@lenne.tech/cli 1.41.2 → 1.42.0

package/build/commands/deployment/create.js

@@ -268,7 +268,24 @@ const NewCommand = {
         info('       (an explicit node blocks the parent wildcard for names below it)');
         info('  4. Set the stage env vars in TurboOps (per stage), e.g. for production:');
         info(`       NODE_ENV=production, NSC__BASE_URL=https://api.${domain},`);
-        info('       NSC__MONGOOSE__URI, NSC__BETTER_AUTH__SECRET, NSC__AI__ENCRYPTION_SECRET,');
+        // The DB host is spelled out per stage on purpose. Every other variable in
+        // this checklist carries a concrete value; leaving this one as a bare name
+        // forces the reader to invent it, and the only reference in sight is the
+        // project's own docker-compose.yml, where the service is called `mongo`.
+        // `mongodb://mongo:27017/...` is the natural guess — and the wrong one: the
+        // short name is a Swarm alias on a network shared by every stack, so it
+        // resolves to a FOREIGN project's database (and to a different one on each
+        // connection). Symptoms are split-brain writes, sessions that vanish, and
+        // data quietly landing in someone else's MongoDB. See DEV-2140.
+        info(`       NSC__MONGOOSE__URI=mongodb://<user>:<pass>@${project}-production_mongo:27017/${project}?authSource=admin,`);
+        info(`         (dev stage: mongodb://<user>:<pass>@${project}-dev_mongo:27017/${project}?authSource=admin)`);
+        info('         NOTE: always the stack-prefixed host `<project>-<stage>_mongo`, never a bare');
+        info('         `mongo` — the short name is shared across stacks and resolves to a FOREIGN');
+        info('         database, non-deterministically per connection.');
+        info('         The stack-prefix fixes WHICH database you reach, not WHO may reach it:');
+        info('         the overlay network is shared, so the DB credentials are the actual');
+        info('         boundary. Set them in the mongo service and never deploy it open.');
+        info('       NSC__BETTER_AUTH__SECRET, NSC__AI__ENCRYPTION_SECRET,');
         if (isAngular) {
             info('       NSC__EMAIL__SMTP__*, NSC__EMAIL__DEFAULT_SENDER__EMAIL');
             info('     The Angular app needs no URL env vars — they are baked into');

package/build/commands/dev/vscode.js

@@ -0,0 +1,173 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.help = void 0;
+const vscode_settings_1 = require("../../lib/vscode-settings");
+/**
+ * Tune VS Code's USER settings for machines that keep many lt monorepos open.
+ *
+ * Each open workspace root spawns its own pair of TypeScript servers, and the
+ * "semantic" one of each pair is what actually holds the memory. Eight open
+ * monorepos (api + app root each) therefore means 16 semantic servers — enough
+ * to push a 32 GB machine deep into swap. This command applies the verified
+ * profile in `lib/vscode-settings.ts` to every detected installation.
+ *
+ * Safety properties, all load-bearing:
+ *   - JSONC-aware, so comments and formatting in a hand-maintained
+ *     settings.json survive (a JSON.parse round-trip would delete them).
+ *   - Refuses to write into a settings.json it cannot parse.
+ *   - Backs up to `settings.json.bak` before the first write.
+ *   - Merges the object-valued exclude maps, so hand-added entries are kept —
+ *     and `--revert` SUBTRACTS only those same entries again, so an undo never
+ *     takes a hand-maintained exclusion with it.
+ *   - Keeps the FIRST `.bak`, so a later run (including the revert) cannot
+ *     overwrite the record of the pre-tuning state.
+ *   - No-op on re-run.
+ *
+ * `--revert` restores VS Code's default for the scalar keys rather than any
+ * explicit value that preceded them; the `.bak` is the recovery path for those.
