@lenne.tech/cli 1.41.3 → 1.43.0

package/build/extensions/server.js

@@ -46,6 +46,7 @@ exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
+const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const strip_comments_1 = require("../lib/strip-comments");
@@ -1021,6 +1022,22 @@ class Server {
                 // Best-effort — without the lockfile, the closure step falls back to
                 // the upstream package.json ranges (still better than nothing).
             }
+            // Snapshot the upstream pnpm-workspace.yaml. It carries `allowBuilds`, the map
+            // that decides which packages may run install scripts — and vendoring is what
+            // makes the framework's entries the PROJECT's problem: step 5b turns the core's
+            // import closure into direct dependencies, so packages nest-server knew about
+            // (bullmq → msgpackr → msgpackr-extract) become the project's own. pnpm 11 aborts
+            // the install outright on an unlisted one, so a missing entry is an unusable
+            // project rather than a warning. This file is NOT in nest-server's npm tarball,
+            // so the clone is the only moment it can be read at all.
+            let upstreamWorkspaceYaml = '';
+            try {
+                upstreamWorkspaceYaml = filesystem.read(`${tmpClone}/pnpm-workspace.yaml`) || '';
+            }
+            catch (_c) {
+                // Best-effort: an older framework revision may predate the file. The project
+                // then keeps exactly the allowlist its own template shipped.
+            }
             // Snapshot the upstream CLAUDE.md for section-merge into projects/api/CLAUDE.md.
             // The nest-server CLAUDE.md contains framework-specific instructions that
             // Claude Code needs to work correctly with the vendored source (API conventions,
@@ -1033,7 +1050,7 @@ class Server {
                     upstreamClaudeMd = claudeMdContent;
                 }
             }
-            catch (_c) {
+            catch (_d) {
                 // Non-fatal — if missing, the project CLAUDE.md just won't get upstream sections.
             }
             // Snapshot the upstream commit SHA for traceability in VENDOR.md.
@@ -1042,7 +1059,7 @@ class Server {
                 const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
                 upstreamCommit = (sha || '').trim();
             }
-            catch (_d) {
+            catch (_e) {
                 // Non-fatal — VENDOR.md will just show an empty SHA.
             }
             try {
@@ -1325,7 +1342,7 @@ class Server {
                             }
                         }
                     }
-                    catch (_e) {
+                    catch (_f) {
                         // skip unreadable file
                     }
                 }
@@ -1503,6 +1520,14 @@ class Server {
                         upstreamDeps,
                         upstreamDevDeps,
                     });
+                    // The closure above just made framework-only packages direct dependencies of
+                    // this project. Their build-script decisions have to come along, or the first
+                    // `pnpm install` stops on ERR_PNPM_IGNORED_BUILDS. Additive only — a decision
+                    // the project already made is never overwritten.
+                    const adoptedBuilds = (0, adopt_upstream_build_allowlist_1.adoptUpstreamBuildAllowlist)({ dest, filesystem, upstreamWorkspaceYaml });
+                    if (adoptedBuilds.length > 0) {
+                        this.toolbox.print.info(`  vendored core allowlist: adopted ${adoptedBuilds.length} build decision(s) from nest-server → ${adoptedBuilds.join(', ')}`);
+                    }
                     // Add a script to run the local bin/migrate.js. The starter's
                     // existing migrate:* scripts are already correct for npm mode; we
                     // need them pointing at the local bin + local ts-compiler.

package/build/lib/adopt-upstream-build-allowlist.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adoptUpstreamBuildAllowlist = adoptUpstreamBuildAllowlist;
+const js_yaml_1 = require("js-yaml");
+const fs_utils_1 = require("./fs-utils");
+const hoist_workspace_pnpm_config_1 = require("./hoist-workspace-pnpm-config");
+/**
+ * Carry the framework's build-script allowlist into a project that has just
+ * vendored it.
+ *
+ * `allowBuilds` decides which packages may run install scripts. pnpm 11 does not
+ * treat an unlisted one as "deny" — it ABORTS the install with
+ * `ERR_PNPM_IGNORED_BUILDS` and writes a `set this to true or false` placeholder
+ * into the workspace file. So a single missing entry is not a hardening gap; it
+ * is a project that cannot be installed at all, on the very first
+ * `lt fullstack init`, before anyone has written a line of code.
