@lenne.tech/cli 1.41.0 → 1.41.2

package/build/extensions/frontend-helper.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
+const strip_comments_1 = require("../lib/strip-comments");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Frontend helper functions for project scaffolding
@@ -813,7 +814,11 @@ class FrontendHelper {
         for (const absFile of allFiles) {
             if (skipPathContaining && absFile.includes(skipPathContaining))
                 continue;
-            const content = filesystem.read(absFile) || '';
+            // Strip comments first — a docblock that DOCUMENTS the conversion legitimately quotes the
+            // very import syntax this looks for, and would otherwise be reported as a file the user has
+            // to fix by hand. Same false-positive class that hit the backend detector on
+            // nest-server-starter's bootstrap-diagnostics.spec.ts.
+            const content = (0, strip_comments_1.stripComments)(filesystem.read(absFile) || '');
             const matches = typeof needle === 'string' ? content.includes(needle) : needle.test(content);
             if (matches) {
                 stale.push(absFile.replace(`${appDir}/`, ''));

package/build/extensions/server.js

@@ -48,6 +48,7 @@ const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
+const strip_comments_1 = require("../lib/strip-comments");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Server helper functions
@@ -2494,7 +2495,14 @@ class Server {
                 recursive: true,
             }) || [];
             for (const file of files) {
-                const content = this.filesystem.read(file) || '';
+                const raw = this.filesystem.read(file) || '';
+                // Strip comments before matching. The keyword-anchored pattern is not enough on its own:
+                // a docblock that DOCUMENTS the conversion legitimately quotes the very syntax it looks
+                // for — nest-server-starter's `tests/unit/bootstrap-diagnostics.spec.ts` contains
+                // "rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path", which matched
+                // and told the user to rewrite imports that file does not have. A detector that reads
+                // comments as code produces false alarms on exactly the files that explain it best.
+                const content = (0, strip_comments_1.stripComments)(raw);
                 if (pattern ? pattern.test(content) : content.includes(needle)) {
                     stale.push(file.replace(`${dest}/`, ''));
                 }