+ */
+const VsCodeCommand = {
+    alias: ['vsc'],
+    description: 'Tune VS Code memory settings',
+    hidden: false,
+    name: 'vscode',
+    run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
+        const { parameters, print: { colors, info }, prompt: { confirm }, } = toolbox;
+        // `--dry-run` PREVENTS a write, so it reads presence-as-intent: `--dry-run=1`
+        // must not fall through and write. `--revert` / `--explain` merely enable
+        // something, so the usual `=== true || === 'true'` is safe there.
+        const dryRun = (0, vscode_settings_1.isPreventingFlagSet)(parameters.options, 'dry-run', 'dryRun');
+        const revert = (0, vscode_settings_1.isEnablingFlagSet)(parameters.options.revert);
+        const explain = (0, vscode_settings_1.isEnablingFlagSet)(parameters.options.explain);
+        // This command writes OUTSIDE the project, into the user's global editor
+        // settings. A `defaults.noConfirm` in a repo-local `lt.config.json` — which
+        // is discovered by walking up from cwd, i.e. can come from a cloned repo —
+        // must not be able to silence that prompt. Only an explicit CLI flag does.
+        const noConfirm = (0, vscode_settings_1.isEnablingFlagSet)(parameters.options.noConfirm);
+        info('');
+        info(colors.bold(`lt dev vscode${revert ? ' --revert' : ''}${dryRun ? ' (dry run)' : ''}`));
+        info(colors.dim('─'.repeat(64)));
+        if (explain) {
+            info(colors.bold('\nProfile:'));
+            for (const [key, entry] of Object.entries(vscode_settings_1.MEMORY_PROFILE)) {
+                info(`  ${colors.cyan(key)}`);
+                info(`    ${colors.dim(entry.reason)}`);
+            }
+            info(colors.bold('\nDeliberately NOT set:'));
+            for (const item of vscode_settings_1.EXCLUDED_FROM_PROFILE) {
+                info(`  ${colors.yellow(item.key)}`);
+                info(`    ${colors.dim(item.why)}`);
+            }
+            info('');
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return 'dev vscode: explained';
+        }
+        const all = (0, vscode_settings_1.detectVariants)();
+        const { targets, unknownFilter } = (0, vscode_settings_1.selectVariants)(all, parameters.options.variant);
+        // A bare `--variant` parses to boolean `true` and matches no id. Reporting
+        // that as "no installation found" told users their editor was missing while
+        // it was installed — two different problems deserve two different messages.
+        if (unknownFilter) {
+            info(colors.yellow(`  Unknown --variant "${unknownFilter}".`));
+            info(colors.dim(`  Valid values: ${all.map((v) => v.id).join(' | ')}`));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit(1);
+            return 'dev vscode: unknown variant';
+        }
+        if (targets.length === 0) {
+            info(colors.yellow('  No VS Code installation with a user settings.json found.'));
+            info(colors.dim(`  Looked for: ${all.map((v) => v.label).join(', ')}`));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit(1);
+            return 'dev vscode: no installation found';
+        }
+        // Preview first — the user sees the exact before/after per key before
+        // anything is written.
