@lenne.tech/cli 1.33.0 → 1.34.0

package/build/commands/codex/codex.js

@@ -0,0 +1,23 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Codex commands
+ */
+module.exports = {
+    alias: ['cx'],
+    description: 'Codex commands',
+    name: 'codex',
+    run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
+        yield toolbox.helper.showMenu('codex');
+        return 'codex';
+    }),
+};

package/build/commands/codex/plugins.js

@@ -0,0 +1,103 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const path_1 = require("path");
+const codex_cli_1 = require("../../lib/codex-cli");
+const codex_plugin_utils_1 = require("../../lib/codex-plugin-utils");
+const CODEX_PLUGIN_NAME = 'lt-dev';
+/**
+ * Install/update lenne.tech Codex plugin, custom agents, and prompt wrappers.
+ */
+const PluginsCommand = {
+    alias: ['p'],
+    description: 'Install Codex plugins',
+    name: 'plugins',
+    run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
+        const { helper, print: { error, info, spin, success, warning }, system, } = toolbox;
+        const timer = system.startTimer();
+        const marketplaceRoot = String(toolbox.parameters.options.path || codex_cli_1.DEFAULT_CODEX_MARKETPLACE_ROOT);
+        const pluginRoot = (0, path_1.join)(marketplaceRoot, 'plugins', CODEX_PLUGIN_NAME);
+        const marketplaceName = (0, codex_plugin_utils_1.readCodexMarketplaceName)(marketplaceRoot);
+        if (!marketplaceName) {
+            error(`Codex marketplace not found at ${marketplaceRoot}`);
+            info('');
+            info('Expected: .agents/plugins/marketplace.json');
+            info('Run this from a checkout that contains the generated codex marketplace, or pass --path=<marketplace-root>.');
+            process.exit(1);
+        }
+        if (!(0, fs_1.existsSync)(pluginRoot)) {
+            error(`Codex plugin not found: ${pluginRoot}`);
+            process.exit(1);
+        }
+        const cli = (0, codex_cli_1.findCodexCli)();
+        if (!cli) {
+            error('Codex CLI not found. Please install Codex first.');
+            info('');
+            info('Installation: https://developers.openai.com/codex');
+            process.exit(1);
+        }
+        const listSpinner = spin('Checking Codex marketplaces');
+        const listResult = (0, codex_cli_1.runCodexCommand)(cli, ['plugin', 'marketplace', 'list', '--json']);
+        const marketplaceConfigured = listResult.success &&
+            (listResult.output.includes(`"name": "${marketplaceName}"`) || listResult.output.includes(marketplaceRoot));
+        if (marketplaceConfigured) {
+            listSpinner.succeed(`Marketplace ${marketplaceName} already configured`);
+        }
+        else {
+            listSpinner.text = `Adding marketplace ${marketplaceName}`;
+            const addResult = (0, codex_cli_1.runCodexCommand)(cli, ['plugin', 'marketplace', 'add', marketplaceRoot, '--json']);
+            if (addResult.success || addResult.output.includes('already')) {
+                listSpinner.succeed(`Marketplace ${marketplaceName} added`);
+            }
+            else {
+                listSpinner.fail(`Failed to add marketplace ${marketplaceName}`);
+                error(addResult.output);
+                process.exit(1);
+            }
+        }
+        const installSpinner = spin(`Installing/updating ${CODEX_PLUGIN_NAME}`);
+        const installResult = (0, codex_cli_1.runCodexCommand)(cli, ['plugin', 'add', `${CODEX_PLUGIN_NAME}@${marketplaceName}`, '--json']);
+        if (installResult.success || installResult.output.includes('already')) {
+            installSpinner.succeed(`${CODEX_PLUGIN_NAME} installed`);
+        }
+        else {
+            installSpinner.fail(`Failed to install ${CODEX_PLUGIN_NAME}`);
+            error(installResult.output);
+            process.exit(1);
+        }
+        const agentSpinner = spin('Installing Codex custom agents');
+        const agentCount = (0, codex_plugin_utils_1.installCodexAgents)(pluginRoot);
+        agentSpinner.succeed(`${agentCount} custom agents installed`);
+        const promptSpinner = spin('Installing Codex prompt wrappers');
+        const promptCount = (0, codex_plugin_utils_1.installCodexPrompts)(pluginRoot);
+        promptSpinner.succeed(`${promptCount} prompt wrappers installed`);
+        const contents = (0, codex_plugin_utils_1.readLocalCodexPluginContents)(pluginRoot);
+        info('');
+        success(`Codex setup completed in ${helper.msToMinutesAndSeconds(timer())}m.`);
+        info('');
+        info('Installed:');
+        info(`  Plugin: ${CODEX_PLUGIN_NAME}@${marketplaceName}`);
+        info(`  Skills (${contents.skills.length}): ${contents.skills.join(', ')}`);
+        info(`  MCP Servers (${contents.mcpServers.length}): ${contents.mcpServers.join(', ')}`);
+        info(`  Hooks: ${contents.hooks}`);
+        info(`  Custom agents: ${agentCount}`);
+        info(`  Prompt wrappers: ${promptCount}`);
+        info('');
+        warning('Restart Codex or start a new thread so new skills, agents, prompts, and MCP tools are loaded.');
+        info('Use former lt-dev commands via /prompts:lt-dev-... or by asking Codex to use the lt-dev command router.');
+        if (!toolbox.parameters.options.fromGluegunMenu) {
+            process.exit(0);
+        }
+        return 'codex plugins installed';
+    }),
+};
+exports.default = PluginsCommand;