package/build/lib/dev-patches.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addToGitignore = addToGitignore;
 exports.autoPatch = autoPatch;
+exports.canonicaliseBridgeSpan = canonicaliseBridgeSpan;
 exports.patchApiConfig = patchApiConfig;
 exports.patchClaudeMd = patchClaudeMd;
 exports.patchNuxtConfig = patchNuxtConfig;
@@ -13,10 +14,33 @@ exports.patchPlaywrightConfig = patchPlaywrightConfig;
  * defaults and make it env-aware so it can be served behind Caddy
  * under `https://<slug>.localhost`.
  *
- * Each patch is a regex-based replace that matches only the legacy
- * form. Already-patched files are no-ops.
+ * Most patches are regex-based replaces that match only the legacy
+ * form; the marker-bracketed `lt-dev:bridge` block in
+ * playwright.config.ts is located by its markers instead. Already-patched
+ * files are no-ops — including when the consumer's own formatter has since
+ * restyled an injected block: that block is compared SEMANTICALLY (see
+ * `BRIDGE_VERSION` / `normaliseBridgeBlock`), not byte-for-byte.
  */
 const fs_1 = require("fs");
+/**
+ * Version of the `lt-dev:bridge` block emitted into a consumer's
+ * `playwright.config.ts`. It travels IN the markers
+ * (`// >>> lt-dev:bridge v2 >>>`), which is what makes a genuine upgrade
+ * detectable independently of formatting.
+ *
+ * **Bump this on every change to `bridgeBlock`** — including a
+ * formatting-only one. The content comparison deliberately ignores quote
+ * style and whitespace (the consumer's formatter owns that file), so
+ * without a bump a cosmetic fix would never reach already-patched
+ * projects. That is exactly what happened to 1.32.1's `"utf8"` → `'utf8'`
+ * fix, which is why the version exists.
+ */
+const BRIDGE_VERSION = 2;
+/** Matches any bridge marker, versioned or not — v1 shipped without one. */
+const BRIDGE_START_RE = /\/\/ >>> lt-dev:bridge(?: v(\d+))? >>>/;
+const BRIDGE_END_RE = /\/\/ <<< lt-dev:bridge(?: v(\d+))? <<</;
+/** Imports the bridge block owns; a stray copy outside it must be dropped. */
+const BRIDGE_IMPORT_RE = /^\s*import \{[^}]*__ltDev(?:Exists|Read|Dirname|Resolve)[^}]*\} from '[^']*';?\s*$/gm;
 /** Append entry to .gitignore if not already present. */
 function addToGitignore(root, entry) {
     const path = `${root}/.gitignore`;
@@ -40,6 +64,29 @@ function autoPatch(file) {
         return patchPlaywrightConfig(file);
     return { file, patched: false, replacements: 0 };
 }
+/**
+ * Replace the `lt-dev:bridge` span inside a whole file with its canonical
+ * comparison form, leaving every other byte untouched.
+ *
+ * For callers that must decide "is this file exactly what `autoPatch` would
+ * produce, or did a developer edit it?" — most importantly
+ * `dev-ticket.ts#isPristineLtDevPatch`, which gates whether `lt ticket stop`
+ * may discard a dirty config. Since the patcher deliberately tolerates the
+ * consumer formatter restyling the block, such a comparison MUST tolerate it
+ * too; otherwise a formatter-touched config reads as real developer work and
+ * the worktree removal is refused.
+ *
+ * Everything outside the markers stays byte-exact on purpose — being lenient
+ * there could let genuine work be silently discarded.
+ */
+function canonicaliseBridgeSpan(content) {
+    const start = BRIDGE_START_RE.exec(content);
+    const end = BRIDGE_END_RE.exec(content);
+    if (!start || !end || end.index <= start.index)
+        return content;
+    const endsAt = end.index + end[0].length;
+    return (content.slice(0, start.index) + normaliseBridgeBlock(content.slice(start.index, endsAt)) + content.slice(endsAt));
+}
 /**
  * API: make the server listen port honour `process.env.PORT` (injected by
  * `lt dev up` for its Caddy upstream). Handles two patterns found in
@@ -164,8 +211,12 @@ function patchNuxtConfig(file) {
  * any env.
  *
  * Patches applied (each idempotent):
- *   1. Top-of-file: `if (existsSync('.lt-dev/.env')) loadEnv(...)` block,
- *      bracketed by `// >>> lt-dev:bridge >>>` markers.
+ *   1. Top-of-file: a dotenv loader that searches UP from cwd for
+ *      `.lt-dev/.env`, bracketed by `// >>> lt-dev:bridge vN >>>` markers.
+ *      Re-injected when the marker's version differs from `BRIDGE_VERSION`
+ *      (a genuine upgrade) or when the block's CODE differs semantically
+ *      (tampering / corruption) — but NOT when the consumer's formatter
+ *      merely restyled it, which owns this file and must stay free to.
  *   2. Hardcoded baseURL/host/url for `http://localhost:3001` →
  *      `process.env.NUXT_PUBLIC_SITE_URL || 'http://localhost:3001'`.
  *   3. `webServer` wrapped in an `LT_DEV_ACTIVE` guard so Playwright reuses
@@ -180,6 +231,7 @@ function patchNuxtConfig(file) {
  *   6. `slowMo: 10` → `0` (pointless per-action delay, multiplied across shards).
  */
 function patchPlaywrightConfig(file) {
+    var _a;
     if (!(0, fs_1.existsSync)(file))
         return { file, patched: false, replacements: 0 };
     const before = (0, fs_1.readFileSync)(file, 'utf8');
@@ -198,8 +250,8 @@ function patchPlaywrightConfig(file) {
     //    a direct `playwright test` run) usually sit in `projects/app`. The
     //    original cwd-only resolve missed it, so direct runs fell back to
