@lenne.tech/cli 1.38.1 → 1.40.0

package/build/commands/claude/marketplaces.js

@@ -0,0 +1,245 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const claude_cli_1 = require("../../lib/claude-cli");
+const marketplace_config_1 = require("../../lib/marketplace-config");
+/**
+ * Print the configured marketplaces.
+ */
+function printConfigured(toolbox) {
+    var _a, _b;
+    const { print: { info }, } = toolbox;
+    const configured = (0, marketplace_config_1.readConfiguredMarketplaces)();
+    info('');
+    info(`Configured marketplaces (${(0, marketplace_config_1.getMarketplaceConfigPath)()}):`);
+    if (configured.length === 0) {
+        info('  (none yet — add one with: lt claude marketplaces add)');
+        info('');
+        return;
+    }
+    for (const m of configured) {
+        const flags = [
+            m.private ? 'private' : 'public',
+            `provider=${(_a = m.provider) !== null && _a !== void 0 ? _a : 'git'}`,
+            `autoInstall=${(_b = m.autoInstall) !== null && _b !== void 0 ? _b : true}`,
+        ];
+        info(`  ${m.name}`);
+        info(`      source: ${m.source}`);
+        info(`      ${flags.join(', ')}${m.description ? ` — ${m.description}` : ''}`);
+    }
+    info('');
+}
+/**
+ * Resolve the marketplace name that a `claude plugin marketplace add` produced,
+ * by diffing the Claude registry before/after and falling back to a source match.
+ */
+function resolveAddedName(source, before) {
+    var _a, _b, _c, _d, _e, _f;
+    const known = (0, claude_cli_1.readKnownMarketplaces)();
+    const after = Object.keys(known);
+    const added = after.filter((n) => !before.includes(n));
+    if (added.length === 1) {
+        return added[0];
+    }
+    // Already present (or ambiguous): match by source (repo/url contains the input).
+    const needle = source.trim().replace(/\.git$/, '');
+    const ownerRepo = (_b = (_a = needle.match(/[:/]([^/\s]+\/[^/\s]+)$/)) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : needle;
+    for (const [name, entry] of Object.entries(known)) {
+        const src = `${(_d = (_c = entry.source) === null || _c === void 0 ? void 0 : _c.repo) !== null && _d !== void 0 ? _d : ''} ${(_f = (_e = entry.source) === null || _e === void 0 ? void 0 : _e.url) !== null && _f !== void 0 ? _f : ''}`;
+        if (src.includes(ownerRepo) || src.includes(needle)) {
+            return name;
+        }
+    }
+    return null;
+}
+/**
+ * Add (or update) a configured marketplace.
+ */
+function runAdd(toolbox, sourceArg) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { parameters, print: { error, info, spin, success }, prompt: { ask, confirm }, } = toolbox;
+        const cli = (0, claude_cli_1.findClaudeCli)();
+        if (!cli) {
+            error('Claude CLI not found. Please install Claude Code first.');
+            return;
+        }
+        // Resolve the source (Git URL or owner/repo).
+        let source = (sourceArg || parameters.options.source || '').trim();
+        if (!source) {
+            const answer = yield ask([
+                {
+                    message: 'Marketplace source (Git URL or owner/repo):',
+                    name: 'source',
+                    type: 'input',
+                },
+            ]);
+            source = (answer.source || '').trim();
+        }
+        if (!source) {
+            error('No source provided.');
+            return;
+        }
+        // Add via the Claude CLI (this clones the repo locally, honoring the user's Git
+        // access) and determine the resulting marketplace name from the registry.
+        const before = (0, claude_cli_1.listKnownMarketplaceNames)();
+        const addSpinner = spin(`Adding marketplace from ${source}`);
+        const addResult = (0, claude_cli_1.runClaudeCommand)(cli, `plugin marketplace add ${source}`);
+        if (!addResult.success && !addResult.output.includes('already')) {
+            addSpinner.fail('Failed to add marketplace');
+            error(addResult.output.trim());
+            info('');
+            info('Make sure you have access to the repository (SSH key / permissions).');
+            return;
+        }
+        const name = resolveAddedName(source, before);
+        if (!name) {
+            addSpinner.fail('Could not determine the marketplace name');
+            info('The repository was added to Claude, but its name could not be resolved.');
+            info('Check: claude plugin marketplace list');
+            return;
+        }
+        addSpinner.succeed(`Marketplace "${name}" available`);
+        // Gather options (defaults geared towards a private internal marketplace).
+        const isPrivate = yield confirm('Is this a private / access-restricted repository?', true);
+        const autoInstall = yield confirm('Auto-install all its plugins on `lt claude plugins`?', true);
+        const descAnswer = yield ask([
+            {
+                message: 'Description (optional):',
+                name: 'description',
+                type: 'input',
+            },
+        ]);
+        const entry = {
+            autoInstall,
+            name,
+            private: isPrivate,
+            provider: 'git',
+            source,
+        };
+        const description = (descAnswer.description || '').trim();
+        if (description) {
+            entry.description = description;
+        }
+        (0, marketplace_config_1.upsertConfiguredMarketplace)(entry);
+        info('');
+        success(`Saved marketplace "${name}" to ${(0, marketplace_config_1.getMarketplaceConfigPath)()}`);
+        info('It will be used automatically on the next `lt claude plugins` run.');
+    });
+}
+/**
+ * Interactive menu when no action is given.
+ */
+function runMenu(toolbox) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { prompt: { ask }, } = toolbox;
+        printConfigured(toolbox);
+        const answer = yield ask([
+            {
+                choices: ['List', 'Add', 'Remove', 'Exit'],
+                message: 'Manage Claude marketplaces',
+                name: 'action',
+                type: 'select',
+            },
+        ]);
+        switch (answer.action) {
+            case 'Add':
+                yield runAdd(toolbox);
+                break;
+            case 'List':
+                printConfigured(toolbox);
+                break;
+            case 'Remove':
+                yield runRemove(toolbox);
+                break;
+            default:
+                break;
+        }
+    });
+}
+/**
+ * Remove a configured marketplace.
+ */
+function runRemove(toolbox, nameArg) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { print: { error, info, success, warning }, prompt: { ask, confirm }, } = toolbox;
+        const configured = (0, marketplace_config_1.readConfiguredMarketplaces)();
+        if (configured.length === 0) {
+            warning('No configured marketplaces to remove.');
+            return;
+        }
+        let name = (nameArg || '').trim();
+        if (!name) {
+            const answer = yield ask([
+                {
+                    choices: configured.map((m) => m.name),
+                    message: 'Which marketplace do you want to remove?',
+                    name: 'name',
+                    type: 'select',
+                },
+            ]);
+            name = (answer.name || '').trim();
+        }
+        const { removed } = (0, marketplace_config_1.removeConfiguredMarketplace)(name);
+        if (!removed) {
+            error(`Marketplace "${name}" is not in the configuration.`);
+            return;
+        }
+        success(`Removed "${name}" from the lt configuration.`);
+        // Offer to also detach it from the Claude CLI.
+        const cli = (0, claude_cli_1.findClaudeCli)();
+        if (cli) {
+            const alsoClaude = yield confirm(`Also remove it from Claude (claude plugin marketplace remove ${name})?`, false);
+            if (alsoClaude) {
+                const result = (0, claude_cli_1.runClaudeCommand)(cli, `plugin marketplace remove ${name}`);
+                if (result.success || result.output.includes('not found')) {
+                    info(`Detached "${name}" from Claude.`);
+                }
+                else {
+                    warning(`Could not detach from Claude: ${result.output.trim()}`);
+                }
+            }
+        }
+    });
+}
+/**
+ * Manage additional Claude Code plugin marketplaces (GitLab, GitHub or any Git host).
+ * The configuration is stored locally so internal/private repositories never end
+ * up in the (public) CLI source, and it is used on every `lt claude plugins` run.
+ */
+const MarketplacesCommand = {
+    alias: ['mp'],
+    description: 'Manage additional Claude plugin marketplaces',
+    name: 'marketplaces',
+    run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        const { parameters } = toolbox;
+        const action = (parameters.first || '').toLowerCase();
+        const arg = (_a = parameters.array) === null || _a === void 0 ? void 0 : _a[1];
+        if (action === 'list' || action === 'ls' || parameters.options.list) {
+            printConfigured(toolbox);
+        }
+        else if (action === 'add' || parameters.options.add) {
+            yield runAdd(toolbox, action === 'add' ? arg : undefined);
+        }
+        else if (action === 'remove' || action === 'rm' || parameters.options.remove) {
+            const removeName = typeof parameters.options.remove === 'string' ? parameters.options.remove : arg;
+            yield runRemove(toolbox, removeName);
+        }
+        else {
+            yield runMenu(toolbox);
+        }
+        if (!parameters.options.fromGluegunMenu) {
+            process.exit(0);
+        }
+        return 'claude marketplaces';
+    }),
+};
+exports.default = MarketplacesCommand;