+ *
+ * Vendoring is exactly where that gap opens. The conversion resolves the core's
+ * import closure into DIRECT dependencies — `import('bullmq')` in
+ * core-cron-jobs.service.ts becomes a real `bullmq` dep, which pulls
+ * `msgpackr` → `msgpackr-extract`, a package with an install script. nest-server
+ * knows about it and lists it. The project does not, and cannot: nest-server's
+ * `pnpm-workspace.yaml` is not part of its npm tarball — `files` ships `dist`,
+ * `src`, `bin` and the docs, never a repo-root config file — so nothing
+ * downstream can read it. Until now the only bridge was a
+ * human copying entries into nest-server-starter by hand — and that bridge has
+ * already been observed to rot: `@scarf/scarf` sat at `true` in the starter while
+ * the framework denied it, for long enough that the drift shipped.
+ *
+ * Deliberately additive. A key the project has already decided is left exactly as
+ * it is, including an explicit `false`: the project is the more specific context,
+ * and silently flipping its decision to match the framework would be a worse bug
+ * than the one this fixes. Only genuinely absent keys are taken over — together
+ * with the comment that explains them, because an entry like
+ * `'msgpackr-extract': false` reads as dead weight without it and gets deleted by
+ * the next person who runs `pnpm why`.
+ *
+ * @returns the keys actually adopted, for the caller to report.
+ */
+function adoptUpstreamBuildAllowlist(options) {
+    var _a;
+    const { dest, filesystem, upstreamWorkspaceYaml } = options;
+    if (!upstreamWorkspaceYaml)
+        return [];
+    const upstream = parseYamlObject(upstreamWorkspaceYaml);
+    const upstreamAllow = asStringBoolMap(upstream === null || upstream === void 0 ? void 0 : upstream.allowBuilds);
+    if (Object.keys(upstreamAllow).length === 0)
+        return [];
+    // Never write through a symlinked project: with `--api-link` it points at the
+    // user's own nest-server-starter checkout, and this would edit their repo. The
+    // same guard already protects `hoistWorkspacePnpmConfig` and
+    // `removeNestedLockfiles`; these two libs were the odd ones out.
+    if ((0, fs_utils_1.isSymlink)(dest))
+        return [];
+    const destPath = `${dest}/pnpm-workspace.yaml`;
+    // No file to extend means no pnpm settings of the project's own. Writing one
+    // here would invent a workspace root the scaffolding did not ask for, so the
+    // absence is respected rather than filled in.
+    if (!filesystem.exists(destPath))
+        return [];
+    const destRaw = (_a = filesystem.read(destPath)) !== null && _a !== void 0 ? _a : '';
+    const destWs = parseYamlObject(destRaw);
+    if (!destWs)
+        return [];
+    // The project's map is read RAW, not through `asStringBoolMap`. Narrowing it to
+    // booleans first was a live deny-bypass with no attacker involved: js-yaml 4
+    // uses the YAML 1.2 core schema, so `esbuild: no` and `esbuild: off` parse as
+    // STRINGS. A maintainer writing `no` to mean "deny" was read as "no opinion",
+    // upstream's `true` was adopted, and the original entry was dropped from the
+    // rewritten map as well. Same for `'false'`, for an empty value (null), and for
+    // pnpm's own `set this to true or false` placeholder — all five verified.
+    //
+    // `Object.create(null)` and `hasOwnProperty.call`: with a plain object,
+    // `'constructor' in map` is true via the prototype, so eight real package names
+    // ('constructor', 'toString', 'valueOf', …) would be treated as already decided
+    // and silently never adopted — the ERR_PNPM_IGNORED_BUILDS abort this whole
+    // function exists to prevent.
+    const merged = Object.assign(Object.create(null), asRawMap(destWs.allowBuilds));
+    const adopted = [];
+    for (const [pkg, value] of Object.entries(upstreamAllow)) {
+        // ANY existing key is a decision, whatever shape YAML gave it.
+        if (Object.prototype.hasOwnProperty.call(merged, pkg))
+            continue;
+        merged[pkg] = value;
+        adopted.push(pkg);
+    }
+    if (adopted.length === 0)
+        return [];
+    destWs.allowBuilds = Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b)));
+    // The project's own annotations win where both files comment the same key; the
+    // upstream ones fill in only for the keys just adopted, which by definition the
+    // project had nothing to say about.