+        let pending = 0;
+        for (const target of targets) {
+            const preview = (0, vscode_settings_1.tuneSettingsFile)(target.settingsPath, { dryRun: true, remove: revert });
+            info(`\n  ${colors.bold(target.label)} ${colors.dim(target.settingsPath)}`);
+            if (preview.error) {
+                info(`    ${colors.red('skipped')} — ${preview.error}`);
+                continue;
+            }
+            for (const change of preview.changes) {
+                info(`    ${(0, vscode_settings_1.formatChange)(change, colors)}`);
+                if (change.action !== 'unchanged')
+                    pending++;
+            }
+        }
+        if (pending === 0) {
+            info(colors.green('\n✓ already up to date — nothing to do\n'));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return 'dev vscode: no changes needed';
+        }
+        if (dryRun) {
+            info(colors.dim(`\n${pending} change(s) would be applied. Re-run without --dry-run to apply.\n`));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return `dev vscode: dry run, ${pending} pending change(s)`;
+        }
+        if (!noConfirm && !(yield confirm(`Apply ${pending} change(s)?`, true))) {
+            info(colors.dim('\nAborted — nothing written.\n'));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return 'dev vscode: aborted';
+        }
+        let applied = 0;
+        for (const target of targets) {
+            const result = (0, vscode_settings_1.tuneSettingsFile)(target.settingsPath, { remove: revert });
+            if (result.error) {
+                info(`  ${colors.red('✗')} ${target.label}: ${result.error}`);
+                continue;
+            }
+            if (!result.written)
+                continue;
+            applied += result.changes.filter((c) => c.action !== 'unchanged').length;
+            info(`  ${colors.green('✓')} ${target.label} updated ${colors.dim(`(backup: ${result.backupPath})`)}`);
+        }
+        info(colors.dim('\n  Restart VS Code (or run "Developer: Reload Window") for the TS servers to pick this up.\n'));
+        if (!parameters.options.fromGluegunMenu)
+            process.exit();
+        return `dev vscode: applied ${applied} change(s)`;
+    }),
+};
+exports.help = {
+    aliases: ['vsc'],
+    configuration: 'none (writes global editor settings — --noConfirm must be passed explicitly)',
+    description: "Apply a verified low-memory profile to VS Code's user settings. Targets the per-workspace TypeScript servers, which dominate memory when many monorepos are open at once.",
+    examples: ['dev vscode', 'dev vscode --dry-run', 'dev vscode --explain', 'dev vscode --revert'],
+    features: [
+        'JSONC-aware — preserves comments and formatting; refuses to write an unparseable file or a symlink.',
+        'Backs up to settings.json.bak (the first one is kept) and merges object-valued keys, keeping hand-added entries.',
+        'Detects VS Code, Insiders, Cursor and VSCodium; idempotent, with --revert subtracting only its own entries.',
+    ],
+    name: 'vscode',
+    options: [
+        { description: 'Show what would change without writing', flag: '--dry-run', type: 'boolean' },
+        { description: 'Remove the profile keys again', flag: '--revert', type: 'boolean' },
+        {
+            description: 'Print the profile with reasons, plus the keys deliberately left out',
+            flag: '--explain',
+            type: 'boolean',
+        },
+        {
+            description: 'Limit to one installation: code | insiders | cursor | vscodium',
+            flag: '--variant',
+            type: 'string',
+        },
+        { description: 'Skip the confirmation prompt', flag: '--noConfirm', type: 'boolean' },
+    ],
+};
+module.exports = Object.assign(VsCodeCommand, { help: exports.help });

package/build/commands/fullstack/update.js

@@ -14,6 +14,7 @@ const dev_patches_1 = require("../../lib/dev-patches");
 const framework_detection_1 = require("../../lib/framework-detection");
 const frontend_framework_detection_1 = require("../../lib/frontend-framework-detection");
 const heal_check_wrapper_1 = require("../../lib/heal-check-wrapper");
+const heal_vendor_migrate_store_1 = require("../../lib/heal-vendor-migrate-store");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 /**
  * Update a fullstack workspace — mode-aware.
@@ -208,6 +209,22 @@ const NewCommand = {
             info('');
             success('  Added `.lt-dev/` to .gitignore');
         }
+        // ── Self-heal: repair the vendor-mode migration store ──────────────────
+        //
+        // `migrations-utils/migrate.js` is written ONCE, at conversion time. Projects
+        // converted before the template stopped requiring ts-node unconditionally keep
+        // the broken file forever — it is project scaffolding, not `src/core/`, so no
+        // update path ever revisits it. Those containers die with
+        // `Cannot find module 'ts-node'` before applying a single migration, and stay
+        // healthy while doing so, because the entrypoint degrades the failure to a
+        // warning on purpose. Idempotent, and deliberately blind to stores that guard
+        // the require their own way.
