@lenne.tech/cli 1.42.0 → 1.44.0

package/build/commands/dev/doctor.js

@@ -154,23 +154,46 @@ const DoctorCommand = {
             else if (gs.file && gs.hasDbReset) {
                 line('OK', colors.green, 'global-setup allow-list is ticket + shard safe');
             }
-            // 7.5 check.mjs drift: the root wrapper is canonical (bundled with the
+            // 7.5 check wrapper drift: the root wrapper is canonical (bundled with the
             //     CLI, synced by `lt fullstack update`). A diverged copy silently
             //     misses fixes (idle-watchdog, install hoisting, summed test
             //     metrics) — surface it instead of letting copies drift apart.
+            //
+            //     Checked over the WHOLE copy set, not just `check.mjs`: the wrapper
+            //     imports siblings, so a missing or stale one makes `check` die with
+            //     ERR_MODULE_NOT_FOUND (or an import mismatch) before running a single
+            //     step. Reporting only on `check.mjs` meant doctor printed a green
+            //     "matches the canonical CLI version" for a project whose `check` was
+            //     completely broken — and doctor is the tool people reach for exactly
+            //     then.
             try {
                 const { readFileSync: read } = yield Promise.resolve().then(() => __importStar(require('fs')));
                 const { join: j } = yield Promise.resolve().then(() => __importStar(require('path')));
-                const projectCheck = j(layout.root, 'scripts', 'check.mjs');
+                const { resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
                 const bundledCheck = j(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
-                if (filesystem.exists(projectCheck) && filesystem.exists(bundledCheck)) {
-                    if (read(projectCheck, 'utf8') === read(bundledCheck, 'utf8')) {
-                        line('OK', colors.green, 'scripts/check.mjs matches the canonical CLI version');
+                if (filesystem.exists(bundledCheck)) {
+                    const missing = [];
+                    const drifted = [];
+                    for (const { rel, source } of resolveCopySet(bundledCheck)) {
+                        const target = j(layout.root, rel);
+                        if (!filesystem.exists(target)) {
+                            missing.push(rel);
+                        }
+                        else if (read(target, 'utf8') !== read(source, 'utf8')) {
+                            drifted.push(rel);
+                        }
                     }
-                    else {
-                        line('WARN', colors.yellow, 'scripts/check.mjs differs from the canonical CLI version');
+                    if (missing.length > 0) {
+                        line('ERROR', colors.red, `check wrapper incomplete — missing ${missing.join(', ')}`);
+                        line('ERROR', colors.red, '  `pnpm run check` cannot start; run `lt fullstack update` to install it');
+                    }
+                    else if (drifted.length > 0) {
+                        line('WARN', colors.yellow, `${drifted.join(', ')} differs from the canonical CLI version`);
                         line('WARN', colors.yellow, '  run `lt fullstack update` to sync it (skips uncommitted local edits)');
                     }
+                    else if (filesystem.exists(j(layout.root, 'scripts', 'check.mjs'))) {
+                        line('OK', colors.green, 'check wrapper matches the canonical CLI version');
+                    }
                 }
             }
             catch (_a) {

package/build/commands/fullstack/add-api.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const workspace_integration_1 = require("../../lib/workspace-integration");
 /**
  * Add an API (`projects/api/`) to a fullstack workspace that currently
@@ -68,6 +69,7 @@ const NewCommand = {
         info('Add API to fullstack workspace');
         toolbox.tools.nonInteractiveHint('lt fullstack add-api --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor> [--api-branch <ref>] [--next] [--dry-run] --noConfirm');
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         const ltConfig = config.loadConfig();
@@ -126,10 +128,12 @@ const NewCommand = {
         const layout = (0, workspace_integration_1.detectWorkspaceLayout)(workspaceDir, filesystem);
         if (!layout.hasWorkspace) {
             error(`No fullstack workspace detected at "${workspaceDir}". Expected pnpm-workspace.yaml, package.json#workspaces, or a projects/ directory. Use \`lt fullstack init\` for a fresh workspace.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         if (layout.hasApi) {
             error(`An API already exists at "${workspaceDir}/projects/api". Remove it first or use \`lt fullstack init\` in a fresh directory.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Resolve api mode (CLI > experimental override > config > global > interactive/default).
@@ -177,6 +181,7 @@ const NewCommand = {
         }
         else if (cliFrameworkMode) {
             error(`Invalid --framework-mode value "${cliFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
@@ -282,6 +287,7 @@ const NewCommand = {
         });
         if (!apiResult.success) {
             apiSpinner.fail(`Failed to set up API: ${apiResult.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         apiSpinner.succeed(`API integrated (${apiResult.method})`);

