@lenne.tech/cli 1.24.1 → 1.25.0

package/build/commands/dev/{migrate.js → init.js}

@@ -10,15 +10,25 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const caddy_1 = require("../../lib/caddy");
+const dev_bootstrap_1 = require("../../lib/dev-bootstrap");
+const dev_install_helper_1 = require("../../lib/dev-install-helper");
 const dev_migrate_helper_1 = require("../../lib/dev-migrate-helper");
 const dev_project_1 = require("../../lib/dev-project");
+const dev_service_1 = require("../../lib/dev-service");
 /**
- * Register an existing project with `lt dev` and apply idempotent
- * env-aware patches.
+ * Initialize an existing project for `lt dev` and apply idempotent
+ * env-aware patches. (Formerly `lt dev migrate`; `migrate` stays as an
+ * alias for backwards compatibility.)
  *
  * Idempotent — re-running with no changes is a no-op. Safe to invoke
  * automatically after `lt fullstack init` or by developers manually.
  *
+ * Auto-chaining: if the machine has not been prepared yet (`lt dev
+ * install` never ran), it runs install FIRST, then initializes the
+ * project. The chain is one hop deep and cannot recurse, because this
+ * command calls the `runInstall` *helper* — never the install command
+ * (see `dev-bootstrap.ts`). Pass `--skip-install` to opt out.
+ *
  * Steps (delegated to `lib/dev-migrate-helper.ts#runMigrate`):
  * 1. Resolve workspace layout (api/app dirs, root)
  * 2. Build identity (slug + subdomains)
@@ -27,14 +37,12 @@ const dev_project_1 = require("../../lib/dev-project");
  * 4. Inject CLAUDE.md URL block (root + each subproject)
  * 5. Persist project to ~/.lenneTech/projects.json
  * 6. Add `.lt-dev/` to .gitignore
- *
- * Closes with a hint to run `lt dev install` if Caddy is missing.
  */
-const MigrateCommand = {
-    alias: ['m'],
-    description: 'Migrate an existing project to lt dev (idempotent)',
+const InitCommand = {
+    alias: ['migrate', 'm'],
+    description: 'Init project for lt dev (idempotent)',
     hidden: false,
-    name: 'migrate',
+    name: 'init',
     run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
         const { filesystem, parameters, print: { colors, error, info, success, warning }, } = toolbox;
         const layout = (0, dev_project_1.resolveLayout)(filesystem.cwd(), filesystem);
@@ -42,55 +50,35 @@ const MigrateCommand = {
             error('No API (src/config.env.ts) or App (nuxt.config.ts) project detected at this path.');
             if (!parameters.options.fromGluegunMenu)
                 process.exit(1);
-            return 'dev migrate: not a project';
-        }
-        const result = (0, dev_migrate_helper_1.runMigrate)({ layout });
-        info('');
-        info(colors.bold(`Migrating "${result.identity.slug}"`));
-        info(colors.dim('─'.repeat(60)));
-        if (result.identity.subdomains.app)
-            info(`  App URL: https://${result.identity.subdomains.app.hostname}`);
-        if (result.identity.subdomains.api)
-            info(`  API URL: https://${result.identity.subdomains.api.hostname}`);
-        info(`  DB:      mongodb://127.0.0.1/${result.dbName}`);
-        info('');
-        // Code patches
-        if (result.codePatches.length > 0) {
-            for (const r of result.codePatches) {
-                if (r.patched)
-                    success(`patched ${r.replacements}× in ${r.file}`);
-                else
-                    info(colors.dim(`already patched: ${r.file}`));
-            }
-        }
-        else {
-            info(colors.dim('  patches: not needed (already env-aware)'));
+            return 'dev init: not a project';
         }
-        // CLAUDE.md
-        result.claudePatches.filter((r) => r.patched).forEach((r) => success(`updated CLAUDE.md URL block: ${r.file}`));
-        // Registry
-        if (result.registryUpdated) {
-            success(`registered in ${process.env.LT_DEV_REGISTRY_PATH || '~/.lenneTech/projects.json'}`);
-        }
-        // .gitignore
-        if (result.addedGitignoreEntry)
-            success('added `.lt-dev/` to .gitignore');
-        if (result.alreadyMigrated) {
-            info(colors.dim('  Project was already fully migrated — nothing changed.'));
+        // Auto-chain: prepare the machine first if `lt dev install` never ran.
+        // `--skip-install` opts out. Calling the runInstall HELPER (not the
+        // install command) makes infinite recursion structurally impossible.
+        const runInstallFirst = (0, dev_bootstrap_1.shouldRunInstallBeforeInit)({
+            machinePrepared: (0, dev_bootstrap_1.isMachinePrepared)(),
+            platformSupported: (0, dev_service_1.platformSupported)() !== 'unsupported',
+            skipInstall: parameters.options.skipInstall === true,
+        });
+        if (runInstallFirst) {
+            info(colors.dim('Machine not prepared for lt dev yet — running `lt dev install` first ...'));
+            yield (0, dev_install_helper_1.runInstall)(toolbox, { auto: true });
         }
+        const result = (0, dev_migrate_helper_1.runMigrate)({ layout });
+        (0, dev_migrate_helper_1.printMigrateResult)(toolbox, result);
         info('');
-        success('Migration complete.');
-        // Hint: Caddy installed?
+        success('Project initialized for lt dev.');
+        // Closing hint based on Caddy availability.
         const caddyOk = yield (0, caddy_1.caddyAvailable)();
         if (!caddyOk) {
-            warning('Caddy is not installed yet. Run `lt dev install` first, then `lt dev up`.');
+            warning('Caddy is not installed yet. Run `lt dev install` (installs caddy first), then `lt dev up`.');
         }
         else {
             info('Start the project with `lt dev up`.');
         }
         if (!parameters.options.fromGluegunMenu)
             process.exit();
-        return `dev migrate: ${result.identity.slug}`;
+        return `dev init: ${result.identity.slug}`;
     }),
 };
-module.exports = MigrateCommand;
+module.exports = InitCommand;

