@lenne.tech/cli 1.41.3 → 1.43.0

package/build/commands/deployment/create.js

@@ -268,7 +268,24 @@ const NewCommand = {
         info('       (an explicit node blocks the parent wildcard for names below it)');
         info('  4. Set the stage env vars in TurboOps (per stage), e.g. for production:');
         info(`       NODE_ENV=production, NSC__BASE_URL=https://api.${domain},`);
-        info('       NSC__MONGOOSE__URI, NSC__BETTER_AUTH__SECRET, NSC__AI__ENCRYPTION_SECRET,');
+        // The DB host is spelled out per stage on purpose. Every other variable in
+        // this checklist carries a concrete value; leaving this one as a bare name
+        // forces the reader to invent it, and the only reference in sight is the
+        // project's own docker-compose.yml, where the service is called `mongo`.
+        // `mongodb://mongo:27017/...` is the natural guess — and the wrong one: the
+        // short name is a Swarm alias on a network shared by every stack, so it
+        // resolves to a FOREIGN project's database (and to a different one on each
+        // connection). Symptoms are split-brain writes, sessions that vanish, and
+        // data quietly landing in someone else's MongoDB. See DEV-2140.
+        info(`       NSC__MONGOOSE__URI=mongodb://<user>:<pass>@${project}-production_mongo:27017/${project}?authSource=admin,`);
+        info(`         (dev stage: mongodb://<user>:<pass>@${project}-dev_mongo:27017/${project}?authSource=admin)`);
+        info('         NOTE: always the stack-prefixed host `<project>-<stage>_mongo`, never a bare');
+        info('         `mongo` — the short name is shared across stacks and resolves to a FOREIGN');
+        info('         database, non-deterministically per connection.');
+        info('         The stack-prefix fixes WHICH database you reach, not WHO may reach it:');
+        info('         the overlay network is shared, so the DB credentials are the actual');
+        info('         boundary. Set them in the mongo service and never deploy it open.');
+        info('       NSC__BETTER_AUTH__SECRET, NSC__AI__ENCRYPTION_SECRET,');
         if (isAngular) {
             info('       NSC__EMAIL__SMTP__*, NSC__EMAIL__DEFAULT_SENDER__EMAIL');
             info('     The Angular app needs no URL env vars — they are baked into');