package/build/commands/claude/plugins.js

@@ -11,6 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 const claude_cli_1 = require("../../lib/claude-cli");
 const marketplace_1 = require("../../lib/marketplace");
+const marketplace_config_1 = require("../../lib/marketplace-config");
 const plugin_utils_1 = require("../../lib/plugin-utils");
 const shell_config_1 = require("../../lib/shell-config");
 /**
@@ -145,10 +146,10 @@ const PluginsCommand = {
             info('Installation: https://docs.anthropic.com/en/docs/claude-code');
             process.exit(1);
         }
-        // Fetch available plugins from GitHub
+        // Fetch available plugins from all marketplaces (built-in + configured)
         let availablePlugins;
         try {
-            availablePlugins = yield (0, marketplace_1.fetchAvailablePlugins)(spin);
+            availablePlugins = yield (0, marketplace_1.fetchAvailablePlugins)(spin, cli);
         }
         catch (err) {
             error(`Failed to fetch plugins: ${err.message}`);
@@ -192,8 +193,7 @@ const PluginsCommand = {
         }
         else {
             // Install all plugins from primary marketplace (lenne-tech) plus default external plugins
-            const primaryMarketplace = marketplace_1.MARKETPLACES[0].name;
-            const primaryPlugins = availablePlugins.filter((p) => p.marketplaceName === primaryMarketplace);
+            const primaryPlugins = availablePlugins.filter((p) => p.marketplaceName === marketplace_1.PRIMARY_MARKETPLACE_NAME);
             // Add default external plugins
             const externalPlugins = [];
             for (const defaultPlugin of marketplace_1.DEFAULT_EXTERNAL_PLUGINS) {
@@ -202,10 +202,23 @@ const PluginsCommand = {
                     externalPlugins.push(plugin);
                 }
             }
-            pluginsToInstall = [...primaryPlugins, ...externalPlugins];
-            if (externalPlugins.length > 0) {
-                info(`Installing ${primaryPlugins.length} plugins from ${primaryMarketplace}`);
-                info(`  + ${externalPlugins.length} default plugins: ${externalPlugins.map((p) => p.pluginName).join(', ')}`);
+            // Also install plugins from configured auto-install marketplaces (e.g. the
+            // internal one). They only appear in availablePlugins when the user has
+            // repo access, so this auto-installs them for authorized team members and
+            // is a no-op for everyone else.
+            const autoInstallNames = new Set((0, marketplace_1.getAllMarketplaces)()
+                .filter((m) => m.autoInstall && m.name !== marketplace_1.PRIMARY_MARKETPLACE_NAME)
+                .map((m) => m.name));
+            const internalPlugins = availablePlugins.filter((p) => autoInstallNames.has(p.marketplaceName));
+            pluginsToInstall = [...primaryPlugins, ...externalPlugins, ...internalPlugins];
+            if (externalPlugins.length > 0 || internalPlugins.length > 0) {
+                info(`Installing ${primaryPlugins.length} plugins from ${marketplace_1.PRIMARY_MARKETPLACE_NAME}`);
+                if (externalPlugins.length > 0) {
+                    info(`  + ${externalPlugins.length} default plugins: ${externalPlugins.map((p) => p.pluginName).join(', ')}`);
+                }
+                if (internalPlugins.length > 0) {
+                    info(`  + ${internalPlugins.length} internal plugins: ${internalPlugins.map((p) => p.pluginName).join(', ')}`);
+                }
             }
             else {
                 info(`Installing all plugins (${pluginsToInstall.length})...`);
@@ -306,6 +319,15 @@ const PluginsCommand = {
             }
         }
         info('');
+        // Remind the user that marketplaces are configurable and used on every run.
+        const configuredCount = (0, marketplace_config_1.readConfiguredMarketplaces)().length;
+        if (configuredCount > 0) {
+            info(`Tip: ${configuredCount} extra marketplace${configuredCount > 1 ? 's' : ''} configured — manage with \`lt claude marketplaces\`.`);
+        }
+        else {
+            info('Tip: Add private/internal or extra plugin marketplaces (GitLab, GitHub, any Git host) with `lt claude marketplaces`.');
+        }
+        info('');
         if (!toolbox.parameters.options.fromGluegunMenu) {
             process.exit(totalIssues > 0 ? 1 : 0);
         }

