoluta e carrega apenas um ticket protegido. O React recebe somente o DTO público do usuário.": ". It has a fixed lifetime and carries only a protected ticket. React receives only the user's public DTO.",
   ". Em Azure, termine HTTPS no ingress e configure forwarded headers somente para proxies confiáveis.": ". In Azure, terminate HTTPS in the ingress and configure forwarded headers only for trusted proxies.",
+  ". Em CI, prefira os scripts do projeto ou": ". In CI, prefer project scripts or",
   ". Em desenvolvimento, ASP.NET faz proxy de": ". In development, ASP.NET proxy",
   ". Em múltiplas réplicas, persista e proteja o key ring do ASP.NET Core Data Protection para que autenticação e antiforgery sejam consistentes entre instâncias.": ". Across multiple replicas, persist and secure the ASP.NET Core Data Protection key ring so that authentication and antiforgery are consistent across instances.",
   ". Em produção, valide paths de": ". In production, validate paths",
@@ -92,6 +93,8 @@ export const englishText: Readonly<Record<string, string>> = {
   ". O comando cria somente os arquivos públicos da feature e não altera o runtime.": ". The command only creates the feature's public files and does not change the runtime.",
   ". O entry React usa": ". entry React uses",
   ". O exemplo": ". The example",
+  ". O fallback sem instalação global é": ". Fallback without global installation is",
+  ". O global cria projetos; o local executa doctor, dev, build e generators sem drift.": ". The global creates projects; local runs doctor, dev, build and generators without drift.",
   ". O Hot Reload incrementa a revisão do backend e o router busca props SSR novas pela mesma origem.": ". Hot Reload increments the backend revision and the router searches for new SSR props from the same source.",
   ". O mesmo registry virtual é consumido no SSR e na hydration, evitando árvores diferentes.": ". The same virtual registry is consumed in SSR and hydration, avoiding different trees.",
   ". O nome antigo continua citado porque muitos projetos ainda possuem": ". The old name continues to be mentioned because many projects still have",
@@ -126,6 +129,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "(shop)/products/page": "(shop)/products/page",
   "[--routes] --url --out": "[--routes] --url --out",
   "[--static-only]": "[--static-only]",
+  "[--url]": "[--url]",
   "[AllowAnonymous]": "[AllowAnonymous]",
   "[Authorize(Policy = \"catalog.manage\")]": "[Authorize(Policy = \"catalog.manage\")]",
   "[Authorize(Policy = \"orders.write\")]": "[Authorize(Policy = \"orders.write\")]",
@@ -147,7 +151,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "@rafagouveia/dotreact-rsc": "@rafagouveia/dotreact-rsc",
   "@rafagouveia/dotreact-rsc experimental": "@rafagouveia/dotreact-rsc experimental",
   "@rafagouveia/dotreact-script": "@rafagouveia/dotreact-script",
-  "@rafagouveia/dotreact-vite": "@rafazouveia/dotreact-vite",
+  "@rafagouveia/dotreact-vite": "@rafagouveia/dotreact-vite",
   "*": "*",
   "*.server.ts": "*.server.ts",
   "/": "/",
@@ -170,6 +174,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "<route> --kind error|not-found|loading|global-error": "<route> --kind error|not-found|loading|global-error",
   "<route> [--dry-run]": "<route> [--dry-run]",
   "<style>": "<style>",
+  "<version> [--dry-run]": "<version> [--dry-run]",
   "01": "01",
   "01 · Backend": "01 Backend",
   "02": "02",
@@ -265,6 +270,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Agrupa rajadas de salvamento entre 100 e 2000 ms.": "Coalesces save bursts using a delay between 100 and 2000 ms.",
   "Ainda não há convenções @slot/(.) equivalentes no router estável.": "There are no equivalent @slot/(.) conventions in the stable router yet.",
   "Ajusta a fila global de SSR. Use 0 para fail-fast ou mantenha -1 para o framework dimensionar pela capacidade dos workers.": "Adjusts the global SSR queue. Use 0 for fail-fast or keep -1 so the framework sizes it from worker capacity.",
+  "Alinha npm, NuGet e TypeGen sem reescrever código da aplicação.": "Aligns npm, NuGet and TypeGen without rewriting application code.",
   "Allowlist explícita de valores não secretos. O renderer nunca herda o environment privado do host ASP.NET.": "Explicit allowlist of non-secret values. The renderer never inherits the ASP.NET host's private environment.",
   "Altere somente pesos, observe métricas em cada janela e interrompa em qualquer regressão.": "Change only weights, watch metrics in each window, and stop at any regression.",
   "Alterna entre a visão limpa da aplicação e a infraestrutura avançada.": "Switch between a clean application view and advanced infrastructure.",
@@ -448,7 +454,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Comece por uma entrega vertical pequena": "Start with a small vertical slice",
   "Como acompanhar uma lacuna": "How to track a gap",
   "Como decidir": "How to decide",
-  "como devDependency. Portanto": "as a devDependency. Therefore",
+  "como devDependency. O launcher global encontra e executa essa versão local;": "like devDependency. The global launcher finds and runs this local version;",
   "Como escolher o local de execução": "How to choose the place of execution",
   "como fallback.": "as a fallback.",
   "como objeto ou função das props. O runtime aceita title, description, noIndex e links estruturados; não aceita HTML arbitrário no head.": "as an object or function of the props. The runtime accepts title, description, noIndex and structured links; does not accept arbitrary HTML in the head.",
@@ -494,6 +500,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "CONTAINER_APP_REVISION": "CONTAINER_APP_REVISION",
   "contém essa arquitetura funcionando: abra o dashboard, crie, edite e exclua itens e confirme a persistência após atualizar a página.": "contains this working architecture: open the dashboard, create, edit and delete items and confirm persistence after refreshing the page.",
   "conteúdo público": "public content",
+  "continua disponível como fallback explícito.": "continues to be available as an explicit fallback.",
   "continua disponível quando a aplicação opta conscientemente por um pipeline estático ASP.NET separado.": "remains available when the application consciously opts for a separate ASP.NET static pipeline.",
   "continua no Domain e protege invariantes sem conhecer banco ou framework.": "continues in the Domain and protects invariants without knowing the database or framework.",
   "continua suportado para migrações e integrações existentes. Os exemplos oficiais e novos projetos usam discovery por assembly e a convenção": "continues to be supported for existing migrations and integrations. The official examples and new projects use discovery by assembly and the convention",
@@ -564,6 +571,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Definition of done": "Definition of done",
   "Definition of ready": "Definition of ready",
   "Deixe defaults não secretos no projeto. Connection strings, chaves e tokens vêm do secret store da plataforma.": "Leave non-secret defaults in the project. Connection strings, keys and tokens come from the platform's secret store.",
+  "delega automaticamente para a CLI exata declarada e instalada naquele": "automatically delegates to the exact CLI declared and installed on that",
   "Demonstra a arquitetura atual de ponta a ponta: separação Domain/Application/Infrastructure/Presentation, rota": "Demonstrates the current end-to-end architecture: Domain/Application/Infrastructure/Presentation separation, route",
   "Demonstra a experiência recomendada:": "Demonstrates recommended experience:",
   "dentro deles não vira endpoint.": "inside them it does not become an endpoint.",
@@ -588,6 +596,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Diagnósticos confiáveis": "Reliable diagnostics",
   "diferencia": "differentiates",
   "diretamente. O servidor continua reavaliando policies em toda operação sensível.": "directly. The server continues to reevaluate policies in every sensitive operation.",
+  "Distribuição privada 0.x por pacotes": "Private 0.x distribution by packages",
   "Do scaffold ao primeiro dado C#": "From scaffold to first C# data",
   "Do zero à primeira feature": "From scratch to the first feature",
   "Docker em Linux": "Docker on Linux",
@@ -601,13 +610,15 @@ export const englishText: Readonly<Record<string, string>> = {
   "Domain + ports": "Domain + ports",
   "Domínios e proxies em desenvolvimento": "Domains and proxies in development",
   "DOTNET_WATCH_SUPPRESS_BROWSER_REFRESH=1": "DOTNET_WATCH_SUPPRESS_BROWSER_REFRESH=1",
+  "dotreact": "dotreact",
   "DotReact": "DotReact",
   "DotReact — React SSR para .NET": "DotReact — React SSR for .NET",
   "DotReact adota a ergonomia que torna o Next produtivo — arquivo por rota, layouts, boundaries, navegação parcial, SSR, geração estática e actions — mas não replica o backend JavaScript. Tudo que acessa identidade, banco, secrets ou executa efeitos pertence ao ASP.NET Core.": "DotReact adopts the ergonomics that make Next productive — file per route, layouts, boundaries, partial navigation, SSR, static generation and actions — but does not replicate the JavaScript backend. Everything that accesses identity, database, secrets or performs effects belongs to ASP.NET Core.",