+    const comments = (0, hoist_workspace_pnpm_config_1.extractKeyComments)(destRaw);
+    for (const [key, block] of (0, hoist_workspace_pnpm_config_1.extractKeyComments)(upstreamWorkspaceYaml)) {
+        if (!comments.has(key))
+            comments.set(key, block);
+    }
+    filesystem.write(destPath, (0, hoist_workspace_pnpm_config_1.reattachKeyComments)((0, js_yaml_1.dump)(destWs, { lineWidth: -1, sortKeys: false }), comments));
+    return adopted;
+}
+/** The value as a plain key/value map, or an empty one — no narrowing of values. */
+function asRawMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    return value;
+}
+/**
+ * Narrow an unknown value to a `{ pkg: boolean }` map, dropping other shapes.
+ *
+ * Used for the UPSTREAM side only. There, dropping a non-boolean is right — we
+ * adopt only decisions we understand. On the DEST side it is the opposite: see
+ * the comment at the merge above.
+ */
+function asStringBoolMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+        if (typeof v === 'boolean')
+            out[key] = v;
+    }
+    return out;
+}
+/** Parse YAML into a plain object, or null on empty/malformed/non-object input. */
+function parseYamlObject(raw) {
+    if (!raw)
+        return null;
+    let parsed;
+    try {
+        parsed = (0, js_yaml_1.load)(raw);
+    }
+    catch (_a) {
+        // Malformed upstream YAML must not take the conversion down with it — the
+        // vendored project is still usable, it just does not inherit the allowlist.
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return null;
+    return parsed;
+}

package/build/lib/dev-test-session.js

@@ -9,17 +9,19 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TEST_INITIAL_ADMIN_ENV = void 0;
+exports.TEST_NITRO_OUTPUT_DIR = exports.TEST_NUXT_BUILD_DIR = exports.TEST_INITIAL_ADMIN_ENV = void 0;
 exports.ensurePlaywrightBrowsers = ensurePlaywrightBrowsers;
 exports.autoShardCount = autoShardCount;
 exports.bringUpTestSession = bringUpTestSession;
 exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
+exports.buildTestAppEnv = buildTestAppEnv;
 exports.hasTestSession = hasTestSession;
 exports.resolveTestSession = resolveTestSession;
 exports.runShardedTestSession = runShardedTestSession;
 exports.shardReportDir = shardReportDir;
 exports.tearDownAllTestSessions = tearDownAllTestSessions;
 exports.tearDownTestSession = tearDownTestSession;
+exports.testAppEntryCandidates = testAppEntryCandidates;
 /**
  * Ephemeral, isolated test session for `lt dev test`.
  *
@@ -103,6 +105,47 @@ exports.TEST_INITIAL_ADMIN_ENV = {
     NSC__SYSTEM_SETUP__INITIAL_ADMIN__NAME: 'CI Admin',
     NSC__SYSTEM_SETUP__INITIAL_ADMIN__PASSWORD: 'CiThrowawayAdmin123!',
 };
+/**
+ * The Nuxt build directory the test stack's app process uses — never the one
+ * `nuxt dev` / the IDE write (`.nuxt`), never the check chain's (`.nuxt-check`).
+ *
+ * `@nuxt/cli` takes its lock ON the build directory
+ * (`acquireLock(nuxt.options.buildDir)`), so sharing it does not merely
+ * interleave writes — it makes the second command ABORT: a `lt dev test` next to
+ * a parked `lt dev up` died with "Another Nuxt dev is already running", the test
+ * app never started, and every spec then failed on a missing selector. That
+ * reads like broken specs while being pure infrastructure, which is what made it
+ * expensive to diagnose. A directory of its own frees the lock and the writes in
+ * one move.
+ *
+ * Projects whose `nuxt.config.ts` does not (yet) read `NUXT_BUILD_DIR` simply
+ * ignore it, so this needs no per-project case distinction.
+ */
+exports.TEST_NUXT_BUILD_DIR = '.nuxt-test';
+/**
+ * The Nitro OUTPUT directory the test stack builds into (DEV-2724).
+ *
+ * A second axis from `TEST_NUXT_BUILD_DIR`, not a duplicate of it: `buildDir`
+ * and Nitro's `output.dir` are unrelated knobs, so isolating the former left
+ * `.output/` shared. That matters here more than anywhere else, because this
+ * stack does not run `nuxt dev` — it serves the production bundle, rebuilding on
+ * every run, and therefore overwrites the tree a local `pnpm run build` (or a
+ * server started from it) is using.