package/build/commands/dev/up.js

@@ -9,9 +9,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.help = void 0;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const caddy_1 = require("../../lib/caddy");
+const dev_api_launch_1 = require("../../lib/dev-api-launch");
 const dev_env_1 = require("../../lib/dev-env");
 const dev_env_bridge_1 = require("../../lib/dev-env-bridge");
 const dev_identity_1 = require("../../lib/dev-identity");
@@ -112,6 +114,10 @@ const UpCommand = {
         // suffixed so the stack is fully isolated from the base dev session and every
         // other ticket. Without a ticket this is the plain project identity.
         const { dbName, identity, ticket } = (0, dev_ticket_1.resolveDevIdentity)(layout, { ticket: parameters.options.ticket });
+        // `--api-compiled`: run the API compiled (`node dist`) instead of ts-node.
+        // Trades hot reload for stability — ts-node intermittently dies under browser
+        // load without a stacktrace (DEV-2525); `lt dev test` already runs compiled.
+        const apiCompiled = (0, dev_api_launch_1.isApiCompiledRequested)(parameters.options);
         // Guard against two checkouts of the SAME project (same package.json "name"
         // → same slug → shared URLs / ports / DB / Caddy block). If another checkout
         // is already RUNNING under this slug, abort with a clear message — otherwise
@@ -321,7 +327,7 @@ const UpCommand = {
         if (identity.subdomains.app)
             info(`  app: https://${identity.subdomains.app.hostname}  →  127.0.0.1:${appPort}`);
         if (identity.subdomains.api)
-            info(`  api: https://${identity.subdomains.api.hostname}  →  127.0.0.1:${apiPort}`);
+            info(`  api: https://${identity.subdomains.api.hostname}  →  127.0.0.1:${apiPort}${apiCompiled ? colors.dim('  (compiled, no hot reload)') : ''}`);
         if (identity.subdomains.api)
             info(`  db:  mongodb://127.0.0.1/${dbName}`);
         info('');
@@ -353,6 +359,11 @@ const UpCommand = {
             if (apiHealth === 'running') {
                 pids.api = existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api;
                 kept.push('api');
+                // `--api-compiled` only takes effect when the API (re)starts; a healthy API is
+                // kept as-is (force-restarting it would contradict the keep logic), so tell the
+                // user how to switch a currently-running ts-node API to compiled.
+                if (apiCompiled)
+                    info(colors.dim('  --api-compiled: API already running — `lt dev down` first to switch it.'));
             }
             else {
                 yield reclaimPort(existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api, apiPort, apiHealth !== null && apiHealth !== void 0 ? apiHealth : 'dead');
@@ -361,11 +372,20 @@ const UpCommand = {
                 // regenerate a foreign lockfile + crash on un-approved build
                 // scripts when run against an npm-only project.
                 const apiPm = (0, dev_package_manager_1.pickPackageManager)(layout.apiDir);
-                const apiResult = (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), {
-                    cwd: layout.apiDir,
-                    env: devEnv.api.env,
-                    logFile: (0, path_1.join)(layout.root, '.lt-dev', 'api.log'),
-                });
+                const apiLogFile = (0, path_1.join)(layout.root, '.lt-dev', 'api.log');
+                const apiResult = apiCompiled
+                    ? yield (0, dev_api_launch_1.startCompiledApi)({
+                        apiDir: layout.apiDir,
+                        env: devEnv.api.env,
+                        log: { info, warn: warning },
+                        logFile: apiLogFile,
+                        pm: apiPm,
+                    })
+                    : (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), {
+                        cwd: layout.apiDir,
+                        env: devEnv.api.env,
+                        logFile: apiLogFile,
+                    });
                 if (apiResult) {
                     pids.api = apiResult.pid;
                     started.push('api');
@@ -502,4 +522,28 @@ const UpCommand = {
         return `dev up: api=${pids.api}, app=${pids.app}`;
     }),
 };
-module.exports = UpCommand;
+exports.help = {
+    aliases: ['u'],
+    configuration: 'Ephemeral dev-orchestration flags — no lt.config counterpart. Override the spawn binary for both processes via the LT_PNPM_BIN env var.',
+    description: 'Start the API + App behind Caddy under stable https://<slug>.localhost URLs. Health-aware and idempotent: re-running (re)starts only the component(s) that are not truly serving.',
+    examples: ['dev up', 'dev up --api-compiled', 'dev up --ticket DEV-1234'],
+    features: [
+        'Registers a Caddy block and allocates opaque internal ports (4000+).',
+        'Spawns API + App detached; persists PIDs to <root>/.lt-dev/state.json.',
+        'Self-heals legacy hardcoded ports and restarts only the down component(s).',
+    ],
+    name: 'up',
+    options: [
+        {
+            description: 'Run the API compiled (node dist/src/main.js) instead of ts-node — trades hot reload for stability under browser load (DEV-2525). Builds + migrates first; falls back to the ts-node start if the build fails. Only applies when the API (re)starts.',
+            flag: '--api-compiled',
+            type: 'boolean',
+        },
+        {
+            description: 'Suffix the slug / URLs / DB for an isolated ticket stack (also auto-detected from a .lt-dev/ticket marker).',
+            flag: '--ticket',
+            type: 'string',
+        },
+    ],
+};
+module.exports = Object.assign(UpCommand, { help: exports.help });

package/build/lib/claude-cli.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLAUDE_MARKETPLACES_DIR = void 0;
+exports.CLAUDE_KNOWN_MARKETPLACES_PATH = exports.CLAUDE_MARKETPLACES_DIR = void 0;
 exports.checkCommandExists = checkCommandExists;
 exports.checkMarketplaceExists = checkMarketplaceExists;
 exports.findClaudeCli = findClaudeCli;
+exports.listKnownMarketplaceNames = listKnownMarketplaceNames;
+exports.readKnownMarketplaces = readKnownMarketplaces;
 exports.runClaudeCommand = runClaudeCommand;
 /**
  * Claude CLI utilities
@@ -17,6 +19,10 @@ const path_1 = require("path");
  * Path to Claude plugins marketplaces directory
  */
 exports.CLAUDE_MARKETPLACES_DIR = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'plugins', 'marketplaces');
+/**
+ * Path to the Claude CLI's registry of known marketplaces (name → source).
+ */
+exports.CLAUDE_KNOWN_MARKETPLACES_PATH = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'plugins', 'known_marketplaces.json');
 /**
  * Check if a shell command exists and succeeds
  * @param command - Command to check (e.g., 'which typescript-language-server')
@@ -64,6 +70,27 @@ function findClaudeCli() {
     }
     return null;
 }
+/**
+ * List the names of all marketplaces known to the Claude CLI.
+ * @returns Array of marketplace names
+ */
+function listKnownMarketplaceNames() {
+    return Object.keys(readKnownMarketplaces());
+}
+/**
+ * Read the Claude CLI's registry of known marketplaces.
+ * Never throws — returns an empty object when the file is missing or invalid.
+ * @returns Map of marketplace name to its registry entry
+ */
+function readKnownMarketplaces() {
+    try {
+        const parsed = JSON.parse((0, fs_1.readFileSync)(exports.CLAUDE_KNOWN_MARKETPLACES_PATH, 'utf-8'));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch (_a) {
+        return {};
+    }
+}
 /**
  * Execute a Claude CLI command
  * @param cli - Path to Claude CLI executable