   "dotreact architecture": "dotreact architecture",
+  "dotreact build": "dotreact build",
   "dotreact check": "dotreact check",
   "DotReact deliberadamente mantém o backend público em ASP.NET Core.": "DotReact deliberately keeps the backend public in ASP.NET Core.",
-  "dotreact doctor": "dotreat doctor",
+  "dotreact doctor": "dotreact doctor",
   "DotReact é adequado": "DotReact is suitable",
   "DotReact emite URLs relativas para cliente, CSS e módulos. O HTML não deve conter": "DotReact outputs relative URLs for client, CSS and modules. HTML must not contain",
   "DotReact existe especificamente para equipes que escolheram React.": "DotReact exists specifically for teams that chose React.",
@@ -617,9 +628,10 @@ export const englishText: Readonly<Record<string, string>> = {
   "DotReact mantém o backend público em ASP.NET Core. O renderer Node é privado e não vira um runtime de API na borda. Distribuição global deve usar CDN, Azure Front Door, containers ou infraestrutura .NET apropriada.": "DotReact maintains the public backend in ASP.NET Core. The Node renderer is private and does not become an API runtime on the edge. Global distribution must use CDN, Azure Front Door, containers, or appropriate .NET infrastructure.",
   "DotReact publica ActivitySource e Meter estáveis. Quando": "DotReact publishes stable ActivitySource and Meter. When",
   "DotReact serve para construir aplicações React com SSR, hydration, navegação parcial e componentes interativos sem transferir autenticação, autorização, domínio ou persistência para JavaScript. A aplicação pública continua sendo um host ASP.NET Core; React é o renderer universal da interface.": "DotReact is for building React applications with SSR, hydration, partial navigation and interactive components without transferring authentication, authorization, domain or persistence to JavaScript. The public application remains an ASP.NET Core host; React is the universal interface renderer.",
-  "dotreact sync": "doreact sync",
-  "dotreact workspace focus": "doreact workspace focus",
-  "dotreact workspace reveal": "doreact workspace reveal",
+  "dotreact start": "dotreact start",
+  "dotreact sync": "dotreact sync",
+  "dotreact workspace focus": "dotreact workspace focus",
+  "dotreact workspace reveal": "dotreact workspace reveal",
   "DOTREACT_BUILD_ID": "DOTREACT_BUILD_ID",
   "DOTREACT_KEEP_ALIVE_TIMEOUT_MS": "DOTREACT_KEEP_ALIVE_TIMEOUT_MS",
   "DOTREACT_MAX_RENDER_BODY_BYTES": "DOTREACT_MAX_RENDER_BODY_BYTES",
@@ -788,6 +800,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Experimental funcional": "Functional experimental",
   "Experimental ou roadmap": "Experimental or roadmap",
   "Expiração de sessão": "Session expiration",
+  "Explica SSR, prerender/ISR e hidratação seletiva por rota.": "Explains SSR, prerender/ISR, and route-selective hydration.",
   "explícito.": "explicit.",
   "export": "export",
   "export const metadata": "export const metadata",
@@ -840,6 +853,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "gera CSP estrita com nonce por requisição, nosniff, frame, referrer, permissions, COOP e HSTS no facade de produção. Scripts HTTPS externos precisam de Subresource Integrity; origins adicionais aceitam somente HTTPS/WSS exatas.": "generates strict CSP with nonce per request, nosniff, frame, referrer, permissions, COOP and HSTS in the production facade. External HTTPS scripts need Subresource Integrity; Additional origins only accept exact HTTPS/WSS.",
   "gerado pelo host": "host generated",
   "Gere a rota": "Generate the route",
+  "Get-Command dotreact": "Get-Command dotreact",
   "GetQueryValue<T>": "GetQueryValue<T>",
   "GetQueryValues<T>": "GetQueryValues<T>",
   "GetRouteValue<T>": "GetRouteValue<T>",
@@ -914,6 +928,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Infrastructure": "Infrastructure",
   "Ingress gerenciado, probes, múltiplas revisões e tráfego progressivo. Há Bicep oficial.": "Managed ingress, probes, multiple revisions, and progressive traffic. An official Bicep template is available.",
   "Instalar durante o pré-release": "Install during pre-release",
+  "Instale o launcher global uma vez. Ao entrar em um projeto,": "Install global launcher once. When entering a project,",
   "instância do plano": "plan instance",
   "Instrumentation": "Instrumentation",
   "instrumentation.ts": "instrumentation.ts",
@@ -1042,6 +1057,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Module IDs, patterns e tipos usados pelo checker Vite.": "Module IDs, patterns and types used by the Vite checker.",
   "MODULE_NOT_FOUND": "MODULE_NOT_FOUND",
   "Módulo auxiliar exclusivo do entry/renderer; o build falha se ele entrar no bundle do navegador.": "Exclusive entry/renderer auxiliary module; the build fails if it enters the browser bundle.",
+  "Mostra a versão efetiva depois da delegação global para local.": "Shows the effective version after global to local delegation.",
   "Mostra alteração de infraestrutura antes da execução.": "Shows infrastructure change before execution.",
   "Mostra duração, falhas do processo e detalhes que não cabem no painel Problems.": "Shows duration, process failures, and details that don't fit in the Problems panel.",
   "mostra loader/renderer,": "shows loader/renderer,",
@@ -1101,9 +1117,9 @@ export const englishText: Readonly<Record<string, string>> = {
   "not-found.drx / error.drx": "not-found.drx/error.drx",
   "not-found.tsx / error.tsx": "not-found.tsx/error.tsx",
   "NotFound": "NotFound",
+  "npm exec": "npm exec",
   "npm exec -- dotreact": "npm exec -- dotreact",
-  "npm exec -- dotreact build": "npm exec -- dotreact build",
-  "npm exec -- dotreact start": "npm exec -- dotreact start",
+  "npm exec -- dotreact doctor": "npm exec -- dotreact doctor",
   "npm install": "npm install",
   "npm run benchmark:compare": "npm run benchmark:compare",
   "npm run verify": "npm run verify",
@@ -1262,7 +1278,6 @@ export const englishText: Readonly<Record<string, string>> = {
   "PostgreSQL": "PostgreSQL",
   "PowerShell": "PowerShell",
   "PowerShell · autenticação local": "PowerShell local authentication",
-  "Pré-release privado por pacotes": "Private pre-release by packages",
   "Precisa aparecer no primeiro HTML?": "Does it need to appear in the first HTML?",
   "precisa de justificativa, rate limit e teste de abuso. Não use para contornar configuração de autenticação.": "needs justification, rate limit and abuse testing. Do not use to bypass authentication configuration.",
   "Precisão e limites": "Accuracy and limits",
@@ -1448,6 +1463,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Route Handlers": "Route Handlers",
   "Route Handlers / API Routes": "Route Handlers/API Routes",
   "Route values e query string tipados": "Typed route values and query string",
+  "routes": "routes",
   "RSC experimental": "experimental CSR",
   "Runbook mínimo": "Minimum runbook",
   "Runtime e TypeGen agregam os assemblies, ordenam o resultado e rejeitam colisões globais de route pattern, module ID, action ID e nome de export TypeScript.": "Runtime and TypeGen aggregate the assemblies, order the result and reject global collisions of route pattern, module ID, action ID and TypeScript export name.",
@@ -1467,6 +1483,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "Script remoto com integridade": "Remote scripting with integrity",
   "Scripts de continuação recebem um nonce por requisição; a CSP de produção continua sem": "Continuation scripts receive one nonce per request; production CSP continues without",
   "Scripts de terceiros sem bloquear a página inteira": "Third-party scripts without blocking the entire page",
+  "Se o executável ainda não estiver no PATH, reabra o terminal e confirme com": "If the executable is not already in the PATH, reopen the terminal and confirm with",
   "Secrets": "Secrets",
   "Secure": "Secure",
   "security": "security",
@@ -1616,6 +1633,7 @@ export const englishText: Readonly<Record<string, string>> = {
   "ulong": "ulong",
   "Um caso de uso por operação e efeitos injetados.": "One use case per operation, with external effects injected.",
   "Um caso de uso por operação; evite um": "One use case per operation; avoid one",
+  "Um comando direto, versão local previsível": "One direct command, predictable local version",
   "Um limite explícito entre duas plataformas": "An explicit boundary between two platforms",
   "Um projeto DotReact nasce pronto para SSR, hydration, segurança, assets e produção. O primeiro trabalho da equipe não é configurar Vite ou montar um segundo backend: é descrever o domínio, criar um caso de uso C# e expor somente o contrato necessário para uma página DRX.": "A DotReact project is born ready for SSR, hydration, security, assets and production. The team's first job isn't to configure Vite or build a second backend: it's to describe the domain, create a C# use case, and expose only the contract needed for a DRX page.",