package/build/commands/dev/install.js

@@ -9,29 +9,24 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const caddy_1 = require("../../lib/caddy");
-const dev_service_1 = require("../../lib/dev-service");
+const dev_bootstrap_1 = require("../../lib/dev-bootstrap");
+const dev_install_helper_1 = require("../../lib/dev-install-helper");
+const dev_migrate_helper_1 = require("../../lib/dev-migrate-helper");
+const dev_project_1 = require("../../lib/dev-project");
 /**
  * One-time per-machine setup for `lt dev`.
  *
  * Owns the full Caddy lifecycle through a dedicated LaunchAgent
- * (macOS) / systemd-user unit (Linux). This intentionally bypasses
- * `brew services caddy`, whose plist hardcodes
- * `--config /opt/homebrew/etc/Caddyfile` and would crash-loop against
- * our `~/.lenneTech/Caddyfile` location — which is the bug that
- * blocked the first real install.
+ * (macOS) / systemd-user unit (Linux), bypassing `brew services caddy`
+ * (whose plist hardcodes a different Caddyfile path and crash-loops).
+ * The actual steps live in `lib/dev-install-helper.ts#runInstall` so
+ * `lt dev init` can reuse them without a cross-command call.
  *
- * Steps (each idempotent — safe to re-run):
- *   1. Verify `caddy` is on PATH (suggest install instructions otherwise)
- *   2. Ensure `~/.lenneTech/Caddyfile` exists (stub written if missing)
- *   3. Detect conflicting `brew services caddy` and tell the user to
- *      stop it — it would fight us for ports 80/443
- *   4. Install + bootstrap our LaunchAgent/systemd unit
- *   5. Wait for the Caddy admin endpoint to respond
- *   6. Validate the Caddyfile
- *   7. Surface the `sudo -E HOME="$HOME" caddy trust` instruction for
- *      installing the local CA (HOME must survive sudo so caddy can
- *      find its CA files under the *user* profile, not /var/root)
+ * Auto-chaining: when run from inside an lt-dev-capable project that is
+ * not yet registered, it initializes that project afterwards (the same
+ * work `lt dev init` does). The chain is one hop deep and cannot recurse
+ * because it calls the `runMigrate` *helper* — never the init command
+ * (see `dev-bootstrap.ts`). Pass `--skip-init` to opt out.
  */
 const InstallCommand = {
     alias: ['i'],
@@ -39,134 +34,44 @@ const InstallCommand = {
     hidden: false,
     name: 'install',
     run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
-        const { parameters, print: { colors, error, info, success, warning }, } = toolbox;
-        info('');
-        info(colors.bold('lt dev install — one-time per-machine setup'));
-        info(colors.dim('─'.repeat(60)));
-        const plat = (0, dev_service_1.platformSupported)();
-        if (plat === 'unsupported') {
-            error(`Service management is not supported on ${process.platform}. Only macOS and Linux are covered.`);
-            info(`  Workaround: run \`${colors.cyan(`caddy run --config ${caddy_1.paths.caddyfile}`)}\` manually.`);
+        const { filesystem, parameters, print: { colors, info, success, warning }, } = toolbox;
+        const result = yield (0, dev_install_helper_1.runInstall)(toolbox);
+        // Fatal preconditions — nothing more to do, and an auto-init would be
+        // premature (the user must install caddy / use a supported OS first).
+        if (result.unsupported) {
             if (!parameters.options.fromGluegunMenu)
                 process.exit(1);
             return 'dev install: unsupported platform';
         }
-        let blocked = false;
-        // 1. caddy on PATH
-        const hasCaddy = yield (0, caddy_1.caddyAvailable)();
-        if (hasCaddy) {
-            success('caddy is on PATH');
-        }
-        else {
-            warning('caddy is not installed.');
-            info(`  → macOS: ${colors.cyan('brew install caddy')}`);
-            info(`  → Linux: ${colors.cyan('https://caddyserver.com/docs/install')}`);
-            info('  (Do NOT start it via `brew services` — `lt dev install` runs its own service.)');
-            blocked = true;
-        }
-        // 2. Caddyfile stub
-        (0, caddy_1.writeCaddyfile)('# lt dev — managed Caddyfile\n# Add per-project blocks via `lt dev up`.\n');
-        success(`Caddyfile present at ${caddy_1.paths.caddyfile}`);
-        if (!hasCaddy) {
-            info('');
-            error('Cannot continue setup until Caddy is installed. Re-run `lt dev install` afterwards.');
+        if (result.caddyMissing) {
             if (!parameters.options.fromGluegunMenu)
-                process.exit(blocked ? 1 : 0);
+                process.exit(1);
             return 'dev install: caddy missing';
         }
-        // 3. brew services conflict warning
-        const brewConflict = yield detectBrewCaddyConflict();
-        if (brewConflict) {
-            warning('A `brew services caddy` instance is registered.');
-            info(`  Stop it (it crash-loops against our Caddyfile): ${colors.cyan('brew services stop caddy')}`);
-            info('  `lt dev install` runs its own service — the brew one is no longer needed.');
-        }
-        // 4. Install our LaunchAgent / systemd unit
-        const paths = (0, dev_service_1.getServicePaths)();
-        info('');
-        info(`Installing ${plat === 'darwin' ? 'LaunchAgent' : 'systemd-user unit'} at:`);
-        info(colors.dim(`  ${paths.unitFile}`));
-        const installResult = yield (0, dev_service_1.installService)();
-        if (!installResult.ok) {
-            error(installResult.message);
-            blocked = true;
-        }
-        else {
-            if (installResult.created)
-                success(installResult.message);
-            else
-                info(colors.dim(installResult.message));
-        }
-        // 5. Wait for admin endpoint
-        if (installResult.ok) {
-            info(colors.dim('Waiting for Caddy admin endpoint (:2019) ...'));
-            const ready = yield (0, dev_service_1.waitForServiceReady)(8000);
-            const status = yield (0, dev_service_1.getServiceStatus)();
-            if (ready && status.daemonReachable) {
-                success(`Caddy daemon ready${status.pid ? ` (pid ${status.pid})` : ''}.`);
-            }
-            else if (status.loaded && !status.daemonReachable) {
-                warning('Service is loaded but admin endpoint did not respond within 8s.');
-                info(colors.dim(`  Logs: ${paths.logFile} / ${paths.errFile}`));
-                blocked = true;
-            }
-            else {
-                warning('Caddy daemon did not start. See logs:');
-                info(colors.dim(`  ${paths.logFile}`));
-                info(colors.dim(`  ${paths.errFile}`));
-                blocked = true;
-            }
-        }
-        // 6. Validate Caddyfile
-        if (installResult.ok) {
-            const validation = yield (0, caddy_1.validateCaddyfile)();
-            if (validation.ok)
-                success('Caddyfile validates');
-            else
-                warning(`Caddyfile validation: ${validation.stderr.split('\n').slice(0, 2).join(' / ')}`);
+        // Auto-chain: if we're inside an un-initialized lt-dev project, run the
+        // project init now. Calling the runMigrate HELPER (not the init command)
+        // makes infinite recursion structurally impossible. `--skip-init` opts out.
+        const layout = (0, dev_project_1.resolveLayout)(filesystem.cwd(), filesystem);
+        const runInitAfter = (0, dev_bootstrap_1.shouldRunInitAfterInstall)({
+            isProject: (0, dev_bootstrap_1.isLtDevProject)(layout),
+            projectInitialized: (0, dev_bootstrap_1.isProjectInitialized)(layout),
+            skipInit: parameters.options.skipInit === true,
+        });
+        if (runInitAfter) {
+            info('');
+            info(colors.dim('Un-initialized lt dev project detected here — running `lt dev init` ...'));
+            (0, dev_migrate_helper_1.printMigrateResult)(toolbox, (0, dev_migrate_helper_1.runMigrate)({ layout }));
         }
-        // 7. CA trust
-        info('');
-        info(colors.bold('Local CA trust'));
-        info('  Caddy creates its local CA on first run. To trust it system-wide,');
-        info('  run this once (HOME must be preserved so sudo keeps the user-scoped');
-        info('  CA, otherwise caddy looks in /var/root and fails):');
-        info(`    ${colors.cyan('sudo -E HOME="$HOME" caddy trust')}`);
-        info(`  Browsers will then accept ${colors.cyan('https://*.localhost')} without warnings.`);
         info('');
-        if (blocked) {
+        if (result.blocked) {
             warning('Setup incomplete. Address the items above and re-run `lt dev install`.');
         }
         else {
-            success('Setup complete. Use `lt dev migrate` in a project, then `lt dev up`.');
+            success('Setup complete. Use `lt dev init` in a project, then `lt dev up`.');
         }
         if (!parameters.options.fromGluegunMenu)
-            process.exit(blocked ? 1 : 0);
-        return blocked ? 'dev install: incomplete' : 'dev install: ok';
+            process.exit(result.blocked ? 1 : 0);
+        return result.blocked ? 'dev install: incomplete' : 'dev install: ok';
     }),
 };
-/**
- * Quick `brew services list` scan for a registered caddy service.
- * Returns true on macOS if any entry contains "caddy" — error/started
- * alike, both are conflicts. Always returns false on non-darwin or
- * when `brew` is unavailable (no false positives).
- */
-function detectBrewCaddyConflict() {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (process.platform !== 'darwin')
-            return false;
-        return new Promise((resolve) => {
-            var _a;
-            const { spawn } = require('child_process');
-            const child = spawn('brew', ['services', 'list'], { stdio: ['ignore', 'pipe', 'ignore'] });
-            let out = '';
-            (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (b) => (out += String(b)));
-            child.on('error', () => resolve(false));
-            child.on('close', () => {
-                const conflict = /\bcaddy\b/.test(out) && !/^caddy\s+none\b/m.test(out);
-                resolve(conflict);
-            });
-        });
-    });
-}
 module.exports = InstallCommand;