+        const migrateStoreAsset = (0, path_1.join)(__dirname, '..', '..', 'templates', 'vendor-scripts', 'migrate-store.js');
+        const changedStore = (0, heal_vendor_migrate_store_1.healVendorMigrateStore)(apiDir, migrateStoreAsset);
+        if (changedStore.length > 0) {
+            info('');
+            success(`  Repaired the vendor migration store: ${changedStore.join(', ')}`);
+        }
         info('');
         info(colors.bold('For a comprehensive update of everything, use:'));
         info('');

package/build/lib/dev-test-session.js

@@ -9,15 +9,19 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TEST_INITIAL_ADMIN_ENV = void 0;
+exports.TEST_NITRO_OUTPUT_DIR = exports.TEST_NUXT_BUILD_DIR = exports.TEST_INITIAL_ADMIN_ENV = void 0;
 exports.ensurePlaywrightBrowsers = ensurePlaywrightBrowsers;
 exports.autoShardCount = autoShardCount;
 exports.bringUpTestSession = bringUpTestSession;
+exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
+exports.buildTestAppEnv = buildTestAppEnv;
 exports.hasTestSession = hasTestSession;
 exports.resolveTestSession = resolveTestSession;
 exports.runShardedTestSession = runShardedTestSession;
+exports.shardReportDir = shardReportDir;
 exports.tearDownAllTestSessions = tearDownAllTestSessions;
 exports.tearDownTestSession = tearDownTestSession;
+exports.testAppEntryCandidates = testAppEntryCandidates;
 /**
  * Ephemeral, isolated test session for `lt dev test`.
  *
@@ -101,6 +105,47 @@ exports.TEST_INITIAL_ADMIN_ENV = {
     NSC__SYSTEM_SETUP__INITIAL_ADMIN__NAME: 'CI Admin',
     NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD: 'CiThrowawayAdmin123!',
 };
+/**
+ * The Nuxt build directory the test stack's app process uses — never the one
+ * `nuxt dev` / the IDE write (`.nuxt`), never the check chain's (`.nuxt-check`).
+ *
+ * `@nuxt/cli` takes its lock ON the build directory
+ * (`acquireLock(nuxt.options.buildDir)`), so sharing it does not merely
+ * interleave writes — it makes the second command ABORT: a `lt dev test` next to
+ * a parked `lt dev up` died with "Another Nuxt dev is already running", the test
+ * app never started, and every spec then failed on a missing selector. That
+ * reads like broken specs while being pure infrastructure, which is what made it
+ * expensive to diagnose. A directory of its own frees the lock and the writes in
+ * one move.
+ *
+ * Projects whose `nuxt.config.ts` does not (yet) read `NUXT_BUILD_DIR` simply
+ * ignore it, so this needs no per-project case distinction.
+ */
+exports.TEST_NUXT_BUILD_DIR = '.nuxt-test';
+/**
+ * The Nitro OUTPUT directory the test stack builds into (DEV-2724).
+ *
+ * A second axis from `TEST_NUXT_BUILD_DIR`, not a duplicate of it: `buildDir`
+ * and Nitro's `output.dir` are unrelated knobs, so isolating the former left
+ * `.output/` shared. That matters here more than anywhere else, because this
+ * stack does not run `nuxt dev` — it serves the production bundle, rebuilding on
+ * every run, and therefore overwrites the tree a local `pnpm run build` (or a
+ * server started from it) is using.
+ *
+ * NEITHER variable is framework-native — verified against `@nuxt/schema` 4.4.8,
+ * `nitropack` 2.13.4 and `c12`: none of them reads `NUXT_BUILD_DIR` or
+ * `NITRO_OUTPUT_DIR`. Both levers are opened by the project's own
+ * `nuxt.config.ts` (`buildDir: process.env.NUXT_BUILD_DIR || '.nuxt'`,
+ * `nitro.output.dir: process.env.NITRO_OUTPUT_DIR || '.output'`); nuxt-base-starter
+ * ≥ 2.16.0 ships both. Do NOT write "unlike NUXT_BUILD_DIR, …" here: that
+ * asymmetric contrast silently promotes one of them to a framework feature and
+ * makes readers forward only the other, which reintroduces the collision this
+ * whole mechanism exists to prevent.