package/build/commands/fullstack/add-app.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.help = void 0;
+const fail_run_1 = require("../../lib/fail-run");
 const workspace_integration_1 = require("../../lib/workspace-integration");
 /**
  * Add a frontend app (`projects/app/`) to a fullstack workspace that
@@ -57,6 +58,7 @@ const NewCommand = {
         info('Add app to fullstack workspace');
         toolbox.tools.nonInteractiveHint('lt fullstack add-app --frontend <nuxt|angular> [--frontend-branch <ref>] [--next] [--dry-run] --noConfirm');
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         const ltConfig = config.loadConfig();
@@ -110,10 +112,12 @@ const NewCommand = {
         const layout = (0, workspace_integration_1.detectWorkspaceLayout)(workspaceDir, filesystem);
         if (!layout.hasWorkspace) {
             error(`No fullstack workspace detected at "${workspaceDir}". Expected pnpm-workspace.yaml, package.json#workspaces, or a projects/ directory. Use \`lt fullstack init\` for a fresh workspace.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         if (layout.hasApp) {
             error(`An app already exists at "${workspaceDir}/projects/app". Remove it first or use \`lt fullstack init\` in a fresh directory.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Resolve frontend.
@@ -123,6 +127,7 @@ const NewCommand = {
         }
         else if (cliFrontend) {
             error('Invalid --frontend option. Use "angular" or "nuxt".');
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrontend === 'angular' || configFrontend === 'nuxt') {
@@ -150,6 +155,7 @@ const NewCommand = {
         }
         else if (cliFrontendFrameworkMode) {
             error(`Invalid --frontend-framework-mode value "${cliFrontendFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrontendFrameworkMode === 'npm' || configFrontendFrameworkMode === 'vendor') {
@@ -225,6 +231,7 @@ const NewCommand = {
             });
         if (!result.success) {
             appSpinner.fail(`Failed to set up ${frontend} frontend: ${result.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         appSpinner.succeed(`${frontend} integrated (${result.method})`);