   "Um redirect baseado em cookie pode melhorar UX, mas não substitui a policy do loader e de cada action.": "A cookie-based redirect can improve UX, but it does not replace the loader and each action policy.",
@@ -1634,10 +1652,10 @@ export const englishText: Readonly<Record<string, string>> = {
   "unitário": "unitary",
   "unsafe-eval": "unsafe-eval",
   "unsafe-inline": "unsafe-inline",
+  "upgrade": "upgrade",
   "Upload ou webhook": "Upload or webhook",
   "Uploads, webhooks, APIs públicas e respostas não-UI usam ASP.NET Core normal.": "Uploads, webhooks, public APIs, and non-UI responses use regular ASP.NET Core.",
   "URL, timeout, root element e token obrigatório falham cedo quando inválidos.": "URL, timeout, root element and required token fail early when invalid.",
-  "usa a versão do próprio projeto, sem instalação global e sem depender de um checkout do framework.": "uses the project's own version, without global installation and without depending on a framework checkout.",
   "usa o plugin oficial Vite com versões pinadas; o exemplo entrega HTML + Flight real. PPR gera shell Suspense estático e retoma o hole com APIs React 19.2. A integração segue isolada até o contrato de bundler React ter estabilidade SemVer.": "uses the official Vite plugin with pinned versions; the example delivers real HTML + Flight. PPR generates static Suspense shell and resume hole with React 19.2 APIs. The integration remains isolated until the React bundler contract has SemVer stability.",
   "usa por padrão 120 requests/minuto, sem fila, particionando usuários autenticados e protegendo também o otimizador de imagens. Cada processo aceita no máximo quatro transforms simultâneos por padrão.": "uses 120 requests/minute by default, without queue, partitioning authenticated users and also protecting the image optimizer. Each process accepts a maximum of four simultaneous transforms by default.",
   "usando props serializadas pelo C#.": "using props serialized by C#.",
@@ -1695,10 +1713,11 @@ export const englishText: Readonly<Record<string, string>> = {
   "Verifique Problem Details, contrato gerado e token": "Check Problem Details, generated contract and token",
   "Versão": "Version",
   "Versão coordenada": "Coordinated version",
+  "version": "version",
   "Vincule contas somente após uma regra explícita; não confie apenas no e-mail sem verificar o provider.": "Link accounts only through an explicit rule; don't trust an email address without verifying the provider.",
   "viram string.": "become string.",
   "viram unions TypeScript discriminadas e determinísticas, inclusive quando aparecem em propriedades ou coleções. Discriminadores ausentes, duplicados ou ambíguos falham durante a geração, antes de chegarem ao navegador.": "have seen TypeScript unions discriminated and deterministic, including when appearing in properties or collections. Missing, duplicate, or ambiguous discriminators fail during generation before reaching the browser.",
-  "virtual:dotreact/pages": "virtual:doreact/pages",
+  "virtual:dotreact/pages": "virtual:dotreact/pages",
   "Visão geral": "Overview",
   "Vite / TypeScript": "Vite/TypeScript",
   "VITE_*": "VITE_*",
diff --git a/docs/src/content.guides.tsx b/docs/src/content.guides.tsx
index 8f3b8a5..681e332 100644
--- a/docs/src/content.guides.tsx
+++ b/docs/src/content.guides.tsx
@@ -117,7 +117,7 @@ export const guideDocs: readonly DocPage[] = [
     body: <>
       <h2>Comece por uma entrega vertical pequena</h2>
       <p>Um projeto DotReact nasce pronto para SSR, hydration, segurança, assets e produção. O primeiro trabalho da equipe não é configurar Vite ou montar um segundo backend: é descrever o domínio, criar um caso de uso C# e expor somente o contrato necessário para uma página DRX.</p>
-      <CodeBlock label="Terminal" code={'npm run create -- create accounting-portal --template starter\ncd accounting-portal\nnpm install\nnpm exec -- dotreact doctor\nnpm run dev'} />
+      <CodeBlock label="Terminal" code={'dotreact create accounting-portal --template starter\ncd accounting-portal\nnpm install\ndotreact doctor\ndotreact dev'} />
       <Steps>
         <Step title="Registre a identidade"><p>Atualize <code>docs/ai/PROJECT.md</code> com produto, usuários, módulos, persistência e alvo de deploy. O CLI já aplica o nome informado ao package, namespace C#, assembly, metadata e manifesto.</p></Step>
         <Step title="Gere a rota"><p>Use <code>dotreact generate page invoices/[id]</code>. O comando cria somente os arquivos públicos da feature e não altera o runtime.</p></Step>
@@ -167,7 +167,7 @@ export const guideDocs: readonly DocPage[] = [
         { name: "SQL Server", defaultValue: "ecossistema Microsoft", description: "Provider oficial EF Core, Azure SQL e integração madura com ferramentas .NET." }
       ]} />
       <h3>1. Gere a feature e escolha o provider</h3>
-      <CodeBlock label="Terminal" code={'npm exec -- dotreact generate page work-items\nnpm exec -- dotreact generate action CreateWorkItem\nnpm exec -- dotreact generate action UpdateWorkItem\nnpm exec -- dotreact generate action DeleteWorkItem\n\n' + databasePackages} />
+      <CodeBlock label="Terminal" code={'dotreact generate page work-items\ndotreact generate action CreateWorkItem\ndotreact generate action UpdateWorkItem\ndotreact generate action DeleteWorkItem\n\n' + databasePackages} />
       <p>O tutorial instala os três providers para o switch compilar como está. No produto real, remova os cases e pacotes que não serão usados. Tudo fica em Infrastructure; Domain e Application continuam sem referência ao EF Core.</p>
       <h3>2. Configure sem colocar secret no Git</h3>
       <CodeBlock label="appsettings.Development.json + ambiente" code={databaseConfiguration} />
@@ -239,7 +239,7 @@ export const guideDocs: readonly DocPage[] = [
         { name: "minimal", defaultValue: "produto limpo", description: "Mantém uma rota SSR, infraestrutura de produção e documentação, removendo demos e actions." }
       ]} />
       <p>O nome passado ao <code>create</code> define package npm, namespace/root namespace C#, assembly, metadata inicial, manifesto e perfil do projeto. Um projeto <code>Arxis</code> não deve conservar <code>DotReact.Starter</code> em código de aplicação.</p>
-      <CodeBlock label="Criar e manter" code={'npm exec --yes --package=@rafagouveia/dotreact-cli@0.1.3 -- dotreact create arxis --template minimal\ncd arxis\nnpm install\n\n# em uma próxima versão, atualize npm, NuGet e TypeGen em conjunto\nnpm exec -- dotreact upgrade 0.1.4\nnpm install\nnpm run verify'} />
+      <CodeBlock label="Criar e manter" code={'# instalação única do launcher\nnpm install --global @rafagouveia/dotreact-cli@0.1.4 --registry=https://npm.pkg.github.com\n\ndotreact create arxis --template minimal\ncd arxis\nnpm install\ndotreact doctor\n\n# em uma release futura, alinhe npm, NuGet e TypeGen em conjunto\ndotreact upgrade <versão-publicada> --dry-run\ndotreact upgrade <versão-publicada>\nnpm install\nnpm run verify'} />
       <h3>O que o upgrade pode alterar</h3>
       <ul className="feature-list">
         <li>dependências DotReact em <code>package.json</code>, <code>Server.csproj</code> e no manifesto da ferramenta local;</li>
diff --git a/docs/src/content.tsx b/docs/src/content.tsx
index 02d0dcc..a10f62c 100644
--- a/docs/src/content.tsx
+++ b/docs/src/content.tsx
@@ -163,11 +163,14 @@ export const docs: readonly DocPage[] = [
         { name: "React", defaultValue: "19.2.x", description: "SSR com react-dom/server e hydrateRoot no cliente." },
         { name: "Vite / TypeScript", defaultValue: "8.1.x / 7.0.x", description: "Build, HMR e verificação semântica de .drx." }
       ]} />
-      <h3>Pré-release privado por pacotes</h3>
+      <h3>Distribuição privada 0.x por pacotes</h3>
       <p>O runtime, a CLI e o TypeGen são publicados no GitHub Packages sob as versões coordenadas do DotReact. O scaffold fixa versões exatas em <code>package.json</code>, <code>Server.csproj</code> e <code>.config/dotnet-tools.json</code>; ele não copia o código-fonte do framework para a aplicação.</p>
       <CodeBlock label="PowerShell · autenticação local" code={'npm config set @rafagouveia:registry https://npm.pkg.github.com --location=user\nnpm config set //npm.pkg.github.com/:_authToken "$env:GITHUB_PACKAGES_TOKEN" --location=user\n\n# O NuGet.config do projeto já declara o feed. A credencial fica fora do Git.\n${env:NuGetPackageSourceCredentials_github-dotreact}="Username=rafagouveia;Password=$env:GITHUB_PACKAGES_TOKEN"'} />
       <p>O projeto abre em modo <strong>focus</strong>: páginas, features, componentes, loaders, actions e pontos oficiais de extensão ficam visíveis; contratos gerados, entrypoints, compiladores e deploy permanecem versionados, mas fora da navegação cotidiana. Use <code>dotreact workspace reveal</code> para configurar infraestrutura e <code>dotreact workspace focus</code> para voltar à visão de aplicação.</p>
-      <CodeBlock label="PowerShell" code={'npm exec --yes --package=@rafagouveia/dotreact-cli@0.1.3 -- dotreact create minha-app --template starter\ncd minha-app\nnpm install\nnpm exec -- dotreact doctor\nnpm run dev'} />
+      <h3>Um comando direto, versão local previsível</h3>
