@flisk-sh/flisk 1.3.204 → 1.3.206

package/cli/dist/commands/project.js

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 import { execFileSync } from "node:child_process";
 import { cpSync, existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { cwd } from "node:process";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
@@ -86,7 +86,15 @@ export function templateTargetDir(templateName, targetDir) {
     const fromRepo = template?.repo.split("/").pop() ?? templateName;
     return fromRepo.replace(/\.git$/, "");
 }
-export async function cloneProjectTemplate(templateName, targetDir, runtimeNextSteps) {
+/** The last non-empty line of a child process error, for a one-line failure message. */
+function lastLine(text) {
+    const lines = text
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+    return lines.pop() ?? "unknown error";
+}
+export async function cloneProjectTemplate(templateName, targetDir, runtimeNextSteps, options = {}) {
     const template = PROJECT_TEMPLATES[templateName];
     if (!template) {
         console.log(chalk.red(`\n❌ Unknown template: "${templateName}"`));
@@ -101,14 +109,18 @@ export async function cloneProjectTemplate(templateName, targetDir, runtimeNextS
     if (!isPathSafe(dirName)) {
         errorFactories.invalidPath(dirName).exit();
     }
-    const destination = resolve(cwd(), dirName);
+    // If targetDir is an absolute path, use it directly as the destination
+    // Otherwise resolve it relative to cwd()
+    const destination = isAbsolute(dirName) ? dirName : resolve(cwd(), dirName);
     if (existsSync(destination) && readdirSync(destination).length > 0) {
         errorFactories.directoryExists(destination).exit();
     }
-    showCommandHeader(`Cloning template: ${templateName}`);
-    showDetail(`${template.description}\n`, 0);
-    showDetail(`Source: ${template.bundledPath ? "bundled Flisk example" : template.repo}`, 0);
-    showDetail(`Destination: ${destination}\n`, 0);
+    if (!options.quiet) {
+        showCommandHeader(`Cloning template: ${templateName}`);
+        showDetail(`${template.description}\n`, 0);
+        showDetail(`Source: ${template.bundledPath ? "bundled Flisk example" : template.repo}`, 0);
+        showDetail(`Destination: ${destination}\n`, 0);
+    }
     try {
         if (template.bundledPath) {
             const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../../");
@@ -127,15 +139,28 @@ export async function cloneProjectTemplate(templateName, targetDir, runtimeNextS
             }
         }
         else {
-            execFileSync("git", ["clone", template.repo, destination], { stdio: "inherit" });
+            // Piped, not inherited: a raw git progress dump is noise for the caller and, in the
+            // one-command flow, it interleaves with the frame that is already on screen.
+            execFileSync("git", ["clone", template.repo, destination], {
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf-8",
+            });
         }
     }
-    catch {
-        showErrorAndExit(template.bundledPath
-            ? "Bundled example copy failed. Reinstall the Flisk CLI package and try again."
-            : "git clone failed. Check you have git installed and network access.");
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        const message = template.bundledPath
+            ? `Bundled example copy failed (${lastLine(detail)}). Reinstall the Flisk CLI package and try again.`
+            : `git clone failed: ${lastLine(detail)}. Check you have git installed and network access.`;
+        // A caller that paints its own surface (the one-command flow) needs to report the
+        // failure itself instead of having the process die mid-paint.
+        if (options.quiet)
+            throw new Error(message);
+        showErrorAndExit(message);
     }
     clearDiscoveryCache();
+    if (options.quiet)
+        return;
     console.log(chalk.green(`\n✅ Cloned "${templateName}" into ${dirName}/`));
     showDetail("\nNext steps:", 0);
     showDetail(`1. cd ${dirName}`);
@@ -195,22 +220,26 @@ export const projectCommand = addYesOption(new Command("project"))
     .option("--check", "Check if master configs exist and are in sync")
     .option("--force", "Overwrite existing configuration (dangerous)")
     .option("--config-file <path>", "Load project config from existing JSON file")
+    .option("-q, --quiet", "Only print what fails; used by `flisk demo`", false)
     .action(async (template, options) => {
     const { assertMachineReadyOrExit, detectRuntimePrerequisites, formatRuntimeNextSteps } = await import("../utils/cold-preflight.js");
     // Project setup only writes files: it must not need a running Docker daemon
     // or an installed Tilt. The runtime is checked on `flisk up`.
     await assertMachineReadyOrExit({ scope: "scaffold" });
     const runtimeNextSteps = formatRuntimeNextSteps(detectRuntimePrerequisites());
+    const quiet = Boolean(options.quiet);