package/build/commands/fullstack/init.js

@@ -16,6 +16,7 @@ const gluegun_1 = require("gluegun");
 const caddy_1 = require("../../lib/caddy");
 const dev_migrate_helper_1 = require("../../lib/dev-migrate-helper");
 const dev_project_1 = require("../../lib/dev-project");
+const fail_run_1 = require("../../lib/fail-run");
 const package_name_1 = require("../../lib/package-name");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 const workspace_integration_1 = require("../../lib/workspace-integration");
@@ -38,9 +39,10 @@ const NewCommand = {
         // Info
         info('Create a new fullstack workspace');
         // Hint for non-interactive callers (e.g. Claude Code)
-        toolbox.tools.nonInteractiveHint('lt fullstack init --name <name> --frontend <nuxt|angular> --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor> [--framework-upstream-branch <ref>] [--next: implies nuxt-base-starter#next unless --frontend-branch overrides] [--dry-run] --noConfirm');
+        toolbox.tools.nonInteractiveHint('lt fullstack init --name <name> --frontend <nuxt|angular> --api-mode <Rest|GraphQL|Both> --framework-mode <npm|vendor: workspace-wide, applies to API and frontend> [--frontend-framework-mode <npm|vendor>: overrides --framework-mode for the frontend only] [--framework-upstream-branch <ref>] [--next: implies nuxt-base-starter#next unless --frontend-branch overrides] [--dry-run] --noConfirm');
         // Check git
         if (!(yield git.gitInstalled())) {
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Load configuration
@@ -92,6 +94,7 @@ const NewCommand = {
                 if (cwdLayout.hasApi && cwdLayout.hasApp) {
                     error('Workspace already has both projects/api and projects/app — nothing to add.');
                     info('Use `lt fullstack add-api --help-json` or `lt fullstack add-app --help-json` to inspect options.');
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
                 if (cwdLayout.hasApp && !cwdLayout.hasApi) {
@@ -124,6 +127,7 @@ const NewCommand = {
         if (filesystem.exists(projectDir)) {
             info('');
             error(`There's already a folder named "${projectDir}" here.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Determine frontend with priority: CLI > config > interactive
@@ -132,6 +136,7 @@ const NewCommand = {
             frontend = cliFrontend === 'angular' ? 'angular' : cliFrontend === 'nuxt' ? 'nuxt' : null;
             if (!frontend) {
                 error('Invalid frontend option. Use "angular" or "nuxt".');
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
         }
@@ -220,6 +225,7 @@ const NewCommand = {
         }
         else if (cliFrameworkMode) {
             error(`Invalid --framework-mode value "${cliFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
@@ -245,20 +251,34 @@ const NewCommand = {
         }
         // ── Frontend framework mode ─────────────────────────────────────────
         const configFrontendFrameworkMode = (_0 = (_z = ltConfig === null || ltConfig === void 0 ? void 0 : ltConfig.commands) === null || _z === void 0 ? void 0 : _z.fullstack) === null || _0 === void 0 ? void 0 : _0.frontendFrameworkMode;
+        // Precedence: frontend-specific CLI flag > workspace-wide CLI flag >
+        // frontend-specific config > workspace-wide config > vendor default.
+        //
+        // `--framework-mode` is the workspace-wide default and MUST propagate here.
+        // Without that inheritance, `--framework-mode npm` silently produced an
+        // npm API next to a vendored frontend — visible only as the M1..M3 steps in
+        // a `--dry-run` plan, or afterwards as an unexpected `app/core/` tree.
+        // Consumers who genuinely want mixed modes pass `--frontend-framework-mode`.
         let frontendFrameworkMode;
         if (cliFrontendFrameworkMode === 'npm' || cliFrontendFrameworkMode === 'vendor') {
             frontendFrameworkMode = cliFrontendFrameworkMode;
         }
         else if (cliFrontendFrameworkMode) {
             error(`Invalid --frontend-framework-mode value "${cliFrontendFrameworkMode}". Use "npm" or "vendor".`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
+        else if (cliFrameworkMode === 'npm' || cliFrameworkMode === 'vendor') {
+            frontendFrameworkMode = cliFrameworkMode;
+            info(`Using frontend framework mode from --framework-mode: ${frontendFrameworkMode}`);
+        }
         else if (configFrontendFrameworkMode === 'npm' || configFrontendFrameworkMode === 'vendor') {
             frontendFrameworkMode = configFrontendFrameworkMode;
             info(`Using frontend framework mode from lt.config: ${frontendFrameworkMode}`);
         }
-        else if (noConfirm) {
-            frontendFrameworkMode = 'vendor';
+        else if (configFrameworkMode === 'npm' || configFrameworkMode === 'vendor') {
+            frontendFrameworkMode = configFrameworkMode;
+            info(`Using frontend framework mode from lt.config frameworkMode: ${frontendFrameworkMode}`);
         }
         else {
             // Default to vendor without asking (unless user sets it explicitly)
@@ -403,11 +423,13 @@ const NewCommand = {
         }
         catch (err) {
             workspaceSpinner.fail(`Failed to clone monorepo: ${err.message}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Check for directory
         if (!filesystem.isDirectory(`./${projectDir}`)) {
             workspaceSpinner.fail(`The directory "${projectDir}" could not be created.`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         workspaceSpinner.succeed(`Create fullstack workspace with ${frontend} in ${projectDir} for ${name} created`);
@@ -467,6 +489,7 @@ const NewCommand = {
         }
         catch (err) {
             error(`Failed to initialize git: ${err.message}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Add remote if push is configured
@@ -476,6 +499,7 @@ const NewCommand = {
             }
             catch (err) {
                 error(`Failed to add remote: ${err.message}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
         }
@@ -503,6 +527,7 @@ const NewCommand = {
         }
         if (!frontendResult.success) {
             error(`Failed to set up ${frontend} frontend: ${frontendResult.path}`);
+            (0, fail_run_1.failRun)(toolbox);
             return;
         }
         // Patch frontend .env with project-specific values (skip for linked templates)
@@ -546,6 +571,7 @@ const NewCommand = {
             });
             if (!apiResult.success) {
                 serverSpinner.fail(`Failed to set up API: ${apiResult.path}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
             // Auto-run `bun run rename <projectDir>` for the experimental nest-base
@@ -638,6 +664,7 @@ const NewCommand = {
                 }
                 catch (err) {
                     installSpinner.fail(`Failed to install packages: ${err.message}`);
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
             }
@@ -673,6 +700,7 @@ const NewCommand = {
             }
             catch (err) {
                 error(`Failed to create initial commit: ${err.message}`);
+                (0, fail_run_1.failRun)(toolbox);
                 return;
             }
             // Push to remote if configured
@@ -682,6 +710,7 @@ const NewCommand = {
                 }
                 catch (err) {
                     error(`Failed to push to remote: ${err.message}`);
+                    (0, fail_run_1.failRun)(toolbox);
                     return;
                 }
             }