package/build/commands/codex/shortcuts.js

@@ -0,0 +1,110 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const shell_config_1 = require("../../lib/shell-config");
+const CODEX_SHORTCUTS = [
+    {
+        alias: 'x',
+        command: 'codex --sandbox workspace-write --ask-for-approval on-request',
+        description: 'Start new Codex session',
+    },
+    {
+        alias: 'xr',
+        command: 'codex resume',
+        description: 'Select and resume previous Codex session',
+    },
+    {
+        alias: 'xf',
+        command: 'LT_PLUGIN_HOOKS_SKIP=1 codex --sandbox workspace-write --ask-for-approval on-request',
+        description: 'Start Codex in fast mode (skip lenne.tech plugin detect hooks)',
+    },
+    {
+        alias: 'xp',
+        command: 'lt codex plugins',
+        description: 'Install/update lenne.tech Codex plugin setup',
+    },
+];
+const ShortcutsCommand = {
+    alias: ['s'],
+    description: 'Install Codex shell shortcuts',
+    name: 'shortcuts',
+    run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
+        const { print: { error, info, success }, } = toolbox;
+        const shellConfig = (0, shell_config_1.getPreferredShellConfig)();
+        if (!shellConfig) {
+            error('Could not detect shell configuration file.');
+            info('Supported shells: zsh, bash');
+            if (!toolbox.parameters.options.fromGluegunMenu) {
+                process.exit(1);
+            }
+            return 'shortcuts: no shell config found';
+        }
+        info(`Shell: ${shellConfig.shell}`);
+        info(`Config: ${shellConfig.path}`);
+        info('');
+        const existingAliases = [];
+        const missingAliases = [];
+        for (const shortcut of CODEX_SHORTCUTS) {
+            if ((0, shell_config_1.checkAliasInFile)(shellConfig.path, shortcut.alias)) {
+                existingAliases.push(shortcut);
+            }
+            else {
+                missingAliases.push(shortcut);
+            }
+        }
+        if (existingAliases.length > 0) {
+            info('Already installed:');
+            for (const { alias, description } of existingAliases) {
+                info(`  ${alias} - ${description}`);
+            }
+            info('');
+        }
+        if (missingAliases.length === 0) {
+            success('All Codex shortcuts are already installed!');
+            info('');
+            info('Available shortcuts:');
+            for (const { alias, command, description } of CODEX_SHORTCUTS) {
+                info(`  ${alias} - ${description}`);
+                info(`      ${command}`);
+            }
+            if (!toolbox.parameters.options.fromGluegunMenu) {
+                process.exit(0);
+            }
+            return 'shortcuts: already installed';
+        }
+        const added = (0, shell_config_1.addAliasBlockToShellConfig)(shellConfig.path, missingAliases, 'Codex shortcuts - Added by lenne.tech CLI');
+        if (added) {
+            info('');
+            success(`Added ${missingAliases.length} shortcut${missingAliases.length > 1 ? 's' : ''} to ${shellConfig.path}`);
+            info('');
+            info(`Run: source ${shellConfig.path}`);
+            info('Or restart your terminal to apply changes.');
+        }
+        else {
+            error(`Failed to write to ${shellConfig.path}`);
+            info('');
+            info('To add manually, add these lines to your shell config:');
+            info('');
+            for (const { alias, command } of missingAliases) {
+                info(`alias ${alias}='${command}'`);
+            }
+            if (!toolbox.parameters.options.fromGluegunMenu) {
+                process.exit(1);
+            }
+            return 'shortcuts: write failed';
+        }
+        if (!toolbox.parameters.options.fromGluegunMenu) {
+            process.exit(0);
+        }
+        return `shortcuts: ${missingAliases.length} added`;
+    }),
+};
+exports.default = ShortcutsCommand;

package/build/commands/dev/test.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_1 = require("fs");
 const caddy_1 = require("../../lib/caddy");
 const dev_env_bridge_1 = require("../../lib/dev-env-bridge");
+const dev_package_manager_1 = require("../../lib/dev-package-manager");
 const dev_process_1 = require("../../lib/dev-process");
 const dev_project_1 = require("../../lib/dev-project");
 const dev_test_session_1 = require("../../lib/dev-test-session");
@@ -75,7 +76,6 @@ const TestCommand = {
         const keep = Boolean(parameters.options.keep) || parameters.options.teardown === false;
         const debug = Boolean(parameters.options.debug);
         const forwarded = parameters.array || [];
-        const pnpmBin = process.env.LT_PNPM_BIN || 'pnpm';
         // `--shard N` → run the suite split across N fully-isolated stacks in
         // parallel. A bare `--shard` defaults to 2 — the stable sweet spot for a
         // heavy built-SSR suite (N>=3 over-subscribes the perf cores → flaky; see
@@ -102,7 +102,8 @@ const TestCommand = {
                 return 'dev test: no api';
             }
             info(colors.bold(`Running API tests for "${identity.slug}" (isolated DB)`));
-            const code = yield (0, dev_process_1.runChildInherit)(pnpmBin, ['run', 'test:e2e', ...forwarded], {
+            const apiPm = (0, dev_package_manager_1.pickPackageManager)(layout.apiDir);
+            const code = yield (0, dev_process_1.runChildInherit)(apiPm.bin, apiPm.runScript('test:e2e', forwarded), {
                 cwd: layout.apiDir,
                 env: process.env,
             });
@@ -174,10 +175,11 @@ const TestCommand = {
             try {
                 info('');
                 info(colors.bold(`Running isolated Playwright E2E for "${identity.slug}" sharded across ${shardTotal} stacks`));
+                const shardPm = (0, dev_package_manager_1.pickPackageManager)(layout.appDir);
                 shardExit = yield (0, dev_test_session_1.runShardedTestSession)(layout, identity, log, {
                     devDbName,
                     forwarded,
-                    pnpmBin,
+                    pm: shardPm,
                     total: shardTotal,
                 });
             }
@@ -233,7 +235,11 @@ const TestCommand = {
             info(colors.bold(`Running isolated Playwright E2E for "${identity.slug}"`));
             info(colors.dim(`  app: ${ctx.appUrl}   db: ${ctx.dbName}`));
             info('');
-            exitCode = yield (0, dev_process_1.runChildInherit)(pnpmBin, ['run', 'test:e2e', ...forwarded], { cwd: layout.appDir, env });
+            const appPm = (0, dev_package_manager_1.pickPackageManager)(layout.appDir);
+            exitCode = yield (0, dev_process_1.runChildInherit)(appPm.bin, appPm.runScript('test:e2e', forwarded), {
+                cwd: layout.appDir,
+                env,
+            });
         }
         catch (e) {
             error(`Failed to run isolated E2E: ${e.message}`);

package/build/commands/dev/up.js

@@ -14,6 +14,7 @@ const path_1 = require("path");
 const caddy_1 = require("../../lib/caddy");
 const dev_env_1 = require("../../lib/dev-env");
 const dev_env_bridge_1 = require("../../lib/dev-env-bridge");
+const dev_package_manager_1 = require("../../lib/dev-package-manager");
 const dev_patches_1 = require("../../lib/dev-patches");
 const dev_process_1 = require("../../lib/dev-process");
 const dev_project_1 = require("../../lib/dev-project");
@@ -326,7 +327,6 @@ const UpCommand = {
             dbName,
             identity,
         });
-        const pnpmBin = process.env.LT_PNPM_BIN || 'pnpm';
         const pids = {};
         const rotationNotes = [];
         const started = [];
@@ -350,7 +350,12 @@ const UpCommand = {
             }
             else {
                 yield reclaimPort(existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api, apiPort, apiHealth !== null && apiHealth !== void 0 ? apiHealth : 'dead');
-                const apiResult = (0, dev_process_1.spawnDetached)(pnpmBin, ['start'], {
+                // Per-component PM detection: a monorepo may have an npm api and a
+                // pnpm app, and the legacy hard-coded `pnpm start` would silently
+                // regenerate a foreign lockfile + crash on un-approved build
+                // scripts when run against an npm-only project.
+                const apiPm = (0, dev_package_manager_1.pickPackageManager)(layout.apiDir);
+                const apiResult = (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), {
                     cwd: layout.apiDir,
                     env: devEnv.api.env,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', 'api.log'),
@@ -371,7 +376,8 @@ const UpCommand = {
             }
             else {
                 yield reclaimPort(existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.app, appPort, appHealth !== null && appHealth !== void 0 ? appHealth : 'dead');
-                const appResult = (0, dev_process_1.spawnDetached)(pnpmBin, ['dev'], {
+                const appPm = (0, dev_package_manager_1.pickPackageManager)(layout.appDir);
+                const appResult = (0, dev_process_1.spawnDetached)(appPm.bin, appPm.runScript('dev'), {
                     cwd: layout.appDir,
                     env: devEnv.app.env,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', 'app.log'),