     if (template) {
-        await runCommand(async () => cloneProjectTemplate(template, options.path, runtimeNextSteps));
+        await runCommand(async () => cloneProjectTemplate(template, options.path, runtimeNextSteps, { quiet }));
         return;
     }
     await runCommand(async () => {
         let projectRoot = findProjectRoot();
         if (!projectRoot) {
             projectRoot = cwd();
-            showStep("🚀 Initializing new Flisk project...\n");
-            showDetail(`Location: ${projectRoot}\n`, 0);
+            if (!quiet) {
+                showStep("🚀 Initializing new Flisk project...\n");
+                showDetail(`Location: ${projectRoot}\n`, 0);
+            }
         }
         const tdkDir = join(projectRoot, ".tdk");
         const projectJsonPath = join(tdkDir, PROJECT_JSON);
@@ -237,15 +266,19 @@ export const projectCommand = addYesOption(new Command("project"))
                 process.exit(1);
             }
         }
-        showCommandHeader("Project Configuration");
-        showDetail(`Project root: ${projectRoot}\n`, 0);
+        if (!quiet) {
+            showCommandHeader("Project Configuration");
+            showDetail(`Project root: ${projectRoot}\n`, 0);
+        }
         if (!existsSync(tdkDir)) {
             ensureDirectory(tdkDir);
-            showSuccess("Created: .tdk/ directory");
+            if (!quiet)
+                showSuccess("Created: .tdk/ directory");
         }
         const projectJsonExists = existsSync(projectJsonPath);
         if (projectJsonExists && !options.force) {
-            showSuccess(".tdk/project.json exists");
+            if (!quiet)
+                showSuccess(".tdk/project.json exists");
             const rawProjectConfig = JSON.parse(readFileSync(projectJsonPath, "utf-8"));
             const projectConfig = readProjectConfig(projectRoot);
             const discoveredStacks = discoverExistingServiceStacks(projectRoot);
@@ -254,32 +287,36 @@ export const projectCommand = addYesOption(new Command("project"))
             if (shouldRewriteProjectConfig) {
                 writeJsonFile(projectJsonPath, projectConfig);
             }
-            if (autoEnabledStacks.length > 0) {
+            if (autoEnabledStacks.length > 0 && !quiet) {
                 showDetail(`Auto-enabled discovered service stacks: ${autoEnabledStacks.join(", ")}`, 0);
             }
-            showStep("\n📋 Regenerating master configuration files...\n");
-            await generateMasterConfigs(projectRoot);
+            if (!quiet)
+                showStep("\n📋 Regenerating master configuration files...\n");
+            await generateMasterConfigs(projectRoot, { quiet });
             if (ensureEnvFile(projectRoot)) {
-                showSuccess("Created: .env (the defaults work as-is)");
+                if (!quiet)
+                    showSuccess("Created: .env (the defaults work as-is)");
             }
             else {
                 const added = completeEnvFile(projectRoot);
-                if (added.length > 0) {
+                if (added.length > 0 && !quiet) {
                     showSuccess(`Updated: .env (added ${added.join(", ")}; existing values unchanged)`);
                 }
             }
             const ignored = ensureGitignore(projectRoot);
-            if (ignored.length > 0) {
+            if (ignored.length > 0 && !quiet) {
                 showSuccess(`Added to .gitignore: ${ignored.join(", ")}`);
             }
-            console.log(chalk.green("\n✅ Project configuration regenerated!"));
-            showDetail("\nGenerated in .tdk/.tdk-out/:", 0);
-            for (const file of MASTER_CONFIG_FILES) {
-                showDetail(`- ${file}`);
+            if (!quiet) {
+                console.log(chalk.green("\n✅ Project configuration regenerated!"));
+                showDetail("\nGenerated in .tdk/.tdk-out/:", 0);
+                for (const file of MASTER_CONFIG_FILES) {
+                    showDetail(`- ${file}`);
+                }
+                showDetail("\nRuntime readiness:", 0);
+                for (const line of runtimeNextSteps)
+                    showDetail(line, 0);
             }
-            showDetail("\nRuntime readiness:", 0);
-            for (const line of runtimeNextSteps)
-                showDetail(line, 0);
             return;
         }
         if (projectJsonExists && options.force && !options.yes) {
@@ -302,12 +339,14 @@ export const projectCommand = addYesOption(new Command("project"))
             }
             const configContent = readFileSync(configFilePath, "utf-8");
             projectConfig = JSON.parse(configContent);
-            showSuccess(`Loaded config from: ${configFilePath}`);
+            if (!quiet)
+                showSuccess(`Loaded config from: ${configFilePath}`);
         }
         else if (options.yes) {
             projectConfig = JSON.parse(JSON.stringify(DEFAULT_PROJECT_JSON));
             projectConfig.project.name = projectRoot.split("/").pop() || "my-project";