+ *
+ * Projects that forward neither simply keep building into `.nuxt` / `.output`,
+ * which is why `testAppEntryCandidates()` still looks there.
+ */
+exports.TEST_NITRO_OUTPUT_DIR = '.output-test';
 /**
  * Heuristic for the default local shard count (`--shard auto` / bare `--shard`).
  *
@@ -234,6 +279,11 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             dbName,
             identity: testIdentity,
         });
+        // Every app process below — the build, the built server, and the dev-server
+        // fallback — runs with THIS env, so the test stack never touches the build dir
+        // `nuxt dev` and the IDE use. Declared out here because the session context
+        // hands it to the Playwright child as well.
+        const appEnv = buildTestAppEnv(devEnv.app.env);
         const pids = {};
         // --- API: compiled (`node dist`) for stability; fall back to the project's
         // own dev start script. `skipBuild` (sibling shards) reuses the dist the
@@ -279,25 +329,41 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // buildDevEnv sets NUXT_PUBLIC_API_PROXY=false, so the built app talks
         // cross-origin to the test API exactly like prod (the injected session cookie
         // must be a cross-subdomain DOMAIN cookie — see the project's parseCookieHeader).
-        // Rebuilt every run so the suite never hits stale code (no build-skip / reuse). ---
+        // Rebuilt every run so the suite never hits stale code (no build-skip / reuse).
+        // `appEnv` pins NUXT_BUILD_DIR to its own dir, which is what lets this run next
+        // to a parked `lt dev up` at all: the Nuxt lock sits on the build dir, so the
+        // build below used to abort outright against a running dev server (DEV-2715).
+        // The fallback needs it just as much — that path IS a second `nuxt dev`.
+        // It also pins NITRO_OUTPUT_DIR (DEV-2724), so the rebuild below stops
+        // overwriting the `.output/` a local `pnpm run build` is serving — and the
+        // entry lookup moves with it, or the spawn would find nothing and drop to the
+        // slow `pnpm dev` fallback. ---
         if (layout.appDir && appPort) {
+            // The isolated build trees are new names this CLI invented, so a project
+            // whose `.gitignore` predates the starter's `.nuxt-*` / `.output-*` globs
+            // leaves them UNTRACKED — a `git add -A` away from committing a Nitro
+            // bundle (which inlines runtimeConfig defaults), and enough to make
+            // `lt ticket stop` see uncommitted work. Idempotent, like every other
+            // `addToGitignore` call.
+            (0, dev_patches_1.addToGitignore)(layout.appDir, '.nuxt-*');
+            (0, dev_patches_1.addToGitignore)(layout.appDir, '.output-*');
             const appPm = (0, dev_package_manager_1.pickPackageManager)(layout.appDir);
             let appBuild = 0;
             if (!skipBuild) {
                 log.info(log.dim('Building App (nuxt build, for speed + prod-fidelity) …'));
                 appBuild = yield (0, dev_process_1.runChildInherit)(appPm.bin, appPm.runScript('build'), {
                     cwd: layout.appDir,
-                    env: devEnv.app.env,
+                    env: appEnv,
                 });
             }
-            const appEntry = ['.output/server/index.mjs']
+            const appEntry = testAppEntryCandidates()
                 .map((rel) => (0, path_1.join)(layout.appDir, rel))
                 .find((p) => (0, fs_1.existsSync)(p));
             let appSpawn;
             if (appBuild === 0 && appEntry) {
                 appSpawn = (0, dev_process_1.spawnDetached)('node', [appEntry], {
                     cwd: layout.appDir,
-                    env: devEnv.app.env,
+                    env: appEnv,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.appLog),
                 });
             }
@@ -305,7 +371,7 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
                 log.warn(`built app not available — falling back to \`${appPm.bin} dev\` (slower: cold-compiles routes).`);
                 appSpawn = (0, dev_process_1.spawnDetached)(appPm.bin, appPm.runScript('dev'), {
                     cwd: layout.appDir,
-                    env: devEnv.app.env,
+                    env: appEnv,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.appLog),
                 });
             }
@@ -338,9 +404,62 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // Expose THIS stack's API log path so the caller can point the auth E2E specs
         // (via NEST_SERVER_LOG) at the exact isolated log — correct per shard.