package/build/commands/dev/vscode.js

@@ -0,0 +1,173 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.help = void 0;
+const vscode_settings_1 = require("../../lib/vscode-settings");
+/**
+ * Tune VS Code's USER settings for machines that keep many lt monorepos open.
+ *
+ * Each open workspace root spawns its own pair of TypeScript servers, and the
+ * "semantic" one of each pair is what actually holds the memory. Eight open
+ * monorepos (api + app root each) therefore means 16 semantic servers — enough
+ * to push a 32 GB machine deep into swap. This command applies the verified
+ * profile in `lib/vscode-settings.ts` to every detected installation.
+ *
+ * Safety properties, all load-bearing:
+ *   - JSONC-aware, so comments and formatting in a hand-maintained
+ *     settings.json survive (a JSON.parse round-trip would delete them).
+ *   - Refuses to write into a settings.json it cannot parse.
+ *   - Backs up to `settings.json.bak` before the first write.
+ *   - Merges the object-valued exclude maps, so hand-added entries are kept —
+ *     and `--revert` SUBTRACTS only those same entries again, so an undo never
+ *     takes a hand-maintained exclusion with it.
+ *   - Keeps the FIRST `.bak`, so a later run (including the revert) cannot
+ *     overwrite the record of the pre-tuning state.
+ *   - No-op on re-run.
+ *
+ * `--revert` restores VS Code's default for the scalar keys rather than any
+ * explicit value that preceded them; the `.bak` is the recovery path for those.
+ */
+const VsCodeCommand = {
+    alias: ['vsc'],
+    description: 'Tune VS Code memory settings',
+    hidden: false,
+    name: 'vscode',
+    run: (toolbox) => __awaiter(void 0, void 0, void 0, function* () {
+        const { parameters, print: { colors, info }, prompt: { confirm }, } = toolbox;
+        // `--dry-run` PREVENTS a write, so it reads presence-as-intent: `--dry-run=1`
+        // must not fall through and write. `--revert` / `--explain` merely enable
+        // something, so the usual `=== true || === 'true'` is safe there.
+        const dryRun = (0, vscode_settings_1.isPreventingFlagSet)(parameters.options, 'dry-run', 'dryRun');
+        const revert = (0, vscode_settings_1.isEnablingFlagSet)(parameters.options.revert);
+        const explain = (0, vscode_settings_1.isEnablingFlagSet)(parameters.options.explain);
+        // This command writes OUTSIDE the project, into the user's global editor
+        // settings. A `defaults.noConfirm` in a repo-local `lt.config.json` — which
+        // is discovered by walking up from cwd, i.e. can come from a cloned repo —
+        // must not be able to silence that prompt. Only an explicit CLI flag does.
+        const noConfirm = (0, vscode_settings_1.isEnablingFlagSet)(parameters.options.noConfirm);
+        info('');
+        info(colors.bold(`lt dev vscode${revert ? ' --revert' : ''}${dryRun ? ' (dry run)' : ''}`));
+        info(colors.dim('─'.repeat(64)));
+        if (explain) {
+            info(colors.bold('\nProfile:'));
+            for (const [key, entry] of Object.entries(vscode_settings_1.MEMORY_PROFILE)) {
+                info(`  ${colors.cyan(key)}`);
+                info(`    ${colors.dim(entry.reason)}`);
+            }
+            info(colors.bold('\nDeliberately NOT set:'));
+            for (const item of vscode_settings_1.EXCLUDED_FROM_PROFILE) {
+                info(`  ${colors.yellow(item.key)}`);
+                info(`    ${colors.dim(item.why)}`);
+            }
+            info('');
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return 'dev vscode: explained';
+        }
+        const all = (0, vscode_settings_1.detectVariants)();
+        const { targets, unknownFilter } = (0, vscode_settings_1.selectVariants)(all, parameters.options.variant);
+        // A bare `--variant` parses to boolean `true` and matches no id. Reporting
+        // that as "no installation found" told users their editor was missing while
+        // it was installed — two different problems deserve two different messages.
+        if (unknownFilter) {
+            info(colors.yellow(`  Unknown --variant "${unknownFilter}".`));
+            info(colors.dim(`  Valid values: ${all.map((v) => v.id).join(' | ')}`));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit(1);
+            return 'dev vscode: unknown variant';
+        }
+        if (targets.length === 0) {
+            info(colors.yellow('  No VS Code installation with a user settings.json found.'));
+            info(colors.dim(`  Looked for: ${all.map((v) => v.label).join(', ')}`));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit(1);
+            return 'dev vscode: no installation found';
+        }
+        // Preview first — the user sees the exact before/after per key before
+        // anything is written.
+        let pending = 0;
+        for (const target of targets) {
+            const preview = (0, vscode_settings_1.tuneSettingsFile)(target.settingsPath, { dryRun: true, remove: revert });
+            info(`\n  ${colors.bold(target.label)} ${colors.dim(target.settingsPath)}`);
+            if (preview.error) {
+                info(`    ${colors.red('skipped')} — ${preview.error}`);
+                continue;
+            }
+            for (const change of preview.changes) {
+                info(`    ${(0, vscode_settings_1.formatChange)(change, colors)}`);
+                if (change.action !== 'unchanged')
+                    pending++;
+            }
+        }
+        if (pending === 0) {
+            info(colors.green('\n✓ already up to date — nothing to do\n'));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return 'dev vscode: no changes needed';
+        }
+        if (dryRun) {
+            info(colors.dim(`\n${pending} change(s) would be applied. Re-run without --dry-run to apply.\n`));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return `dev vscode: dry run, ${pending} pending change(s)`;
+        }
+        if (!noConfirm && !(yield confirm(`Apply ${pending} change(s)?`, true))) {
+            info(colors.dim('\nAborted — nothing written.\n'));
+            if (!parameters.options.fromGluegunMenu)
+                process.exit();
+            return 'dev vscode: aborted';
+        }
+        let applied = 0;
+        for (const target of targets) {
+            const result = (0, vscode_settings_1.tuneSettingsFile)(target.settingsPath, { remove: revert });
+            if (result.error) {
+                info(`  ${colors.red('✗')} ${target.label}: ${result.error}`);
+                continue;
+            }
+            if (!result.written)
+                continue;
+            applied += result.changes.filter((c) => c.action !== 'unchanged').length;
+            info(`  ${colors.green('✓')} ${target.label} updated ${colors.dim(`(backup: ${result.backupPath})`)}`);
+        }
+        info(colors.dim('\n  Restart VS Code (or run "Developer: Reload Window") for the TS servers to pick this up.\n'));
+        if (!parameters.options.fromGluegunMenu)
+            process.exit();
+        return `dev vscode: applied ${applied} change(s)`;
+    }),
+};
+exports.help = {
+    aliases: ['vsc'],
+    configuration: 'none (writes global editor settings — --noConfirm must be passed explicitly)',
+    description: "Apply a verified low-memory profile to VS Code's user settings. Targets the per-workspace TypeScript servers, which dominate memory when many monorepos are open at once.",
+    examples: ['dev vscode', 'dev vscode --dry-run', 'dev vscode --explain', 'dev vscode --revert'],
+    features: [
+        'JSONC-aware — preserves comments and formatting; refuses to write an unparseable file or a symlink.',
+        'Backs up to settings.json.bak (the first one is kept) and merges object-valued keys, keeping hand-added entries.',
+        'Detects VS Code, Insiders, Cursor and VSCodium; idempotent, with --revert subtracting only its own entries.',
+    ],
+    name: 'vscode',
+    options: [
+        { description: 'Show what would change without writing', flag: '--dry-run', type: 'boolean' },
+        { description: 'Remove the profile keys again', flag: '--revert', type: 'boolean' },
+        {
+            description: 'Print the profile with reasons, plus the keys deliberately left out',
+            flag: '--explain',
+            type: 'boolean',
+        },
+        {
+            description: 'Limit to one installation: code | insiders | cursor | vscodium',
+            flag: '--variant',
+            type: 'string',
+        },
+        { description: 'Skip the confirmation prompt', flag: '--noConfirm', type: 'boolean' },
+    ],
+};
+module.exports = Object.assign(VsCodeCommand, { help: exports.help });