     //    `localhost:3001` and could collide with a parallel project.
-    const bridgeStart = '// >>> lt-dev:bridge >>>';
-    const bridgeEnd = '// <<< lt-dev:bridge <<<';
+    const bridgeStart = `// >>> lt-dev:bridge v${BRIDGE_VERSION} >>>`;
+    const bridgeEnd = `// <<< lt-dev:bridge v${BRIDGE_VERSION} <<<`;
     const bridgeBlock = [
         bridgeStart,
         '// Auto-load <root>/.lt-dev/.env when `lt dev up` is active so',
@@ -228,16 +280,47 @@ function patchPlaywrightConfig(file) {
         '}',
         bridgeEnd,
     ].join('\n');
-    const bridgeStartIdx = after.indexOf(bridgeStart);
-    const bridgeEndIdx = after.indexOf(bridgeEnd);
-    if (bridgeStartIdx === -1) {
+    // Locate ANY bridge marker, versioned or not — v1 shipped unversioned and
+    // must still be recognised (and upgraded) rather than double-injected.
+    const startMatch = BRIDGE_START_RE.exec(after);
+    const endMatch = BRIDGE_END_RE.exec(after);
+    const bridgeStartIdx = startMatch ? startMatch.index : -1;
+    const bridgeEndIdx = endMatch ? endMatch.index : -1;
+    // A start marker without a well-ordered end marker is a corrupted block: the
+    // slice arithmetic below would duplicate everything between the two (and the
+    // user's code with it). `patchClaudeMd` already guards its span this way.
+    const spanIsSane = bridgeStartIdx !== -1 && bridgeEndIdx > bridgeStartIdx;
+    if (bridgeStartIdx === -1 || !spanIsSane) {
+        // Markers present but unusable (e.g. reversed). Strip the STRAY MARKERS
+        // ONLY — never the text between them: with the markers out of order that
+        // text is the user's own code, not our block, so slicing the span out
+        // would delete their work (and slicing it in would duplicate it).
+        if (!spanIsSane)
+            after = after.replace(BRIDGE_START_RE, '').replace(BRIDGE_END_RE, '');
+        // A formatter with organize-imports may have hoisted the block's imports
+        // out of the markers; leaving them behind would duplicate the `__ltDev*`
+        // bindings and break the consumer's config with a duplicate-identifier
+        // error. They are ours to own, so it is safe to drop them.
+        after = after.replace(BRIDGE_IMPORT_RE, '').replace(/^\n+/, '');
         after = `${bridgeBlock}\n${after}`;
         count++;
     }
-    else if (bridgeEndIdx !== -1) {
-        const rebuilt = after.slice(0, bridgeStartIdx) + bridgeBlock + after.slice(bridgeEndIdx + bridgeEnd.length);
-        if (rebuilt !== after) {
-            after = rebuilt;
+    else {
+        const existing = after.slice(bridgeStartIdx, bridgeEndIdx + endMatch[0].length);
+        // Two independent reasons to re-inject:
+        //  (a) VERSION — the marker carries the block's version, so a genuine
+        //      upgrade is detected regardless of how the consumer formatted it.
+        //      This is what keeps formatting-only fixes shippable (see
+        //      BRIDGE_VERSION); an unversioned v1 marker yields `undefined` here.
+        //  (b) CODE — the block's code differs semantically, i.e. it was tampered
+        //      with or corrupted. Cosmetic reformatting by the consumer's own
+        //      formatter is deliberately NOT a reason: rewriting it back on every
+        //      run is what used to leave playwright.config.ts permanently dirty in
+        //      the working tree, with formatter and patcher flipping it forever.
+        const existingVersion = Number((_a = startMatch[1]) !== null && _a !== void 0 ? _a : 0);
+        if (existingVersion !== BRIDGE_VERSION || normaliseBridgeBlock(existing) !== normaliseBridgeBlock(bridgeBlock)) {
+            const head = after.slice(0, bridgeStartIdx).replace(BRIDGE_IMPORT_RE, '');
+            after = head + bridgeBlock + after.slice(bridgeEndIdx + endMatch[0].length);
             count++;
         }
     }
@@ -307,3 +390,30 @@ function patchPlaywrightConfig(file) {
     (0, fs_1.writeFileSync)(file, after, 'utf8');
     return { file, patched: true, replacements: count };
 }
+/**
+ * Canonical form of a bridge block for comparison purposes.
+ *
+ * Compares only the CODE: comment lines are dropped entirely, so rewording
+ * a comment never triggers a rewrite — and, crucially, code that a reflow
+ * folded behind a `//` VANISHES from the comparison and is therefore
+ * detected as changed. A plain `\s+ → ' '` collapse would erase newlines
+ * instead, which makes a fully commented-out (inert) loader normalise
+ * identically to a live one: the block would silently never load
+ * `.lt-dev/.env` again and Playwright would fall back to `localhost:3001`.
+ *
+ * Quote style and intra-line whitespace are normalised away because the
+ * consumer's formatter owns this file (which direction it flips is
+ * project-specific — do not assume). Blind spot to keep in mind: a change
+ * that differs ONLY in quotes or whitespace is invisible here, which is
+ * what `BRIDGE_VERSION` is for.
+ */
+function normaliseBridgeBlock(s) {
+    return s
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l !== '' && !l.startsWith('//'))
+        .join(' ')
+        .replace(/['"]/g, '"')
+        .replace(/\s+/g, ' ')
+        .trim();
+}