         const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
-        return { apiLogPath, apiUrl, appEnv: devEnv.app.env, appUrl, dbName, pids, testIdentity };
+        return { apiLogPath, apiUrl, appEnv, appUrl, dbName, pids, testIdentity };
     });
 }
+/**
+ * Build the Playwright CLI argv + per-shard env overrides for ONE shard of a
+ * `lt dev test --shard` run.
+ *
+ * DEV-2676 — reporter handling: this path must NOT pass `--reporter`. A CLI
+ * `--reporter` REPLACES the project's whole `reporter` list from
+ * playwright.config.ts (Playwright resolves CLI-over-config, it never appends —
+ * `Runner._parseConfig` in playwright's `lib/runner/index.js` does
+ * `result.reporter = [...configOverrides.reporter]`), silently dropping any
+ * release gate a project wires in AS a reporter. SVL's DEV-2098 gate (`./tests/no-skips.reporter.ts`)
+ * turns a run RED when a spec was skipped; the old `--reporter=line` here
+ * clobbered it, so a skipped test passed with exit 0 under `--shard` — the exact
+ * hole this closes. Omitting `--reporter` lets the configured reporters run (the
+ * gate included); Playwright auto-prepends a compact `line` (local) / `dot` (CI)
+ * reporter when none of them claim stdio, so the captured per-shard log stays
+ * readable without us overriding anything.
+ *
+ * The HTML reporter is the only common config reporter that is shard-hostile:
+ * every shard shares one project dir and would write the same
+ * `playwright-report/`, racing each other's report files. We hand each shard its
+ * own HTML output dir and force `open: never` (defensive — the non-TTY,
+ * file-captured child never auto-opens a browser anyway). Both env vars are
+ * inert for a project without an HTML reporter, so the fix stays generic.
+ *
+ * Playwright is invoked via the manager's `exec` (NOT `<pm> run test:e2e -- …`):
+ * forwarding option flags through `<pm> run`'s `--` is unreliable — pnpm passed
+ * the separator on to Playwright, which then read `--shard` as a file FILTER, so
+ * every shard ran the whole suite. `exec` hands args straight to the binary
+ * (mirrors CI); the helper inserts `--` for npm so those flags survive.
+ */
+function buildShardPlaywrightInvocation(pm, shardIndex, total, forwarded, htmlReportDir) {
+    return {
+        args: pm.exec('playwright', ['test', `--shard=${shardIndex}/${total}`, ...forwarded]),
+        env: {
+            PLAYWRIGHT_HTML_OPEN: 'never',
+            PLAYWRIGHT_HTML_OUTPUT_DIR: htmlReportDir,
+        },
+    };
+}
+/**
+ * The env the test stack's APP process runs with: the isolated dev env plus its
+ * own Nuxt build dir.
+ *
+ * The pin goes LAST on purpose — unlike `TEST_INITIAL_ADMIN_ENV`, which is
+ * spread first so a deliberately inherited credential still wins. Here the
+ * isolation IS the contract: `buildDevEnv` seeds the app env from `process.env`,
+ * so a shell that exports `NUXT_BUILD_DIR` (left over from debugging a check
+ * run, say) would otherwise hand the test stack the dev — or the gate — dir
+ * straight back, and the collision returns silently.
+ */
+function buildTestAppEnv(appEnv) {
+    return Object.assign(Object.assign({}, appEnv), { NITRO_OUTPUT_DIR: exports.TEST_NITRO_OUTPUT_DIR, NUXT_BUILD_DIR: exports.TEST_NUXT_BUILD_DIR });
+}
 /** True when a test session file exists (used by status/down). */
 function hasTestSession(root) {
     return (0, dev_state_1.loadSession)(root, dev_state_1.TEST_SESSION_FILE) !== null;
@@ -396,21 +515,14 @@ function runShardedTestSession(layout, baseIdentity, log, opts) {
             // suite runs under concurrent sharded load, so it can relax navigation /
             // test timeouts (N built SSR servers + N Chromium saturate the CPU and slow
             // every navigation) without loosening them for serial runs.