package/build/commands/fullstack/add-api.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const workspace_integration_1 = require("../../lib/workspace-integration");
 /**
  * Add an API (`projects/api/`) to a fullstack workspace that currently
@@ -68,6 +69,7 @@ const NewCommand = {
         info('Add API to fullstack workspace');
         toolbox.tools.nonInteractiveHint('lt fullstack add-api --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor> [--api-branch <ref>] [--next] [--dry-run] --noConfirm');
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         const ltConfig = config.loadConfig();
@@ -126,10 +128,12 @@ const NewCommand = {
         const layout = (0, workspace_integration_1.detectWorkspaceLayout)(workspaceDir, filesystem);
         if (!layout.hasWorkspace) {
             error(`No fullstack workspace detected at "${workspaceDir}". Expected pnpm-workspace.yaml, package.json#workspaces, or a projects/ directory. Use \`lt fullstack init\` for a fresh workspace.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         if (layout.hasApi) {
             error(`An API already exists at "${workspaceDir}/projects/api". Remove it first or use \`lt fullstack init\` in a fresh directory.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Resolve api mode (CLI > experimental override > config > global > interactive/default).
@@ -177,6 +181,7 @@ const NewCommand = {
         }
         else if (cliFrameworkMode) {
             error(`Invalid --framework-mode value "${cliFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
@@ -282,6 +287,7 @@ const NewCommand = {
         });
         if (!apiResult.success) {
             apiSpinner.fail(`Failed to set up API: ${apiResult.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         apiSpinner.succeed(`API integrated (${apiResult.method})`);