package/build/commands/frontend/nuxt.js

@@ -15,7 +15,7 @@ const workspace_integration_1 = require("../../lib/workspace-integration");
  * Create a new nuxt workspace
  *
  * Standalone counterpart to `lt fullstack init` / `lt fullstack add-app`
- * for Nuxt: clones nuxt-base-starter (or invokes create-nuxt-base) into
+ * for Nuxt: clones nuxt-base-starter into
  * a brand-new directory. Mirrors the same surface area as add-app where
  * applicable so behaviour is consistent across the four flows.
  */
@@ -170,7 +170,7 @@ const NewCommand = {
             info('Dry-run plan:');
             info(`  name:                       ${projName}`);
             info(`  projectDir:                 ${projectDir}`);
-            info(`  branch:                     ${branch || '(default — uses create-nuxt-base)'}`);
+            info(`  branch:                     ${branch || '(default branch)'}`);
             info(`  copy:                       ${copyPath || '(none)'}`);
             info(`  link:                       ${linkPath || '(none)'}`);
             info(`  frontendFrameworkMode:      ${frontendFrameworkMode}`);
@@ -183,11 +183,8 @@ const NewCommand = {
             else if (copyPath) {
                 info(`  1. copy ${copyPath} → ./${projectDir}`);
             }
-            else if (branch) {
-                info(`  1. clone nuxt-base-starter (branch: ${branch}) → ./${projectDir}`);
-            }
             else {
-                info(`  1. exec create-nuxt-base@latest → ./${projectDir}`);
+                info(`  1. clone nuxt-base-starter (${branch ? `branch: ${branch}` : 'default branch'}) → ./${projectDir}`);
             }
             if (frontendFrameworkMode === 'vendor') {
                 info(`  2. clone @lenne.tech/nuxt-extensions → /tmp`);
@@ -206,7 +203,7 @@ const NewCommand = {
             branch,
             copyPath,
             linkPath,
-            skipInstall: true, // Nuxt standalone doesn't need npm install (create-nuxt-base handles it)
+            skipInstall: false, // clone-based setup installs here (create-nuxt-base no longer used)
         });
         if (!result.success) {
             baseSpinner.fail(`Failed to setup nuxt workspace: ${result.path}`);

package/build/commands/fullstack/init.js

@@ -33,7 +33,7 @@ const NewCommand = {
     run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0;
         // Retrieve the tools we need
-        const { config, filesystem, frontendHelper, git, helper, parameters, patching, print: { colors, error, info, spin, success }, prompt: { ask, confirm }, server, strings: { kebabCase }, system, template, } = toolbox;
+        const { config, filesystem, frontendHelper, git, helper, parameters, patching, print: { colors, error, info, spin, success, warning }, prompt: { ask, confirm }, server, strings: { kebabCase }, system, template, } = toolbox;
         // Start timer
         const timer = system.startTimer();
         // Info
@@ -209,7 +209,9 @@ const NewCommand = {
         //            `/lt-dev:backend:update-nest-server-core`; local patches are logged
         //            in src/core/VENDOR.md.
         //
-        // Default is still 'npm' until the vendoring pilot is fully evaluated.
+        // Default is 'vendor' — the lt CLI integrates the framework core directly
+        // (clones the starter, vendors core into src/core/), which is the
+        // recommended setup; pass `--framework-mode npm` for the classic npm dep.
         let frameworkMode;
         if (experimental) {
             frameworkMode = 'npm';
@@ -226,16 +228,16 @@ const NewCommand = {
             info(`Using framework mode from lt.config: ${frameworkMode}`);
         }
         else if (noConfirm) {
-            frameworkMode = 'npm';
-            info('Using default framework mode: npm (noConfirm mode)');
+            frameworkMode = 'vendor';
+            info('Using default framework mode: vendor (noConfirm mode)');
         }
         else {
             const frameworkModeChoice = yield ask({
                 choices: [
                     'npm    - @lenne.tech/nest-server as npm dependency (classic, stable)',
-                    'vendor - framework core vendored into projects/api/src/core/ (pilot, allows local patches)',
+                    'vendor - framework core vendored into projects/api/src/core/ (default, allows local patches)',
                 ],
-                initial: 0,
+                initial: 1,
                 message: 'Framework consumption mode?',
                 name: 'frameworkMode',
                 type: 'select',
@@ -257,11 +259,11 @@ const NewCommand = {
             info(`Using frontend framework mode from lt.config: ${frontendFrameworkMode}`);
         }
         else if (noConfirm) {
-            frontendFrameworkMode = 'npm';
+            frontendFrameworkMode = 'vendor';
         }
         else {
-            // Default to npm without asking (unless user sets it explicitly)
-            frontendFrameworkMode = 'npm';
+            // Default to vendor without asking (unless user sets it explicitly)
+            frontendFrameworkMode = 'vendor';
         }
         // Determine remote push settings with priority: CLI > config > interactive
         // Git is always initialized; the question is whether to push to a remote
@@ -273,8 +275,13 @@ const NewCommand = {
             if (pushToRemote) {
                 gitLink = cliGitLink || configGitLink;
                 if (!gitLink) {
-                    error('--git-link is required when --git is true (or configure gitLink in lt.config)');
-                    return;
+                    // Git is always initialized locally (dev branch + initial commit);
+                    // --git only controls the remote push. Without a link there is
+                    // nothing to push to, so degrade to a local-only init instead of
+                    // aborting the whole scaffold — consistent with the config and
+                    // interactive branches below.
+                    warning('--git true without --git-link: initializing local git only (no remote push).');
+                    pushToRemote = false;
                 }
             }
         }
@@ -314,6 +321,14 @@ const NewCommand = {
                 }
             }
         }
+        else if (noConfirm) {
+            // Default in noConfirm mode: git true. Git is always initialized locally
+            // (dev branch + initial commit); push to a remote only when a gitLink is
+            // configured, otherwise stay local-only (nothing to push to).
+            gitLink = configGitLink;
+            pushToRemote = !!gitLink;
+            info(`Using default git: true${gitLink ? ' (push to configured gitLink)' : ' (local only — no --git-link configured)'}`);
+        }
         // Determine branches and copy/link paths with priority: CLI > config
         const apiBranch = cliApiBranch || configApiBranch;
         // Under `--next`, default the nuxt-base-starter ref to the `next`

package/build/commands/ticket/start.js

@@ -97,14 +97,16 @@ const StartCommand = {
         }
         // 2. tag the worktree with its ticket id (makes lt dev * ticket-aware).
         (0, dev_ticket_1.writeTicketMarker)(worktreePath, id);
-        // 3. install deps (pnpm hard-links from the shared store → fast).
+        // 3. install deps. Auto-detects pnpm/yarn/npm from the worktree's
+        // lockfile so an npm-only repo doesn't get a foreign pnpm-lock
+        // injected on every ticket start.
         if (parameters.options.install !== false) {
-            info(colors.dim('Installing dependencies (pnpm) …'));
+            info(colors.dim('Installing dependencies …'));
             try {
-                (0, dev_ticket_1.pnpmInstall)(worktreePath);
+                (0, dev_ticket_1.installWorktreeDeps)(worktreePath);
             }
             catch (e) {
-                warning(`pnpm install failed (${e.message}) — continuing; run it manually in the worktree.`);
+                warning(`install failed (${e.message}) — continuing; run it manually in the worktree.`);
             }
         }
         // 4. bring the isolated stack up (re-invokes THIS lt build so the marker is