package/build/lib/dev-api-launch.js

@@ -0,0 +1,89 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findCompiledEntry = findCompiledEntry;
+exports.isApiCompiledRequested = isApiCompiledRequested;
+exports.startCompiledApi = startCompiledApi;
+/**
+ * Launch strategy for the API process under `lt dev up`.
+ *
+ * By default `lt dev up` runs the API via ts-node (`<pm> run start` → nodemon →
+ * ts-node src/main.ts) for hot reload. Under a browser driving the app, that
+ * ts-node process intermittently dies WITHOUT a stacktrace (dev-SSR load plus
+ * ts-node's heavier footprint) — see DEV-2525. `lt dev test` already sidesteps
+ * this by running the API COMPILED (`node dist/src/main.js`); this module brings
+ * the same option to `lt dev up`, opt-in via `--api-compiled`. The trade-off is
+ * NO hot reload, so it stays opt-in — the caller decides stability vs. reload.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const dev_process_1 = require("./dev-process");
+/** Candidate compiled entry points, in preference order. Single-sourced so `lt dev test` agrees. */
+const COMPILED_ENTRIES = ['dist/src/main.js', 'dist/main.js'];
+/** Resolve the compiled API entry point in `apiDir`, or `undefined` if none was built. */
+function findCompiledEntry(apiDir) {
+    return COMPILED_ENTRIES.map((rel) => (0, node_path_1.join)(apiDir, rel)).find((candidate) => (0, node_fs_1.existsSync)(candidate));
+}
+/**
+ * True when the caller opted into the compiled API via `--api-compiled`.
+ *
+ * gluegun parses argv with yargs-parser and declares no booleans, so the flag
+ * arrives in several shapes: a value-less `--api-compiled` → boolean `true`, but
+ * `--api-compiled=true` → the STRING `'true'` and `--api-compiled=1` → the NUMBER
+ * `1`. A bare `=== true` check silently ignores the latter two and drops the very
+ * stability fix the user asked for. This is an ENABLE flag, so a mis-parse fails
+ * SAFE (default ts-node) — but the repo convention is to honour `true`/`'true'`
+ * too (see `dev-ticket.ts#keepDbFlag` for the destructive-flag counterpart).
+ */
+function isApiCompiledRequested(options = {}) {
+    const affirmative = (value) => value === true || ['1', 'true', 'yes'].includes(String(value).toLowerCase());
+    return affirmative(options.apiCompiled) || affirmative(options['api-compiled']);
+}
+/**
+ * Build the API and start it compiled (`node dist/src/main.js`). Applies pending
+ * migrations first for parity with the ts-node path it replaces (`<pm> run start`
+ * = `migrate:up && start:local`). Falls back to the ts-node start when the build
+ * fails or produces no dist entry, so this never leaves the developer with a dead
+ * API. Returns the detached spawn result (`undefined` when nothing was started).
+ */
+function startCompiledApi(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { apiDir, env, log, logFile, pm } = options;
+        log.info('Building API (compiled, for stability — no hot reload) …');
+        const build = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('build'), { cwd: apiDir, env });
+        const entry = findCompiledEntry(apiDir);
+        if (build === 0 && entry) {
+            if (hasScript(apiDir, 'migrate:up')) {
+                const migrate = yield (0, dev_process_1.runChildInherit)(pm.bin, pm.runScript('migrate:up'), { cwd: apiDir, env });
+                if (migrate !== 0) {
+                    // Parity with `migrate:up && start:local`: a failed migration must PREVENT the server
+                    // from starting rather than boot it against a half-migrated DB behind a "Started" banner.
+                    log.warn(`migrate:up failed (exit ${String(migrate)}) — API NOT started (would run on an un-migrated DB).`);
+                    return undefined;
+                }
+            }
+            return (0, dev_process_1.spawnDetached)('node', [entry], { cwd: apiDir, env: Object.assign(Object.assign({}, env), { NODE_ENV: 'local' }), logFile });
+        }
+        log.warn(`compiled API unavailable (build exit ${String(build)}) — falling back to \`${pm.bin} start\` (ts-node).`);
+        return (0, dev_process_1.spawnDetached)(pm.bin, pm.runScript('start'), { cwd: apiDir, env, logFile });
+    });
+}
+/** True when `package.json` in `apiDir` defines a script named `name`. */
+function hasScript(apiDir, name) {
+    var _a;
+    try {
+        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(apiDir, 'package.json'), 'utf8'));
+        return typeof ((_a = pkg.scripts) === null || _a === void 0 ? void 0 : _a[name]) === 'string';
+    }
+    catch (_b) {
+        return false;
+    }
+}

package/build/lib/dev-test-session.js

@@ -47,6 +47,7 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const caddy_1 = require("./caddy");
+const dev_api_launch_1 = require("./dev-api-launch");
 const dev_env_1 = require("./dev-env");
 const dev_env_bridge_1 = require("./dev-env-bridge");
 const dev_identity_1 = require("./dev-identity");
@@ -245,9 +246,7 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
                 log.info(log.dim('Building API (compiled, for stable long runs) …'));
                 build = yield (0, dev_process_1.runChildInherit)(apiPm.bin, apiPm.runScript('build'), { cwd: layout.apiDir, env: process.env });
             }
-            const entry = ['dist/src/main.js', 'dist/main.js']
-                .map((rel) => (0, path_1.join)(layout.apiDir, rel))
-                .find((p) => (0, fs_1.existsSync)(p));
+            const entry = (0, dev_api_launch_1.findCompiledEntry)(layout.apiDir);
             // Seed a throwaway initial admin into the fresh, isolated test DB so the
             // standard auth E2E specs run against a set-up system — locally exactly like
             // the lt-monorepo template CI. Defaults first so an explicitly inherited