package/build/commands/fullstack/add-app.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const workspace_integration_1 = require("../../lib/workspace-integration");
 /**
  * Add a frontend app (`projects/app/`) to a fullstack workspace that
@@ -57,6 +58,7 @@ const NewCommand = {
         info('Add app to fullstack workspace');
         toolbox.tools.nonInteractiveHint('lt fullstack add-app --frontend <nuxt|angular> [--frontend-branch <ref>] [--next] [--dry-run] --noConfirm');
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         const ltConfig = config.loadConfig();
@@ -110,10 +112,12 @@ const NewCommand = {
         const layout = (0, workspace_integration_1.detectWorkspaceLayout)(workspaceDir, filesystem);
         if (!layout.hasWorkspace) {
             error(`No fullstack workspace detected at "${workspaceDir}". Expected pnpm-workspace.yaml, package.json#workspaces, or a projects/ directory. Use \`lt fullstack init\` for a fresh workspace.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         if (layout.hasApp) {
             error(`An app already exists at "${workspaceDir}/projects/app". Remove it first or use \`lt fullstack init\` in a fresh directory.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Resolve frontend.
@@ -123,6 +127,7 @@ const NewCommand = {
         }
         else if (cliFrontend) {
             error('Invalid --frontend option. Use "angular" or "nuxt".');
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrontend === 'angular' || configFrontend === 'nuxt') {
@@ -150,6 +155,7 @@ const NewCommand = {
         }
         else if (cliFrontendFrameworkMode) {
             error(`Invalid --frontend-framework-mode value "${cliFrontendFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrontendFrameworkMode === 'npm' || configFrontendFrameworkMode === 'vendor') {
@@ -225,6 +231,7 @@ const NewCommand = {
             });
         if (!result.success) {
             appSpinner.fail(`Failed to set up ${frontend} frontend: ${result.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         appSpinner.succeed(`${frontend} integrated (${result.method})`);