-            console.log(chalk.gray("Using default configuration (non-interactive mode)"));
+            if (!quiet)
+                console.log(chalk.gray("Using default configuration (non-interactive mode)"));
         }
         else {
             showStep("📝 Project Setup Wizard\n");
@@ -399,27 +438,34 @@ export const projectCommand = addYesOption(new Command("project"))
                     : DEFAULT_PROJECT_JSON.discovery.paths;
         }
         const autoEnabledStacks = syncDiscoveredStacksToPreAlpha(projectConfig, discoveredStacks);
-        if (autoEnabledStacks.length > 0) {
+        if (autoEnabledStacks.length > 0 && !quiet) {
             showDetail(`Auto-enabled discovered service stacks: ${autoEnabledStacks.join(", ")}`, 0);
         }
-        showStep("\n📋 Creating project configuration...\n");
+        if (!quiet)
+            showStep("\n📋 Creating project configuration...\n");
         writeJsonFile(projectJsonPath, projectConfig);
-        showSuccess("Created: .tdk/project.json");
-        showDetail(`→ Project: ${projectConfig.project.name}`);
-        showStep("\n📋 Generating master configuration files...\n");
-        await generateMasterConfigs(projectRoot);
-        showStep("\n🔧 Setting up environment variables...\n");
+        if (!quiet) {
+            showSuccess("Created: .tdk/project.json");
+            showDetail(`→ Project: ${projectConfig.project.name}`);
+            showStep("\n📋 Generating master configuration files...\n");
+        }
+        await generateMasterConfigs(projectRoot, { quiet });
+        if (!quiet)
+            showStep("\n🔧 Setting up environment variables...\n");
         const envCreated = ensureEnvFile(projectRoot);
         if (envCreated) {
-            showSuccess("Created: .env (the defaults work as-is)");
+            if (!quiet)
+                showSuccess("Created: .env (the defaults work as-is)");
         }
         else {
             // An .env from an older CLI lacks keys a newer one expects; add them without changing anything already there.
             const added = completeEnvFile(projectRoot);
             if (added.length > 0) {
-                showSuccess(`Updated: .env (added ${added.join(", ")}; existing values unchanged)`);
+                if (!quiet) {
+                    showSuccess(`Updated: .env (added ${added.join(", ")}; existing values unchanged)`);
+                }
             }
-            else {
+            else if (!quiet) {
                 showSuccess("Found: .env (environment already configured)");
             }
         }
@@ -432,24 +478,26 @@ export const projectCommand = addYesOption(new Command("project"))
             showDetail("→ Edit .env and fill in these values before running `flisk up`", 1);
         }
         const ignored = ensureGitignore(projectRoot);
-        if (ignored.length > 0) {
+        if (ignored.length > 0 && !quiet) {
             showSuccess(`Added to .gitignore: ${ignored.join(", ")}`);
         }
-        console.log(chalk.green("\n✅ Project configuration complete!"));
-        showDetail("\nGenerated files in .tdk/.tdk-out/:", 0);
-        for (const file of MASTER_CONFIG_FILES) {
-            showDetail(`- ${file}`);
+        if (!quiet) {
+            console.log(chalk.green("\n✅ Project configuration complete!"));
+            showDetail("\nGenerated files in .tdk/.tdk-out/:", 0);
+            for (const file of MASTER_CONFIG_FILES) {
+                showDetail(`- ${file}`);
+            }
+            showDetail("\nEnvironment configuration:", 0);
+            showDetail("- .env (contains all required variables)");
+            showDetail("\nSource file:", 0);
+            showDetail("- .tdk/project.json (edit this to change project structure)");
+            showDetail("\nNext steps:", 0);
+            showDetail("1. flisk resource api --type backend --stack app   # scaffold a service");
+            showDetail("2. flisk up app                                     # start it");
+            showDetail("\nRuntime readiness:", 0);
+            for (const line of runtimeNextSteps)
+                showDetail(line, 0);
+            showDetail("\nAfter editing .tdk/project.json, run `flisk config regenerate`.", 0);
         }
-        showDetail("\nEnvironment configuration:", 0);
-        showDetail("- .env (contains all required variables)");
-        showDetail("\nSource file:", 0);
-        showDetail("- .tdk/project.json (edit this to change project structure)");
-        showDetail("\nNext steps:", 0);
-        showDetail("1. flisk resource api --type backend --stack app   # scaffold a service");
-        showDetail("2. flisk up app                                     # start it");
-        showDetail("\nRuntime readiness:", 0);
-        for (const line of runtimeNextSteps)
-            showDetail(line, 0);
-        showDetail("\nAfter editing .tdk/project.json, run `flisk config regenerate`.", 0);
     });
 });