+      <p>Instale o launcher global uma vez. Ao entrar em um projeto, <code>dotreact</code> delega automaticamente para a CLI exata declarada e instalada naquele <code>package.json</code>. O global cria projetos; o local executa doctor, dev, build e generators sem drift.</p>
+      <CodeBlock label="PowerShell" code={'npm install --global @rafagouveia/dotreact-cli@0.1.4 --registry=https://npm.pkg.github.com\ndotreact version\ndotreact create minha-app --template starter\ncd minha-app\nnpm install\ndotreact doctor\ndotreact dev'} />
+      <p>Se o executável ainda não estiver no PATH, reabra o terminal e confirme com <code>Get-Command dotreact</code>. O fallback sem instalação global é <code>npm exec -- dotreact doctor</code>. Em CI, prefira os scripts do projeto ou <code>npm exec</code>.</p>
       <h3>Pronto para versionamento</h3>
       <p>O gerador não cria a pasta <code>.git</code> nem executa <code>git init</code>. Ele entrega somente os arquivos portáveis do repositório: <code>.gitignore</code>, <code>.gitattributes</code>, <code>.editorconfig</code>, <code>.dockerignore</code>, <code>.npmrc</code>, <code>.nvmrc</code>, <code>global.json</code>, regras MSBuild e um workflow GitHub Actions.</p>
       <p>Execute <code>npm install</code> e versione o <code>package-lock.json</code>. Contratos gerados em <code>src/contracts.ts</code>, <code>src/actions.ts</code> e <code>src/backend-manifest.json</code> também devem ser versionados: o CI usa esses arquivos para detectar drift entre C# e TypeScript.</p>
@@ -186,8 +189,8 @@ export const docs: readonly DocPage[] = [
         <Step title="Abra a aplicação"><p>Acesse <code>http://127.0.0.1:5080</code>. O texto inicial já deve existir no HTML retornado pelo servidor.</p></Step>
         <Step title="Mude o loader"><p>Edite <code>app/page.server.cs</code>. O Hot Reload incrementa a revisão do backend e o router busca props SSR novas pela mesma origem.</p></Step>
         <Step title="Mude a view"><p>Edite <code>app/page.drx</code>. Vite aplica Fast Refresh preservando estado React compatível.</p></Step>
-        <Step title="Valide os contratos"><CodeBlock label="Terminal" code={'npm exec -- dotreact sync\nnpm exec -- dotreact check'} /></Step>
-        <Step title="Teste produção"><p><code>npm exec -- dotreact build</code> gera client e SSR separados. <code>npm exec -- dotreact start</code> publica o host e inicia o renderer privado supervisionado.</p></Step>
+        <Step title="Valide os contratos"><CodeBlock label="Terminal" code={'dotreact sync\ndotreact check'} /></Step>
+        <Step title="Teste produção"><p><code>dotreact build</code> gera client e SSR separados. <code>dotreact start</code> publica o host e inicia o renderer privado supervisionado.</p></Step>
       </Steps>
     </>
   },
@@ -580,7 +583,7 @@ app.MapDotReactFallback();`} />
       <p>Artefatos Redis finitos expiram após a janela stale mais a retenção de recuperação. Artefatos estáticos também recebem retenção máxima — 30 dias por padrão — e podem ser regenerados, impedindo que builds abandonados consumam armazenamento indefinidamente.</p>
       <p>Artefatos persistidos nunca contêm cookie, token CSRF ou estado de usuário. Quando uma página estática executa sua primeira Server Action, o client adquire um token antiforgery por <code>/_dotreact/csrf</code> e o reutiliza.</p>
       <p><code>/_dotreact/prerender-manifest</code> expande os providers tipados, limita a cardinalidade e rejeita paths duplicados/incompletos. Hits fresh pulam o loader C#; o HTML usa request ID determinístico e não emite cookie antiforgery.</p>
-      <CodeBlock label="Export estático" code={'# descobre as rotas no manifest C#\nnpm exec -- dotreact export --url http://127.0.0.1:5080 --out dist/static\n\n# --routes continua disponível como override explícito\nnpm exec -- dotreact export --routes /,/products/1'} />
+      <CodeBlock label="Export estático" code={'# descobre as rotas no manifest C#\ndotreact export --url http://127.0.0.1:5080 --out dist/static\n\n# --routes continua disponível como override explícito\ndotreact export --routes /,/products/1'} />
       <h3>Image component + processor real</h3>
       <PairedCode csharp={'// AddDotReactApplication usa public/ por convenção.\n// Configure apenas origens remotas adicionais quando necessário.\nbuilder.AddDotReactApplication(options => { /* extensões */ });'} react={'import { Image } from "@rafagouveia/dotreact-image";\n\n<Image src="/images/product.jpg" width={640} height={480}\n  quality={75} alt="Produto" />'} csharpLabel="Program.cs" reactLabel="page.drx" />
       <p>O plugin SkiaSharp separado faz resize e encode JPEG/PNG/WebP em Windows/Linux. O endpoint limita origem, bytes, pixels, width e quality, bloqueia SSRF/traversal e responde ETag/cache. O core continua aceitando outro <code>IDotReactImageProcessor</code>.</p>
@@ -614,6 +617,7 @@ app.MapDotReactFallback();`} />
     body: <>
       <h2>Comandos implementados</h2>
       <ReferenceTable valueHeading="Argumentos principais" rows={[
+        { name: "version", description: "Mostra a versão efetiva depois da delegação global para local." },
         { name: "create", defaultValue: "<name> --template starter|minimal", description: "Cria um projeto autônomo com pacotes npm, NuGet e TypeGen alinhados." },
         { name: "templates", description: "Lista starter e minimal." },
         { name: "generate page", defaultValue: "<route> [--dry-run]", description: "Cria page.drx e companion C# sem sobrescrever." },
@@ -626,15 +630,17 @@ app.MapDotReactFallback();`} />
         { name: "dev / build / start", description: "O executor do framework coordena contratos, bundles client/SSR, Release ASP.NET, publish e runtime." },
         { name: "analyze", defaultValue: "--max-client-kb / --max-ssr-kb", description: "Mede bundle raw/gzip e aplica budgets." },
         { name: "benchmark", defaultValue: "[url] --compare baseline --json", description: "Mede TTFB, resposta completa, p50/p95/p99, throughput e budgets comparativos." },
+        { name: "routes", defaultValue: "[--url]", description: "Explica SSR, prerender/ISR e hidratação seletiva por rota." },
         { name: "export", defaultValue: "[--routes] --url --out", description: "Descobre o prerender manifest C# ou usa override e materializa HTML portátil." },
         { name: "architecture", description: "Valida o contrato App Router e apresenta correções acionáveis." },
         { name: "security", defaultValue: "[--static-only]", description: "Procura sinks inseguros e, no modo completo, audita dependências npm e .NET." },
         { name: "health", description: "Executa doctor e o gate completo do projeto: contratos, testes, build, budgets e auditorias." },
         { name: "doctor", description: "Valida runtimes, zonas, scripts, assets públicos, Lighthouse, Docker e manifests Azure." },
+        { name: "upgrade", defaultValue: "<version> [--dry-run]", description: "Alinha npm, NuGet e TypeGen sem reescrever código da aplicação." },
         { name: "workspace", defaultValue: "focus|reveal|status", description: "Alterna entre a visão limpa da aplicação e a infraestrutura avançada." }
       ]} />
-      <CodeBlock label="Terminal" code={'npm exec -- dotreact generate page catalog/[slug] --dry-run\nnpm exec -- dotreact generate page catalog/[slug]\nnpm exec -- dotreact generate component ProductCard --route catalog\nnpm exec -- dotreact generate action SaveProduct --route catalog\nnpm exec -- dotreact generate boundary catalog --kind loading\nnpm exec -- dotreact sync\nnpm exec -- dotreact architecture\nnpm exec -- dotreact check\nnpm exec -- dotreact security\nnpm exec -- dotreact build\nnpm exec -- dotreact analyze --max-client-kb 100 --max-ssr-kb 50\nnpm exec -- dotreact health\nnpm exec -- dotreact workspace focus'} />
-      <p>Projetos gerados fixam <code>@rafagouveia/dotreact-cli</code> como devDependency. Portanto <code>npm exec -- dotreact</code> usa a versão do próprio projeto, sem instalação global e sem depender de um checkout do framework.</p>
+      <CodeBlock label="Terminal" code={'dotreact version\ndotreact generate page catalog/[slug] --dry-run\ndotreact generate page catalog/[slug]\ndotreact generate component ProductCard --route catalog\ndotreact generate action SaveProduct --route catalog\ndotreact generate boundary catalog --kind loading\ndotreact sync\ndotreact routes\ndotreact architecture\ndotreact check\ndotreact security\ndotreact build\ndotreact analyze --max-client-kb 100 --max-ssr-kb 50\ndotreact health\ndotreact workspace focus'} />
+      <p>Projetos gerados fixam <code>@rafagouveia/dotreact-cli</code> como devDependency. O launcher global encontra e executa essa versão local; <code>npm exec -- dotreact</code> continua disponível como fallback explícito.</p>
       <p><code>add</code> é alias de <code>generate</code>. Generators rejeitam traversal e colisões; não há flag de overwrite.</p>
     </>
   },
diff --git a/dotnet/Directory.Build.props b/dotnet/Directory.Build.props
index 1c5f151..85e6697 100644
--- a/dotnet/Directory.Build.props
+++ b/dotnet/Directory.Build.props
@@ -5,10 +5,10 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <LangVersion>latest</LangVersion>
