@lenne.tech/cli 1.45.0 → 1.46.0

package/build/commands/dev/up.js

@@ -354,6 +354,9 @@ const UpCommand = {
         // Build env per process.
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
+            // Lets `buildDevEnv` consult the app's own `.env` for keys a project may have set
+            // itself, so `lt dev` never replaces one of its values with a derived fallback.
+            appDir: layout.appDir,
             appInternalPort: appPort !== null && appPort !== void 0 ? appPort : 0,
             baseEnv: process.env,
             dbName,

package/build/lib/dev-env-bridge.js

@@ -16,8 +16,11 @@ exports.writeEnvBridge = writeEnvBridge;
  * Shell B does not inherit shell A's exports. Reading a file solves
  * this without polluting global state.
  *
- * The file is gitignored via `.lt-dev/`. It contains only public URLs +
- * the local CA path — no secrets. Format: standard dotenv KEY=VALUE.
+ * The file is gitignored via `.lt-dev/` and written 0600, because it is no longer
+ * URLs only: `NUXT_SESSION_PASSWORD` is a session-sealing key. Usually that is the
+ * value `lt dev` derived itself, but when the project exported its own it is THAT
+ * one being copied here — so treat the file as credential-bearing, and think twice
+ * before adding a key to it. Format: standard dotenv KEY=VALUE.
  */
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -84,6 +87,11 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
         'NUXT_PUBLIC_SITE_URL',
         'NUXT_PUBLIC_STORAGE_PREFIX',
         'NUXT_PUBLIC_API_PROXY',
+        // Not needed by the runner itself, but external suites check it to tell a stack that
+        // can log in from one that will 500 on every login, and a suite that seals its own
+        // session cookie to skip the login form needs the value (see dev-env.ts). This is the
+        // one credential-shaped key in the bridge — it is why the file is written 0600.
+        'NUXT_SESSION_PASSWORD',
         'NSC__MONGOOSE__URI',
         'DATABASE_URL',
         // Legacy aliases — see dev-env.ts for the rationale.
@@ -107,6 +115,9 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
     if ((0, fs_1.existsSync)(file) && (0, fs_1.readFileSync)(file, 'utf8') === content)
         return file;
     (0, fs_1.mkdirSync)((0, path_1.dirname)(file), { recursive: true });
-    (0, fs_1.writeFileSync)(file, content, 'utf8');
+    (0, fs_1.writeFileSync)(file, content, { encoding: 'utf8', mode: 0o600 });
+    // `mode` only applies when the file is CREATED, so an existing bridge from an older
+    // lt version would keep its 0644. chmod unconditionally to heal those.
+    (0, fs_1.chmodSync)(file, 0o600);
     return file;
 }