package/cli/dist/commands/resource.js

@@ -214,7 +214,9 @@ export function createPackageJson(name, type, frameworkId, prismaEnabled = false
             // image's `bun run build` fails with TS2688. ^20 matches the services that build.
             "@types/node": "^20.0.0",
             typescript: "^7.0.2",
-            vitest: "^5.0.0",
+            // The same version the CLI tests itself with (cli/package.json devDependencies.vitest).
+            // Dependabot pins it exactly to keep CVE-2026-112950 fixed, and the scaffold follows.
+            vitest: "5.0.5",
             "@biomejs/biome": "^2.5.13",
             // vitest 5 peers on vite ^6.4.0 || ^7 || ^8; vite 5 makes `vitest run` fail at startup with
             // ERR_PACKAGE_PATH_NOT_EXPORTED ('./module-runner'), in every resource once it is hoisted.

package/cli/dist/commands/up.js

@@ -19,6 +19,7 @@ import { exportHostPortPlan, getHostPortPlan, writeSavedHostPortPlan, } from "..
 import { formatHostPortPlan } from "../utils/host-port-plan.js";
 import { createJsonEmitter } from "../utils/json-output.js";
 import { toMachineError } from "../utils/machine-output.js";
+import { nativeWindowsStackRefusal } from "../utils/native-windows.js";
 import { findProjectRoot, getPackageVersion } from "../utils/paths.js";
 import { findAvailablePort } from "../utils/port-assignment.js";
 import { formatPortFallbackNotice } from "../utils/port-fallback-notice.js";
@@ -48,11 +49,13 @@ export function formatUpSuccess(port, appUrls = []) {
         "Stop: flisk down",
     ];
 }
-export function nativeWindowsUpRefusal(platform, allowNativeWindows) {
-    if (platform !== "win32" || allowNativeWindows === "1")
-        return null;
-    return "Landscape startup needs Ubuntu on WSL2. Native Windows is inspect-only.";
-}
+/**
+ * The native Windows boundary for a command that starts a stack.
+ *
+ * It lives here because `flisk up` is where the boundary has always been enforced; the
+ * one-command demo flow refuses with the same message before it clones or installs anything.
+ */
+export const nativeWindowsUpRefusal = nativeWindowsStackRefusal;
 /** Why `flisk up` cannot work on this host, or null when it may proceed. Docker reachability is only probed in container hosts. */
 export async function hostUpRefusal(host = detectHost(), dockerReachable = defaultDockerReachable) {
     if (host.kind === "webcontainer")