package/build/lib/dev-ticket.js

@@ -824,7 +824,17 @@ function isPristineLtDevPatch(worktreePath, relPath) {
     try {
         (0, fs_1.writeFileSync)(tmp, head, 'utf8');
         (0, dev_patches_1.autoPatch)(tmp);
-        return (0, fs_1.readFileSync)(tmp, 'utf8') === current;
+        const derived = (0, fs_1.readFileSync)(tmp, 'utf8');
+        if (derived === current)
+            return true;
+        // The patcher deliberately lets the consumer's formatter restyle the
+        // injected `lt-dev:bridge` block (quote style, wrapping) without rewriting
+        // it — so a byte-exact comparison would classify a merely reformatted
+        // playwright.config.ts as real developer work and make `lt ticket stop`
+        // refuse to remove the worktree. Compare the bridge span in its canonical
+        // form; everything OUTSIDE the markers stays byte-exact, so genuine edits
+        // are still never auto-discarded.
+        return (0, dev_patches_1.canonicaliseBridgeSpan)(derived) === (0, dev_patches_1.canonicaliseBridgeSpan)(current);
     }
     catch (_c) {
         return false;

package/build/lib/strip-comments.js

@@ -0,0 +1,78 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripComments = stripComments;
+const ts = __importStar(require("typescript"));
+/**
+ * Removes comments from TypeScript/JavaScript source, preserving everything else verbatim.
+ *
+ * Exists because detectors that search source for import specifiers must not read comments as
+ * code. A keyword-anchored regex is not sufficient on its own: a docblock that DOCUMENTS an import
+ * rewrite legitimately quotes the exact syntax the detector looks for. nest-server-starter's
+ * `tests/unit/bootstrap-diagnostics.spec.ts` contains
+ *
+ *   * CLI's vendor conversion rewrites `from '@lenne.tech/nest-server'` to a relative `./core` path
+ *
+ * which matched `/(?:from|import|…)\s*['"]@lenne\.tech\/nest-server['"]/` and made
+ * `lt fullstack init --framework-mode vendor` warn about imports that file does not have.
+ *
+ * Uses the TypeScript scanner rather than a regex, so string literals, template literals and
+ * regex literals containing `//` or `/*` are handled correctly by construction — a hand-rolled
+ * stripper trips over `'https://…'` and over `/* ` inside a string.
+ *
+ * Comment characters are replaced with spaces instead of being deleted, so byte offsets and line
+ * numbers of the surrounding code stay unchanged — a caller can still report a meaningful
+ * position from a match.
+ *
+ * @param source - TypeScript or JavaScript source text
+ * @returns The source with every comment blanked out
+ *
+ * @example
+ * stripComments("// from 'pkg'\nimport x from 'pkg';")
+ * // => "             \nimport x from 'pkg';"
+ */
+function stripComments(source) {
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, /* skipTrivia */ false, ts.LanguageVariant.Standard, source);
+    let result = '';
+    let token = scanner.scan();
+    while (token !== ts.SyntaxKind.EndOfFileToken) {
+        const text = scanner.getTokenText();
+        const isComment = token === ts.SyntaxKind.SingleLineCommentTrivia || token === ts.SyntaxKind.MultiLineCommentTrivia;
+        // Keep newlines so line numbers survive; blank everything else in the comment.
+        result += isComment ? text.replace(/[^\n]/g, ' ') : text;
+        token = scanner.scan();
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.41.0",
+  "version": "1.41.2",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -46,14 +46,10 @@
     "start:build": "npm run build && node bin/lt --compiled-build",
     "start:compiled": "node bin/lt --compiled-build",
     "test": "jest --testTimeout=60000",
-    "watch": "jest --watch",
-    "release": "standard-version && git push --follow-tags origin main",
-    "release:minor": "standard-version --release-as minor && git push --follow-tags origin main",
-    "release:major": "standard-version --release-as major && git push --follow-tags origin main"
+    "watch": "jest --watch"
   },
   "files": [
     "tsconfig.json",
-    "tslint.json",
     "build",
     "LICENSE",
     "README.md",
@@ -96,14 +92,19 @@
     "jest": "30.4.2",
     "prettier": "3.8.3",
     "rimraf": "6.1.3",
-    "standard-version": "9.5.0",
     "ts-jest": "29.4.11"
   },
   "//overrides": {
-    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep."
+    "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
+    "brace-expansion@<1.1.16": "DoS via exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high). Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude > minimatch. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
+    "brace-expansion@>=2.0.0 <2.1.2": "Same advisory, 2.x line.",
+    "brace-expansion@>=5.0.0 <5.0.7": "Same advisory, 5.x line. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors."
   },
   "overrides": {
-    "semver@*": "7.8.5"
+    "semver@*": "7.8.5",
+    "brace-expansion@<1.1.16": "1.1.16",
+    "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+    "brace-expansion@>=5.0.0 <5.0.7": "5.0.7"
   },
   "jest": {
     "testEnvironment": "node",