package/build/commands/dev/status.js

@@ -36,7 +36,7 @@ const StatusCommand = {
             info(colors.dim('─'.repeat(60)));
             const slugs = Object.keys(reg.projects).sort();
             if (slugs.length === 0) {
-                warning('No projects registered. Run `lt dev migrate` in a project.');
+                warning('No projects registered. Run `lt dev init` in a project.');
             }
             else {
                 for (const slug of slugs) {
@@ -62,7 +62,7 @@ const StatusCommand = {
         info(colors.bold(`lt dev status: ${identity.slug}`));
         info(colors.dim('─'.repeat(60)));
         if (!entry) {
-            warning('Not registered. Run `lt dev migrate` first.');
+            warning('Not registered. Run `lt dev init` first.');
             // Show what migrate would do (legacy code present?) so the user
             // can judge urgency before running it.
             const legacyFiles = [];
@@ -74,11 +74,11 @@ const StatusCommand = {
             if (layout.appDir)
                 legacyFiles.push(...(0, dev_project_1.appNeedsPortPatch)(layout.appDir));
             if (legacyFiles.length > 0) {
-                info(colors.dim('  Legacy hardcoded ports detected — `lt dev migrate` will patch:'));
+                info(colors.dim('  Legacy hardcoded ports detected — `lt dev init` will patch:'));
                 legacyFiles.forEach((f) => info(colors.dim(`    - ${f}`)));
             }
             else {
-                info(colors.dim('  Code is already env-aware; `lt dev migrate` will only register + patch CLAUDE.md.'));
+                info(colors.dim('  Code is already env-aware; `lt dev init` will only register + patch CLAUDE.md.'));
             }
             info('');
             if (!parameters.options.fromGluegunMenu)
@@ -104,7 +104,7 @@ const StatusCommand = {
             info('');
             warning('  Legacy hardcoded ports still present:');
             legacyFiles.forEach((f) => info(colors.dim(`    - ${f}`)));
-            info(colors.dim('  Run `lt dev migrate` to patch them; otherwise Caddy may proxy into the void.'));
+            info(colors.dim('  Run `lt dev init` to patch them; otherwise Caddy may proxy into the void.'));
         }
         // Caddy status — quick view whether the daemon is reachable.
         {

package/build/commands/dev/tunnel.js

@@ -49,7 +49,7 @@ const TunnelCommand = {
         const { filesystem, parameters, print: { colors, error, info, success, warning }, } = toolbox;
         const layout = (0, dev_project_1.resolveLayout)(filesystem.cwd(), filesystem);
         if (!layout.apiDir && !layout.appDir) {
-            error('No API or App project detected at this path. Run `lt dev migrate` first.');
+            error('No API or App project detected at this path. Run `lt dev init` first.');
             if (!parameters.options.fromGluegunMenu)
                 process.exit(1);
             return 'dev tunnel: not a project';

package/build/commands/dev/up.js

@@ -50,7 +50,7 @@ const UpCommand = {
         const { filesystem, parameters, print: { colors, error, info, success, warning }, } = toolbox;
         const layout = (0, dev_project_1.resolveLayout)(filesystem.cwd(), filesystem);
         if (!layout.apiDir && !layout.appDir) {
-            error('No API or App project detected at this path. Run `lt dev migrate` first.');
+            error('No API or App project detected at this path. Run `lt dev init` first.');
             if (!parameters.options.fromGluegunMenu)
                 process.exit(1);
             return 'dev up: not a project';
@@ -72,7 +72,7 @@ const UpCommand = {
         const dbName = (0, dev_project_1.deriveDbName)(layout.apiDir, identity.slug);
         // Sanft auto-migrate sichere Operationen (ohne Code-Modifikation):
         // CLAUDE.md-URL-Block einfügen + .gitignore ergänzen.
-        // Code-Patches (config.env.ts, nuxt.config.ts) bleiben explizit `lt dev migrate`.
+        // Code-Patches (config.env.ts, nuxt.config.ts) bleiben explizit `lt dev init`.
         {
             const claudeCandidates = [
                 (0, path_1.join)(layout.root, 'CLAUDE.md'),
@@ -98,7 +98,7 @@ const UpCommand = {
             if (layout.appDir)
                 legacyFiles.push(...(0, dev_project_1.appNeedsPortPatch)(layout.appDir));
             if (legacyFiles.length > 0) {
-                warning('Legacy hardcoded ports detected — Caddy will proxy correctly only after running `lt dev migrate`:');
+                warning('Legacy hardcoded ports detected — Caddy will proxy correctly only after running `lt dev init`:');
                 legacyFiles.forEach((f) => info(colors.dim(`  - ${f}`)));
                 info(colors.dim('  (Continuing — env-aware files will work; legacy files may bind on 3000/3001 and miss Caddy.)'));
             }

package/build/commands/fullstack/init.js

@@ -17,6 +17,7 @@ const caddy_1 = require("../../lib/caddy");
 const dev_migrate_helper_1 = require("../../lib/dev-migrate-helper");
 const dev_project_1 = require("../../lib/dev-project");
 const hoist_workspace_pnpm_config_1 = require("../../lib/hoist-workspace-pnpm-config");
+const package_name_1 = require("../../lib/package-name");
 const workspace_integration_1 = require("../../lib/workspace-integration");
 const add_api_1 = __importDefault(require("./add-api"));
 const add_app_1 = __importDefault(require("./add-app"));
@@ -440,6 +441,11 @@ const NewCommand = {
                     .replace(/\{\{FRONTEND_FRAMEWORK\}\}/g, () => frontendName));
             }
         }
+        // Rename the cloned monorepo's root package so each project gets a unique
+        // `lt dev` slug. The slug is derived from package.json `name`; without
+        // this rename every lt-monorepo-based project would register as
+        // `lt-monorepo` and collide on `https://lt-monorepo.localhost`.
+        (0, package_name_1.setPackageName)({ filesystem, name: projectDir, packageJsonPath: `${projectDir}/package.json` });
         // Always initialize git
         try {
             yield system.run(`cd ${projectDir} && git init --initial-branch=dev`);
@@ -653,7 +659,7 @@ const NewCommand = {
                     return;
                 }
             }
-            // Best-effort `lt dev migrate` so the workspace is ready for `lt dev up`
+            // Best-effort `lt dev init` so the workspace is ready for `lt dev up`
             // out-of-the-box: registers the slug in `~/.lenneTech/projects.json`,
             // injects the URL block into CLAUDE.md, adds `.lt-dev/` to .gitignore.
             // Failures here are non-fatal — `init` itself remains successful.