package/build/extensions/frontend-helper.js

@@ -141,49 +141,54 @@ class FrontendHelper {
         return __awaiter(this, arguments, void 0, function* (dest, options = {}) {
             const { system, templateHelper } = this.toolbox;
             const { branch, copyPath, linkPath, skipInstall } = options;
-            // Use template extension for link/copy/branch operations
-            if (linkPath || copyPath || branch) {
-                const result = yield templateHelper.setup(dest, {
-                    branch,
-                    copyPath,
-                    isNuxt: true,
-                    linkPath,
-                    repoUrl: branch ? 'https://github.com/lenneTech/nuxt-base-starter.git' : undefined,
-                });
-                if (!result.success) {
-                    return { method: result.method, path: result.path, success: false };
-                }
-                // After a clone, flatten the wrapper layout so `projects/app/`
-                // IS the Nuxt app (the cloned root is the `create-nuxt-base`
-                // scaffolder, not the app — see flattenNuxtBaseTemplate).
-                // Skip on link mode: a symlink points at the user's local
-                // checkout and must not have its template subdir torn out.
-                if (result.method === 'clone') {
-                    yield this.flattenNuxtBaseTemplate(dest);
-                }
-                // Run install if not skipped and not a symlink
-                if (!skipInstall && result.method !== 'link') {
-                    try {
-                        const { pm } = this.toolbox;
-                        yield system.run(`cd "${dest}" && ${pm.install(pm.detect(dest))}`);
-                    }
-                    catch (err) {
-                        return { method: result.method, path: dest, success: false };
-                    }
-                }
-                return { method: result.method, path: result.path, success: true };
+            // Source the Nuxt app from the nuxt-base-starter repo (priority:
+            // link > copy > clone), mirroring the backend (nest-server-starter)
+            // flow. The default — no link/copy/branch — clones the repo's default
+            // branch, so a fresh init always integrates the CURRENT GitHub template.
+            //
+            // This deliberately replaces the former `create-nuxt-base@latest` npx
+            // path: that package is marked `private` and is no longer published
+            // (nuxt-base-starter commit b534af2 — "distribute via lt CLI fullstack
+            // template"), so `@latest` was frozen at an outdated copy and the
+            // bundled template drifted from GitHub. Cloning the repo directly is
+            // the same mechanism the backend already uses and removes that drift.
+            const result = yield templateHelper.setup(dest, {
+                branch,
+                copyPath,
+                isNuxt: true,
+                linkPath,
+                repoUrl: linkPath || copyPath ? undefined : 'https://github.com/lenneTech/nuxt-base-starter.git',
+            });
+            if (!result.success) {
+                return { method: result.method, path: result.path, success: false };
             }
-            // Default: use create-nuxt-base
-            try {
-                const { pm } = this.toolbox;
-                yield system.run(pm.exec(`create-nuxt-base@latest "${dest}"`));
-                // Fix package name - create-nuxt-base uses path as name which is invalid for lerna
+            // After a clone, flatten the wrapper layout so `dest` IS the Nuxt app
+            // (the cloned root carries the scaffolder; the app lives in
+            // `nuxt-base-template/` — see flattenNuxtBaseTemplate). Skip on link
+            // mode: a symlink points at the user's checkout and must not be torn out.
+            if (result.method === 'clone') {
+                yield this.flattenNuxtBaseTemplate(dest);
+            }
+            // Normalize the sub-project package name to a stable, valid workspace
+            // name ("app"). The template ships as `nuxt-base-template`; the former
+            // create-nuxt-base path renamed it the same way. Skip link mode — a
+            // symlinked checkout is shared with upstream and must not be mutated.
+            if (result.method !== 'link') {
                 yield this.fixPackageName(dest);
-                return { method: 'npx', path: dest, success: true };
             }
-            catch (err) {
-                return { method: 'npx', path: dest, success: false };
+            // Run install unless skipped or a symlink. Fullstack init installs at
+            // the monorepo level (skipInstall: true); standalone `lt frontend nuxt`
+            // installs here (create-nuxt-base used to handle that).
+            if (!skipInstall && result.method !== 'link') {
+                try {
+                    const { pm } = this.toolbox;
+                    yield system.run(`cd "${dest}" && ${pm.install(pm.detect(dest))}`);
+                }
+                catch (_a) {
+                    return { method: result.method, path: dest, success: false };
+                }
             }
+            return { method: result.method, path: result.path, success: true };
         });
     }
     /**