package/build/lib/marketplace-config.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLtConfigDir = getLtConfigDir;
+exports.getMarketplaceConfigPath = getMarketplaceConfigPath;
+exports.readConfiguredMarketplaces = readConfiguredMarketplaces;
+exports.removeConfiguredMarketplace = removeConfiguredMarketplace;
+exports.upsertConfiguredMarketplace = upsertConfiguredMarketplace;
+exports.writeConfiguredMarketplaces = writeConfiguredMarketplaces;
+/**
+ * User-level configuration for additional Claude Code plugin marketplaces.
+ *
+ * Marketplace repositories must NOT be hard-coded in the (public) CLI source.
+ * Instead they live in a local, user-owned config file so that private/internal
+ * repositories stay confidential and any number of extra marketplaces can be
+ * added. The file is read on every `lt claude plugins` run and maintained via
+ * `lt claude marketplaces`.
+ */
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const json_utils_1 = require("./json-utils");
+/**
+ * Directory holding lenne.Tech CLI user configuration (shared with e.g. the
+ * `lt dev` Caddyfile). Resolved at call time so tests can redirect it.
+ * @returns Absolute path to the lenne.Tech config directory
+ */
+function getLtConfigDir() {
+    return process.env.LT_CONFIG_DIR || (0, path_1.join)((0, os_1.homedir)(), '.lenneTech');
+}
+/**
+ * Absolute path to the marketplace configuration file. Resolved at call time so
+ * tests can redirect it via LT_MARKETPLACE_CONFIG or LT_CONFIG_DIR.
+ * @returns Absolute path to claude-marketplaces.json
+ */
+function getMarketplaceConfigPath() {
+    return process.env.LT_MARKETPLACE_CONFIG || (0, path_1.join)(getLtConfigDir(), 'claude-marketplaces.json');
+}
+const CONFIG_VERSION = 1;
+/**
+ * Read the configured marketplaces from disk.
+ * Never throws — returns an empty array when the file is missing or invalid.
+ * @returns Array of configured marketplaces (validated, deduplicated by name)
+ */
+function readConfiguredMarketplaces() {
+    const configPath = getMarketplaceConfigPath();
+    if (!(0, fs_1.existsSync)(configPath)) {
+        return [];
+    }
+    let raw;
+    try {
+        raw = (0, fs_1.readFileSync)(configPath, 'utf-8');
+    }
+    catch (_a) {
+        return [];
+    }
+    const parsed = (0, json_utils_1.safeJsonParse)(raw);
+    if (!parsed || !Array.isArray(parsed.marketplaces)) {
+        return [];
+    }
+    // Keep only structurally valid entries and drop duplicates (first wins).
+    const seen = new Set();
+    const result = [];
+    for (const entry of parsed.marketplaces) {
+        if (!entry || typeof entry.name !== 'string' || typeof entry.source !== 'string') {
+            continue;
+        }
+        const name = entry.name.trim();
+        const source = entry.source.trim();
+        if (!name || !source || seen.has(name)) {
+            continue;
+        }
+        seen.add(name);
+        result.push(Object.assign(Object.assign({}, entry), { name, source }));
+    }
+    return result;
+}
+/**
+ * Remove a marketplace entry by name.
+ * @param name - Name of the marketplace to remove
+ * @returns Object with the updated list and whether an entry was removed
+ */
+function removeConfiguredMarketplace(name) {
+    const target = name.trim();
+    const current = readConfiguredMarketplaces();
+    const next = current.filter((m) => m.name !== target);
+    const removed = next.length !== current.length;
+    if (removed) {
+        writeConfiguredMarketplaces(next);
+    }
+    return { marketplaces: next, removed };
+}
+/**
+ * Add or update a marketplace entry (matched by name). Returns the resulting
+ * list. Existing entries with the same name are replaced.
+ * @param entry - Marketplace to add or update
+ * @returns The updated list of configured marketplaces
+ */
+function upsertConfiguredMarketplace(entry) {
+    const name = entry.name.trim();
+    const source = entry.source.trim();
+    const normalized = Object.assign(Object.assign({}, entry), { name, source });
+    const current = readConfiguredMarketplaces().filter((m) => m.name !== name);
+    current.push(normalized);
+    writeConfiguredMarketplaces(current);
+    return current;
+}
+/**
+ * Persist the given marketplaces to disk, creating the config directory if
+ * needed.
+ * @param marketplaces - Marketplaces to write
+ */
+function writeConfiguredMarketplaces(marketplaces) {
+    const configPath = getMarketplaceConfigPath();
+    const dir = (0, path_1.dirname)(configPath);
+    if (!(0, fs_1.existsSync)(dir)) {
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+    }
+    const payload = { marketplaces, version: CONFIG_VERSION };
+    (0, fs_1.writeFileSync)(configPath, `${JSON.stringify(payload, null, 2)}\n`, 'utf-8');
+}