package/build/commands/fullstack/init.js

@@ -16,6 +16,7 @@ const gluegun_1 = require("gluegun");
 const caddy_1 = require("../../lib/caddy");
 const dev_migrate_helper_1 = require("../../lib/dev-migrate-helper");
 const dev_project_1 = require("../../lib/dev-project");
+const fail_run_1 = require("../../lib/fail-run");
 const package_name_1 = require("../../lib/package-name");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 const workspace_integration_1 = require("../../lib/workspace-integration");
@@ -38,9 +39,10 @@ const NewCommand = {
         // Info
         info('Create a new fullstack workspace');
         // Hint for non-interactive callers (e.g. Claude Code)
-        toolbox.tools.nonInteractiveHint('lt fullstack init --name <name> --frontend <nuxt|angular> --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor> [--framework-upstream-branch <ref>] [--next: implies nuxt-base-starter#next unless --frontend-branch overrides] [--dry-run] --noConfirm');
+        toolbox.tools.nonInteractiveHint('lt fullstack init --name <name> --frontend <nuxt|angular> --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor: workspace-wide, applies to API and frontend> [--frontend-framework-mode <npm|vendor>: overrides --framework-mode for the frontend only] [--framework-upstream-branch <ref>] [--next: implies nuxt-base-starter#next unless --frontend-branch overrides] [--dry-run] --noConfirm');
         // Check git
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Load configuration
@@ -92,6 +94,7 @@ const NewCommand = {
                 if (cwdLayout.hasApi && cwdLayout.hasApp) {
                     error('Workspace already has both projects/api and projects/app — nothing to add.');
                     info('Use `lt fullstack add-api --help-json` or `lt fullstack add-app --help-json` to inspect options.');
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
                 if (cwdLayout.hasApp && !cwdLayout.hasApi) {
@@ -124,6 +127,7 @@ const NewCommand = {
         if (filesystem.exists(projectDir)) {
             info('');
             error(`There's already a folder named "${projectDir}" here.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Determine frontend with priority: CLI > config > interactive
@@ -132,6 +136,7 @@ const NewCommand = {
             frontend = cliFrontend === 'angular' ? 'angular' : cliFrontend === 'nuxt' ? 'nuxt' : null;
             if (!frontend) {
                 error('Invalid frontend option. Use "angular" or "nuxt".');
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
         }
@@ -220,6 +225,7 @@ const NewCommand = {
         }
         else if (cliFrameworkMode) {
             error(`Invalid --framework-mode value "${cliFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
@@ -245,20 +251,34 @@ const NewCommand = {
         }
         // ── Frontend framework mode ─────────────────────────────────────────
         const configFrontendFrameworkMode = (_0 = (_z = ltConfig === null || ltConfig === void 0 ? void 0 : ltConfig.commands) === null || _z === void 0 ? void 0 : _z.fullstack) === null || _0 === void 0 ? void 0 : _0.frontendFrameworkMode;
+        // Precedence: frontend-specific CLI flag > workspace-wide CLI flag >
+        // frontend-specific config > workspace-wide config > vendor default.
+        //
+        // `--framework-mode` is the workspace-wide default and MUST propagate here.
+        // Without that inheritance, `--framework-mode npm` silently produced an
+        // npm API next to a vendored frontend — visible only as the M1..M3 steps in
+        // a `--dry-run` plan, or afterwards as an unexpected `app/core/` tree.
+        // Consumers who genuinely want mixed modes pass `--frontend-framework-mode`.
         let frontendFrameworkMode;
         if (cliFrontendFrameworkMode === 'npm' || cliFrontendFrameworkMode === 'vendor') {
             frontendFrameworkMode = cliFrontendFrameworkMode;
         }
         else if (cliFrontendFrameworkMode) {
             error(`Invalid --frontend-framework-mode value "${cliFrontendFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
+        else if (cliFrameworkMode === 'npm' || cliFrameworkMode === 'vendor') {
+            frontendFrameworkMode = cliFrameworkMode;
+            info(`Using frontend framework mode from --framework-mode: ${frontendFrameworkMode}`);
+        }
         else if (configFrontendFrameworkMode === 'npm' || configFrontendFrameworkMode === 'vendor') {
             frontendFrameworkMode = configFrontendFrameworkMode;
             info(`Using frontend framework mode from lt.config: ${frontendFrameworkMode}`);
         }
-        else if (noConfirm) {
-            frontendFrameworkMode = 'vendor';
+        else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
+            frontendFrameworkMode = configFrameworkMode;
+            info(`Using frontend framework mode from lt.config frameworkMode: ${frontendFrameworkMode}`);
         }
         else {
             // Default to vendor without asking (unless user sets it explicitly)
@@ -403,11 +423,13 @@ const NewCommand = {
         }
         catch (err) {
             workspaceSpinner.fail(`Failed to clone monorepo: ${err.message}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Check for directory
         if (!filesystem.isDirectory(`./${projectDir}`)) {
             workspaceSpinner.fail(`The directory "${projectDir}" could not be created.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         workspaceSpinner.succeed(`Create fullstack workspace with ${frontend} in ${projectDir} for ${name} created`);
@@ -467,6 +489,7 @@ const NewCommand = {
         }
         catch (err) {
             error(`Failed to initialize git: ${err.message}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Add remote if push is configured
@@ -476,6 +499,7 @@ const NewCommand = {
             }
             catch (err) {
                 error(`Failed to add remote: ${err.message}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
         }
@@ -503,6 +527,7 @@ const NewCommand = {
         }
         if (!frontendResult.success) {
             error(`Failed to set up ${frontend} frontend: ${frontendResult.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Patch frontend .env with project-specific values (skip for linked templates)
@@ -546,6 +571,7 @@ const NewCommand = {
             });
             if (!apiResult.success) {
                 serverSpinner.fail(`Failed to set up API: ${apiResult.path}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
             // Auto-run `bun run rename <projectDir>` for the experimental nest-base
@@ -638,6 +664,7 @@ const NewCommand = {
                 }
                 catch (err) {
                     installSpinner.fail(`Failed to install packages: ${err.message}`);
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
             }
@@ -673,6 +700,7 @@ const NewCommand = {
             }
             catch (err) {
                 error(`Failed to create initial commit: ${err.message}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
             // Push to remote if configured
@@ -682,6 +710,7 @@ const NewCommand = {
                 }
                 catch (err) {
                     error(`Failed to push to remote: ${err.message}`);
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
             }

