@lenne.tech/cli 1.45.0 → 1.47.0

package/bin/postinstall.js

@@ -3,9 +3,13 @@
 /**
  * Postinstall script for lt CLI
  * Generates static completion files on install/update (no runtime overhead)
+ *
+ * Must never fail the install: npm runs this through cmd.exe on Windows, so the
+ * former `2>/dev/null || true` guard in package.json broke `npm i -g` there
+ * instead of protecting it. The guard now lives in this file (see bottom).
  */
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } = require('fs');
 const { homedir } = require('os');
 const { join } = require('path');
@@ -26,11 +30,17 @@ function addSourceLine(configFile, sourceLine) {
 
 /**
  * Detect user's shell
+ *
+ * Returns null when no supported shell can be identified. On Windows an unset
+ * SHELL means PowerShell or cmd.exe, which read none of the rc files below —
+ * appending to a ~/.bashrc nothing sources would only leave clutter behind.
+ * Git Bash sets SHELL, so it still gets bash completions.
  */
 function detectShell() {
   const shell = process.env.SHELL || '';
   if (shell.includes('zsh')) return 'zsh';
   if (shell.includes('fish')) return 'fish';
+  if (!shell && process.platform === 'win32') return null;
   return 'bash';
 }
 
@@ -45,8 +55,13 @@ function generateCompletionFile(shell, completionFile) {
       mkdirSync(dir, { recursive: true });
     }
 
-    // Generate completion script
-    const script = execSync(`lt completion ${shell}`, { encoding: 'utf-8' });
+    // Run this package's own entry point with the current Node binary instead of
+    // resolving `lt` from PATH: during a global install the bin link may not exist
+    // yet, and on Windows `lt` is a .cmd shim that cannot be spawned without a shell.
+    const script = execFileSync(process.execPath, [join(__dirname, 'lt'), 'completion', shell], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
     writeFileSync(completionFile, script);
     return true;
   } catch {
@@ -109,6 +124,10 @@ function main() {
   }
 
   const shell = detectShell();
+  if (!shell) {
+    return; // No supported shell (e.g. PowerShell) - nothing to install
+  }
+
   const paths = getCompletionPaths(shell);
   const isTTY = process.stdout.isTTY;
 
@@ -152,5 +171,9 @@ function main() {
   }
 }
 
-// Run
-main();
+// Run - completions are a convenience, so no failure may abort the install
+try {
+  main();
+} catch {
+  // Silent fail
+}

package/build/commands/dev/doctor.js

@@ -169,7 +169,7 @@ const DoctorCommand = {
             try {
                 const { readFileSync: read } = yield Promise.resolve().then(() => __importStar(require('fs')));
                 const { join: j } = yield Promise.resolve().then(() => __importStar(require('path')));
-                const { resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
+                const { keptWrapperReason, resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
                 const bundledCheck = j(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
                 if (filesystem.exists(bundledCheck)) {
                     const missing = [];
@@ -183,12 +183,26 @@ const DoctorCommand = {
                             drifted.push(rel);
                         }
                     }
-                    if (missing.length > 0) {
+                    // A missing module only breaks `check` when the project's wrapper is the
+                    // canonical one that imports it (or the wrapper itself is missing). An
+                    // older wrapper does not import the newer modules (e.g. `lib/*.mjs`) and
+                    // still runs — calling that "cannot start" would be a false alarm.
+                    const wrapperDrifted = drifted.includes('scripts/check.mjs');
+                    // A project wrapper that heal refuses to replace (newer release, or the same
+                    // release with other content) is not drift to fix: pointing at
+                    // `lt fullstack update` there would recommend a no-op or a downgrade.
+                    const kept = keptWrapperReason(layout.root, bundledCheck);
+                    if (kept) {
+                        line('INFO', colors.cyan, `check wrapper: ${kept}`);
+                    }
+                    else if (missing.length > 0 && !wrapperDrifted) {
                         line('ERROR', colors.red, `check wrapper incomplete — missing ${missing.join(', ')}`);
                         line('ERROR', colors.red, '  `pnpm run check` cannot start; run `lt fullstack update` to install it');
                     }
                     else if (drifted.length > 0) {
-                        line('WARN', colors.yellow, `${drifted.join(', ')} differs from the canonical CLI version`);
+                        const outdated = [...drifted, ...missing.map((rel) => `${rel} (missing)`)];
+                        const verb = outdated.length === 1 ? 'differs' : 'differ';
+                        line('WARN', colors.yellow, `${outdated.join(', ')} ${verb} from the canonical CLI version`);
                         line('WARN', colors.yellow, '  run `lt fullstack update` to sync it (skips uncommitted local edits)');
                     }
                     else if (filesystem.exists(j(layout.root, 'scripts', 'check.mjs'))) {
@@ -199,6 +213,34 @@ const DoctorCommand = {
             catch (_a) {
                 /* best-effort diagnostics */
             }
+            // 7.6 oxlint config filename: oxlint only auto-discovers `.oxlintrc.json`.
+            //     Apps from the template before the rename carry `oxlint.json`, whose
+            //     rules then silently never apply — lint passes on code the project's
+            //     own rules forbid.
+            if (layout.appDir) {
+                // Behaviour-changing fix flags delete console calls once rules load.
+                try {
+                    const { findDangerousFixFlagUsage } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-oxlintrc')));
+                    const workspaceRoot = layout.root !== layout.appDir ? layout.root : undefined;
+                    const flagged = findDangerousFixFlagUsage(layout.appDir, workspaceRoot);
+                    if (flagged.length > 0) {
+                        line('WARN', colors.yellow, `oxlint --fix-suggestions/--fix-dangerously in ${flagged.join(', ')}`);
+                        line('WARN', colors.yellow, '  they apply behaviour-changing fixes (e.g. delete console calls); run `lt fullstack update`');
+                    }
+                }
+                catch (_b) {
+                    /* best-effort diagnostics */
+                }
+                const hasLegacy = filesystem.exists(filesystem.path(layout.appDir, 'oxlint.json'));
+                const hasCurrent = filesystem.exists(filesystem.path(layout.appDir, '.oxlintrc.json'));
+                if (hasLegacy && !hasCurrent) {
+                    line('WARN', colors.yellow, 'oxlint config not loaded — oxlint only reads .oxlintrc.json, the app has oxlint.json');
+                    line('WARN', colors.yellow, '  run `lt fullstack update` to rename it');
+                }
+                else if (hasLegacy) {
+                    line('WARN', colors.yellow, 'oxlint.json is ignored next to .oxlintrc.json — merge its rules and delete it');
+                }
+            }
             // 8. Slug ↔ path: is this project's slug registered to a DIFFERENT checkout?
             //    Two clones of the same project (same package.json "name") share the
             //    slug → Caddy block / ports / DB and collide. Surface it proactively.