package/build/lib/dev-bootstrap.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLtDevProject = isLtDevProject;
+exports.isMachinePrepared = isMachinePrepared;
+exports.isProjectInitialized = isProjectInitialized;
+exports.shouldRunInitAfterInstall = shouldRunInitAfterInstall;
+exports.shouldRunInstallBeforeInit = shouldRunInstallBeforeInit;
+/**
+ * Bootstrap-state checks that drive the mutual auto-chaining between
+ * `lt dev install` (per-machine setup) and `lt dev init` (per-project
+ * setup).
+ *
+ * These are pure, synchronous predicates so the chaining decision is
+ * trivially testable and cannot itself trigger side effects. The actual
+ * work is delegated to `runInstall` / `runMigrate`, which never call each
+ * other — so the install↔init chaining can never recurse infinitely:
+ *
+ *   - `lt dev init`   → if NOT machine-prepared, run install first, then init
+ *   - `lt dev install`→ if inside an un-initialized project, run init after
+ *
+ * Because each command calls the *helpers* (not the other command), the
+ * chain is at most one hop deep in either direction. The predicates below
+ * additionally make re-runs no-ops (nothing repeated unnecessarily).
+ */
+const fs_1 = require("fs");
+const dev_identity_1 = require("./dev-identity");
+const dev_service_1 = require("./dev-service");
+const dev_state_1 = require("./dev-state");
+/**
+ * True if this path is an lt-dev-capable project — i.e. `resolveLayout`
+ * found an API (`src/config.env.ts`) and/or App (`nuxt.config.ts`).
+ * Used by `lt dev install` to decide whether an auto-init makes sense.
+ */
+function isLtDevProject(layout) {
+    return !!(layout.apiDir || layout.appDir);
+}
+/**
+ * True once `lt dev install` has set up this machine — i.e. the
+ * LaunchAgent/systemd unit file exists. This is the durable marker that
+ * install has run; whether the daemon is currently *running* is a
+ * separate concern handled by `lt dev up` / `doctor`.
+ *
+ * Always false on unsupported platforms (no service model), so the
+ * chaining never tries to install where it cannot.
+ */
+function isMachinePrepared() {
+    const paths = (0, dev_service_1.getServicePaths)();
+    return paths.platform !== 'unsupported' && (0, fs_1.existsSync)(paths.unitFile);
+}
+/**
+ * True if this project is already registered with `lt dev` (present in
+ * `~/.lenneTech/projects.json` under its slug, pointing at this root).
+ * This is the durable marker that `lt dev init` has run for the project.
+ */
+function isProjectInitialized(layout) {
+    const slug = (0, dev_identity_1.buildIdentity)(layout.root).slug;
+    const entry = (0, dev_state_1.loadRegistry)().projects[slug];
+    return !!entry && entry.path === layout.root;
+}
+/**
+ * Pure decision: should `lt dev install` run `init` AFTERWARDS? Yes only
+ * when not opted out, we're inside an lt-dev-capable project, and that
+ * project isn't initialized yet. Re-runs become no-ops once initialized.
+ */
+function shouldRunInitAfterInstall(input) {
+    return !input.skipInit && input.isProject && !input.projectInitialized;
+}
+/**
+ * Pure decision: should `lt dev init` run `install` BEFORE initializing?
+ * Yes only when not opted out, the platform supports a service model, and
+ * the machine isn't prepared yet. Re-runs become no-ops once prepared.
+ */
+function shouldRunInstallBeforeInit(input) {
+    return !input.skipInstall && input.platformSupported && !input.machinePrepared;
+}

package/build/lib/dev-env.js

@@ -35,7 +35,12 @@ function buildDevEnv(input) {
     const apiUrl = apiSub ? `https://${apiSub.hostname}` : '';
     const appUrl = appSub ? `https://${appSub.hostname}` : '';
     const caPath = (0, dev_env_bridge_1.detectCaddyRootCa)();
-    const sharedKeys = Object.assign(Object.assign(Object.assign(Object.assign({}, (apiUrl ? { BASE_URL: apiUrl, NSC__BASE_URL: apiUrl } : {})), (appUrl ? { APP_URL: appUrl, NSC__APP_URL: appUrl } : {})), (dbName ? { DATABASE_URL: buildPostgresUrl(dbName), NSC__MONGOOSE__URI: `mongodb://127.0.0.1/${dbName}` } : {})), (caPath ? { NODE_EXTRA_CA_CERTS: caPath } : {}));
+    const sharedKeys = Object.assign(Object.assign(Object.assign(Object.assign({ 
+        // Marks the API + App processes as running under `lt dev`. Consumed by the
+        // backend to relax dev-only behaviour (rate limiting, Better-Auth
+        // user-cache) so E2E suites run without a separate VITEST/PLAYWRIGHT flag.
+        // (Also written to the .lt-dev/.env bridge for external test runners.)
+        LT_DEV_ACTIVE: 'true' }, (apiUrl ? { BASE_URL: apiUrl, NSC__BASE_URL: apiUrl } : {})), (appUrl ? { APP_URL: appUrl, NSC__APP_URL: appUrl } : {})), (dbName ? { DATABASE_URL: buildPostgresUrl(dbName), NSC__MONGOOSE__URI: `mongodb://127.0.0.1/${dbName}` } : {})), (caPath ? { NODE_EXTRA_CA_CERTS: caPath } : {}));
     return {
         api: {
             env: Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 

package/build/lib/dev-install-helper.js

@@ -0,0 +1,136 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInstall = runInstall;
+const caddy_1 = require("./caddy");
+const dev_service_1 = require("./dev-service");
+/**
+ * Run the one-time per-machine `lt dev` setup. Idempotent — safe to
+ * re-run. When `opts.auto` is set the heading reflects that it was
+ * triggered by another command (e.g. `lt dev init`).
+ */
+function runInstall(toolbox_1) {
+    return __awaiter(this, arguments, void 0, function* (toolbox, opts = {}) {
+        const { print: { colors, error, info, success, warning }, } = toolbox;
+        info('');
+        info(colors.bold(opts.auto ? 'Preparing this machine for lt dev (lt dev install)' : 'lt dev install — one-time per-machine setup'));
+        info(colors.dim('─'.repeat(60)));
+        const plat = (0, dev_service_1.platformSupported)();
+        if (plat === 'unsupported') {
+            error(`Service management is not supported on ${process.platform}. Only macOS and Linux are covered.`);
+            info(`  Workaround: run \`${colors.cyan(`caddy run --config ${caddy_1.paths.caddyfile}`)}\` manually.`);
+            return { blocked: true, caddyMissing: false, ok: false, unsupported: true };
+        }
+        let blocked = false;
+        // 1. caddy on PATH
+        const hasCaddy = yield (0, caddy_1.caddyAvailable)();
+        if (hasCaddy) {
+            success('caddy is on PATH');
+        }
+        else {
+            warning('caddy is not installed.');
+            info(`  → macOS: ${colors.cyan('brew install caddy')}`);
+            info(`  → Linux: ${colors.cyan('https://caddyserver.com/docs/install')}`);
+            info('  (Do NOT start it via `brew services` — `lt dev install` runs its own service.)');
+            blocked = true;
+        }
+        // 2. Caddyfile stub
+        (0, caddy_1.writeCaddyfile)('# lt dev — managed Caddyfile\n# Add per-project blocks via `lt dev up`.\n');
+        success(`Caddyfile present at ${caddy_1.paths.caddyfile}`);
+        if (!hasCaddy) {
+            info('');
+            error('Cannot continue setup until Caddy is installed. Re-run `lt dev install` afterwards.');
+            return { blocked: true, caddyMissing: true, ok: false, unsupported: false };
+        }
+        // 3. brew services conflict warning
+        const brewConflict = yield detectBrewCaddyConflict();
+        if (brewConflict) {
+            warning('A `brew services caddy` instance is registered.');
+            info(`  Stop it (it crash-loops against our Caddyfile): ${colors.cyan('brew services stop caddy')}`);
+            info('  `lt dev install` runs its own service — the brew one is no longer needed.');
+        }
+        // 4. Install our LaunchAgent / systemd unit
+        const paths = (0, dev_service_1.getServicePaths)();
+        info('');
+        info(`Installing ${plat === 'darwin' ? 'LaunchAgent' : 'systemd-user unit'} at:`);
+        info(colors.dim(`  ${paths.unitFile}`));
+        const installResult = yield (0, dev_service_1.installService)();
+        if (!installResult.ok) {
+            error(installResult.message);
+            blocked = true;
+        }
+        else if (installResult.created) {
+            success(installResult.message);
+        }
+        else {
+            info(colors.dim(installResult.message));
+        }
+        // 5. Wait for admin endpoint
+        if (installResult.ok) {
+            info(colors.dim('Waiting for Caddy admin endpoint (:2019) ...'));
+            const ready = yield (0, dev_service_1.waitForServiceReady)(8000);
+            const status = yield (0, dev_service_1.getServiceStatus)();
+            if (ready && status.daemonReachable) {
+                success(`Caddy daemon ready${status.pid ? ` (pid ${status.pid})` : ''}.`);
+            }
+            else if (status.loaded && !status.daemonReachable) {
+                warning('Service is loaded but admin endpoint did not respond within 8s.');
+                info(colors.dim(`  Logs: ${paths.logFile} / ${paths.errFile}`));
+                blocked = true;
+            }
+            else {
+                warning('Caddy daemon did not start. See logs:');
+                info(colors.dim(`  ${paths.logFile}`));
+                info(colors.dim(`  ${paths.errFile}`));
+                blocked = true;
+            }
+        }
+        // 6. Validate Caddyfile
+        if (installResult.ok) {
+            const validation = yield (0, caddy_1.validateCaddyfile)();
+            if (validation.ok)
+                success('Caddyfile validates');
+            else
+                warning(`Caddyfile validation: ${validation.stderr.split('\n').slice(0, 2).join(' / ')}`);
+        }
+        // 7. CA trust
+        info('');
+        info(colors.bold('Local CA trust'));
+        info('  Caddy creates its local CA on first run. To trust it system-wide,');
+        info('  run this once (HOME must be preserved so sudo keeps the user-scoped');
+        info('  CA, otherwise caddy looks in /var/root and fails):');
+        info(`    ${colors.cyan('sudo -E HOME="$HOME" caddy trust')}`);
+        info(`  Browsers will then accept ${colors.cyan('https://*.localhost')} without warnings.`);
+        return { blocked, caddyMissing: false, ok: installResult.ok, unsupported: false };
+    });
+}
+/**
+ * Quick `brew services list` scan for a registered caddy service.
+ * Returns true on macOS if any entry contains "caddy" — error/started
+ * alike, both are conflicts. Always returns false on non-darwin or
+ * when `brew` is unavailable (no false positives).
+ */
+function detectBrewCaddyConflict() {
+    if (process.platform !== 'darwin')
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        var _a;
+        const { spawn } = require('child_process');
+        const child = spawn('brew', ['services', 'list'], { stdio: ['ignore', 'pipe', 'ignore'] });
+        let out = '';
+        (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (b) => (out += String(b)));
+        child.on('error', () => resolve(false));
+        child.on('close', () => {
+            const conflict = /\bcaddy\b/.test(out) && !/^caddy\s+none\b/m.test(out);
+            resolve(conflict);
+        });
+    });
+}