package/build/lib/marketplace.js

@@ -9,32 +9,54 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_EXTERNAL_PLUGINS = exports.MARKETPLACES = void 0;
+exports.DEFAULT_EXTERNAL_PLUGINS = exports.PRIMARY_MARKETPLACE_NAME = exports.BUILTIN_MARKETPLACES = void 0;
+exports.configuredToMarketplaceConfig = configuredToMarketplaceConfig;
+exports.deriveGitHubRepo = deriveGitHubRepo;
 exports.fetchAvailablePlugins = fetchAvailablePlugins;
 exports.fetchPluginsFromMarketplace = fetchPluginsFromMarketplace;
+exports.getAllMarketplaces = getAllMarketplaces;
 exports.printAvailablePlugins = printAvailablePlugins;
 /**
  * Plugin marketplace utilities
- * Handles fetching and managing plugins from GitHub-based marketplaces
+ * Handles discovering and managing plugins from configurable marketplaces.
+ *
+ * Built-in marketplaces (public) are discovered via the GitHub REST API.
+ * Additional marketplaces — including private/internal ones on GitLab, GitHub or
+ * any other Git host — are NOT hard-coded here (that would expose internal repo
+ * URLs in this public package). They are loaded from the user's local config
+ * (see marketplace-config.ts) and discovered by cloning them via the Claude CLI
+ * and reading the manifest from the local checkout.
  */
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const claude_cli_1 = require("./claude-cli");
 const json_utils_1 = require("./json-utils");
+const marketplace_config_1 = require("./marketplace-config");
 /**
- * Available marketplaces for plugin discovery
+ * Built-in, public marketplaces that always ship with the CLI.
+ * Private/internal marketplaces are configured locally, never listed here.
  */
-exports.MARKETPLACES = [
+exports.BUILTIN_MARKETPLACES = [
     {
         apiBase: 'https://api.github.com/repos/lenneTech/claude-code/contents',
         name: 'lenne-tech',
+        provider: 'github',
         rawBase: 'https://raw.githubusercontent.com/lenneTech/claude-code/main',
         repo: 'lenneTech/claude-code',
     },
     {
         apiBase: 'https://api.github.com/repos/anthropics/claude-plugins-official/contents',
         name: 'claude-plugins-official',
+        provider: 'github',
         rawBase: 'https://raw.githubusercontent.com/anthropics/claude-plugins-official/main',
         repo: 'anthropics/claude-plugins-official',
     },
 ];
+/**
+ * Name of the primary marketplace whose plugins are installed by default.
+ */
+exports.PRIMARY_MARKETPLACE_NAME = exports.BUILTIN_MARKETPLACES[0].name;
 /**
  * Default plugins to install when no specific plugins are requested
  * These are installed in addition to all plugins from the primary marketplace (lenne-tech)
@@ -43,17 +65,68 @@ exports.DEFAULT_EXTERNAL_PLUGINS = [
     { marketplaceName: 'claude-plugins-official', pluginName: 'typescript-lsp' },
 ];
 /**
- * Fetch available plugins from all configured marketplaces
+ * Map a locally configured marketplace to a MarketplaceConfig used for discovery.
+ * Defaults to the provider-agnostic `git` strategy; a `github` provider derives
+ * API/raw bases from the source so it can use the fast REST discovery path.
+ * @param entry - Configured marketplace from the user config
+ * @returns Discovery configuration
+ */
+function configuredToMarketplaceConfig(entry) {
+    var _a, _b;
+    const provider = (_a = entry.provider) !== null && _a !== void 0 ? _a : 'git';
+    const base = {
+        autoInstall: (_b = entry.autoInstall) !== null && _b !== void 0 ? _b : true,
+        branch: entry.branch,
+        name: entry.name,
+        private: entry.private,
+        provider,
+        source: entry.source,
+    };
+    if (provider === 'github') {
+        const repo = deriveGitHubRepo(entry.source);
+        if (repo) {
+            const branch = entry.branch || 'main';
+            base.apiBase = `https://api.github.com/repos/${repo}/contents`;
+            base.rawBase = `https://raw.githubusercontent.com/${repo}/${branch}`;
+            base.repo = repo;
+        }
+    }
+    return base;
+}
+/**
+ * Derive an 'owner/repo' identifier from a marketplace source (github provider).
+ * Accepts 'owner/repo', an https GitHub URL or an SSH GitHub URL.
+ * @param source - Marketplace source string
+ * @returns 'owner/repo' or undefined when it is not a recognizable GitHub source
+ */
+function deriveGitHubRepo(source) {
+    const trimmed = source.trim().replace(/\.git$/, '');
+    // https://github.com/owner/repo or git@github.com:owner/repo (check first, so
+    // a host prefix like git@gitlab.example.com:… is not mistaken for owner/repo).
+    const match = trimmed.match(/github\.com[:/]([^/\s]+\/[^/\s]+)$/);
+    if (match) {
+        return match[1];
+    }
+    // Plain owner/repo — reject anything carrying URL/host syntax (@, :, /host/…).
+    if (/^[\w.-]+\/[\w.-]+$/.test(trimmed)) {
+        return trimmed;
+    }
+    return undefined;
+}
+/**
+ * Fetch available plugins from all marketplaces (built-in + configured)
  * @param spin - Spinner factory function from toolbox
+ * @param cli - Path to the Claude CLI (required to discover `git` marketplaces)
  * @returns Array of plugin configurations
  * @throws Error if no plugins are found
  */
-function fetchAvailablePlugins(spin) {
+function fetchAvailablePlugins(spin, cli) {
     return __awaiter(this, void 0, void 0, function* () {
         const spinner = spin('Fetching available plugins from marketplaces');
+        const marketplaces = getAllMarketplaces();
         try {
             // Fetch plugins from all marketplaces in parallel
-            const results = yield Promise.all(exports.MARKETPLACES.map((marketplace) => fetchPluginsFromMarketplace(marketplace)));
+            const results = yield Promise.all(marketplaces.map((marketplace) => fetchPluginsFromMarketplace(marketplace, cli)));
             // Flatten results
             const plugins = results.flat();
             if (plugins.length === 0) {
@@ -61,10 +134,12 @@ function fetchAvailablePlugins(spin) {
                 throw new Error('No plugins found');
             }
             // Group by marketplace for display
-            const byMarketplace = exports.MARKETPLACES.map((m) => ({
+            const byMarketplace = marketplaces
+                .map((m) => ({
                 count: plugins.filter((p) => p.marketplaceName === m.name).length,
                 name: m.name,
-            })).filter((m) => m.count > 0);
+            }))
+                .filter((m) => m.count > 0);
             const summary = byMarketplace.map((m) => `${m.name}: ${m.count}`).join(', ');
             spinner.succeed(`Found ${plugins.length} plugins (${summary})`);
             return plugins;
@@ -76,18 +151,71 @@ function fetchAvailablePlugins(spin) {
     });
 }
 /**
- * Fetch available plugins from a single marketplace
- * First tries central marketplace.json, then falls back to directory scan
+ * Fetch available plugins from a single marketplace, dispatching on provider.
  * @param marketplace - Marketplace configuration
+ * @param cli - Path to the Claude CLI (required for the `git` provider)
+ * @returns Array of plugin configurations
+ */
+function fetchPluginsFromMarketplace(marketplace, cli) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (marketplace.provider === 'git') {
+            return fetchPluginsFromGitMarketplace(marketplace, cli);
+        }
+        return fetchPluginsFromGitHubMarketplace(marketplace);
+    });
+}
+/**
+ * Return all marketplaces: built-in public ones plus any configured locally.
+ * @returns Combined list of marketplace configurations
+ */
+function getAllMarketplaces() {
+    const configured = (0, marketplace_config_1.readConfiguredMarketplaces)().map(configuredToMarketplaceConfig);
+    // Built-in names take precedence; drop configured entries that collide.
+    const builtinNames = new Set(exports.BUILTIN_MARKETPLACES.map((m) => m.name));
+    const extra = configured.filter((m) => !builtinNames.has(m.name));
+    return [...exports.BUILTIN_MARKETPLACES, ...extra];
+}
+/**
+ * Print available plugins list
+ * @param plugins - Array of plugin configurations
+ * @param info - Info print function from toolbox
+ */
+function printAvailablePlugins(plugins, info) {
+    info('Available plugins:');
+    for (const plugin of plugins) {
+        info(`  ${plugin.pluginName} - ${plugin.description}`);
+    }
+}
+/**