package/build/lib/dev-env.js

@@ -14,6 +14,8 @@ exports.buildDevEnv = buildDevEnv;
  * - `NUXT_PUBLIC_*` lock the App to its own API
  * - `NUXT_PUBLIC_STORAGE_PREFIX` namespaces localStorage/sessionStorage
  * - `NSC__MONGOOSE__URI` / `DATABASE_URL` namespace the database per project
+ * - `NUXT_SESSION_PASSWORD` is keyed per slug, so a session cookie sealed by one
+ *   stack cannot be unsealed by another (dev vs. `-test` vs. `-test-N` shard)
  *
  * CA trust for SSR fetches:
  * - Both API and App receive `NODE_EXTRA_CA_CERTS` pointing at the
@@ -21,6 +23,10 @@ exports.buildDevEnv = buildDevEnv;
  *   subdomains succeed. Without this Nuxt SSR fails with "unable to
  *   get local issuer certificate" when the app calls its own API.
  */
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
 const dev_env_bridge_1 = require("./dev-env-bridge");
 /**
  * Build the environment maps for both API and App processes.
@@ -29,7 +35,8 @@ const dev_env_bridge_1 = require("./dev-env-bridge");
  * vars survive. `lt dev`-managed keys win on top.
  */
 function buildDevEnv(input) {
-    const { apiInternalPort, appInternalPort, baseEnv = {}, dbName, identity } = input;
+    var _a;
+    const { apiInternalPort, appDir, appInternalPort, baseEnv = {}, dbName, identity } = input;
     const apiSub = identity.subdomains.api;
     const appSub = identity.subdomains.app;
     const apiUrl = apiSub ? `https://${apiSub.hostname}` : '';
@@ -52,14 +59,18 @@ function buildDevEnv(input) {
             internalPort: apiInternalPort,
         },
         app: {
-            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
+            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
                 // See API note above: pin the dev server to IPv4 so Caddy's
                 // `127.0.0.1` upstream is unambiguous.
                 HOST: '127.0.0.1', NITRO_HOST: '127.0.0.1' }), (apiUrl ? { API_URL: apiUrl, NUXT_API_URL: apiUrl, NUXT_PUBLIC_API_URL: apiUrl } : {})), (appUrl ? { NUXT_PUBLIC_SITE_URL: appUrl, SITE_URL: appUrl } : {})), { 
                 // Vite-API-Proxy is OFF by default in lt dev mode — Caddy serves
                 // both subdomains under HTTPS with shared cookie domain, so
                 // same-origin trickery is no longer required.
-                NUXT_PUBLIC_API_PROXY: 'false', NUXT_PUBLIC_STORAGE_PREFIX: identity.slug, PORT: String(appInternalPort) }), (process.platform === 'darwin' ? { TMPDIR: '/tmp' } : {})),
+                NUXT_PUBLIC_API_PROXY: 'false', NUXT_PUBLIC_STORAGE_PREFIX: identity.slug }), (baseEnv.NUXT_SESSION_PASSWORD
+                ? {}
+                : {
+                    NUXT_SESSION_PASSWORD: (_a = readEnvFileValue(appDir, 'NUXT_SESSION_PASSWORD')) !== null && _a !== void 0 ? _a : deriveSessionPassword(identity.slug),
+                })), { PORT: String(appInternalPort) }), (process.platform === 'darwin' ? { TMPDIR: '/tmp' } : {})),
             internalPort: appInternalPort,
         },
     };
@@ -68,3 +79,106 @@ function buildDevEnv(input) {
 function buildPostgresUrl(dbName) {
     return `postgresql://${dbName}:${dbName}@localhost:5432/${dbName}`;
 }
+/**
+ * Stable local session password for a project's app process.
+ *
+ * 32 hex chars — h3's floor. Deterministic per slug AND per machine: the same stack on the
+ * same machine always gets the same value, so a restart does not invalidate open sessions,
+ * while a different slug (or a different developer's machine) gets a different one.
+ *
+ * The machine salt is what makes it unguessable. Without it the only input is the slug, which
+ * the app publishes itself via `NUXT_PUBLIC_STORAGE_PREFIX`, so anyone who loaded a page —
+ * including any visitor of a `lt dev tunnel` URL — could recompute the key and forge a sealed
+ * session cookie. With it, an attacker would have to read the developer's home directory.
+ */
+function deriveSessionPassword(slug) {
+    var _a;
+    // No salt means the home directory is unwritable. Fall back to a constant key rather than a
+    // random one: determinism is the property every caller depends on, and a fresh value per run
+    // would log everybody out on every restart. The fallback is guessable — hence last resort.
+    return (0, node_crypto_1.createHmac)('sha256', (_a = machineSessionSalt()) !== null && _a !== void 0 ? _a : 'lt-dev')
+        .update(`lt-dev:session:${slug}`)
+        .digest('hex')
+        .slice(0, 32);
+}
+/**
+ * Read (or create) the machine-local salt at `~/.lenneTech/dev-session-salt`, mode 0600.
+ *
+ * Returns `null` when it can be neither read nor created — see {@link deriveSessionPassword}
+ * for what happens then.
+ */
+function machineSessionSalt() {
+    const file = sessionSaltPath();
+    try {
+        const existing = (0, node_fs_1.readFileSync)(file, 'utf8').trim();
+        if (existing) {
+            return existing;
+        }
+    }
+    catch (_a) {
+        // Not created yet — fall through and create it.
+    }
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(file), { recursive: true });
+        // `wx` fails when the file already exists, so two shards racing on a cold machine can
+        // never end up with two different salts: the loser falls into the catch and re-reads.
+        const salt = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        (0, node_fs_1.writeFileSync)(file, `${salt}\n`, { flag: 'wx', mode: 0o600 });
+        return salt;
+    }
+    catch (_b) {
+        try {
+            return (0, node_fs_1.readFileSync)(file, 'utf8').trim() || null;
+        }
+        catch (_c) {
+            return null;
+        }
+    }
+}
+/**
+ * Read one key out of `<dir>/.env` without pulling in a dotenv dependency.
+ *
+ * Deliberately minimal: no interpolation, no multi-line values, no `.env.local` cascade. It
+ * exists to answer one question — did the project set this key itself? — for a value the built
+ * Nitro server would otherwise never see.
+ */
+function readEnvFileValue(dir, key) {
+    if (!dir) {
+        return undefined;
+    }
+    let content;
+    try {
+        content = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, '.env'), 'utf8');
+    }
+    catch (_a) {
+        return undefined;
+    }
+    for (const line of content.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        const eq = trimmed.indexOf('=');
+        if (eq === -1) {
+            continue;
+        }
+        if (trimmed
+            .slice(0, eq)
+            .replace(/^export\s+/, '')
+            .trim() !== key) {
+            continue;
+        }
+        const raw = trimmed.slice(eq + 1).trim();
+        const quoted = raw.length >= 2 && ((raw.startsWith('"') && raw.endsWith('"')) || (raw.startsWith("'") && raw.endsWith("'")));
+        return (quoted ? raw.slice(1, -1) : raw) || undefined;
+    }
+    return undefined;
+}
+/**
+ * Path of the machine-local salt. `LT_DEV_SESSION_SALT_PATH` overrides it, and `HOME` is read
+ * before `os.homedir()` — both so tests can redirect the write to a tmpdir, the same reason
+ * `dev-service.ts#userHome` does it.
+ */
+function sessionSaltPath() {
+    return process.env.LT_DEV_SESSION_SALT_PATH || (0, node_path_1.join)(process.env.HOME || (0, node_os_1.homedir)(), '.lenneTech', 'dev-session-salt');
+}