package/build/lib/dev-migrate-helper.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.printMigrateResult = printMigrateResult;
 exports.runMigrate = runMigrate;
 /**
- * Reusable migrate logic — used by `commands/dev/migrate.ts` (interactive
- * + verbose) and `commands/fullstack/init.ts` (silent best-effort after
- * project creation).
+ * Reusable init/migrate logic — used by `commands/dev/init.ts` (interactive
+ * + verbose, also chained from `commands/dev/install.ts`) and
+ * `commands/fullstack/init.ts` (silent best-effort after project creation).
  *
  * Returns a structured result so callers can decide what to print.
  * Idempotent — safe to run multiple times.
@@ -15,6 +16,43 @@ const dev_identity_1 = require("./dev-identity");
 const dev_patches_1 = require("./dev-patches");
 const dev_project_1 = require("./dev-project");
 const dev_state_1 = require("./dev-state");
+/**
+ * Print a `runMigrate` result via the toolbox. Shared by `lt dev init`
+ * and the auto-init step of `lt dev install` so both render identically.
+ * Does NOT print Caddy-install hints — chaining handles that separately.
+ */
+function printMigrateResult(toolbox, result) {
+    const { print: { colors, info, success }, } = toolbox;
+    info('');
+    info(colors.bold(`Initializing "${result.identity.slug}" for lt dev`));
+    info(colors.dim('─'.repeat(60)));
+    if (result.identity.subdomains.app)
+        info(`  App URL: https://${result.identity.subdomains.app.hostname}`);
+    if (result.identity.subdomains.api)
+        info(`  API URL: https://${result.identity.subdomains.api.hostname}`);
+    info(`  DB:      mongodb://127.0.0.1/${result.dbName}`);
+    info('');
+    if (result.codePatches.length > 0) {
+        for (const r of result.codePatches) {
+            if (r.patched)
+                success(`patched ${r.replacements}× in ${r.file}`);
+            else
+                info(colors.dim(`already patched: ${r.file}`));
+        }
+    }
+    else {
+        info(colors.dim('  patches: not needed (already env-aware)'));
+    }
+    result.claudePatches.filter((r) => r.patched).forEach((r) => success(`updated CLAUDE.md URL block: ${r.file}`));
+    if (result.registryUpdated) {
+        success(`registered in ${process.env.LT_DEV_REGISTRY_PATH || '~/.lenneTech/projects.json'}`);
+    }
+    if (result.addedGitignoreEntry)
+        success('added `.lt-dev/` to .gitignore');
+    if (result.alreadyMigrated) {
+        info(colors.dim('  Project was already initialized — nothing changed.'));
+    }
+}
 /**
  * Run all migration steps for a resolved project.
  *