package/build/extensions/server.js

@@ -1006,6 +1006,20 @@ class Server {
                 // Best-effort — if we can't read upstream pkg, the starter's own
                 // deps should still cover most of the framework's needs.
             }
+            // Snapshot the upstream lockfile too. The shallow clone ships
+            // pnpm-lock.yaml, which pins EXACT versions for every transitive
+            // dependency the vendored core imports directly (cron, jose,
+            // fs-capacitor, graphql-ws, ws, …) but that nest-server never declares
+            // as a direct dep. Step 5b below resolves the core's import closure
+            // against this so those packages become direct project deps.
+            let upstreamLockRaw = '';
+            try {
+                upstreamLockRaw = filesystem.read(`${tmpClone}/pnpm-lock.yaml`) || '';
+            }
+            catch (_b) {
+                // Best-effort — without the lockfile, the closure step falls back to
+                // the upstream package.json ranges (still better than nothing).
+            }
             // Snapshot the upstream CLAUDE.md for section-merge into projects/api/CLAUDE.md.
             // The nest-server CLAUDE.md contains framework-specific instructions that
             // Claude Code needs to work correctly with the vendored source (API conventions,
@@ -1018,7 +1032,7 @@ class Server {
                     upstreamClaudeMd = claudeMdContent;
                 }
             }
-            catch (_b) {
+            catch (_c) {
                 // Non-fatal — if missing, the project CLAUDE.md just won't get upstream sections.
             }
             // Snapshot the upstream commit SHA for traceability in VENDOR.md.
@@ -1027,7 +1041,7 @@ class Server {
                 const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
                 upstreamCommit = (sha || '').trim();
             }
-            catch (_c) {
+            catch (_d) {
                 // Non-fatal — VENDOR.md will just show an empty SHA.
             }
             try {
@@ -1310,7 +1324,7 @@ class Server {
                             }
                         }
                     }
-                    catch (_d) {
+                    catch (_e) {
                         // skip unreadable file
                     }
                 }
@@ -1420,6 +1434,25 @@ class Server {
                             }
                         }
                     }
+                    // ── 5b. Backfill the vendored core's transitive import closure ──
+                    //
+                    // The merge above only covers nest-server's *declared* dependencies.
+                    // The vendored core ALSO imports packages that used to arrive
+                    // transitively through the @lenne.tech/nest-server npm dep
+                    // (cron←@nestjs/schedule, jose←better-auth, fs-capacitor←graphql-upload,
+                    // graphql-ws / ws). Once vendored, those imports are direct, so under
+                    // pnpm's isolated node_modules they are unresolvable unless declared
+                    // as direct deps → TS2307 at build time. Scan the core's bare imports
+                    // and add any missing package (+ matching @types) at the EXACT version
+                    // pinned by the upstream lockfile.
+                    this.gatherVendorCoreImportClosure({
+                        coreDir,
+                        deps,
+                        devDeps,
+                        lockRaw: upstreamLockRaw,
+                        upstreamDeps,
+                        upstreamDevDeps,
+                    });
                     // Add a script to run the local bin/migrate.js. The starter's
                     // existing migrate:* scripts are already correct for npm mode; we
                     // need them pointing at the local bin + local ts-compiler.
@@ -1692,7 +1725,13 @@ class Server {
             // Scan all consumer files for stale bare-specifier imports that the
             // codemod should have rewritten. A single miss causes a compile error,
             // so catching it here with a clear message saves the user debugging time.
-            const staleImports = this.findStaleImports(dest, '@lenne.tech/nest-server');
+            const staleImports = this.findStaleImports(dest, '@lenne.tech/nest-server', 
+            // Match only real import/export/require specifiers in single/double
+            // quotes — NOT comment references like
+            // `node_modules/@lenne.tech/nest-server/...` (backticks, no keyword),
+            // which the codemod legitimately leaves untouched. A naive substring
+            // match flagged config.env.ts's JSDoc path as a false positive.
+            /(?:from|import|export|require)\s*\(?\s*['"]@lenne\.tech\/nest-server(?:\/[^'"]*)?['"]/);
             if (staleImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`⚠ ${staleImports.length} file(s) still contain '@lenne.tech/nest-server' imports after vendor conversion:`);
@@ -2341,6 +2380,177 @@ class Server {
         }
         return stale;
     }
+    /**
+     * Backfills the vendored core's transitive import closure into the
+     * project's dependencies. After vendoring, `src/core/**` imports packages
+     * that previously arrived transitively via the `@lenne.tech/nest-server`
+     * npm dependency (e.g. `cron`, `jose`, `fs-capacitor`, `graphql-ws`,
+     * `ws`). nest-server never declares these as direct deps, so the
+     * upstream-deps merge misses them — yet the vendored code imports them
+     * directly, which pnpm's isolated node_modules cannot resolve → TS2307 at
+     * build time.
+     *
+     * Scans every `.ts` file under the vendored core for bare import
+     * specifiers, drops Node builtins and already-declared packages, and adds
+     * the remainder (plus any matching `@types/*`) using EXACT versions read
+     * from the upstream `pnpm-lock.yaml`. Mutates `deps`/`devDeps` in place.
+     */
+    gatherVendorCoreImportClosure(options) {
+        const { coreDir, deps, devDeps, lockRaw, upstreamDeps, upstreamDevDeps } = options;
+        const { print } = this.toolbox;
+        const builtins = new Set(require('module').builtinModules);
+        // Compare two dotted versions numerically (major.minor.patch) — used to
+        // pick the highest when the lockfile pins multiple copies (e.g. ws 7/8).
+        const compareVersions = (a, b) => {
+            const pa = a.split('.').map((n) => parseInt(n, 10) || 0);
+            const pb = b.split('.').map((n) => parseInt(n, 10) || 0);
+            for (let i = 0; i < 3; i++) {
+                if ((pa[i] || 0) !== (pb[i] || 0)) {
+                    return (pa[i] || 0) - (pb[i] || 0);
+                }
+            }
+            return 0;
+        };
+        // Parse `<name>@<version>` keys from the lockfile's `packages:` section
+        // into a name→version map (highest version wins). pnpm-lock v9 lists
+        // every package (direct + transitive) there with a clean 2-space indent.
+        const parseLockVersions = (raw) => {
+            const map = {};
+            let inPackages = false;
+            for (const line of raw.split('\n')) {
+                if (/^packages:\s*$/.test(line)) {
+                    inPackages = true;
+                    continue;
+                }
+                if (inPackages && /^\S/.test(line)) {
+                    break; // reached the next top-level section
+                }
+                if (!inPackages) {
+                    continue;
+                }
+                const matched = line.match(/^ {2}(['"]?)(.+?)\1:\s*$/);
+                if (!matched) {
+                    continue;
+                }
+                let key = matched[2] || '';
+                const paren = key.indexOf('('); // strip pnpm peer suffix
+                if (paren >= 0) {
+                    key = key.slice(0, paren);
+                }
+                const at = key.lastIndexOf('@');
+                if (at <= 0) {
+                    continue;
+                }
+                const name = key.slice(0, at);
+                const version = key.slice(at + 1);
+                if (!/^\d/.test(version)) {
+                    continue; // ranges / non-versions
+                }
+                const current = map[name];
+                if (!current || compareVersions(version, current) > 0) {
+                    map[name] = version;
+                }
+            }
+            return map;
+        };
+        // Reduce an import specifier to its package name (or null for relative
+        // paths and Node builtins, which need no dependency entry).
+        const packageNameOf = (spec) => {
+            if (!spec || spec.startsWith('.') || spec.startsWith('/')) {
+                return null;
+            }
+            const bare = spec.startsWith('node:') ? spec.slice('node:'.length) : spec;
+            const parts = bare.split('/');
+            const name = bare.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0] || '';
+            // Drop Node builtins, the framework package itself (never a dependency
+            // of its own vendored code), and anything that is not a syntactically
+            // valid npm package name (defensive guard).
+            if (!name || builtins.has(name) || name === '@lenne.tech/nest-server') {
+                return null;
+            }
+            return /^(?:@[\w.~-]+\/)?[\w.~-]+$/.test(name) ? name : null;
+        };
+        // Collect every bare specifier imported by the vendored core. Parse the
+        // TypeScript AST (ts-morph) rather than scanning text, so that prose in
+        // comments/strings — a JSDoc `import … from '@lenne.tech/nest-server'`
+        // example, or an English `… distinguishable from "never set"` — is never
+        // mistaken for a real import (which a naive regex did).
+        const imported = new Set();
+        const { Project, SyntaxKind } = require('ts-morph');
+        const scanProject = new Project({
+            skipAddingFilesFromTsConfig: true,
+            skipFileDependencyResolution: true,
+        });
+        const sourceFiles = scanProject.addSourceFilesAtPaths(`${coreDir}/**/*.ts`);
+        for (const sourceFile of sourceFiles) {
+            // `import … from 'x'` and `export … from 'x'`
+            for (const decl of [...sourceFile.getImportDeclarations(), ...sourceFile.getExportDeclarations()]) {
+                const spec = decl.getModuleSpecifierValue();
+                const name = spec ? packageNameOf(spec) : null;
+                if (name) {
+                    imported.add(name);
+                }
+            }
+            // `import x = require('x')`
+            for (const decl of sourceFile.getDescendantsOfKind(SyntaxKind.ImportEqualsDeclaration)) {
+                const ref = decl
+                    .getModuleReference()
+                    .getText()
+                    .match(/^require\(\s*['"]([^'"]+)['"]\s*\)$/);
+                const name = ref ? packageNameOf(ref[1] || '') : null;
+                if (name) {
+                    imported.add(name);
+                }
+            }
+            // Dynamic `import('x')` / `require('x')` calls
+            for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+                const callee = call.getExpression().getText();
+                if (callee !== 'import' && callee !== 'require') {
+                    continue;
+                }
+                const arg = call.getArguments()[0];
+                if (arg && arg.getKind() === SyntaxKind.StringLiteral) {
+                    const name = packageNameOf(arg.getLiteralText());
+                    if (name) {
+                        imported.add(name);
+                    }
+                }
+            }
+        }
+        const lockVersions = parseLockVersions(lockRaw);
+        const added = [];
+        const unresolved = [];
+        for (const name of [...imported].sort()) {
+            if (name in deps || name in devDeps) {
+                continue; // already declared by the starter or the upstream merge
+            }
+            const version = lockVersions[name] || upstreamDeps[name] || upstreamDevDeps[name];
+            if (!version) {
+                unresolved.push(name);
+                continue;
+            }
+            deps[name] = version;
+            added.push(`${name}@${version}`);
+            // Add a matching @types/* (for packages that ship no own types) so the
+            // vendored core type-checks. Handles scoped names
+            // (@scope/x → @types/scope__x) too.
+            const typesName = name.startsWith('@') ? `@types/${name.slice(1).replace('/', '__')}` : `@types/${name}`;
+            if (!(typesName in deps) && !(typesName in devDeps)) {
+                const typesVersion = lockVersions[typesName] || upstreamDevDeps[typesName];
+                if (typesVersion) {
+                    devDeps[typesName] = typesVersion;
+                }
+            }
+        }
+        if (added.length > 0) {
+            print.info(`  vendored core closure: added ${added.length} transitive dep(s) → ${added.join(', ')}`);
+        }
+        if (unresolved.length > 0) {
+            print.warning(`⚠ ${unresolved.length} vendored-core import(s) could not be resolved to a version ` +
+                `(absent from the upstream lock and package.json): ${unresolved.join(', ')}. ` +
+                'Add them to projects/api/package.json manually if the build fails.');
+        }
+    }
     /**
      * Checks whether an import specifier resolves to the vendored core directory.
      * Used during vendor→npm import rewriting.