+ *
+ * NEITHER variable is framework-native — verified against `@nuxt/schema` 4.4.8,
+ * `nitropack` 2.13.4 and `c12`: none of them reads `NUXT_BUILD_DIR` or
+ * `NITRO_OUTPUT_DIR`. Both levers are opened by the project's own
+ * `nuxt.config.ts` (`buildDir: process.env.NUXT_BUILD_DIR || '.nuxt'`,
+ * `nitro.output.dir: process.env.NITRO_OUTPUT_DIR || '.output'`); nuxt-base-starter
+ * ≥ 2.16.0 ships both. Do NOT write "unlike NUXT_BUILD_DIR, …" here: that
+ * asymmetric contrast silently promotes one of them to a framework feature and
+ * makes readers forward only the other, which reintroduces the collision this
+ * whole mechanism exists to prevent.
+ *
+ * Projects that forward neither simply keep building into `.nuxt` / `.output`,
+ * which is why `testAppEntryCandidates()` still looks there.
+ */
+exports.TEST_NITRO_OUTPUT_DIR = '.output-test';
 /**
  * Heuristic for the default local shard count (`--shard auto` / bare `--shard`).
  *
@@ -236,6 +279,11 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             dbName,
             identity: testIdentity,
         });
+        // Every app process below — the build, the built server, and the dev-server
+        // fallback — runs with THIS env, so the test stack never touches the build dir
+        // `nuxt dev` and the IDE use. Declared out here because the session context
+        // hands it to the Playwright child as well.
+        const appEnv = buildTestAppEnv(devEnv.app.env);
         const pids = {};
         // --- API: compiled (`node dist`) for stability; fall back to the project's
         // own dev start script. `skipBuild` (sibling shards) reuses the dist the
@@ -281,25 +329,41 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // buildDevEnv sets NUXT_PUBLIC_API_PROXY=false, so the built app talks
         // cross-origin to the test API exactly like prod (the injected session cookie
         // must be a cross-subdomain DOMAIN cookie — see the project's parseCookieHeader).
-        // Rebuilt every run so the suite never hits stale code (no build-skip / reuse). ---
+        // Rebuilt every run so the suite never hits stale code (no build-skip / reuse).
+        // `appEnv` pins NUXT_BUILD_DIR to its own dir, which is what lets this run next
+        // to a parked `lt dev up` at all: the Nuxt lock sits on the build dir, so the
+        // build below used to abort outright against a running dev server (DEV-2715).
+        // The fallback needs it just as much — that path IS a second `nuxt dev`.
+        // It also pins NITRO_OUTPUT_DIR (DEV-2724), so the rebuild below stops
+        // overwriting the `.output/` a local `pnpm run build` is serving — and the
+        // entry lookup moves with it, or the spawn would find nothing and drop to the
+        // slow `pnpm dev` fallback. ---
         if (layout.appDir && appPort) {
+            // The isolated build trees are new names this CLI invented, so a project
+            // whose `.gitignore` predates the starter's `.nuxt-*` / `.output-*` globs
+            // leaves them UNTRACKED — a `git add -A` away from committing a Nitro
+            // bundle (which inlines runtimeConfig defaults), and enough to make
+            // `lt ticket stop` see uncommitted work. Idempotent, like every other
+            // `addToGitignore` call.