-    <VersionPrefix>0.1.3</VersionPrefix>
-    <AssemblyVersion>0.1.3.0</AssemblyVersion>
-    <FileVersion>0.1.3.0</FileVersion>
-    <InformationalVersion>0.1.3</InformationalVersion>
+    <VersionPrefix>0.1.4</VersionPrefix>
+    <AssemblyVersion>0.1.4.0</AssemblyVersion>
+    <FileVersion>0.1.4.0</FileVersion>
+    <InformationalVersion>0.1.4</InformationalVersion>
     <Authors>Black Red Solutions</Authors>
     <Company>Black Red Solutions</Company>
     <Copyright>Copyright © Black Red Solutions</Copyright>
diff --git a/dotnet/src/DotReact.Hosting/DotReact.Hosting.csproj b/dotnet/src/DotReact.Hosting/DotReact.Hosting.csproj
index 6641cbf..55616ea 100644
--- a/dotnet/src/DotReact.Hosting/DotReact.Hosting.csproj
+++ b/dotnet/src/DotReact.Hosting/DotReact.Hosting.csproj
@@ -9,9 +9,9 @@
     <ProjectReference Include="../DotReact.Images.SkiaSharp/DotReact.Images.SkiaSharp.csproj" />
     <ProjectReference Include="../DotReact.Redis/DotReact.Redis.csproj" />
     <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
-    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
+    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
     <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.16.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
     <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="10.0.10" />
   </ItemGroup>
 </Project>
diff --git a/dotnet/tests/DotReact.AppGenerator.Tests/DotReact.AppGenerator.Tests.csproj b/dotnet/tests/DotReact.AppGenerator.Tests/DotReact.AppGenerator.Tests.csproj
index 0fd92b4..e4a041f 100644
--- a/dotnet/tests/DotReact.AppGenerator.Tests/DotReact.AppGenerator.Tests.csproj
+++ b/dotnet/tests/DotReact.AppGenerator.Tests/DotReact.AppGenerator.Tests.csproj
@@ -6,7 +6,7 @@
   <ItemGroup>
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="xunit.v3" Version="3.2.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
diff --git a/dotnet/tests/DotReact.AspNetCore.Tests/DotReact.AspNetCore.Tests.csproj b/dotnet/tests/DotReact.AspNetCore.Tests/DotReact.AspNetCore.Tests.csproj
index d41a7c4..edfbb67 100644
--- a/dotnet/tests/DotReact.AspNetCore.Tests/DotReact.AspNetCore.Tests.csproj
+++ b/dotnet/tests/DotReact.AspNetCore.Tests/DotReact.AspNetCore.Tests.csproj
@@ -6,7 +6,7 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.TestHost" Version="10.0.10" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="SkiaSharp" Version="4.150.1" />
     <PackageReference Include="xunit.v3" Version="3.2.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
diff --git a/dotnet/tests/DotReact.TypeGen.Tests/DotReact.TypeGen.Tests.csproj b/dotnet/tests/DotReact.TypeGen.Tests/DotReact.TypeGen.Tests.csproj
index a5d6081..78d0acf 100644
--- a/dotnet/tests/DotReact.TypeGen.Tests/DotReact.TypeGen.Tests.csproj
+++ b/dotnet/tests/DotReact.TypeGen.Tests/DotReact.TypeGen.Tests.csproj
@@ -5,7 +5,7 @@
     <NoWarn>$(NoWarn);xUnit1051</NoWarn>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="xunit.v3" Version="3.2.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
diff --git a/examples/crud/package.json b/examples/crud/package.json
index 370a32d..0aedff9 100644
--- a/examples/crud/package.json
+++ b/examples/crud/package.json
@@ -16,17 +16,17 @@
     "build": "dotreact build"
   },
   "dependencies": {
-    "@rafagouveia/dotreact-client": "0.1.3",
-    "@rafagouveia/dotreact-font": "0.1.3",
-    "@rafagouveia/dotreact-protocol": "0.1.3",
-    "@rafagouveia/dotreact-renderer": "0.1.3",
-    "@rafagouveia/dotreact-script": "0.1.3",
+    "@rafagouveia/dotreact-client": "0.1.4",
+    "@rafagouveia/dotreact-font": "0.1.4",
+    "@rafagouveia/dotreact-protocol": "0.1.4",
+    "@rafagouveia/dotreact-renderer": "0.1.4",
+    "@rafagouveia/dotreact-script": "0.1.4",
     "react": "19.2.7",
     "react-dom": "19.2.7"
   },
   "devDependencies": {
-    "@rafagouveia/dotreact-cli": "0.1.3",
-    "@rafagouveia/dotreact-vite": "0.1.3",
+    "@rafagouveia/dotreact-cli": "0.1.4",
+    "@rafagouveia/dotreact-vite": "0.1.4",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "concurrently": "9.2.4",
diff --git a/examples/rsc/package.json b/examples/rsc/package.json
index 8b16489..533afbb 100644
--- a/examples/rsc/package.json
+++ b/examples/rsc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-example-rsc",
-  "version": "0.1.3-experimental.0",
+  "version": "0.1.4-experimental.0",
   "private": true,
   "type": "module",
   "scripts": {
@@ -9,7 +9,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@rafagouveia/dotreact-rsc": "0.1.3-experimental.0",
+    "@rafagouveia/dotreact-rsc": "0.1.4-experimental.0",
     "react": "19.2.7",
     "react-dom": "19.2.7"
   },
diff --git a/examples/starter/README.md b/examples/starter/README.md
index 4023be7..4bf6a53 100644
--- a/examples/starter/README.md
+++ b/examples/starter/README.md
@@ -55,17 +55,17 @@ npm install
 npm run dev
 ```
 
-Projects created during the pre-release vendor the CLI too, so project-local
-commands work without a global installation:
+The project pins its CLI version. A one-time global launcher delegates every
+command below to that project-local package:
 
 ```powershell
-npm exec -- dotreact doctor
-npm exec -- dotreact generate page catalog/[slug]
-npm exec -- dotreact generate component ProductCard --route catalog
-npm exec -- dotreact generate action SaveProduct --route catalog
-npm exec -- dotreact check
-npm exec -- dotreact security
-npm exec -- dotreact health
+dotreact doctor
+dotreact generate page catalog/[slug]
+dotreact generate component ProductCard --route catalog
+dotreact generate action SaveProduct --route catalog
+dotreact check
+dotreact security
+dotreact health
 ```
 
 Open `http://127.0.0.1:5080`.
@@ -177,7 +177,7 @@ DotReact is consumed through exact npm and NuGet versions plus a pinned local
 machine, then upgrade the complete runtime contract together:
 
 ```powershell
-dotreact upgrade 0.1.3
+dotreact upgrade <published-version>
 npm install
 npm run verify
 ```
diff --git a/examples/starter/docs/ai/06-WORKFLOW-RECIPES.md b/examples/starter/docs/ai/06-WORKFLOW-RECIPES.md
index 424d6b7..72a67c3 100644
--- a/examples/starter/docs/ai/06-WORKFLOW-RECIPES.md
+++ b/examples/starter/docs/ai/06-WORKFLOW-RECIPES.md
@@ -4,7 +4,7 @@
 
 ```powershell
 npm install
-npm exec -- dotreact doctor
+dotreact doctor
 npm run check:contracts
 npm run typecheck
 npm run dev
@@ -18,7 +18,7 @@ ASP.NET; the renderer port is private infrastructure.
 Prefer the CLI to create collision-safe files:
 
 ```powershell
-npm exec -- dotreact generate page invoices/[id]
+dotreact generate page invoices/[id]
 ```
 
 Then:
@@ -34,7 +34,7 @@ Then:
 ## Add a Server Action
 
 ```powershell
-npm exec -- dotreact generate action CreateInvoice
+dotreact generate action CreateInvoice
 ```
 
 Then:
@@ -51,10 +51,10 @@ Then:
 ## Add a layout or boundary
 
 ```powershell
-npm exec -- dotreact generate layout invoices
-npm exec -- dotreact generate boundary invoices --kind loading
-npm exec -- dotreact generate boundary invoices --kind error
-npm exec -- dotreact generate boundary invoices --kind not-found
+dotreact generate layout invoices
+dotreact generate boundary invoices --kind loading
+dotreact generate boundary invoices --kind error
+dotreact generate boundary invoices --kind not-found
 ```
 
 Keep layouts free of hidden backend access. Boundaries must be accessible,
diff --git a/examples/starter/package.json b/examples/starter/package.json
index 6870112..3af10a3 100644
--- a/examples/starter/package.json
+++ b/examples/starter/package.json
@@ -26,18 +26,18 @@
     "verify": "npm run check:contracts && npm run typecheck && dotreact security --static-only && npm run build && npm run analyze && npm audit --audit-level=high && npm run audit:dotnet"
   },
   "dependencies": {
-    "@rafagouveia/dotreact-client": "0.1.3",
-    "@rafagouveia/dotreact-font": "0.1.3",
-    "@rafagouveia/dotreact-image": "0.1.3",
-    "@rafagouveia/dotreact-protocol": "0.1.3",
-    "@rafagouveia/dotreact-renderer": "0.1.3",
-    "@rafagouveia/dotreact-script": "0.1.3",
+    "@rafagouveia/dotreact-client": "0.1.4",
+    "@rafagouveia/dotreact-font": "0.1.4",
+    "@rafagouveia/dotreact-image": "0.1.4",
+    "@rafagouveia/dotreact-protocol": "0.1.4",
+    "@rafagouveia/dotreact-renderer": "0.1.4",
+    "@rafagouveia/dotreact-script": "0.1.4",
     "react": "19.2.7",
     "react-dom": "19.2.7"
   },
   "devDependencies": {
-    "@rafagouveia/dotreact-cli": "0.1.3",
-    "@rafagouveia/dotreact-vite": "0.1.3",
+    "@rafagouveia/dotreact-cli": "0.1.4",
+    "@rafagouveia/dotreact-vite": "0.1.4",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "concurrently": "9.2.4",
diff --git a/package-lock.json b/package-lock.json
index 02ac9ec..2b0f164 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,19 +1,19 @@
 {
   "name": "dotreact-monorepo",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dotreact-monorepo",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "workspaces": [
         "packages/*",
         "examples/*",
         "editors/*"
       ],
       "dependencies": {
-        "@rafagouveia/dotreact-cli": "0.1.3"
+        "@rafagouveia/dotreact-cli": "0.1.4"
       },