package/build/lib/codex-cli.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CODEX_MARKETPLACE_ROOT = void 0;
+exports.findCodexCli = findCodexCli;
+exports.runCodexCommand = runCodexCommand;
+/**
+ * Codex CLI utilities.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+exports.DEFAULT_CODEX_MARKETPLACE_ROOT = process.env.LT_CODEX_MARKETPLACE_ROOT || '/Users/kaihaase/code/lenneTech/codex';
+function findCodexCli() {
+    const possiblePaths = [
+        (0, path_1.join)((0, os_1.homedir)(), '.local', 'bin', 'codex'),
+        (0, path_1.join)((0, os_1.homedir)(), '.codex', 'bin', 'codex'),
+        '/usr/local/bin/codex',
+        '/opt/homebrew/bin/codex',
+        '/usr/bin/codex',
+    ];
+    for (const path of possiblePaths) {
+        if ((0, fs_1.existsSync)(path)) {
+            return path;
+        }
+    }
+    try {
+        const result = (0, child_process_1.spawnSync)('which', ['codex'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        const path = (result.stdout || '').trim();
+        if (result.status === 0 && path && (0, fs_1.existsSync)(path)) {
+            return path;
+        }
+    }
+    catch (_a) {
+        // Codex CLI not found in PATH.
+    }
+    return null;
+}
+function runCodexCommand(cli, args) {
+    try {
+        const result = (0, child_process_1.spawnSync)(cli, args, {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return {
+            output: result.stdout + result.stderr,
+            success: result.status === 0,
+        };
+    }
+    catch (err) {
+        return {
+            output: err.message,
+            success: false,
+        };
+    }
+}

package/build/lib/codex-plugin-utils.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMPTY_CODEX_PLUGIN_CONTENTS = void 0;
+exports.installCodexAgents = installCodexAgents;
+exports.installCodexPrompts = installCodexPrompts;
+exports.readCodexMarketplaceName = readCodexMarketplaceName;
+exports.readLocalCodexPluginContents = readLocalCodexPluginContents;
+/**
+ * Codex plugin setup helpers.
+ */
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const json_utils_1 = require("./json-utils");
+exports.EMPTY_CODEX_PLUGIN_CONTENTS = {
+    agents: [],
+    hooks: 0,
+    mcpServers: [],
+    prompts: [],
+    skills: [],
+};
+function installCodexAgents(pluginRoot) {
+    const sourceDir = (0, path_1.join)(pluginRoot, 'codex-agents');
+    if (!(0, fs_1.existsSync)(sourceDir)) {
+        return 0;
+    }
+    const targetDir = (0, path_1.join)((0, os_1.homedir)(), '.codex', 'agents');
+    (0, fs_1.mkdirSync)(targetDir, { recursive: true });
+    let count = 0;
+    for (const entry of (0, fs_1.readdirSync)(sourceDir, { withFileTypes: true })) {
+        if (!entry.isFile() || !entry.name.endsWith('.toml'))
+            continue;
+        (0, fs_1.copyFileSync)((0, path_1.join)(sourceDir, entry.name), (0, path_1.join)(targetDir, entry.name));
+        count += 1;
+    }
+    return count;
+}
+function installCodexPrompts(pluginRoot) {
+    const sourceDir = (0, path_1.join)(pluginRoot, 'prompts');
+    if (!(0, fs_1.existsSync)(sourceDir)) {
+        return 0;
+    }
+    const targetDir = (0, path_1.join)((0, os_1.homedir)(), '.codex', 'prompts');
+    (0, fs_1.mkdirSync)(targetDir, { recursive: true });
+    let count = 0;
+    for (const entry of (0, fs_1.readdirSync)(sourceDir, { withFileTypes: true })) {
+        if (!entry.isFile() || !entry.name.endsWith('.md'))
+            continue;
+        (0, fs_1.copyFileSync)((0, path_1.join)(sourceDir, entry.name), (0, path_1.join)(targetDir, entry.name));
+        count += 1;
+    }
+    return count;
+}
+function readCodexMarketplaceName(root) {
+    const path = (0, path_1.join)(root, '.agents', 'plugins', 'marketplace.json');
+    if (!(0, fs_1.existsSync)(path)) {
+        return null;
+    }
+    const parsed = (0, json_utils_1.safeJsonParse)((0, fs_1.readFileSync)(path, 'utf-8'));
+    return (parsed === null || parsed === void 0 ? void 0 : parsed.name) || null;
+}
+function readLocalCodexPluginContents(pluginRoot) {
+    const result = Object.assign({}, exports.EMPTY_CODEX_PLUGIN_CONTENTS);
+    const skillsDir = (0, path_1.join)(pluginRoot, 'skills');
+    if ((0, fs_1.existsSync)(skillsDir)) {
+        result.skills = (0, fs_1.readdirSync)(skillsDir, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name)
+            .sort();
+    }
+    const agentsDir = (0, path_1.join)(pluginRoot, 'codex-agents');
+    if ((0, fs_1.existsSync)(agentsDir)) {
+        result.agents = (0, fs_1.readdirSync)(agentsDir, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && entry.name.endsWith('.toml'))
+            .map((entry) => entry.name.replace(/\.toml$/, ''))
+            .sort();
+    }
+    const promptsDir = (0, path_1.join)(pluginRoot, 'prompts');
+    if ((0, fs_1.existsSync)(promptsDir)) {
+        result.prompts = (0, fs_1.readdirSync)(promptsDir, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && entry.name.endsWith('.md'))
+            .map((entry) => entry.name.replace(/\.md$/, ''))
+            .sort();
+    }
+    const hooksPath = (0, path_1.join)(pluginRoot, 'hooks', 'hooks.json');
+    if ((0, fs_1.existsSync)(hooksPath)) {
+        const parsed = (0, json_utils_1.safeJsonParse)((0, fs_1.readFileSync)(hooksPath, 'utf-8'));
+        if (parsed === null || parsed === void 0 ? void 0 : parsed.hooks) {
+            for (const groups of Object.values(parsed.hooks)) {
+                for (const group of groups) {
+                    result.hooks += Array.isArray(group.hooks) ? group.hooks.length : 0;
+                }
+            }
+        }
+    }
+    const mcpPath = (0, path_1.join)(pluginRoot, '.mcp.json');
+    if ((0, fs_1.existsSync)(mcpPath)) {
+        const parsed = (0, json_utils_1.safeJsonParse)((0, fs_1.readFileSync)(mcpPath, 'utf-8'));
+        result.mcpServers = Object.keys((parsed === null || parsed === void 0 ? void 0 : parsed.mcpServers) || {}).sort();
+    }
+    return result;
+}