package/build/commands/fullstack/update.js

@@ -14,6 +14,7 @@ const dev_patches_1 = require("../../lib/dev-patches");
 const framework_detection_1 = require("../../lib/framework-detection");
 const frontend_framework_detection_1 = require("../../lib/frontend-framework-detection");
 const heal_check_wrapper_1 = require("../../lib/heal-check-wrapper");
+const heal_vendor_migrate_store_1 = require("../../lib/heal-vendor-migrate-store");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 /**
  * Update a fullstack workspace — mode-aware.
@@ -208,6 +209,22 @@ const NewCommand = {
             info('');
             success('  Added `.lt-dev/` to .gitignore');
         }
+        // ── Self-heal: repair the vendor-mode migration store ──────────────────
+        //
+        // `migrations-utils/migrate.js` is written ONCE, at conversion time. Projects
+        // converted before the template stopped requiring ts-node unconditionally keep
+        // the broken file forever — it is project scaffolding, not `src/core/`, so no
+        // update path ever revisits it. Those containers die with
+        // `Cannot find module 'ts-node'` before applying a single migration, and stay
+        // healthy while doing so, because the entrypoint degrades the failure to a
+        // warning on purpose. Idempotent, and deliberately blind to stores that guard
+        // the require their own way.
+        const migrateStoreAsset = (0, path_1.join)(__dirname, '..', '..', 'templates', 'vendor-scripts', 'migrate-store.js');
+        const changedStore = (0, heal_vendor_migrate_store_1.healVendorMigrateStore)(apiDir, migrateStoreAsset);
+        if (changedStore.length > 0) {
+            info('');
+            success(`  Repaired the vendor migration store: ${changedStore.join(', ')}`);
+        }
         info('');
         info(colors.bold('For a comprehensive update of everything, use:'));
         info('');

package/build/commands/git/reset.js

@@ -46,7 +46,7 @@ const NewCommand = {
             return;
         }
         // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
-        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
+        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
         if (!remoteBranch) {
             error(`No remote branch ${branch} found!`);
             return;

package/build/commands/git/update.js

@@ -48,7 +48,7 @@ const NewCommand = {
             info(`Current branch: ${branch}`);
             info('');
             // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline)
-            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
+            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
             // Check for incoming commits
             const incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline 2>/dev/null || echo ""`);
             const commits = (incomingCommits === null || incomingCommits === void 0 ? void 0 : incomingCommits.trim().split('\n').filter((c) => c)) || [];
@@ -78,7 +78,7 @@ const NewCommand = {
         const timer = startTimer();
         // Update
         const updateSpin = spin(`Update branch ${branch}`);
-        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git pull --rebase');
+        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git pull --rebase');
         updateSpin.succeed();
         // Install packages (unless skipped) with correctly detected package manager (supports monorepo lockfiles)
         if (!skipInstall) {