       "devDependencies": {
         "@playwright/test": "1.61.1"
@@ -38,17 +38,17 @@
       "name": "@rafagouveia/dotreact-example-crud",
       "version": "0.1.0",
       "dependencies": {
-        "@rafagouveia/dotreact-client": "0.1.3",
-        "@rafagouveia/dotreact-font": "0.1.3",
-        "@rafagouveia/dotreact-protocol": "0.1.3",
-        "@rafagouveia/dotreact-renderer": "0.1.3",
-        "@rafagouveia/dotreact-script": "0.1.3",
+        "@rafagouveia/dotreact-client": "0.1.4",
+        "@rafagouveia/dotreact-font": "0.1.4",
+        "@rafagouveia/dotreact-protocol": "0.1.4",
+        "@rafagouveia/dotreact-renderer": "0.1.4",
+        "@rafagouveia/dotreact-script": "0.1.4",
         "react": "19.2.7",
         "react-dom": "19.2.7"
       },
       "devDependencies": {
-        "@rafagouveia/dotreact-cli": "0.1.3",
-        "@rafagouveia/dotreact-vite": "0.1.3",
+        "@rafagouveia/dotreact-cli": "0.1.4",
+        "@rafagouveia/dotreact-vite": "0.1.4",
         "@types/react": "19.2.14",
         "@types/react-dom": "19.2.3",
         "concurrently": "9.2.4",
@@ -59,9 +59,9 @@
     },
     "examples/rsc": {
       "name": "@rafagouveia/dotreact-example-rsc",
-      "version": "0.1.3-experimental.0",
+      "version": "0.1.4-experimental.0",
       "dependencies": {
-        "@rafagouveia/dotreact-rsc": "0.1.3-experimental.0",
+        "@rafagouveia/dotreact-rsc": "0.1.4-experimental.0",
         "react": "19.2.7",
         "react-dom": "19.2.7"
       },
@@ -78,18 +78,18 @@
       "name": "@rafagouveia/dotreact-example-starter",
       "version": "0.1.0",
       "dependencies": {
-        "@rafagouveia/dotreact-client": "0.1.3",
-        "@rafagouveia/dotreact-font": "0.1.3",
-        "@rafagouveia/dotreact-image": "0.1.3",
-        "@rafagouveia/dotreact-protocol": "0.1.3",
-        "@rafagouveia/dotreact-renderer": "0.1.3",
-        "@rafagouveia/dotreact-script": "0.1.3",
+        "@rafagouveia/dotreact-client": "0.1.4",
+        "@rafagouveia/dotreact-font": "0.1.4",
+        "@rafagouveia/dotreact-image": "0.1.4",
+        "@rafagouveia/dotreact-protocol": "0.1.4",
+        "@rafagouveia/dotreact-renderer": "0.1.4",
+        "@rafagouveia/dotreact-script": "0.1.4",
         "react": "19.2.7",
         "react-dom": "19.2.7"
       },
       "devDependencies": {
-        "@rafagouveia/dotreact-cli": "0.1.3",
-        "@rafagouveia/dotreact-vite": "0.1.3",
+        "@rafagouveia/dotreact-cli": "0.1.4",
+        "@rafagouveia/dotreact-vite": "0.1.4",
         "@types/react": "19.2.14",
         "@types/react-dom": "19.2.3",
         "concurrently": "9.2.4",
@@ -8057,7 +8057,7 @@
     },
     "packages/adapter": {
       "name": "@rafagouveia/dotreact-adapter",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "devDependencies": {
         "@types/node": "24.10.1",
@@ -8066,7 +8066,7 @@
     },
     "packages/cli": {
       "name": "@rafagouveia/dotreact-cli",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "bin": {
         "dotreact": "bin/dotreact.js"
@@ -8078,7 +8078,7 @@
     },
     "packages/client": {
       "name": "@rafagouveia/dotreact-client",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "devDependencies": {
         "@types/node": "24.10.1",
@@ -8095,7 +8095,7 @@
     },
     "packages/font": {
       "name": "@rafagouveia/dotreact-font",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "devDependencies": {
         "@types/node": "24.10.1",
@@ -8104,7 +8104,7 @@
     },
     "packages/image": {
       "name": "@rafagouveia/dotreact-image",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "devDependencies": {
         "@types/node": "24.10.1",
@@ -8118,7 +8118,7 @@
     },
     "packages/protocol": {
       "name": "@rafagouveia/dotreact-protocol",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "devDependencies": {
         "@types/node": "24.10.1",
@@ -8127,11 +8127,11 @@
     },
     "packages/renderer": {
       "name": "@rafagouveia/dotreact-renderer",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "dependencies": {
-        "@rafagouveia/dotreact-client": "0.1.3",
-        "@rafagouveia/dotreact-protocol": "0.1.3",
+        "@rafagouveia/dotreact-client": "0.1.4",
+        "@rafagouveia/dotreact-protocol": "0.1.4",
         "react": "19.2.7",
         "react-dom": "19.2.7",
         "vite": "8.1.5"
@@ -8148,7 +8148,7 @@
     },
     "packages/rsc": {
       "name": "@rafagouveia/dotreact-rsc",
-      "version": "0.1.3-experimental.0",
+      "version": "0.1.4-experimental.0",
       "license": "MPL-2.0",
       "dependencies": {
         "@vitejs/plugin-rsc": "0.5.29"
@@ -8172,10 +8172,10 @@
     },
     "packages/script": {
       "name": "@rafagouveia/dotreact-script",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "dependencies": {
-        "@rafagouveia/dotreact-client": "0.1.3"
+        "@rafagouveia/dotreact-client": "0.1.4"
       },
       "devDependencies": {
         "@types/node": "24.10.1",
@@ -8184,10 +8184,10 @@
     },
     "packages/vite": {
       "name": "@rafagouveia/dotreact-vite",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "license": "MPL-2.0",
       "dependencies": {
-        "@rafagouveia/dotreact-font": "0.1.3",
+        "@rafagouveia/dotreact-font": "0.1.4",
         "@vitejs/plugin-react": "6.0.3",
         "typescript": "7.0.2",
         "vite": "8.1.5"
diff --git a/package.json b/package.json
index bc2d6cb..aba001d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dotreact-monorepo",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "private": true,
   "type": "module",
   "workspaces": [
@@ -44,6 +44,6 @@
     "postcss": "8.5.21"
   },
   "dependencies": {
-    "@rafagouveia/dotreact-cli": "0.1.3"
+    "@rafagouveia/dotreact-cli": "0.1.4"
   }
 }
diff --git a/packages/adapter/package.json b/packages/adapter/package.json
index 2ea7bda..78bff02 100644
--- a/packages/adapter/package.json
+++ b/packages/adapter/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-adapter",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Deployment adapters for DotReact applications.",
   "license": "MPL-2.0",
   "repository": {
diff --git a/packages/cli/package.json b/packages/cli/package.json
index d10aacf..24282ed 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Project lifecycle and diagnostics CLI for DotReact.",
   "license": "MPL-2.0",
   "repository": {
diff --git a/packages/cli/src/index.test.ts b/packages/cli/src/index.test.ts
index 9fb512a..55f325b 100644
--- a/packages/cli/src/index.test.ts
+++ b/packages/cli/src/index.test.ts
@@ -265,10 +265,10 @@ test("minimal template is self-contained and omits demo actions and routes", ()
     assert.equal(existsSync(path.join(app, "vendor")), false,
       "published package projects must not copy framework sources into the application");
     const generatedPackage = JSON.parse(readFileSync(path.join(app, "package.json"), "utf8"));
-    assert.equal(generatedPackage.devDependencies["@rafagouveia/dotreact-cli"], "0.1.3");
-    assert.equal(generatedPackage.dependencies["@rafagouveia/dotreact-image"], "0.1.3");
-    assert.equal(generatedPackage.dependencies["@rafagouveia/dotreact-font"], "0.1.3");
-    assert.equal(generatedPackage.dependencies["@rafagouveia/dotreact-script"], "0.1.3");
+    assert.equal(generatedPackage.devDependencies["@rafagouveia/dotreact-cli"], "0.1.4");
+    assert.equal(generatedPackage.dependencies["@rafagouveia/dotreact-image"], "0.1.4");
+    assert.equal(generatedPackage.dependencies["@rafagouveia/dotreact-font"], "0.1.4");
+    assert.equal(generatedPackage.dependencies["@rafagouveia/dotreact-script"], "0.1.4");
     assert.equal(generatedPackage.scripts.postinstall, "dotnet tool restore");
     assert.equal(generatedPackage.scripts.drx, "dotreact");
     assert.match(generatedPackage.scripts.dev, /npm run generate/);
@@ -295,8 +295,8 @@ test("minimal template is self-contained and omits demo actions and routes", ()
     assert.equal(existsSync(path.join(app, "src/entry-server.tsx")), false);
     assert.doesNotMatch(readFileSync(path.join(app, "vite.config.ts"), "utf8"), /cssCodeSplit:\s*false/);
     const generatedCsproj = readFileSync(path.join(app, "Server/Server.csproj"), "utf8");
-    assert.match(generatedCsproj, /<PackageReference Include="DotReact\.Hosting" Version="0\.1\.3"/);
-    assert.match(generatedCsproj, /<PackageReference Include="DotReact\.AppGenerator" Version="0\.1\.3"/);
+    assert.match(generatedCsproj, /<PackageReference Include="DotReact\.Hosting" Version="0\.1\.4"/);
+    assert.match(generatedCsproj, /<PackageReference Include="DotReact\.AppGenerator" Version="0\.1\.4"/);
     assert.match(generatedCsproj, /PrivateAssets="all"/);
     assert.match(generatedCsproj, /<RootNamespace>MinimalApp\.Server<\/RootNamespace>/);
     assert.match(generatedCsproj, /<AssemblyName>MinimalApp\.Server<\/AssemblyName>/);
@@ -357,7 +357,7 @@ test("minimal template is self-contained and omits demo actions and routes", ()
     const doctor = spawnSync(process.execPath, [cli, "doctor"], { cwd: app, encoding: "utf8" });
     assert.equal(doctor.status, 0, doctor.stderr);
     assert.match(doctor.stdout, /runtime=packages/);