package/build/lib/dev-package-manager.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pickPackageManager = pickPackageManager;
+/**
+ * Pick the package manager `lt dev` should drive for a given project dir.
+ *
+ * `lt dev up` and the related test/ticket flows used to hard-code `pnpm`
+ * for every monorepo. That breaks npm-only and yarn-only projects: a
+ * `pnpm install` invoked from inside `pnpm start` regenerates a
+ * pnpm-lock.yaml (which the project's .gitignore then refuses to track),
+ * fails on un-approved build scripts (bcrypt, sharp, esbuild) and exits
+ * non-zero — the supervised api/app processes die immediately and
+ * `lt dev status` reports them as `dead`.
+ *
+ * Detection order — highest precedence first:
+ *   1. `LT_PM_BIN` env var (generic override).
+ *   2. `LT_PNPM_BIN` env var (legacy — kept for backwards compatibility).
+ *   3. `pnpm-lock.yaml` in `cwd` → pnpm
+ *   4. `yarn.lock`       in `cwd` → yarn
+ *   5. `package-lock.json` in `cwd` → npm
+ *   6. Fallback: `pnpm` (preserves the historical default so nothing
+ *      breaks for the projects this CLI was originally written for).
+ *
+ * The detection is per-cwd so a monorepo with a pnpm api + npm app gets
+ * the correct command per component.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/**
+ * Resolve which package manager to drive for `cwd`. Pure — only filesystem
+ * existence checks, no exec. The override env vars take precedence so a
+ * CI pipeline can pin the manager without touching the lockfile.
+ *
+ * `cwd` is expected to be a project root (i.e. where the lockfile lives).
+ * For a monorepo with separate api/app dirs, call this once per dir.
+ */
+function pickPackageManager(cwd, env = process.env) {
+    const override = env.LT_PM_BIN || env.LT_PNPM_BIN;
+    if (override) {
+        return buildCommand(override, inferNameFromBin(override));
+    }
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(cwd, 'pnpm-lock.yaml'))) {
+        return buildCommand('pnpm', 'pnpm');
+    }
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(cwd, 'yarn.lock'))) {
+        return buildCommand('yarn', 'yarn');
+    }
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(cwd, 'package-lock.json'))) {
+        return buildCommand('npm', 'npm');
+    }
+    // Historical default — keep so projects without a lockfile (fresh
+    // scaffolds, vendored monorepos) behave exactly as before.
+    return buildCommand('pnpm', 'pnpm');
+}
+function buildCommand(bin, name) {
+    const isNpm = name === 'npm';
+    return {
+        bin,
+        exec(binary, args = []) {
+            // `npm exec` consumes the args before the binary name and treats
+            // anything after as its own flags unless separated by `--`. pnpm
+            // and yarn route them through unchanged. Without the separator
+            // `npm exec playwright test --shard=1/2` would parse `--shard`
+            // as an npm option, NOT a Playwright one.
+            return isNpm ? ['exec', '--', binary, ...args] : ['exec', binary, ...args];
+        },
+        installArgs: ['install'],
+        name,
+        runScript(script, extra = []) {
+            // pnpm + yarn accept the bare-script shortcut (`pnpm dev`), npm
+            // does not. Using `run <script>` is universally accepted so we
+            // route every manager through the same call.
+            return ['run', script, ...extra];
+        },
+    };
+}
+function inferNameFromBin(bin) {
+    const lower = bin.toLowerCase();
+    if (lower.endsWith('pnpm') || lower.includes('/pnpm')) {
+        return 'pnpm';
+    }
+    if (lower.endsWith('yarn') || lower.includes('/yarn')) {
+        return 'yarn';
+    }
+    if (lower.endsWith('npm') || lower.includes('/npm')) {
+        return 'npm';
+    }
+    return 'unknown';
+}

package/build/lib/dev-patches.js

@@ -127,7 +127,10 @@ function patchClaudeMd(file, options) {
     }
     else {
         const sep = content.endsWith('\n\n') ? '' : content.endsWith('\n') ? '\n' : '\n\n';
-        next = `${content}${sep}${block}\n`;
+        // No trailing newline: oxfmt strips it from .md files, so emitting one
+        // makes a freshly patched CLAUDE.md fail `format:check` (read-only) until
+        // the next `check` auto-fix. Keep the block flush with EOF.
+        next = `${content}${sep}${block}`;
     }
     if (next === content)
         return { file, patched: false, replacements: 0 };