+            (0, dev_patches_1.addToGitignore)(layout.appDir, '.nuxt-*');
+            (0, dev_patches_1.addToGitignore)(layout.appDir, '.output-*');
             const appPm = (0, dev_package_manager_1.pickPackageManager)(layout.appDir);
             let appBuild = 0;
             if (!skipBuild) {
                 log.info(log.dim('Building App (nuxt build, for speed + prod-fidelity) …'));
                 appBuild = yield (0, dev_process_1.runChildInherit)(appPm.bin, appPm.runScript('build'), {
                     cwd: layout.appDir,
-                    env: devEnv.app.env,
+                    env: appEnv,
                 });
             }
-            const appEntry = ['.output/server/index.mjs']
+            const appEntry = testAppEntryCandidates()
                 .map((rel) => (0, path_1.join)(layout.appDir, rel))
                 .find((p) => (0, fs_1.existsSync)(p));
             let appSpawn;
             if (appBuild === 0 && appEntry) {
                 appSpawn = (0, dev_process_1.spawnDetached)('node', [appEntry], {
                     cwd: layout.appDir,
-                    env: devEnv.app.env,
+                    env: appEnv,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.appLog),
                 });
             }
@@ -307,7 +371,7 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
                 log.warn(`built app not available — falling back to \`${appPm.bin} dev\` (slower: cold-compiles routes).`);
                 appSpawn = (0, dev_process_1.spawnDetached)(appPm.bin, appPm.runScript('dev'), {
                     cwd: layout.appDir,
-                    env: devEnv.app.env,
+                    env: appEnv,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.appLog),
                 });
             }
@@ -340,7 +404,7 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // Expose THIS stack's API log path so the caller can point the auth E2E specs
         // (via NEST_SERVER_LOG) at the exact isolated log — correct per shard.
         const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
-        return { apiLogPath, apiUrl, appEnv: devEnv.app.env, appUrl, dbName, pids, testIdentity };
+        return { apiLogPath, apiUrl, appEnv, appUrl, dbName, pids, testIdentity };
     });
 }
 /**
@@ -382,6 +446,20 @@ function buildShardPlaywrightInvocation(pm, shardIndex, total, forwarded, htmlRe
         },
     };
 }
+/**
+ * The env the test stack's APP process runs with: the isolated dev env plus its
+ * own Nuxt build dir.
+ *
+ * The pin goes LAST on purpose — unlike `TEST_INITIAL_ADMIN_ENV`, which is
+ * spread first so a deliberately inherited credential still wins. Here the
+ * isolation IS the contract: `buildDevEnv` seeds the app env from `process.env`,
+ * so a shell that exports `NUXT_BUILD_DIR` (left over from debugging a check
+ * run, say) would otherwise hand the test stack the dev — or the gate — dir
+ * straight back, and the collision returns silently.
+ */
+function buildTestAppEnv(appEnv) {
+    return Object.assign(Object.assign({}, appEnv), { NITRO_OUTPUT_DIR: exports.TEST_NITRO_OUTPUT_DIR, NUXT_BUILD_DIR: exports.TEST_NUXT_BUILD_DIR });
+}
 /** True when a test session file exists (used by status/down). */
 function hasTestSession(root) {
     return (0, dev_state_1.loadSession)(root, dev_state_1.TEST_SESSION_FILE) !== null;
@@ -541,11 +619,45 @@ function tearDownTestSession(layout_1, baseIdentity_1, log_1) {
             delete reg.projects[testIdentity.slug];
             (0, dev_state_1.saveRegistry)(reg);
         }
+        // Reclaim the isolated build trees. They exist only for this stack and are
+        // rebuilt from scratch on every run (there is no build-skip / reuse), so
+        // keeping them buys nothing and costs 37-294 MB per project — permanently,
+        // since nothing else ever removes them. Only the SUFFIXED names are touched:
+        // a project that does not forward the env vars builds into the shared
+        // `.nuxt` / `.output`, which belong to the developer's own `pnpm run build`.
+        if (layout.appDir) {
+            for (const dir of [exports.TEST_NUXT_BUILD_DIR, exports.TEST_NITRO_OUTPUT_DIR]) {
+                const path = (0, path_1.join)(layout.appDir, dir);
+                try {
+                    if ((0, fs_1.existsSync)(path)) {
+                        (0, fs_1.rmSync)(path, { force: true, recursive: true });
+                        stopped.push(`${dir}/`);
+                    }
+                }
+                catch (_a) {
+                    // Best effort — a locked build tree must not fail the teardown.
+                }
+            }
+        }
         if (!opts.silent && stopped.length > 0)
             log.info(`Stopped test stack: ${stopped.join(', ')}`);
         return { stopped };
     });
 }
+/**
+ * Where to look for the built server entry, in priority order.
+ *
+ * The isolated dir comes FIRST and that ordering is load-bearing: `.find()` takes
+ * the first hit and a stale `.output/` from an earlier local build is the normal
+ * case, so the shared path first would serve that stale bundle while the fresh
+ * build sat unused. The shared path remains as a fallback for projects whose
+ * `nuxt.config.ts` does not forward `NITRO_OUTPUT_DIR` yet — without it they
+ * would find no entry at all and drop to the slow `pnpm dev` fallback, which is
+ * a second `nuxt dev` and re-takes the build-dir lock DEV-2715 just freed.