-    assert.match(doctor.stdout, /Published package runtime 0\.1\.3/);
+    assert.match(doctor.stdout, /Published package runtime 0\.1\.4/);
     assert.match(readFileSync(path.join(app, "app/page.server.cs"), "utf8"), /namespace MinimalApp\.Pages\.Home/);
     assert.match(readFileSync(path.join(app, "src/backend-manifest.json"), "utf8"), /MinimalApp\.HomePageProps/);
     assert.match(readFileSync(path.join(app, "docs/ai/PROJECT.md"), "utf8"), /Product name: Minimal App/);
@@ -369,7 +369,7 @@ test("minimal template is self-contained and omits demo actions and routes", ()
     assert.equal(dryUpgrade.status, 0, dryUpgrade.stderr);
     const generatedActions = readFileSync(path.join(app, "src/actions.ts"), "utf8");
     assert.doesNotMatch(generatedActions, /createServerAction/);
-    assert.equal(JSON.parse(readFileSync(path.join(app, "package.json"), "utf8")).devDependencies["@rafagouveia/dotreact-cli"], "0.1.3");
+    assert.equal(JSON.parse(readFileSync(path.join(app, "package.json"), "utf8")).devDependencies["@rafagouveia/dotreact-cli"], "0.1.4");
     const upgrade = spawnSync(process.execPath, [cli, "upgrade", "0.1.4"],
       { cwd: app, encoding: "utf8", timeout: 30_000 });
     assert.equal(upgrade.status, 0, upgrade.stderr);
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 5199ba4..34fe458 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -303,7 +303,7 @@ async function applyMinimalTemplate(target: string): Promise<void> {
     }],
     actions: []
   }, null, 2)}\n`);
-  await writeFile(resolve(target, "README.md"), `# DotReact minimal project\n\nASP.NET Core owns HTTP, security and data; React renders on the server and hydrates in the browser. Keep routes, route-private components and Server Actions in \`app/\`; keep Domain, Application, Infrastructure and jobs in \`Server/\`; keep public assets in \`public/\`. Framework runtime dependencies are pinned npm and NuGet packages; do not copy framework source into the application.\n\nThe scaffold is repository-ready but deliberately does not run \`git init\`. Authenticate npm and NuGet for the private GitHub Packages feeds, run \`npm install\`, and commit the resulting \`package-lock.json\` before relying on the included CI workflow. Repository defaults cover Git, editors, Node/npm, .NET, Docker and dependency updates.\n\n\`\`\`powershell\nnpm install\nnpm exec -- dotreact doctor\nnpm exec -- dotreact dev\n\`\`\`\n\nGenerate application artifacts without overwriting existing files:\n\n\`\`\`powershell\nnpm exec -- dotreact generate page catalog/[slug]\nnpm exec -- dotreact generate layout catalog\nnpm exec -- dotreact generate component CatalogCard --route catalog\nnpm exec -- dotreact generate action SaveCatalog --route catalog\nnpm exec -- dotreact sync\nnpm exec -- dotreact check\n\`\`\`\n\nUse \`npm exec -- dotreact build\`, \`npm exec -- dotreact analyze\` and \`npm exec -- dotreact start\` for the production lifecycle. Run \`npm run verify\` before integration. Set \`OTEL_EXPORTER_OTLP_ENDPOINT\` to export DotReact traces and metrics through OTLP. Update the pinned DotReact package versions together and validate with \`npm run verify\`.\n`);
+  await writeFile(resolve(target, "README.md"), `# DotReact minimal project\n\nASP.NET Core owns HTTP, security and data; React renders on the server and hydrates in the browser. Keep routes, route-private components and Server Actions in \`app/\`; keep Domain, Application, Infrastructure and jobs in \`Server/\`; keep public assets in \`public/\`. Framework runtime dependencies are pinned npm and NuGet packages; do not copy framework source into the application.\n\nThe scaffold is repository-ready but deliberately does not run \`git init\`. Authenticate npm and NuGet for the private GitHub Packages feeds, run \`npm install\`, and commit the resulting \`package-lock.json\` before relying on the included CI workflow. Repository defaults cover Git, editors, Node/npm, .NET, Docker and dependency updates. Install the global launcher once; it delegates commands to this project's pinned local CLI.\n\n\`\`\`powershell\nnpm install\ndotreact doctor\ndotreact dev\n\`\`\`\n\nGenerate application artifacts without overwriting existing files:\n\n\`\`\`powershell\ndotreact generate page catalog/[slug]\ndotreact generate layout catalog\ndotreact generate component CatalogCard --route catalog\ndotreact generate action SaveCatalog --route catalog\ndotreact sync\ndotreact check\n\`\`\`\n\nUse \`dotreact build\`, \`dotreact analyze\` and \`dotreact start\` for the production lifecycle. Run \`npm run verify\` before integration. Set \`OTEL_EXPORTER_OTLP_ENDPOINT\` to export DotReact traces and metrics through OTLP. Update the pinned DotReact package versions together and validate with \`npm run verify\`.\n`);
 }
 
 function run(executable: string, commandArgs: string[], cwd = process.cwd(), env?: NodeJS.ProcessEnv): Promise<void> {
diff --git a/packages/cli/src/launcher.test.ts b/packages/cli/src/launcher.test.ts
index 73feef3..43a68a3 100644
--- a/packages/cli/src/launcher.test.ts
+++ b/packages/cli/src/launcher.test.ts
@@ -1,10 +1,14 @@
 import assert from "node:assert/strict";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 import { resolveProjectCli } from "./launcher.js";
 
+const packagedBin = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../bin/dotreact.js");
+
 function temporaryProject(): string {
   return mkdtempSync(path.join(tmpdir(), "dotreact-launcher-"));
 }
@@ -18,6 +22,7 @@ test("global launcher selects the nearest explicitly declared project CLI", () =
     writeFileSync(path.join(root, "package.json"), JSON.stringify({
       devDependencies: { "@rafagouveia/dotreact-cli": "0.1.3" }
     }));
+    writeFileSync(path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "package.json"), JSON.stringify({ version: "0.1.3" }));
     writeFileSync(localBin, "#!/usr/bin/env node\n");
     assert.equal(resolveProjectCli(path.join(root, "app", "reports"), path.join(root, "global.js")), localBin);
   } finally {
@@ -37,6 +42,7 @@ test("global launcher does not execute undeclared or current package bins", () =
     writeFileSync(path.join(root, "package.json"), JSON.stringify({
       dependencies: { "@rafagouveia/dotreact-cli": "0.1.3" }
     }));
+    writeFileSync(path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "package.json"), JSON.stringify({ version: "0.1.3" }));
     assert.equal(resolveProjectCli(root, localBin), undefined);
   } finally {
     rmSync(root, { recursive: true, force: true });
@@ -54,3 +60,47 @@ test("global launcher fails closed when the declared project CLI is not installe
     rmSync(root, { recursive: true, force: true });
   }
 });
+
+test("workspace launcher accepts an aligned CLI hoisted to a parent node_modules", () => {
+  const root = temporaryProject();
+  try {
+    const workspace = path.join(root, "examples", "app");
+    const hoistedBin = path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "bin", "dotreact.js");
+    mkdirSync(workspace, { recursive: true });
+    mkdirSync(path.dirname(hoistedBin), { recursive: true });
+    writeFileSync(path.join(workspace, "package.json"), JSON.stringify({
+      devDependencies: { "@rafagouveia/dotreact-cli": "0.1.4" }
+    }));
+    writeFileSync(path.join(root, "package.json"), JSON.stringify({
+      dependencies: { "@rafagouveia/dotreact-cli": "0.1.4" }
+    }));
+    writeFileSync(path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "package.json"), JSON.stringify({ version: "0.1.4" }));
+    writeFileSync(hoistedBin, "#!/usr/bin/env node\n");
+    assert.equal(resolveProjectCli(workspace, path.join(root, "global", "dotreact.js")), hoistedBin);
+    assert.equal(resolveProjectCli(workspace, hoistedBin), undefined,
+      "the delegated local launcher must not recurse into itself");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("packaged global launcher delegates arguments, cwd and exit status to the local CLI", () => {
+  const root = temporaryProject();
+  try {
+    const localBin = path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "bin", "dotreact.js");
+    mkdirSync(path.dirname(localBin), { recursive: true });
+    writeFileSync(path.join(root, "package.json"), JSON.stringify({
+      devDependencies: { "@rafagouveia/dotreact-cli": "0.1.2" }
+    }));
+    writeFileSync(path.join(root, "node_modules", "@rafagouveia", "dotreact-cli", "package.json"), JSON.stringify({ version: "0.1.2" }));
+    writeFileSync(localBin, "process.stdout.write(JSON.stringify({ args: process.argv.slice(2), cwd: process.cwd() })); process.exit(7);\n");
+    const result = spawnSync(process.execPath, [packagedBin, "doctor", "--probe"], {
+      cwd: root,
+      encoding: "utf8"
+    });
+    assert.equal(result.status, 7);
+    assert.deepEqual(JSON.parse(result.stdout), { args: ["doctor", "--probe"], cwd: root });
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
diff --git a/packages/cli/src/launcher.ts b/packages/cli/src/launcher.ts
index 4356f98..e5f528e 100644
--- a/packages/cli/src/launcher.ts
+++ b/packages/cli/src/launcher.ts
@@ -21,10 +21,10 @@ function canonicalPath(path: string): string {
   }
 }
 
-function declaresCli(manifest: PackageManifest): boolean {