package/build/lib/dev-patches.js

@@ -7,7 +7,7 @@ exports.patchClaudeMd = patchClaudeMd;
 exports.patchNuxtConfig = patchNuxtConfig;
 exports.patchPlaywrightConfig = patchPlaywrightConfig;
 /**
- * Idempotent patches applied by `lt dev migrate`.
+ * Idempotent patches applied by `lt dev init`.
  *
  * Goal: take a project that still has hardcoded `localhost:3000`
  * defaults and make it env-aware so it can be served behind Caddy
@@ -40,16 +40,32 @@ function autoPatch(file) {
         return patchPlaywrightConfig(file);
     return { file, patched: false, replacements: 0 };
 }
-/** API: `port: 3000,` → `port: Number(process.env.PORT) || 3000,`. */
+/**
+ * API: make the server listen port honour `process.env.PORT` (injected by
+ * `lt dev up` for its Caddy upstream). Handles two patterns found in
+ * nest-server `config.env.ts` files:
+ *
+ *  - the legacy literal `port: 3000,` (e.g. in `deployedConfig()`)
+ *  - the offers-pattern `port: process.env.NSC__PORT ? parseInt(process.env.NSC__PORT, 10) : 3000`
+ *    found in `localConfig()` — `lt dev` runs the API in local mode, so this
+ *    line MUST be patched too or the API ignores the assigned port.
+ *
+ * Idempotent — lines that already read `process.env.PORT` are left untouched.
+ */
 function patchApiConfig(file) {
     if (!(0, fs_1.existsSync)(file))
         return { file, patched: false, replacements: 0 };
     const before = (0, fs_1.readFileSync)(file, 'utf8');
     let count = 0;
-    const after = before.replace(/^(\s*)port:\s*3000\s*,$/gm, (_m, indent) => {
+    let after = before.replace(/^(\s*)port:\s*3000\s*,$/gm, (_m, indent) => {
         count++;
         return `${indent}port: Number(process.env.PORT) || 3000,`;
     });
+    // localConfig() keeps the NSC__PORT operator override; PORT (lt dev) wins.
+    after = after.replace(/^(\s*)port:\s*process\.env\.NSC__PORT\s*\?[^\n]*:\s*3000\s*,$/gm, (_m, indent) => {
+        count++;
+        return `${indent}port: Number(process.env.PORT) || (process.env.NSC__PORT ? parseInt(process.env.NSC__PORT, 10) : 3000),`;
+    });
     if (count === 0)
         return { file, patched: false, replacements: 0 };
     (0, fs_1.writeFileSync)(file, after, 'utf8');
@@ -69,6 +85,7 @@ function patchClaudeMd(file, options) {
     const appSub = identity.subdomains.app;
     const lines = [
         startMarker,
+        '',
         '## Local Development (lt dev)',
         '',
         `This project is registered with \`lt dev\` (slug: \`${identity.slug}\`). Use these commands to run alongside other lt projects without cross-wiring or port collisions:`,
@@ -77,9 +94,12 @@ function patchClaudeMd(file, options) {
         'lt dev up        # Start API + App behind Caddy with project-specific URLs',
         'lt dev down      # Stop the detached processes + remove Caddy block',
         'lt dev status    # Show running PIDs + bound URLs',
+        'lt dev test      # Ensure up + run the E2E suite with project URLs injected',
         'lt dev doctor    # Diagnose Caddy/CA/DNS/port issues',
         '```',
         '',
+        '**Start and test local apps via `lt dev`** — never `pnpm dev` / `pnpm start` / a bare `playwright test` directly; those bind the framework default ports (3000/3001) and collide with parallel projects.',
+        '',
         '**Active URLs for THIS project:**',
         '',
     ];
@@ -88,7 +108,7 @@ function patchClaudeMd(file, options) {
     if (apiSub)
         lines.push(`- API: \`https://${apiSub.hostname}\``);
     if (dbName)
-        lines.push(`- DB:  \`mongodb://127.0.0.1/${dbName}\``);
+        lines.push(`- DB: \`mongodb://127.0.0.1/${dbName}\``);
     lines.push('');
     lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
     lines.push('');
@@ -159,30 +179,52 @@ function patchPlaywrightConfig(file) {
             return `${key}: process.env.NUXT_PUBLIC_SITE_URL || 'http://localhost:3001'`;
         });
     }
-    // 2. Top-of-file dotenv bridge — only inject if not already present.
+    // 2. Top-of-file dotenv bridge — inject it, or replace an outdated block.
+    //    The loader walks UP from cwd to find `.lt-dev/.env`: that file lives
+    //    at the repo root, while playwright.config.ts (and the process cwd of
+    //    a direct `playwright test` run) usually sit in `projects/app`. The
+    //    original cwd-only resolve missed it, so direct runs fell back to
+    //    `localhost:3001` and could collide with a parallel project.
     const bridgeStart = '// >>> lt-dev:bridge >>>';
     const bridgeEnd = '// <<< lt-dev:bridge <<<';
-    if (!after.includes(bridgeStart)) {
-        const bridgeBlock = [
-            bridgeStart,
-            '// Auto-load <root>/.lt-dev/.env when `lt dev up` is active so',
-            '// external test runners (CLI, IDE, VS Code Playwright Extension)',
-            '// pick up project URLs + Caddy CA without inheriting the parent shell.',
-            "import { existsSync as __ltDevExists, readFileSync as __ltDevRead } from 'node:fs';",
-            "import { resolve as __ltDevResolve } from 'node:path';",
-            "const __ltDevEnvFile = __ltDevResolve(process.cwd(), '.lt-dev/.env');",
-            'if (__ltDevExists(__ltDevEnvFile)) {',
-            '  for (const __ln of __ltDevRead(__ltDevEnvFile, "utf8").split(/\\r?\\n/)) {',
-            '    const __m = __ln.match(/^([A-Z][A-Z0-9_]*)=(.*)$/);',
-            '    if (__m && process.env[__m[1]] === undefined) process.env[__m[1]] = __m[2];',
-            '  }',
-            '}',
-            bridgeEnd,
-            '',
-        ].join('\n');
-        after = bridgeBlock + after;
+    const bridgeBlock = [
+        bridgeStart,
+        '// Auto-load <root>/.lt-dev/.env when `lt dev up` is active so',
+        '// external test runners (CLI, IDE, VS Code Playwright Extension)',
+        '// pick up project URLs + Caddy CA without inheriting the parent shell.',
+        '// Searches upward from cwd because `.lt-dev/` sits at the repo root',
+        '// while playwright.config.ts (and cwd) usually sit in projects/app.',
+        "import { existsSync as __ltDevExists, readFileSync as __ltDevRead } from 'node:fs';",
+        "import { dirname as __ltDevDirname, resolve as __ltDevResolve } from 'node:path';",
+        "let __ltDevEnvFile = '';",
+        'for (let __ltDevDir = process.cwd(), __i = 0; __i < 6; __i++) {',
+        "  const __candidate = __ltDevResolve(__ltDevDir, '.lt-dev/.env');",
+        '  if (__ltDevExists(__candidate)) { __ltDevEnvFile = __candidate; break; }',
+        '  const __parent = __ltDevDirname(__ltDevDir);',
+        '  if (__parent === __ltDevDir) break;',
+        '  __ltDevDir = __parent;',
+        '}',
+        'if (__ltDevEnvFile) {',
+        '  for (const __ln of __ltDevRead(__ltDevEnvFile, "utf8").split(/\\r?\\n/)) {',
+        '    const __m = __ln.match(/^([A-Z][A-Z0-9_]*)=(.*)$/);',
+        '    if (__m && process.env[__m[1]] === undefined) process.env[__m[1]] = __m[2];',
+        '  }',
+        '}',
+        bridgeEnd,
+    ].join('\n');
+    const bridgeStartIdx = after.indexOf(bridgeStart);
+    const bridgeEndIdx = after.indexOf(bridgeEnd);
+    if (bridgeStartIdx === -1) {
+        after = `${bridgeBlock}\n${after}`;
         count++;
     }
+    else if (bridgeEndIdx !== -1) {
+        const rebuilt = after.slice(0, bridgeStartIdx) + bridgeBlock + after.slice(bridgeEndIdx + bridgeEnd.length);
+        if (rebuilt !== after) {
+            after = rebuilt;
+            count++;
+        }
+    }
     if (count === 0)
         return { file, patched: false, replacements: 0 };
     (0, fs_1.writeFileSync)(file, after, 'utf8');