+ */
+function testAppEntryCandidates() {
+    return [`${exports.TEST_NITRO_OUTPUT_DIR}/server/index.mjs`, '.output/server/index.mjs'];
+}
 /**
  * Resolve the per-stack file/identity names. For a sharded run (`shardIndex`
  * given) everything gets a `.<i>` / `-<i>` suffix so N stacks coexist without

package/build/lib/dev-ticket.js

@@ -587,8 +587,23 @@ function runWithProjectDriver(driverPaths, action, env) {
         return { outcome: 'failed', stdout: '' };
     }
 }
-/** Framework-generated / ephemeral paths a dev/build run dirties (never real work). */
-const GENERATED_PATHS = /(^|\/)(\.nuxtrc|\.nuxt|\.nitro|\.output|dist|\.turbo|\.cache|\.eslintcache)(\/|$)|\.tsbuildinfo$/;
+/**
+ * Framework-generated / ephemeral paths a dev/build run dirties (never real work).
+ *
+ * `.nuxt` and `.output` carry an optional `-<suffix>`: the build directory is no
+ * longer a single well-known name. The check chain builds into `.nuxt-check` and
+ * `lt dev test` into `.nuxt-test` / `.output-test`, precisely so they do not
+ * collide with a parked `nuxt dev` (the Nuxt lock sits on the build dir).
+ *
+ * Without the suffix these read as REAL developer work — a glob segment matches
+ * whole segments, so `.nuxt` never covered `.nuxt-test` — and
+ * `worktreeSafetyReport` then classifies a 300 MB build tree as uncommitted
+ * work, making `lt ticket stop` REFUSE to remove the worktree over files the
+ * developer never wrote. Only projects whose app `.gitignore` predates the
+ * starter's `.nuxt-*` globs are affected, but that is exactly the population the
+ * rest of this CLI's heal machinery exists to serve.
+ */
+const GENERATED_PATHS = /(^|\/)(\.nuxtrc|\.nuxt(-[\w.]+)?|\.nitro|\.output(-[\w.]+)?|dist|\.turbo|\.cache|\.eslintcache)(\/|$)|\.tsbuildinfo$/;
 /** The three git-tracked configs `lt dev up` self-heals to be env-aware. */
 const LT_DEV_MANAGED_CONFIG = /(?:^|\/)(?:config\.env\.ts|nuxt\.config\.ts|playwright\.config\.ts)$/;
 /**

package/build/lib/fail-run.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.failRun = failRun;
+/**
+ * Mark the current command run as failed.
+ *
+ * A gluegun command signals failure by printing and returning, and a bare
+ * `return` leaves the process at exit code 0. So a scaffold that died halfway
+ * reported SUCCESS to every caller that checks `$?` — a CI job, a wrapper
+ * script, an agent. That is not theoretical: a `lt fullstack init` whose
+ * `pnpm install` aborted on a native build script printed a red spinner and
+ * still exited 0, and the half-built workspace was only noticed later, by hand.
+ *
+ * Call it immediately before every `return` on an error path:
+ *
+ *     failRun(toolbox);
+ *     return;
+ *
+ * **`process.exitCode`, not `process.exit()`** — the latter can truncate
+ * buffered output, including the spinner's own failure message, which is the one
+ * line the operator actually needs.
+ *
+ * **Guarded by `fromGluegunMenu`**, like the CLI's other exit-code call sites
+ * (`dev test`, `dev tunnel`, `tools ocr`, `workspace-integration`): inside the
+ * interactive `lt` menu a command is one step of a longer session, and failing
+ * the whole session because one step errored is the same over-reach in reverse.
+ *
+ * Shared rather than redeclared per command: `fullstack init` delegates to
+ * `add-api` / `add-app` inside an existing workspace, so all three have to agree
+ * on the contract or the exit code depends on which directory the user happened
+ * to be standing in — which was exactly the state before this helper existed.
+ */
+function failRun(toolbox) {
+    var _a, _b;
+    if (!((_b = (_a = toolbox.parameters) === null || _a === void 0 ? void 0 : _a.options) === null || _b === void 0 ? void 0 : _b.fromGluegunMenu)) {
+        process.exitCode = 1;
+    }
+}