+ * Discover plugins from a `github`-provider marketplace via the GitHub REST API.
+ * First tries the central marketplace.json, then falls back to a directory scan.
+ * @param marketplace - Marketplace configuration (must have apiBase/rawBase)
  * @returns Array of plugin configurations
  */
-function fetchPluginsFromMarketplace(marketplace) {
+function fetchPluginsFromGitHubMarketplace(marketplace) {
     return __awaiter(this, void 0, void 0, function* () {
         const plugins = [];
+        if (!marketplace.apiBase || !marketplace.rawBase) {
+            return plugins;
+        }
+        const repo = marketplace.repo || marketplace.source || marketplace.name;
+        // Private marketplaces need a GitHub token. No token available → silently skip
+        // so discovery never fails for users without access.
+        const token = marketplace.private ? getGitHubToken() : undefined;
+        if (marketplace.private && !token) {
+            return plugins;
+        }
+        const authHeaders = token ? { Authorization: `Bearer ${token}` } : {};
         try {
-            // First try to read central marketplace.json (used by official marketplace)
-            const marketplaceJsonUrl = `${marketplace.rawBase}/.claude-plugin/marketplace.json`;
-            const marketplaceJsonResponse = yield fetch(marketplaceJsonUrl);
+            // First try to read central marketplace.json. Private repos: via the API
+            // contents endpoint with the raw media type (raw.githubusercontent.com does
+            // not serve private content).
+            const marketplaceJsonUrl = marketplace.private
+                ? `${marketplace.apiBase}/.claude-plugin/marketplace.json`
+                : `${marketplace.rawBase}/.claude-plugin/marketplace.json`;
+            const marketplaceJsonResponse = yield fetch(marketplaceJsonUrl, {
+                headers: marketplace.private ? Object.assign(Object.assign({}, authHeaders), { Accept: 'application/vnd.github.raw+json' }) : authHeaders,
+            });
             if (marketplaceJsonResponse.ok) {
                 const text = yield marketplaceJsonResponse.text();
                 const marketplaceManifest = (0, json_utils_1.safeJsonParse)(text);
@@ -96,7 +224,7 @@ function fetchPluginsFromMarketplace(marketplace) {
                         plugins.push({
                             description: plugin.description || '',
                             marketplaceName: marketplace.name,
-                            marketplaceRepo: marketplace.repo,
+                            marketplaceRepo: repo,
                             pluginName: plugin.name,
                         });
                     }
@@ -104,7 +232,7 @@ function fetchPluginsFromMarketplace(marketplace) {
                 }
             }
             // Fallback: Get list of plugin directories and read individual plugin.json files
-            const dirResponse = yield fetch(`${marketplace.apiBase}/plugins`);
+            const dirResponse = yield fetch(`${marketplace.apiBase}/plugins`, { headers: authHeaders });
             if (!dirResponse.ok) {
                 return plugins;
             }
@@ -117,8 +245,12 @@ function fetchPluginsFromMarketplace(marketplace) {
             // Fetch plugin.json for each plugin in parallel
             const manifestPromises = pluginDirs.map((dir) => __awaiter(this, void 0, void 0, function* () {
                 try {
-                    const manifestUrl = `${marketplace.rawBase}/plugins/${dir.name}/.claude-plugin/plugin.json`;
-                    const manifestResponse = yield fetch(manifestUrl);
+                    const manifestUrl = marketplace.private
+                        ? `${marketplace.apiBase}/plugins/${dir.name}/.claude-plugin/plugin.json`
+                        : `${marketplace.rawBase}/plugins/${dir.name}/.claude-plugin/plugin.json`;
+                    const manifestResponse = yield fetch(manifestUrl, {
+                        headers: marketplace.private ? Object.assign(Object.assign({}, authHeaders), { Accept: 'application/vnd.github.raw+json' }) : authHeaders,
+                    });
                     if (manifestResponse.ok) {
                         const manifestText = yield manifestResponse.text();
                         const manifest = (0, json_utils_1.safeJsonParse)(manifestText);
@@ -126,7 +258,7 @@ function fetchPluginsFromMarketplace(marketplace) {
                             return {
                                 description: manifest.description,
                                 marketplaceName: marketplace.name,
-                                marketplaceRepo: marketplace.repo,
+                                marketplaceRepo: repo,
                                 pluginName: manifest.name,
                             };
                         }
@@ -147,13 +279,79 @@ function fetchPluginsFromMarketplace(marketplace) {
     });
 }
 /**
- * Print available plugins list
- * @param plugins - Array of plugin configurations
- * @param info - Info print function from toolbox
+ * Discover plugins from a `git`-provider marketplace: ensure the marketplace is
+ * present locally (clone via the Claude CLI), then read its manifest from the
+ * local checkout. Requires no API token — access is governed by the user's Git
+ * permissions, so unauthorized users are skipped silently.
+ * @param marketplace - Marketplace configuration (must have a source)
+ * @param cli - Path to the Claude CLI
+ * @returns Array of plugin configurations (empty when inaccessible)
  */
-function printAvailablePlugins(plugins, info) {
-    info('Available plugins:');
-    for (const plugin of plugins) {
-        info(`  ${plugin.pluginName} - ${plugin.description}`);
+function fetchPluginsFromGitMarketplace(marketplace, cli) {
+    const plugins = [];
+    const source = marketplace.source || marketplace.repo;
+    if (!cli || !source) {
+        return plugins;
+    }
+    // Ensure the marketplace exists locally. Add it if missing; a failed add
+    // (e.g. no repo access) is treated as "skip" so discovery never hard-fails.
+    if (!(0, claude_cli_1.checkMarketplaceExists)(marketplace.name)) {
+        const addResult = (0, claude_cli_1.runClaudeCommand)(cli, `plugin marketplace add ${source}`);
+        if (!addResult.success && !addResult.output.includes('already') && !(0, claude_cli_1.checkMarketplaceExists)(marketplace.name)) {
+            return plugins;
+        }
+    }
+    else {
+        // Refresh the local cache to pick up newly published plugins (best effort).
+        (0, claude_cli_1.runClaudeCommand)(cli, `plugin marketplace update ${marketplace.name}`);
+    }
+    // Read the central manifest from the local checkout.
+    const manifestPath = (0, path_1.join)(claude_cli_1.CLAUDE_MARKETPLACES_DIR, marketplace.name, '.claude-plugin', 'marketplace.json');
+    if (!(0, fs_1.existsSync)(manifestPath)) {
+        return plugins;
+    }
+    let manifestText;
+    try {
+        manifestText = (0, fs_1.readFileSync)(manifestPath, 'utf-8');
+    }
+    catch (_a) {
+        return plugins;
+    }
+    const manifest = (0, json_utils_1.safeJsonParse)(manifestText);
+    if (!(manifest === null || manifest === void 0 ? void 0 : manifest.plugins)) {
+        return plugins;
+    }
+    for (const plugin of manifest.plugins) {
+        if (!(plugin === null || plugin === void 0 ? void 0 : plugin.name)) {
+            continue;
+        }
+        plugins.push({
+            description: plugin.description || '',
+            marketplaceName: marketplace.name,
+            marketplaceRepo: source,
+            pluginName: plugin.name,
+        });
+    }
+    return plugins;
+}
+/**
+ * Resolve a GitHub token for authenticated access to private marketplaces.
+ * Tries GH_TOKEN / GITHUB_TOKEN, then the gh CLI. Returns undefined when none is
+ * available — callers then simply skip private marketplaces (commands never fail).
+ * @returns A GitHub token or undefined
+ */
+function getGitHubToken() {
+    const fromEnv = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+    if (fromEnv) {
+        return fromEnv.trim();
+    }
+    try {
+        const fromGh = (0, child_process_1.execSync)('gh auth token', { stdio: ['ignore', 'pipe', 'ignore'] })
+            .toString()
+            .trim();
+        return fromGh || undefined;
+    }
+    catch (_a) {
+        return undefined;
     }
 }