package/build/lib/dev-patches.js

@@ -157,7 +157,7 @@ function patchClaudeMd(file, options) {
     if (dbName)
         lines.push(`- DB: \`mongodb://127.0.0.1/${dbName}\``);
     lines.push('');
-    lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
+    lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NUXT_SESSION_PASSWORD`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
     lines.push('');
     lines.push(endMarker);
     const block = lines.join('\n');

package/build/lib/dev-test-session.js

@@ -274,6 +274,9 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         log.info('');
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
+            // The built server this stack runs reads no `.env` at all, so a key the project set
+            // there has to be forwarded explicitly — that is the whole reason this argument exists.
+            appDir: layout.appDir,
             appInternalPort: appPort !== null && appPort !== void 0 ? appPort : 0,
             baseEnv: process.env,
             dbName,

package/build/lib/ensure-root-dockerignore.js

@@ -16,8 +16,15 @@ exports.ensureRootDockerignore = ensureRootDockerignore;
 // bundle itself changes.
 const REQUIRED_PATTERNS = [
     '**/node_modules',
+    // `**/.output` matches a path component EXACTLY, so the isolated build dirs of
+    // `lt dev test` (`.output-test`, `.nuxt-test`, `.nuxt-test-2`, …) need their own
+    // globs. They are built with the app's full dev env, so Nitro freezes values like
+    // `NUXT_SESSION_PASSWORD` into them as runtime-config defaults — and a `--keep`
+    // run or a crashed teardown leaves the tree on disk for the next `docker build`.
     '**/.output',
+    '**/.output-*',
     '**/.nuxt',
+    '**/.nuxt-*',
     '**/dist',
     // `**/.env` matches a path component EXACTLY, so it does NOT cover
     // `.env.production` / `.env.staging` / `.env.test` — all of which routinely

package/docs/commands.md

@@ -451,9 +451,24 @@ lt dev up
 | `NUXT_PUBLIC_SITE_URL` | Nuxt `useRuntimeConfig().public.siteUrl` + Playwright | `https://crm.localhost` |
 | `NUXT_PUBLIC_STORAGE_PREFIX` | namespaces sessionStorage/localStorage | `crm` |
 | `NUXT_PUBLIC_API_PROXY` | always `false` — Caddy + cookie-domain make it obsolete | `false` |
+| `NUXT_SESSION_PASSWORD` | Nuxt/h3 `useSession` — only projects that added h3 sessions or `nuxt-auth-utils` read it; the Better-Auth default stack ignores it | `a1b2…` (32 hex chars) |
 | `NSC__MONGOOSE__URI` | nest-server Mongoose URI | `mongodb://127.0.0.1/crm-local` |
 | `DATABASE_URL` | Postgres convenience URL (for nest-base-style projects) | `postgresql://crm-local:crm-local@localhost:5432/crm-local` |
 