-            const env = Object.assign(Object.assign(Object.assign({}, ctx.appEnv), { LT_DEV_TEST_SHARDS: String(total), MONGO_URI: `mongodb://127.0.0.1/${ctx.dbName}` }), (ctx.apiLogPath ? { NEST_SERVER_LOG: ctx.apiLogPath } : {}));
+            // Reporter + shard args come from the shared helper, which deliberately
+            // does NOT inject `--reporter` so the project's own release gate (e.g.
+            // SVL's DEV-2098 no-skips reporter) still runs under `--shard` (DEV-2676),
+            // and isolates the HTML report per shard.
+            const reportDir = shardReportDir(layout.root, index);
+            const { args, env: reporterEnv } = buildShardPlaywrightInvocation(opts.pm, index, total, opts.forwarded, reportDir);
+            const env = Object.assign(Object.assign(Object.assign(Object.assign({}, ctx.appEnv), { LT_DEV_TEST_SHARDS: String(total), MONGO_URI: `mongodb://127.0.0.1/${ctx.dbName}` }), (ctx.apiLogPath ? { NEST_SERVER_LOG: ctx.apiLogPath } : {})), reporterEnv);
             const logFile = (0, path_1.join)(layout.root, '.lt-dev', `shard.${index}.test.log`);
-            // Invoke Playwright DIRECTLY via the manager's `exec` (NOT `<pm> run
-            // test:e2e -- …`): forwarding option flags through `<pm> run`'s `--`
-            // is unreliable — pnpm passed the separator on to Playwright, which
-            // then read `--shard` / `--reporter` as file FILTERS (not options) →
-            // every shard ran the whole suite. `<pm> exec` hands args straight
-            // to the binary (mirrors CI); the helper inserts `--` for npm so
-            // those flags don't get re-parsed as npm's own.
-            const args = opts.pm.exec('playwright', [
-                'test',
-                `--shard=${index}/${total}`,
-                '--reporter=line',
-                ...opts.forwarded,
-            ]);
             const code = yield (0, dev_process_1.runChildToFile)(opts.pm.bin, args, { cwd: appDir, env, logFile });
             return { code, index, logFile };
         })));
@@ -426,6 +538,16 @@ function runShardedTestSession(layout, baseIdentity, log, opts) {
         return failed === 0 ? 0 : 1;
     });
 }
+/**
+ * The per-shard HTML report directory. Distinct per shard (the `<index>` in the
+ * path) so N shards never race on a shared `playwright-report/` — this is the
+ * actual isolation `buildShardPlaywrightInvocation`'s `PLAYWRIGHT_HTML_OUTPUT_DIR`
+ * relies on. Extracted as a pure helper so the shard-distinctness guarantee is
+ * unit-testable without booting the (deliberately untested) real orchestrator.
+ */
+function shardReportDir(root, shardIndex) {
+    return (0, path_1.join)(root, '.lt-dev', `shard.${shardIndex}.playwright-report`);
+}
 /**
  * Tear down the unsharded test stack AND every sharded stack discovered on disk
  * (`state.test.<i>.json` in `.lt-dev/`). Used by `lt dev test down` so a
@@ -497,11 +619,45 @@ function tearDownTestSession(layout_1, baseIdentity_1, log_1) {
             delete reg.projects[testIdentity.slug];
             (0, dev_state_1.saveRegistry)(reg);
         }
+        // Reclaim the isolated build trees. They exist only for this stack and are
+        // rebuilt from scratch on every run (there is no build-skip / reuse), so
+        // keeping them buys nothing and costs 37-294 MB per project — permanently,
+        // since nothing else ever removes them. Only the SUFFIXED names are touched:
+        // a project that does not forward the env vars builds into the shared
+        // `.nuxt` / `.output`, which belong to the developer's own `pnpm run build`.