package/build/commands/fullstack/update.js

@@ -198,7 +198,20 @@ const NewCommand = {
         const changedCheck = (0, heal_check_wrapper_1.healCheckWrapper)(cwd, checkAsset);
         if (changedCheck.length > 0) {
             info('');
-            success(`  Installed/updated the check wrapper: ${changedCheck.join(', ')}`);
+            // A skip entry is NOT a success — it means the wrapper stayed on its old
+            // version. Reporting the whole list through `success()` painted a refusal
+            // green.
+            const skipped = changedCheck.filter((entry) => entry.includes('skipped'));
+            const applied = changedCheck.filter((entry) => !entry.includes('skipped'));
+            if (applied.length > 0) {
+                success(`  Installed/updated the check wrapper: ${applied.join(', ')}`);
+                info('    `check` now serialises build/typecheck against the test suites,');
+                info('    so it takes longer in wall-clock but no longer destabilises API e2e runs.');
+                info('    The wrapper imports its siblings — keep them together, or `check` will not start.');
+            }
+            for (const entry of skipped) {
+                warning(`  Check wrapper NOT updated: ${entry}`);
+            }
         }
         // ── Self-heal: keep `.lt-dev/` out of git ──────────────────────────────
         //
@@ -209,6 +222,16 @@ const NewCommand = {
             info('');
             success('  Added `.lt-dev/` to .gitignore');
         }
+        // ── Self-heal: keep the check's isolated Nuxt build dir out of git ──────
+        //
+        // The check wrapper pins `NUXT_BUILD_DIR=.nuxt-check` so it never writes the
+        // `.nuxt/` a parked `nuxt dev` reads. Current starters already ignore it
+        // (via their `.nuxt-*` glob); projects scaffolded before that glob do not,
+        // and a build dir is a plausible place for a resolved runtimeConfig to be
+        // committed by accident. Idempotent.
+        if ((0, dev_patches_1.addToGitignore)(cwd, '.nuxt-check')) {
+            success('  Added `.nuxt-check` to .gitignore');
+        }
         // ── Self-heal: repair the vendor-mode migration store ──────────────────
         //
         // `migrations-utils/migrate.js` is written ONCE, at conversion time. Projects

package/build/commands/git/reset.js

@@ -46,7 +46,7 @@ const NewCommand = {
             return;
         }
         // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
-        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
+        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
         if (!remoteBranch) {
             error(`No remote branch ${branch} found!`);
             return;