package/cli/dist/generator/template-engine.js

@@ -503,7 +503,8 @@ export async function generateMasterConfigs(projectRoot, options = {}) {
     if (fs.existsSync(tiltignoreSource)) {
         if (!fs.existsSync(tiltignoreTarget)) {
             fs.copyFileSync(tiltignoreSource, tiltignoreTarget);
-            console.log(`✓ Copied: .tiltignore → project root`);
+            if (!options.quiet)
+                console.log(`✓ Copied: .tiltignore → project root`);
         }
         else if (options.discardHandEdits) {
             // Only a file Flisk wrote (it carries the header) may be restored; one without the
@@ -512,17 +513,23 @@ export async function generateMasterConfigs(projectRoot, options = {}) {
             if (current.includes(TDK_GENERATED_MARKER) &&
                 current !== fs.readFileSync(tiltignoreSource, "utf-8")) {
                 fs.copyFileSync(tiltignoreSource, tiltignoreTarget);
-                console.log("✓ Restored: .tiltignore → project root (hand edits discarded)");
+                if (!options.quiet) {
+                    console.log("✓ Restored: .tiltignore → project root (hand edits discarded)");
+                }
             }
         }
     }
     const copiedAssets = ensureProjectRuntimeAssets(projectRoot);
-    for (const asset of copiedAssets) {
-        console.log(`✓ Copied: ${asset} → project root`);
+    if (!options.quiet) {
+        for (const asset of copiedAssets) {
+            console.log(`✓ Copied: ${asset} → project root`);
+        }
+    }
+    await vendorTdkExtension(projectRoot, { quiet: options.quiet });
+    if (!options.quiet) {
+        console.log("");
+        console.log("💡 To start Tilt: flisk up");
     }
-    await vendorTdkExtension(projectRoot);
-    console.log("");
-    console.log("💡 To start Tilt: flisk up");
 }
 // The generated Tiltfile loads the Flisk Tilt extension (engine, discovery,
 // specs, ext starlark modules). The extension repo may stay private, so we
@@ -618,7 +625,7 @@ export function ensureProjectRuntimeAssets(projectRoot) {
     }
     return copied;
 }
-async function vendorTdkExtension(projectRoot) {
+async function vendorTdkExtension(projectRoot, options = {}) {
     const vendoredDir = assertTdkGeneratedPath(projectRoot, path.join(".tdk", ".tdk-out", "tdk-cli-ext"));
     // Source resolution order:
     //   1. $TDK_EXTENSION_SOURCE (explicit override)
@@ -669,7 +676,8 @@ async function vendorTdkExtension(projectRoot) {
             filter: (source) => !isTestFile(source),
         });
     }
-    console.log(`✓ Vendored Flisk extension → .tdk/.tdk-out/tdk-cli-ext/`);
+    if (!options.quiet)
+        console.log(`✓ Vendored Flisk extension → .tdk/.tdk-out/tdk-cli-ext/`);
     // Best-effort: if TDK_LICENSE_KEY is set and grants any paid resource,
     // overlay the premium bundle over the stub files just vendored above.
     // No-ops silently (beyond a warning) if there's no key, the fetch

package/cli/dist/utils/cli-command.js

@@ -107,7 +107,9 @@ export function ensureGlobalInstall(env = process.env) {
         // Not installed under the old name, or the manager is missing.
     }
     try {
-        execFileSync(manager, ["install", "-g", CLI_PACKAGE], { stdio: "inherit", timeout: 300000 });
+        // Silent on purpose: the caller owns the screen, and npm's install banner would paint
+        // over whatever it is showing. Progress is reported by the caller, not by npm.
+        execFileSync(manager, ["install", "-g", CLI_PACKAGE], { stdio: "ignore", timeout: 300000 });
         return "installed";
     }
     catch {

package/cli/dist/utils/colima.js

@@ -114,10 +114,13 @@ export function checkColima(deps = defaultDeps()) {
 export function planColimaRepair(status, dockerAnswers) {
     if (!status.isColima)
         return undefined;
+    // A Lima that is an x86_64 build on Apple Silicon, or a colima CLI that cannot see the VM because of it,
+    // needs a native limactl before anything else can start.
+    if (status.problem && /x86_64|rosetta|native arch|cannot see it/i.test(status.problem)) {
+        return "native-lima";
+    }
     if (!status.running)
         return "start";
-    if (status.problem?.includes("cannot see it"))
-        return "native-lima";
     if (!dockerAnswers)
         return "restart";
     return undefined;
@@ -125,15 +128,31 @@ export function planColimaRepair(status, dockerAnswers) {
 /** Runs a colima command with a native limactl first on PATH, when one is installed. */
 export function nativeLimaPath(env = process.env) {
     const home = env.HOME ?? "";
+    // Prefer the Apple Silicon Homebrew location first; an x86_64 limactl must never be treated as native.
     const candidates = [
+        "/opt/homebrew/bin",
         home ? `${home}/.local/bin` : "",
         home ? `${home}/bin` : "",
-        "/opt/homebrew/bin",
     ].filter(Boolean);
     for (const dir of candidates) {
         const candidate = join(dir, "limactl");
         try {
-            if (existsSync(candidate))
+            if (!existsSync(candidate))
+                continue;
+            // Verify the binary is actually a native (arm64/aarch64) build, not a Rosetta x86_64 one.
+            let archOutput = "";
+            try {
+                archOutput = execFileSync("file", ["-bL", candidate], {
+                    encoding: "utf-8",
+                    timeout: 5_000,
+                    stdio: ["ignore", "pipe", "ignore"],
+                });
+            }
+            catch {
+                // `file` unavailable: fall back to accepting the candidate.
+                return dir;
+            }
+            if (/arm64|aarch64/i.test(archOutput))
                 return dir;
         }
         catch {