+        if (layout.appDir) {
+            for (const dir of [exports.TEST_NUXT_BUILD_DIR, exports.TEST_NITRO_OUTPUT_DIR]) {
+                const path = (0, path_1.join)(layout.appDir, dir);
+                try {
+                    if ((0, fs_1.existsSync)(path)) {
+                        (0, fs_1.rmSync)(path, { force: true, recursive: true });
+                        stopped.push(`${dir}/`);
+                    }
+                }
+                catch (_a) {
+                    // Best effort — a locked build tree must not fail the teardown.
+                }
+            }
+        }
         if (!opts.silent && stopped.length > 0)
             log.info(`Stopped test stack: ${stopped.join(', ')}`);
         return { stopped };
     });
 }
+/**
+ * Where to look for the built server entry, in priority order.
+ *
+ * The isolated dir comes FIRST and that ordering is load-bearing: `.find()` takes
+ * the first hit and a stale `.output/` from an earlier local build is the normal
+ * case, so the shared path first would serve that stale bundle while the fresh
+ * build sat unused. The shared path remains as a fallback for projects whose
+ * `nuxt.config.ts` does not forward `NITRO_OUTPUT_DIR` yet — without it they
+ * would find no entry at all and drop to the slow `pnpm dev` fallback, which is
+ * a second `nuxt dev` and re-takes the build-dir lock DEV-2715 just freed.
+ */
+function testAppEntryCandidates() {
+    return [`${exports.TEST_NITRO_OUTPUT_DIR}/server/index.mjs`, '.output/server/index.mjs'];
+}
 /**
  * Resolve the per-stack file/identity names. For a sharded run (`shardIndex`
  * given) everything gets a `.<i>` / `-<i>` suffix so N stacks coexist without

package/build/lib/dev-ticket.js

@@ -587,8 +587,23 @@ function runWithProjectDriver(driverPaths, action, env) {
         return { outcome: 'failed', stdout: '' };
     }
 }
-/** Framework-generated / ephemeral paths a dev/build run dirties (never real work). */
-const GENERATED_PATHS = /(^|\/)(\.nuxtrc|\.nuxt|\.nitro|\.output|dist|\.turbo|\.cache|\.eslintcache)(\/|$)|\.tsbuildinfo$/;
+/**
+ * Framework-generated / ephemeral paths a dev/build run dirties (never real work).
+ *
+ * `.nuxt` and `.output` carry an optional `-<suffix>`: the build directory is no
+ * longer a single well-known name. The check chain builds into `.nuxt-check` and
+ * `lt dev test` into `.nuxt-test` / `.output-test`, precisely so they do not
+ * collide with a parked `nuxt dev` (the Nuxt lock sits on the build dir).
+ *
+ * Without the suffix these read as REAL developer work — a glob segment matches
+ * whole segments, so `.nuxt` never covered `.nuxt-test` — and
+ * `worktreeSafetyReport` then classifies a 300 MB build tree as uncommitted
+ * work, making `lt ticket stop` REFUSE to remove the worktree over files the
+ * developer never wrote. Only projects whose app `.gitignore` predates the
+ * starter's `.nuxt-*` globs are affected, but that is exactly the population the
+ * rest of this CLI's heal machinery exists to serve.
+ */
+const GENERATED_PATHS = /(^|\/)(\.nuxtrc|\.nuxt(-[\w.]+)?|\.nitro|\.output(-[\w.]+)?|dist|\.turbo|\.cache|\.eslintcache)(\/|$)|\.tsbuildinfo$/;
 /** The three git-tracked configs `lt dev up` self-heals to be env-aware. */
 const LT_DEV_MANAGED_CONFIG = /(?:^|\/)(?:config\.env\.ts|nuxt\.config\.ts|playwright\.config\.ts)$/;
 /**