package/build/commands/git/update.js

@@ -48,7 +48,7 @@ const NewCommand = {
             info(`Current branch: ${branch}`);
             info('');
             // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline)
-            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
+            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
             // Check for incoming commits
             const incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline 2>/dev/null || echo ""`);
             const commits = (incomingCommits === null || incomingCommits === void 0 ? void 0 : incomingCommits.trim().split('\n').filter((c) => c)) || [];
@@ -78,7 +78,7 @@ const NewCommand = {
         const timer = startTimer();
         // Update
         const updateSpin = spin(`Update branch ${branch}`);
-        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git pull --rebase');
+        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git pull --rebase');
         updateSpin.succeed();
         // Install packages (unless skipped) with correctly detected package manager (supports monorepo lockfiles)
         if (!skipInstall) {

package/build/extensions/frontend-helper.js

@@ -13,6 +13,7 @@ exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const strip_comments_1 = require("../lib/strip-comments");
+const strip_vendor_schema_augmentation_1 = require("../lib/strip-vendor-schema-augmentation");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
  * Frontend helper functions for project scaffolding
@@ -520,6 +521,24 @@ class FrontendHelper {
             this.rewriteConsumerImportsToVendor(dest);
             // ── 4. Rewrite nuxt.config.ts module entry ──────────────────────────
             this.rewriteNuxtConfig(dest, 'vendor');
+            // ── 4b. Drop the core's `nuxt/schema` runtime-config augmentation ────
+            //
+            // Harmless inside node_modules, poisonous as project source: it augments the
+            // same interface under both `nuxt/schema` and `@nuxt/schema` (the former
+            // re-exports the latter) and closes a cycle with Nuxt's generated
+            // runtime-config types. TS2310 — suppressed by `skipLibCheck`, so all a
+            // developer sees is every `config.public.*` typed `unknown`. See the lib for
+            // the measurement.
+            const strippedAugmentation = (0, strip_vendor_schema_augmentation_1.stripVendorSchemaAugmentation)({ coreDir, filesystem });
+            if (strippedAugmentation.touched.length > 0) {
+                this.toolbox.print.info(`  vendored core: removed the nuxt/schema runtime-config augmentation from ${strippedAugmentation.touched.length} file(s) — keeps config.public.* typed`);
+            }
+            // A block the transform could not process is left in place, which means the
+            // TS2310 bug ships with the project. Silence there would be the worst of both
+            // worlds: the conversion reports success and the typing is broken anyway.
+            for (const warning of strippedAugmentation.warnings) {
+                this.toolbox.print.warning(`  ⚠ vendored core: ${warning}`);
+            }
             // ── 5. package.json: remove @lenne.tech/nuxt-extensions, merge deps ─
             const pkgPath = path.join(dest, 'package.json');
             if (filesystem.exists(pkgPath)) {

package/build/extensions/git.js

@@ -120,7 +120,7 @@ class Git {
             // Toolbox features
             const { system } = this.toolbox;
             // Get branches (use short SSH timeout so fetch doesn't hang in offline environments)
-            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null; git show-branch --list');
+            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null; git show-branch --list');
             branches.split('\n').forEach((item) => {
                 const matches = item.match(/\[(.*?)]/);
                 if (matches) {
@@ -197,6 +197,27 @@ class Git {
     /**
      * Check if git is installed (cached for performance)
      */
+    /**
+     * Why the git calls in this repo spell `GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-…}"` (shell default)
+     * rather than assigning it outright.
+     *
+     * These commands do a best-effort `git fetch` to see whether the branch is
+     * behind. They set `BatchMode=yes` so ssh fails instead of PROMPTING — but an
+     * agent that stalls is not a prompt. On a 1Password-backed machine the agent is
+     * reachable and every signature needs an interactive approval; unattended it
+     * waits and then reports `communication with agent failed`. Measured: **61 s per
+     * fetch**, so `lt git update --dry-run` took 62 s and `lt git create --dry-run`
+     * 123 s (two fetches). `ConnectTimeout` does not bound it — that covers the TCP
+     * connect, not the agent.
+     *
+     * Waiting for a human to approve a key is legitimate for an interactive command,
+     * so the default is unchanged. What was wrong is that the assignment was
+     * UNCONDITIONAL: it overrode a caller who had deliberately configured ssh,
+     * including a test harness trying to make the behaviour deterministic. The
+     * `:-` default respects an existing value and keeps the old behaviour when there
+     * is none. `IdentityAgent=none` in the caller's env then drops the same fetch to
+     * ~1 s with a clean `Permission denied (publickey)`.
+     */
     gitInstalled() {
         return __awaiter(this, void 0, void 0, function* () {
             // Return cached result if available
@@ -252,7 +273,7 @@ class Git {
                 searchSpin = spin(opts.spinText);
             }
             // Update infos (use short SSH timeout so fetch doesn't hang in offline environments)
-            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="ssh -o ConnectTimeout=5 -o BatchMode=yes" git fetch 2>/dev/null || true');
+            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
             if (fetch.length && !fetch.startsWith('remote')) {
                 info(`Could not update infos ${fetch.length}`);
             }