-  return manifest.dependencies?.[cliPackageName] !== undefined
-    || manifest.devDependencies?.[cliPackageName] !== undefined
-    || manifest.optionalDependencies?.[cliPackageName] !== undefined;
+function declaredCliVersion(manifest: PackageManifest): string | undefined {
+  return manifest.dependencies?.[cliPackageName]
+    ?? manifest.devDependencies?.[cliPackageName]
+    ?? manifest.optionalDependencies?.[cliPackageName];
 }
 
 /**
@@ -35,24 +35,36 @@ function declaresCli(manifest: PackageManifest): boolean {
 export function resolveProjectCli(startDirectory: string, launcherBin = currentBin): string | undefined {
   let directory = resolve(startDirectory);
   const volumeRoot = parse(directory).root;
+  let nearestDeclaration: { readonly packagePath: string; readonly version: string } | undefined;
   while (true) {
     const packagePath = resolve(directory, "package.json");
     if (existsSync(packagePath)) {
       try {
         const manifest = JSON.parse(readFileSync(packagePath, "utf8")) as PackageManifest;
-        if (declaresCli(manifest)) {
+        const version = declaredCliVersion(manifest);
+        if (version !== undefined) {
+          nearestDeclaration ??= { packagePath, version };
           const candidate = resolve(directory, "node_modules", "@rafagouveia", "dotreact-cli", "bin", "dotreact.js");
-          if (existsSync(candidate) && canonicalPath(candidate) !== canonicalPath(launcherBin)) return candidate;
-          if (!existsSync(candidate) && process.env[delegationGuard] !== "1")
-            throw new Error(`DotReact CLI is declared by ${packagePath} but is not installed. Run npm install.`);
+          if (existsSync(candidate)) {
+            const installedManifest = JSON.parse(readFileSync(resolve(dirname(candidate), "../package.json"), "utf8")) as { version?: string };
+            if (/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(nearestDeclaration.version)
+              && installedManifest.version !== nearestDeclaration.version)
+              throw new Error(`DotReact CLI ${nearestDeclaration.version} is declared by ${nearestDeclaration.packagePath}, but ${installedManifest.version ?? "an unknown version"} is installed. Run npm install.`);
+            if (canonicalPath(candidate) !== canonicalPath(launcherBin)) return candidate;
+            return undefined;
+          }
         }
       } catch (error) {
-        if (error instanceof Error && error.message.startsWith("DotReact CLI is declared")) throw error;
+        if (error instanceof Error && error.message.startsWith("DotReact CLI")) throw error;
         // The CLI command itself will provide the project diagnostic. A broken
         // package manifest must never redirect execution to an arbitrary file.
       }
     }
-    if (directory === volumeRoot) return undefined;
+    if (directory === volumeRoot) {
+      if (nearestDeclaration !== undefined && process.env[delegationGuard] !== "1")
+        throw new Error(`DotReact CLI is declared by ${nearestDeclaration.packagePath} but is not installed. Run npm install.`);
+      return undefined;
+    }
     directory = dirname(directory);
   }
 }
diff --git a/packages/client/package.json b/packages/client/package.json
index f5ca807..a31efde 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-client",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Hydration, navigation and Server Action client runtime for DotReact.",
   "license": "MPL-2.0",
   "repository": {
diff --git a/packages/font/package.json b/packages/font/package.json
index 051adb8..fa7d6c4 100644
--- a/packages/font/package.json
+++ b/packages/font/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-font",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Self-hosted font optimization for DotReact.",
   "license": "MPL-2.0",
   "repository": {
diff --git a/packages/image/package.json b/packages/image/package.json
index 8e2ed5a..6298928 100644
--- a/packages/image/package.json
+++ b/packages/image/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-image",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Responsive image component for the DotReact image pipeline.",
   "license": "MPL-2.0",
   "repository": {
diff --git a/packages/protocol/package.json b/packages/protocol/package.json
index 1652654..fcd25f6 100644
--- a/packages/protocol/package.json
+++ b/packages/protocol/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-protocol",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Versioned renderer protocol contracts for DotReact.",
   "license": "MPL-2.0",
   "repository": {
diff --git a/packages/renderer/package.json b/packages/renderer/package.json
index 17ba9b1..3d3a929 100644
--- a/packages/renderer/package.json
+++ b/packages/renderer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-renderer",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Private Node renderer runtime used by DotReact ASP.NET Core hosts.",
   "license": "MPL-2.0",
   "repository": {
@@ -32,8 +32,8 @@
     "start:production": "node dist/production-server.js"
   },
   "dependencies": {
-    "@rafagouveia/dotreact-client": "0.1.3",
-    "@rafagouveia/dotreact-protocol": "0.1.3",
+    "@rafagouveia/dotreact-client": "0.1.4",
+    "@rafagouveia/dotreact-protocol": "0.1.4",
     "react": "19.2.7",
     "react-dom": "19.2.7",
     "vite": "8.1.5"
diff --git a/packages/rsc/package.json b/packages/rsc/package.json
index 8b8d558..2f07fb7 100644
--- a/packages/rsc/package.json
+++ b/packages/rsc/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-rsc",
-  "version": "0.1.3-experimental.0",
+  "version": "0.1.4-experimental.0",
   "description": "Experimental React Server Components integration for DotReact.",
   "license": "MPL-2.0",
   "repository": {
diff --git a/packages/script/package.json b/packages/script/package.json
index 6129bfe..e219171 100644
--- a/packages/script/package.json
+++ b/packages/script/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-script",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Controlled script loading strategies for DotReact.",
   "license": "MPL-2.0",
   "repository": {
@@ -25,7 +25,7 @@
     "test": "node --test dist/index.test.js"
   },
   "dependencies": {
-    "@rafagouveia/dotreact-client": "0.1.3"
+    "@rafagouveia/dotreact-client": "0.1.4"
   },
   "devDependencies": {
     "@types/node": "24.10.1",
diff --git a/packages/vite/package.json b/packages/vite/package.json
index ed65364..65f2a68 100644
--- a/packages/vite/package.json
+++ b/packages/vite/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@rafagouveia/dotreact-vite",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Vite plugin, App Router compiler and DRX checker for DotReact.",
   "license": "MPL-2.0",
   "repository": {
@@ -29,7 +29,7 @@
     "test": "node --test dist/index.test.js"
   },
   "dependencies": {
-    "@rafagouveia/dotreact-font": "0.1.3",
+    "@rafagouveia/dotreact-font": "0.1.4",
     "@vitejs/plugin-react": "6.0.3",
     "typescript": "7.0.2",
     "vite": "8.1.5"
diff --git a/scripts/package-npm.test.mjs b/scripts/package-npm.test.mjs
index 5eadaa4..6ca76af 100644
--- a/scripts/package-npm.test.mjs
+++ b/scripts/package-npm.test.mjs
@@ -14,7 +14,7 @@ test("private npm publishing resumes safely and tags experimental versions", ()
 import { appendFileSync } from "node:fs";
 const args = process.argv.slice(2);
 appendFileSync(process.env.FAKE_NPM_LOG, JSON.stringify(args) + "\\n");
-if (args[0] === "view" && args[1] === "@rafagouveia/dotreact-protocol@0.1.3") process.exit(0);
+if (args[0] === "view" && args[1] === "@rafagouveia/dotreact-protocol@0.1.4") process.exit(0);
 if (args[0] === "view") { process.stderr.write("npm error code E404\\n"); process.exit(1); }
 process.exit(args[0] === "publish" ? 0 : 2);
 `);
@@ -29,7 +29,7 @@ process.exit(args[0] === "publish" ? 0 : 2);
       }
     });
     assert.equal(result.status, 0, result.stderr);
-    assert.match(result.stdout, /dotreact-protocol@0\.1\.3 already exists; skipping/);
+    assert.match(result.stdout, /dotreact-protocol@0\.1\.4 already exists; skipping/);
     const calls = readFileSync(log, "utf8").trim().split("\n").map(line => JSON.parse(line));
     assert.equal(calls.filter(call => call[0] === "view").length, 10);
     assert.equal(calls.some(call => call[0] === "publish" && call.includes("@rafagouveia/dotreact-protocol")), false);

From e0e281cd5f012aaf55537de71b82a4cde177062c Mon Sep 17 00:00:00 2001
From: Rafael Gomes <rafaelgomesgouve@gmail.com>
Date: Wed, 22 Jul 2026 01:15:46 -0300
Subject: [PATCH 3/3] chore(deps): keep React updates atomic

---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5b510a8..f445744 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,6 +11,8 @@ updates:
           - react
           - react-dom
           - react-server-dom-webpack
+          - "@types/react"
+          - "@types/react-dom"
         update-types:
           - minor
           - patch
@@ -31,6 +33,8 @@ updates:
         patterns:
           - react
           - react-dom
+          - "@types/react"
+          - "@types/react-dom"
         update-types:
           - minor
           - patch