package/build/lib/dev-test-session.js

@@ -47,6 +47,7 @@ const caddy_1 = require("./caddy");
 const dev_env_1 = require("./dev-env");
 const dev_env_bridge_1 = require("./dev-env-bridge");
 const dev_identity_1 = require("./dev-identity");
+const dev_package_manager_1 = require("./dev-package-manager");
 const dev_patches_1 = require("./dev-patches");
 const dev_process_1 = require("./dev-process");
 const dev_project_1 = require("./dev-project");
@@ -189,15 +190,17 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             dbName,
             identity: testIdentity,
         });
-        const pnpmBin = process.env.LT_PNPM_BIN || 'pnpm';
         const pids = {};
-        // --- API: compiled (`node dist`) for stability; fall back to `pnpm start`.
-        // `skipBuild` (sibling shards) reuses the dist the first shard produced. ---
+        // --- API: compiled (`node dist`) for stability; fall back to the project's
+        // own dev start script. `skipBuild` (sibling shards) reuses the dist the
+        // first shard produced. Per-component PM detection mirrors `lt dev up`:
+        // a monorepo with an npm api and a pnpm app must drive each correctly. ---
         if (layout.apiDir && apiPort) {
+            const apiPm = (0, dev_package_manager_1.pickPackageManager)(layout.apiDir);
             let build = 0;
             if (!skipBuild) {
                 log.info(log.dim('Building API (compiled, for stable long runs) …'));
-                build = yield (0, dev_process_1.runChildInherit)(pnpmBin, ['run', 'build'], { cwd: layout.apiDir, env: process.env });
+                build = yield (0, dev_process_1.runChildInherit)(apiPm.bin, apiPm.runScript('build'), { cwd: layout.apiDir, env: process.env });
             }
             const entry = ['dist/src/main.js', 'dist/main.js']
                 .map((rel) => (0, path_1.join)(layout.apiDir, rel))
@@ -212,8 +215,8 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
                 });
             }
             else {
-                log.warn('compiled API not available — falling back to `pnpm start` (ts-node).');
-                apiSpawn = (0, dev_process_1.spawnDetached)(pnpmBin, ['start'], {
+                log.warn(`compiled API not available — falling back to \`${apiPm.bin} start\` (ts-node).`);
+                apiSpawn = (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), {
                     cwd: layout.apiDir,
                     env: apiEnv,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
@@ -231,10 +234,14 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // must be a cross-subdomain DOMAIN cookie — see the project's parseCookieHeader).
         // Rebuilt every run so the suite never hits stale code (no build-skip / reuse). ---
         if (layout.appDir && appPort) {
+            const appPm = (0, dev_package_manager_1.pickPackageManager)(layout.appDir);
             let appBuild = 0;
             if (!skipBuild) {
                 log.info(log.dim('Building App (nuxt build, for speed + prod-fidelity) …'));
-                appBuild = yield (0, dev_process_1.runChildInherit)(pnpmBin, ['run', 'build'], { cwd: layout.appDir, env: devEnv.app.env });
+                appBuild = yield (0, dev_process_1.runChildInherit)(appPm.bin, appPm.runScript('build'), {
+                    cwd: layout.appDir,
+                    env: devEnv.app.env,
+                });
             }
             const appEntry = ['.output/server/index.mjs']
                 .map((rel) => (0, path_1.join)(layout.appDir, rel))
@@ -248,8 +255,8 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
                 });
             }
             else {
-                log.warn('built app not available — falling back to `pnpm dev` (slower: cold-compiles routes).');
-                appSpawn = (0, dev_process_1.spawnDetached)(pnpmBin, ['dev'], {
+                log.warn(`built app not available — falling back to \`${appPm.bin} dev\` (slower: cold-compiles routes).`);
+                appSpawn = (0, dev_process_1.spawnDetached)(appPm.bin, appPm.runScript('dev'), {
                     cwd: layout.appDir,
                     env: devEnv.app.env,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.appLog),
@@ -340,13 +347,20 @@ function runShardedTestSession(layout, baseIdentity, log, opts) {
             // every navigation) without loosening them for serial runs.
             const env = Object.assign(Object.assign({}, ctx.appEnv), { LT_DEV_TEST_SHARDS: String(total), MONGO_URI: `mongodb://127.0.0.1/${ctx.dbName}` });
             const logFile = (0, path_1.join)(layout.root, '.lt-dev', `shard.${index}.test.log`);
-            // Invoke Playwright DIRECTLY via `pnpm exec` (NOT `pnpm run test:e2e -- …`):
-            // forwarding option flags through `pnpm run`'s `--` is unreliable — pnpm
-            // passed the separator on to Playwright, which then read `--shard`/
-            // `--reporter` as file FILTERS (not options) → every shard ran the whole
-            // suite. `pnpm exec` hands args straight to the binary (mirrors CI).
-            const args = ['exec', 'playwright', 'test', `--shard=${index}/${total}`, '--reporter=line', ...opts.forwarded];
-            const code = yield (0, dev_process_1.runChildToFile)(opts.pnpmBin, args, { cwd: appDir, env, logFile });
+            // Invoke Playwright DIRECTLY via the manager's `exec` (NOT `<pm> run
+            // test:e2e -- …`): forwarding option flags through `<pm> run`'s `--`
+            // is unreliable — pnpm passed the separator on to Playwright, which
+            // then read `--shard` / `--reporter` as file FILTERS (not options) →
+            // every shard ran the whole suite. `<pm> exec` hands args straight
+            // to the binary (mirrors CI); the helper inserts `--` for npm so
+            // those flags don't get re-parsed as npm's own.
+            const args = opts.pm.exec('playwright', [
+                'test',
+                `--shard=${index}/${total}`,
+                '--reporter=line',
+                ...opts.forwarded,
+            ]);
+            const code = yield (0, dev_process_1.runChildToFile)(opts.pm.bin, args, { cwd: appDir, env, logFile });
             return { code, index, logFile };
         })));
         // Aggregate per-shard exit codes into a single result.

package/build/lib/dev-ticket.js

@@ -8,8 +8,8 @@ exports.dropDatabase = dropDatabase;
 exports.gitBranchExists = gitBranchExists;
 exports.gitFetch = gitFetch;
 exports.gitMainRepoRoot = gitMainRepoRoot;
+exports.installWorktreeDeps = installWorktreeDeps;
 exports.listWorktrees = listWorktrees;
-exports.pnpmInstall = pnpmInstall;
 exports.readTicketMarker = readTicketMarker;
 exports.resolveDevIdentity = resolveDevIdentity;
 exports.worktreeAdd = worktreeAdd;
@@ -43,6 +43,7 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const dev_identity_1 = require("./dev-identity");
+const dev_package_manager_1 = require("./dev-package-manager");
 const dev_patches_1 = require("./dev-patches");
 const dev_project_1 = require("./dev-project");
 const dev_state_1 = require("./dev-state");
@@ -183,6 +184,16 @@ function gitMainRepoRoot(cwd) {
     const commonDir = git(cwd, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
     return (0, path_1.dirname)(commonDir);
 }
+/**
+ * Install dependencies in a freshly-created worktree. Auto-detects the
+ * project's package manager from its lockfile (pnpm hard-links from the
+ * shared store → fast; npm + yarn install normally). Falls back to pnpm
+ * for fresh scaffolds without a lockfile yet.
+ */
+function installWorktreeDeps(dir) {
+    const pm = (0, dev_package_manager_1.pickPackageManager)(dir);
+    (0, child_process_1.execFileSync)(pm.bin, pm.installArgs, { cwd: dir, stdio: 'inherit' });
+}
 /** List all worktrees of the repo (parsed from `git worktree list --porcelain`). */
 function listWorktrees(repoDir) {
     let out = '';
@@ -208,11 +219,6 @@ function listWorktrees(repoDir) {
         result.push(finalizeWorktree(current));
     return result;
 }
-/** Install dependencies in a freshly-created worktree (pnpm hard-links from the shared store → fast). */
-function pnpmInstall(dir) {
-    const pnpmBin = process.env.LT_PNPM_BIN || 'pnpm';
-    (0, child_process_1.execFileSync)(pnpmBin, ['install'], { cwd: dir, stdio: 'inherit' });
-}
 /** Read the ticket id this worktree is tagged with, or null. */
 function readTicketMarker(root) {
     const file = (0, path_1.join)(root, dev_state_1.paths.sessionDir, TICKET_MARKER);

package/build/lib/vendor-claude-md.js

@@ -210,9 +210,14 @@ function upsertVendorBlock(content, marker, newBlock) {
     }
     return content.replace(blockRegex(marker), newBlock);
 }
-/** Join block lines into the canonical `marker … --- ` shape (ends with `---\n`). */
+/** Join block lines into the canonical `marker … --- ` shape (ends with `---\n\n`). */
 function block(lines) {
-    return [...lines, '', '---', ''].join('\n');
+    // Blank line AFTER the `---` too, so the prepended block is separated from
+    // the following template heading by an empty line — oxfmt requires a blank
+    // line between a thematic break and a heading, otherwise `format:check`
+    // fails on a freshly vendored CLAUDE.md. blockRegex's `---\s*\n?` absorbs
+    // the extra newline, so removeVendorBlock stays round-trip-safe.
+    return [...lines, '', '---', '', ''].join('\n');
 }
 /** Build the regex that matches an existing block from its marker to the first `---`. */
 function blockRegex(marker) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",