package/build/extensions/server.js

@@ -46,6 +46,7 @@ exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
+const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
 const strip_comments_1 = require("../lib/strip-comments");
@@ -1021,6 +1022,22 @@ class Server {
                 // Best-effort — without the lockfile, the closure step falls back to
                 // the upstream package.json ranges (still better than nothing).
             }
+            // Snapshot the upstream pnpm-workspace.yaml. It carries `allowBuilds`, the map
+            // that decides which packages may run install scripts — and vendoring is what
+            // makes the framework's entries the PROJECT's problem: step 5b turns the core's
+            // import closure into direct dependencies, so packages nest-server knew about
+            // (bullmq → msgpackr → msgpackr-extract) become the project's own. pnpm 11 aborts
+            // the install outright on an unlisted one, so a missing entry is an unusable
+            // project rather than a warning. This file is NOT in nest-server's npm tarball,
+            // so the clone is the only moment it can be read at all.
+            let upstreamWorkspaceYaml = '';
+            try {
+                upstreamWorkspaceYaml = filesystem.read(`${tmpClone}/pnpm-workspace.yaml`) || '';
+            }
+            catch (_c) {
+                // Best-effort: an older framework revision may predate the file. The project
+                // then keeps exactly the allowlist its own template shipped.
+            }
             // Snapshot the upstream CLAUDE.md for section-merge into projects/api/CLAUDE.md.
             // The nest-server CLAUDE.md contains framework-specific instructions that
             // Claude Code needs to work correctly with the vendored source (API conventions,
@@ -1033,7 +1050,7 @@ class Server {
                     upstreamClaudeMd = claudeMdContent;
                 }
             }
-            catch (_c) {
+            catch (_d) {
                 // Non-fatal — if missing, the project CLAUDE.md just won't get upstream sections.
             }
             // Snapshot the upstream commit SHA for traceability in VENDOR.md.
@@ -1042,7 +1059,7 @@ class Server {
                 const sha = yield system.run(`git -C ${tmpClone} rev-parse HEAD`);
                 upstreamCommit = (sha || '').trim();
             }
-            catch (_d) {
+            catch (_e) {
                 // Non-fatal — VENDOR.md will just show an empty SHA.
             }
             try {
@@ -1325,7 +1342,7 @@ class Server {
                             }
                         }
                     }
-                    catch (_e) {
+                    catch (_f) {
                         // skip unreadable file
                     }
                 }
@@ -1503,6 +1520,14 @@ class Server {
                         upstreamDeps,
                         upstreamDevDeps,
                     });
+                    // The closure above just made framework-only packages direct dependencies of
+                    // this project. Their build-script decisions have to come along, or the first
+                    // `pnpm install` stops on ERR_PNPM_IGNORED_BUILDS. Additive only — a decision
+                    // the project already made is never overwritten.
+                    const adoptedBuilds = (0, adopt_upstream_build_allowlist_1.adoptUpstreamBuildAllowlist)({ dest, filesystem, upstreamWorkspaceYaml });
+                    if (adoptedBuilds.length > 0) {
+                        this.toolbox.print.info(`  vendored core allowlist: adopted ${adoptedBuilds.length} build decision(s) from nest-server → ${adoptedBuilds.join(', ')}`);
+                    }
                     // Add a script to run the local bin/migrate.js. The starter's
                     // existing migrate:* scripts are already correct for npm mode; we
                     // need them pointing at the local bin + local ts-compiler.