+`NUXT_SESSION_PASSWORD` exists because `lt dev test` serves the **built** Nitro server, which
+reads no `.env` — so a project that keeps its password there watched every login answer 500
+(`H3Error: Empty password`). Resolution order: a value exported in the shell, then the app's own
+`.env`, then a fallback derived as `HMAC-SHA256(machine salt, 'lt-dev:session:<slug>')` truncated
+to 32 hex chars. `lt dev` only fills the gap — it never replaces a value the project chose.
+
+The salt lives at `~/.lenneTech/dev-session-salt` (created once, mode 0600; override the path with
+`LT_DEV_SESSION_SALT_PATH`). It is what makes the value unguessable: the slug itself is public —
+the app ships it to every browser as `NUXT_PUBLIC_STORAGE_PREFIX`, and `lt dev tunnel` can put
+that app on a public URL — so an unsalted derivation would hand any visitor the key that seals
+the stack's session cookies. Keying on the slug also means the dev stack, the `lt dev test` stack
+and each `--shard` stack get **different** passwords, so one stack's cookies never validate
+against another's.
+
 **Override the binary** for both spawns via `LT_PNPM_BIN` (e.g. `LT_PNPM_BIN=/usr/local/bin/pnpm lt dev up`).
 
 **Pre-flight guards (exit code 1 each):**
@@ -685,10 +700,16 @@ lt dev test -- --ui spec.ts      # everything after `--` is forwarded to playwri
 | `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL` | Same URLs for Nuxt |
 | `NUXT_PUBLIC_STORAGE_PREFIX` | Project slug |
 | `NUXT_PUBLIC_API_PROXY` | Always `false` under `lt dev` |
+| `NUXT_SESSION_PASSWORD` | The app process's h3 session password — lets a suite tell a stack that can log in from one that 500s on every login, and seal its own cookie to skip the login form |
 | `NSC__MONGOOSE__URI`, `DATABASE_URL` | Project-namespaced DB URI (when `dbName` known) |
 | `LT_DEV_ACTIVE`, `LT_DEV_DB_NAME` | Marker keys for consumers |
 | `NODE_EXTRA_CA_CERTS` | Path to Caddy's root CA cert (auto-detected) |
 
+Because `NUXT_SESSION_PASSWORD` is a session-sealing key, the bridge file is written with mode
+`0600` (and chmod'ed on every rewrite, since a file created by an older `lt` would otherwise keep
+its `0644`). It is gitignored via `.lt-dev/`. Treat it as credential-bearing when deciding what
+else may be written there.
+
 Additionally, `lt dev test` exports two build-directory keys into the app process it
 spawns. They are **not** written to the bridge file — they scope one run, not the
 project:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.45.0",
+  "version": "1.46.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -77,7 +77,13 @@
     "turndown-plugin-gfm": "1.0.2",
     "typescript": "6.0.3"
   },
+  "//devDependencies": {
+    "@emnapi/core": "Not imported by this CLI. @napi-rs/wasm-runtime 1.x moved @emnapi/core and @emnapi/runtime from dependencies to peerDependencies (napi-rs#3174), and the only path to them here is dev-only AND optional: eslint-plugin-import-x / jest-resolve > unrs-resolver > @unrs/resolver-binding-wasm32-wasi (cpu: wasm32) > @napi-rs/wasm-runtime. npm >= 11.5.0 (arborist 9.1.3) prunes nodes that are both peer and optional from the ideal tree, so it never writes them to the lockfile — while npm <= 11.4 still demands them and fails npm ci with \"Missing: @emnapi/core@1.11.3 from lock file\". Declaring them here is the remedy arborist's own source comment names: an optional peer stops being optional once a root dependency requires it, so both npm generations then agree. Verified: npm ci passes on npm 10 and 11.6, and npm install no longer strips the entries. Remove once @napi-rs/wasm-runtime declares them in peerDependenciesMeta as optional, or once npm >= 11.5 is the floor everywhere (GitHub Actions still runs Node 20 = npm 10).",
+    "@emnapi/runtime": "Same as @emnapi/core."
+  },
   "devDependencies": {
+    "@emnapi/core": "^1.11.3",
+    "@emnapi/runtime": "^1.11.3",
     "@lenne.tech/eslint-config-ts": "2.3.0",
     "@lenne.tech/npm-package-helper": "0.0.12",
     "@types/ejs": "3.1.5",