package/build/extensions/frontend-helper.js

@@ -13,6 +13,7 @@ exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const strip_comments_1 = require("../lib/strip-comments");
+const strip_vendor_schema_augmentation_1 = require("../lib/strip-vendor-schema-augmentation");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Frontend helper functions for project scaffolding
@@ -520,6 +521,24 @@ class FrontendHelper {
             this.rewriteConsumerImportsToVendor(dest);
             // ── 4. Rewrite nuxt.config.ts module entry ──────────────────────────
             this.rewriteNuxtConfig(dest, 'vendor');
+            // ── 4b. Drop the core's `nuxt/schema` runtime-config augmentation ────
+            //
+            // Harmless inside node_modules, poisonous as project source: it augments the
+            // same interface under both `nuxt/schema` and `@nuxt/schema` (the former
+            // re-exports the latter) and closes a cycle with Nuxt's generated
+            // runtime-config types. TS2310 — suppressed by `skipLibCheck`, so all a
+            // developer sees is every `config.public.*` typed `unknown`. See the lib for
+            // the measurement.
+            const strippedAugmentation = (0, strip_vendor_schema_augmentation_1.stripVendorSchemaAugmentation)({ coreDir, filesystem });
+            if (strippedAugmentation.touched.length > 0) {
+                this.toolbox.print.info(`  vendored core: removed the nuxt/schema runtime-config augmentation from ${strippedAugmentation.touched.length} file(s) — keeps config.public.* typed`);
+            }
+            // A block the transform could not process is left in place, which means the
+            // TS2310 bug ships with the project. Silence there would be the worst of both
+            // worlds: the conversion reports success and the typing is broken anyway.
+            for (const warning of strippedAugmentation.warnings) {
+                this.toolbox.print.warning(`  ⚠ vendored core: ${warning}`);
+            }
             // ── 5. package.json: remove @lenne.tech/nuxt-extensions, merge deps ─
             const pkgPath = path.join(dest, 'package.json');
             if (filesystem.exists(pkgPath)) {

package/build/extensions/git.js

@@ -120,7 +120,7 @@ class Git {
             // Toolbox features
             const { system } = this.toolbox;
             // Get branches (use short SSH timeout so fetch doesn't hang in offline environments)
-            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null; git show-branch --list');
+            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null; git show-branch --list');
             branches.split('\n').forEach((item) => {
                 const matches = item.match(/\[(.*?)]/);
                 if (matches) {
@@ -197,6 +197,27 @@ class Git {
     /**
      * Check if git is installed (cached for performance)
      */
+    /**
+     * Why the git calls in this repo spell `GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-…}"` (shell default)
+     * rather than assigning it outright.
+     *
+     * These commands do a best-effort `git fetch` to see whether the branch is
+     * behind. They set `BatchMode=yes` so ssh fails instead of PROMPTING — but an
+     * agent that stalls is not a prompt. On a 1Password-backed machine the agent is
+     * reachable and every signature needs an interactive approval; unattended it
+     * waits and then reports `communication with agent failed`. Measured: **61 s per
+     * fetch**, so `lt git update --dry-run` took 62 s and `lt git create --dry-run`
+     * 123 s (two fetches). `ConnectTimeout` does not bound it — that covers the TCP
+     * connect, not the agent.
+     *
+     * Waiting for a human to approve a key is legitimate for an interactive command,
+     * so the default is unchanged. What was wrong is that the assignment was
+     * UNCONDITIONAL: it overrode a caller who had deliberately configured ssh,
+     * including a test harness trying to make the behaviour deterministic. The
+     * `:-` default respects an existing value and keeps the old behaviour when there
+     * is none. `IdentityAgent=none` in the caller's env then drops the same fetch to
+     * ~1 s with a clean `Permission denied (publickey)`.
+     */
     gitInstalled() {
         return __awaiter(this, void 0, void 0, function* () {
             // Return cached result if available
@@ -252,7 +273,7 @@ class Git {
                 searchSpin = spin(opts.spinText);
             }
             // Update infos (use short SSH timeout so fetch doesn't hang in offline environments)
-            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
+            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
             if (fetch.length && !fetch.startsWith('remote')) {
                 info(`Could not update infos ${fetch.length}`);
             }