package/build/lib/hoist-workspace-pnpm-config.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
+const fs_1 = require("fs");
+const js_yaml_1 = require("js-yaml");
 /**
  * pnpm workspace-scoped fields that must live at the workspace root.
  * When present in sub-project package.json files, pnpm emits:
@@ -15,6 +17,16 @@ exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
  * and the actual dependency-resolution behavior.
  */
 const WORKSPACE_SCOPED_PNPM_FIELDS = ['overrides', 'onlyBuiltDependencies', 'ignoredOptionalDependencies'];
+/**
+ * pnpm 11 renamed `onlyBuiltDependencies` (string array) to `allowBuilds`
+ * (a `{ pkg: boolean }` map). A migrated sub-project pnpm-workspace.yaml
+ * usually carries BOTH for cross-version compatibility, but we must not
+ * rely on the array twin always being present: we normalise `allowBuilds`
+ * back into `onlyBuiltDependencies` before hoisting (see
+ * `normalizeAllowBuilds`) so the build-allowlist survives into the pnpm-10
+ * monorepo root even when the file only carries the pnpm-11 object form.
+ */
+const PNPM11_BUILD_KEY = 'allowBuilds';
 /**
  * Hoist workspace-scoped pnpm config from sub-projects into the root
  * package.json. After this runs, sub-project package.json files no
@@ -22,6 +34,27 @@ const WORKSPACE_SCOPED_PNPM_FIELDS = ['overrides', 'onlyBuiltDependencies', 'ign
  * `ignoredOptionalDependencies`, and the root package.json contains
  * the merged union.
  *
+ * Two sources are read per sub-project, because the two starters store
+ * their pnpm config differently:
+ *
+ *   1. `<sub>/package.json` `pnpm` block — nest-server-starter, and
+ *      nuxt-base-template before its pnpm-11 migration.
+ *   2. `<sub>/pnpm-workspace.yaml` — nuxt-base-template after the
+ *      migration. pnpm 11 silently ignores the `pnpm` block in
+ *      package.json, so the template moved overrides into
+ *      pnpm-workspace.yaml. Inside a monorepo that nested file would
+ *      (a) not be hoisted by the old package.json-only logic, regressing
+ *      the CVE overrides, and (b) declare a nested workspace root that
+ *      conflicts with the monorepo's own pnpm-workspace.yaml. We hoist
+ *      its fields into the root package.json (the lt-monorepo root pins
+ *      pnpm@10 via `packageManager`, where package.json#pnpm IS honored)
+ *      and remove the now-redundant nested file.
+ *
+ * Symlinked sub-projects are skipped entirely: in `--frontend-link` /
+ * `--api-link` mode `projects/app` (or `projects/api`) points at the
+ * user's local framework checkout, and stripping its config or deleting
+ * its pnpm-workspace.yaml would corrupt that source repo.
+ *
  * Idempotent: running twice has the same effect as running once.
  *
  * @param options.filesystem  Gluegun filesystem tool
@@ -38,36 +71,106 @@ function hoistWorkspacePnpmConfig(options) {
     if (!rootPkg)
         return;
     (_a = rootPkg.pnpm) !== null && _a !== void 0 ? _a : (rootPkg.pnpm = {});
+    const rootPnpm = rootPkg.pnpm;
     let rootChanged = false;
     for (const subDir of subProjects) {
-        const subPkgPath = `${projectDir}/${subDir}/package.json`;
-        if (!filesystem.exists(subPkgPath))
+        const subPath = `${projectDir}/${subDir}`;
+        if (!filesystem.exists(subPath))
             continue;
-        const subPkg = filesystem.read(subPkgPath, 'json');
-        if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
+        // Never mutate a symlinked sub-project — it points at the user's own
+        // checkout in link mode.
+        if (isSymlink(subPath))
             continue;
-        let subChanged = false;
-        for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
-            const subValue = subPkg.pnpm[field];
-            if (subValue === undefined)
-                continue;
-            rootPkg.pnpm[field] = mergePnpmFieldValue(field, rootPkg.pnpm[field], subValue);
+        if (hoistFromSubPackageJson({ filesystem, rootPnpm, subPath })) {
             rootChanged = true;
-            delete subPkg.pnpm[field];
-            subChanged = true;
         }
-        if (subChanged) {
-            // If the sub-project's pnpm section is now empty, drop it entirely.
-            if (subPkg.pnpm && Object.keys(subPkg.pnpm).length === 0) {
-                delete subPkg.pnpm;
-            }
-            filesystem.write(subPkgPath, `${JSON.stringify(subPkg, null, 2)}\n`);
+        if (hoistFromSubWorkspaceYaml({ filesystem, rootPnpm, subPath })) {
+            rootChanged = true;
         }
     }
     if (rootChanged) {
         filesystem.write(rootPkgPath, `${JSON.stringify(rootPkg, null, 2)}\n`);
     }
 }
+/**
+ * Move the workspace-scoped pnpm fields from `source` into `rootPnpm`,
+ * deleting each moved field from `source`. Returns true if anything moved.
+ */
+function hoistFields(rootPnpm, source) {
+    let changed = false;
+    for (const field of WORKSPACE_SCOPED_PNPM_FIELDS) {
+        if (source[field] === undefined)
+            continue;
+        rootPnpm[field] = mergePnpmFieldValue(field, rootPnpm[field], source[field]);
+        delete source[field];
+        changed = true;
+    }
+    return changed;
+}
+/** Source 1: the sub-project's package.json `pnpm` block. */
+function hoistFromSubPackageJson(options) {
+    const { filesystem, rootPnpm, subPath } = options;
+    const subPkgPath = `${subPath}/package.json`;
+    if (!filesystem.exists(subPkgPath))
+        return false;
+    const subPkg = filesystem.read(subPkgPath, 'json');
+    if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
+        return false;
+    if (!hoistFields(rootPnpm, subPkg.pnpm))
+        return false;
+    // If the sub-project's pnpm section is now empty, drop it entirely.
+    if (Object.keys(subPkg.pnpm).length === 0) {
+        delete subPkg.pnpm;
+    }
+    filesystem.write(subPkgPath, `${JSON.stringify(subPkg, null, 2)}\n`);
+    return true;
+}
+/** Source 2: the sub-project's pnpm-workspace.yaml (pnpm-11 layout). */
+function hoistFromSubWorkspaceYaml(options) {
+    const { filesystem, rootPnpm, subPath } = options;
+    const subWsPath = `${subPath}/pnpm-workspace.yaml`;
+    if (!filesystem.exists(subWsPath))
+        return false;
+    const raw = filesystem.read(subWsPath);
+    if (!raw)
+        return false;
+    let parsed;
+    try {
+        parsed = (0, js_yaml_1.load)(raw);
+    }
+    catch (_a) {
+        // Malformed YAML — leave it untouched rather than risk data loss.
+        return false;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return false;
+    const ws = parsed;
+    // Fold the pnpm-11 `allowBuilds` map into `onlyBuiltDependencies` so it is
+    // hoisted rather than discarded — even when the array twin is absent.
+    normalizeAllowBuilds(ws);
+    if (!hoistFields(rootPnpm, ws))
+        return false;
+    // A settings-only file (no `packages:`) exists solely to carry these
+    // hoisted keys — once emptied it would only declare a nested workspace
+    // root, so remove it. A file that declares `packages:` is a real (rare)
+    // nested workspace; keep it minus the hoisted keys.
+    if (Array.isArray(ws.packages) && ws.packages.length > 0) {
+        filesystem.write(subWsPath, (0, js_yaml_1.dump)(ws));
+    }
+    else {
+        filesystem.remove(subWsPath);
+    }
+    return true;
+}
+/** Whether `path` is a symbolic link (false on any stat error). */
+function isSymlink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
 /**
  * Merge two values for a pnpm workspace-scoped field.
  *
@@ -95,3 +198,26 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
     const merged = Object.assign(Object.assign({}, rootObj), subObj);
     return Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
 }
+/**
+ * Fold a pnpm-11 `allowBuilds: { pkg: boolean }` map into the pnpm-10
+ * `onlyBuiltDependencies: string[]` form (packages whose value is `true`),
+ * unioned with any existing array, then remove the `allowBuilds` key so the
+ * redundant object form does not linger. Mutates `ws` in place.
+ *
+ * No-op when `allowBuilds` is absent or not an object map — an unexpected
+ * shape is left untouched rather than risk silent data loss.
+ */
+function normalizeAllowBuilds(ws) {
+    const raw = ws[PNPM11_BUILD_KEY];
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return;
+    const allowed = Object.entries(raw)
+        .filter(([, enabled]) => enabled === true)
+        .map(([pkg]) => pkg);
+    if (allowed.length > 0) {
+        const existing = Array.isArray(ws.onlyBuiltDependencies) ? ws.onlyBuiltDependencies : [];
+        // Order here is irrelevant — mergePnpmFieldValue sorts the union on hoist.
+        ws.onlyBuiltDependencies = Array.from(new Set([...allowed, ...existing]));
+    }
+    delete ws[PNPM11_BUILD_KEY];
+}