package/docs/commands.md

@@ -433,6 +433,13 @@ lt dev up
 
 **Alias:** `lt d u`
 
+**Flags:**
+- `--api-compiled` — run the API **compiled** (`node dist/src/main.js`) instead of ts-node. Trades hot reload for stability: under sustained browser / dev-SSR load the ts-node API process intermittently dies without a stacktrace (DEV-2525); the compiled `node` process does not. Opt-in — omit it for the default ts-node hot-reload start. Details:
+  - Builds the API first, then applies pending migrations (`migrate:up`) for parity with the default `migrate:up && start:local`; a failed migration aborts the start rather than booting against a half-migrated DB.
+  - Auto-falls-back to the ts-node `start` if the build fails or produces no `dist` entry, so you never end up with a dead API.
+  - Only takes effect when the API actually (re)starts. A healthy running API is kept as-is — run `lt dev down` first to switch a live ts-node API to compiled.
+  - Accepted spellings: `--api-compiled` or `--api-compiled=true`.
+
 **Environment variables injected:**
 | Variable | Consumer | Example value |
 |----------|----------|---------------|
@@ -467,8 +474,10 @@ Behaviour:
   reclaims any orphaned listener still squatting the reused port.
 
 This is the fix for the "`status` says api running but no data loads" case: a
-crashed ts-node dev API is healed by simply re-running `lt dev up` (it does not
-fall back to compiled `node dist` — ts-node is kept so code edits hot-reload).
+crashed ts-node dev API is healed by simply re-running `lt dev up`. The **automatic**
+heal keeps ts-node (it does not silently switch to compiled `node dist`, so code
+edits still hot-reload); pass the explicit `--api-compiled` flag (see **Flags** above)
+when you deliberately want to trade hot reload for compiled stability.
 
 **Logs:** `<root>/.lt-dev/api.log`, `<root>/.lt-dev/app.log` (append-mode).
 
@@ -1812,9 +1821,10 @@ lt claude plugins [plugin-name] [options]
 **Plugin Sources:**
 - [lenne-tech marketplace](https://github.com/lenneTech/claude-code) - lenne.Tech plugins for NestJS development
 - [claude-plugins-official](https://github.com/anthropics/claude-plugins-official) - Official Anthropic plugins (e.g., typescript-lsp)
+- Additional marketplaces you configure via [`lt claude marketplaces`](#lt-claude-marketplaces) — including private/internal repositories on GitLab, GitHub or any Git host. These are read on every run and their plugins auto-installed when accessible.
 
 **Default Behavior:**
-When run without a plugin name, all lenne.Tech plugins plus recommended external plugins (like `typescript-lsp`) are installed automatically.
+When run without a plugin name, all lenne.Tech plugins plus recommended external plugins (like `typescript-lsp`) are installed automatically. Plugins from configured `autoInstall` marketplaces are added as well, but only for users who can access the underlying repository — everyone else silently skips them.
 
 **Examples:**
 ```bash
@@ -1833,6 +1843,47 @@ lt claude plugins lt-dev --uninstall
 
 ---
 
+### `lt claude marketplaces`
+
+Manages **additional** plugin marketplaces used by `lt claude plugins`. Marketplace repositories are **not** hard-coded in the CLI — they live in a local, user-owned config file (`~/.lenneTech/claude-marketplaces.json`), so private/internal repositories stay confidential and any number of extra marketplaces can be added. The config is read on every `lt claude plugins` run.
+
+**Usage:**
+```bash
+lt claude marketplaces [action] [source|name] [options]
+```
+
+**Alias:** `lt claude mp`
+
+**Actions:**
+| Action | Description |
+|--------|-------------|
+| _(none)_ | Interactive menu (list / add / remove) |
+| `list` | Show the configured marketplaces |
+| `add [source]` | Add a marketplace (Git URL or `owner/repo`); prompts for the source if omitted |
+| `remove [name]` | Remove a configured marketplace; prompts for the name if omitted |
+
+**How it works:**
+- Adding a marketplace runs `claude plugin marketplace add <source>`, which clones the repository via your existing Git access (SSH or HTTPS). The real marketplace name is read back from Claude's registry, so it always lines up with the plugin install.
+- Discovery uses the provider-agnostic `git` strategy by default: the marketplace manifest is read from the local checkout — **no API token required**.
+- **Access control is governed solely by your Git permissions.** Users without access to a private repository are skipped silently; the command never fails for them.
+
+**Examples:**
+```bash
+# Interactive management
+lt claude marketplaces
+
+# Add a marketplace (any Git host)
+lt claude marketplaces add git@gitlab.example.com:group/my-marketplace.git
+
+# List configured marketplaces
+lt claude marketplaces list
+
+# Remove one
+lt claude marketplaces remove my-marketplace
+```
+
+---
+
 ### `lt claude shortcuts`
 
 Installs Claude Code shell shortcuts (aliases) for quick access to common commands.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.38.1",
+  "version": "1.40.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",