package/build/lib/package-name.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setPackageName = setPackageName;
+/**
+ * Set the `name` field of a package.json on disk.
+ *
+ * Used by `lt fullstack init` to rename the cloned monorepo's root package
+ * so each project gets a unique `lt dev` slug (the slug is derived from
+ * package.json `name`; without a rename every lt-monorepo-based project would
+ * register as `lt-monorepo` and collide on `https://lt-monorepo.localhost`).
+ *
+ * IMPORTANT: this reads/writes the file as parsed JSON rather than running a
+ * string regex through `patching.update`. Gluegun's `patching.update` hands
+ * the callback a *parsed object* for any `.json` file, so a String-based
+ * `content.replace(...)` callback throws `content.replace is not a function`
+ * at runtime. Going through parsed JSON here is both correct and robust: it
+ * adds a `name` field if one is missing instead of silently no-op'ing.
+ *
+ * Idempotent: if the name already equals `name`, the file is left untouched
+ * and the function returns false.
+ *
+ * @param options.filesystem      Gluegun filesystem tool
+ * @param options.name            New value for the `name` field
+ * @param options.packageJsonPath Absolute path to the package.json
+ * @returns true if the file was written, false otherwise (missing/unreadable/unchanged)
+ */
+function setPackageName(options) {
+    const { filesystem, name, packageJsonPath } = options;
+    if (!filesystem.exists(packageJsonPath))
+        return false;
+    const pkg = filesystem.read(packageJsonPath, 'json');
+    if (!pkg || typeof pkg !== 'object' || Array.isArray(pkg))
+        return false;
+    if (pkg.name === name)
+        return false;
+    pkg.name = name;
+    filesystem.write(packageJsonPath, `${JSON.stringify(pkg, null, 2)}\n`);
+    return true;
+}

package/docs/commands.md

@@ -312,10 +312,13 @@ One-time per-machine setup. Idempotent — re-run anytime to diagnose what's mis
 **Usage:**
 ```bash
 lt dev install
+lt dev install --skip-init   # do NOT auto-run `lt dev init` afterwards
 ```
 
 **Alias:** `lt d i`
 
+**Auto-chaining:** when run from inside an lt-dev-capable project that is not yet initialized, `lt dev install` runs `lt dev init` for that project **afterwards**. Pass `--skip-init` to opt out. This is one hop deep and never recurses — `install` calls the init *helper*, not the init command.
+
 **What it does:**
 1. Verifies `caddy` is on PATH (suggests `brew install caddy` if missing).
 2. Creates `~/.lenneTech/Caddyfile` stub if absent.
@@ -355,16 +358,19 @@ lt dev uninstall --noConfirm  # skip the purge prompt (keep files)
 
 ---
 
-### `lt dev migrate`
+### `lt dev init`
 
-Register an existing project with `lt dev` and apply idempotent env-aware patches. Safe to run multiple times; safe to run after `lt fullstack init`.
+Initialize an existing project for `lt dev` and apply idempotent env-aware patches. Safe to run multiple times; safe to run after `lt fullstack init`.
 
 **Usage:**
 ```bash
-lt dev migrate
+lt dev init
+lt dev init --skip-install   # do NOT auto-run `lt dev install` first
 ```
 
-**Alias:** `lt d m`
+**Alias:** `lt d init`, `lt d migrate`, `lt d m` (`migrate` is the former name, kept for backwards compatibility)
+
+**Auto-chaining:** if the machine has not been prepared yet (no `lt dev install` has run), `lt dev init` runs the install step **first**, then initializes the project. Pass `--skip-install` to opt out. This is one hop deep and never recurses — `init` calls the install *helper*, not the install command.
 
 **What it does:**
 1. Detects the workspace layout (monorepo `projects/api`+`projects/app`, or standalone).
@@ -538,7 +544,7 @@ lt dev test -- --ui spec.ts      # everything after `--` is forwarded to playwri
 | `LT_DEV_ACTIVE`, `LT_DEV_DB_NAME` | Marker keys for consumers |
 | `NODE_EXTRA_CA_CERTS` | Path to Caddy's root CA cert (auto-detected) |
 
-`lt dev migrate` injects a tiny `// >>> lt-dev:bridge >>>` block at the top of `playwright.config.ts` that loads this file at config-load time — making Playwright (CLI, IDE, VS Code extension) automatically use the `lt dev` URLs and trust the local CA, without inheriting the parent shell.
+`lt dev init` injects a tiny `// >>> lt-dev:bridge >>>` block at the top of `playwright.config.ts` that loads this file at config-load time — making Playwright (CLI, IDE, VS Code extension) automatically use the `lt dev` URLs and trust the local CA, without inheriting the parent shell.
 
 `lt dev down` removes the bridge file so subsequent runs without `lt dev up` fall back cleanly to the classic `localhost:3000`/`localhost:3001` defaults.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.24.1",
+  "version": "1.25.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -32,6 +32,8 @@
     "test:vendor-init": "bash scripts/test-vendor-init.sh",
     "test:frontend-vendor-init": "bash scripts/test-frontend-vendor-init.sh",
     "test:incremental-fullstack": "bash scripts/test-incremental-fullstack.sh",
+    "test:manual": "jest --testMatch '<rootDir>/*.manual.ts' --testTimeout=60000",
+    "test:e2e:service": "jest --testMatch '<rootDir>/dev-service-e2e.manual.ts' --testTimeout=60000",
     "format": "prettier --write 'src/**/*.{js,ts,tsx,json}' '!src/templates/**/*'",
     "lint": "eslint './src/**/*.{ts,js,vue}'",
     "lint:fix": "eslint './src/**/*.{ts,js,vue}' --fix",
@@ -58,9 +60,9 @@
     "bin"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1045.0",
+    "@aws-sdk/client-s3": "3.1053.0",
     "@lenne.tech/cli-plugin-helper": "0.0.14",
-    "axios": "1.16.0",
+    "axios": "1.16.1",
     "bcrypt": "6.0.0",
     "defuddle": "0.18.1",
     "glob": "13.0.6",
@@ -70,7 +72,7 @@
     "jsdom": "29.1.1",
     "lodash": "4.18.1",
     "open": "11.0.0",
-    "playwright-core": "1.59.1",
+    "playwright-core": "1.60.0",
     "ts-morph": "28.0.0",
     "ts-node": "10.9.2",
     "turndown": "7.2.4",
@@ -85,7 +87,7 @@
     "@types/js-yaml": "4.0.9",
     "@types/jsdom": "28.0.1",
     "@types/lodash": "4.17.24",
-    "@types/node": "25.6.2",
+    "@types/node": "25.9.1",
     "@types/turndown": "5.0.6",
     "ejs": "5.0.2",
     "eslint": "9.39.4",
@@ -94,18 +96,23 @@
     "prettier": "3.8.3",
     "rimraf": "6.1.3",
     "standard-version": "9.5.0",
-    "ts-jest": "29.4.9"
+    "ts-jest": "29.4.11"
   },
   "//overrides": {
-    "semver@*": "Force latest semver across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep."
+    "brace-expansion@5.0.2 - 5.0.5": "Security fix: GHSA-jxxr-4gwj-5jf2 (large numeric range defeats max DoS protection) in brace-expansion 5.0.2-5.0.5 - transitive via minimatch under glob, @ts-morph/common, @typescript-eslint/typescript-estree. Remove once those parents resolve minimatch to a brace-expansion >=5.0.6.",
+    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep."
   },
   "overrides": {
-    "semver@*": "7.7.4"
+    "brace-expansion@5.0.2 - 5.0.5": "5.0.6",
+    "semver@*": "7.8.1"
   },
   "jest": {
     "testEnvironment": "node",
     "rootDir": "__tests__",
     "testTimeout": 60000,
+    "testMatch": [
+      "<rootDir>/*.test.ts"
+    ],
     "transform": {
       "^.+\\.tsx?$": [
         "ts-jest",