package/build/commands/dev/up.js

@@ -354,6 +354,9 @@ const UpCommand = {
         // Build env per process.
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
+            // Lets `buildDevEnv` consult the app's own `.env` for keys a project may have set
+            // itself, so `lt dev` never replaces one of its values with a derived fallback.
+            appDir: layout.appDir,
             appInternalPort: appPort !== null && appPort !== void 0 ? appPort : 0,
             baseEnv: process.env,
             dbName,

package/build/commands/fullstack/update.js

@@ -14,6 +14,7 @@ const dev_patches_1 = require("../../lib/dev-patches");
 const framework_detection_1 = require("../../lib/framework-detection");
 const frontend_framework_detection_1 = require("../../lib/frontend-framework-detection");
 const heal_check_wrapper_1 = require("../../lib/heal-check-wrapper");
+const heal_oxlintrc_1 = require("../../lib/heal-oxlintrc");
 const heal_vendor_migrate_store_1 = require("../../lib/heal-vendor-migrate-store");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 /**
@@ -213,6 +214,36 @@ const NewCommand = {
                 warning(`  Check wrapper NOT updated: ${entry}`);
             }
         }
+        // ── Self-heal: let oxlint actually load the app's config ───────────────
+        //
+        // oxlint only auto-discovers `.oxlintrc.json`; the app template shipped
+        // `oxlint.json`, so its rules never applied. Runs AFTER the check wrapper
+        // heal on purpose: the rename is refused while anything still passes
+        // `--fix-suggestions`, which would delete console calls once the config loads.
+        if (appDir) {
+            const workspaceRoot = isWorkspace ? cwd : undefined;
+            // 1. Strip the behaviour-changing fix flags first (the root wrapper was
+            // handled above). A file it has to skip keeps blocking the rename below.
+            const flags = (0, heal_oxlintrc_1.healDangerousOxlintFixFlags)(appDir, workspaceRoot);
+            if (flags.changed.length > 0) {
+                info('');
+                success(`  Removed --fix-suggestions/--fix-dangerously from: ${flags.changed.join(', ')}`);
+            }
+            for (const entry of flags.skipped) {
+                warning(`  Fix flag NOT removed: ${entry}`);
+            }
+            // 2. Rename — the gate inside re-checks every file.
+            const oxlintrc = (0, heal_oxlintrc_1.healOxlintrcFilename)(appDir, workspaceRoot);
+            if (oxlintrc.action === 'renamed') {
+                info('');
+                success(`  Renamed the oxlint config so oxlint loads it: ${oxlintrc.changed.join(', ')}`);
+                info('    Its rules apply from now on — expect new lint findings on the next check.');
+            }
+            else if (oxlintrc.detail) {
+                info('');
+                warning(`  oxlint config NOT renamed: ${oxlintrc.detail}`);
+            }
+        }
         // ── Self-heal: keep `.lt-dev/` out of git ──────────────────────────────
         //
         // Newer templates ship the entry, but pre-existing projects predate it —

package/build/lib/check-template-sync.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHECK_TEMPLATE_PIN_FILE = exports.CHECK_TEMPLATE_REPOSITORY = void 0;
+exports.readCheckTemplatePin = readCheckTemplatePin;
+exports.syncCheckTemplate = syncCheckTemplate;
+exports.verifyCheckTemplate = verifyCheckTemplate;
+/**
+ * Keep `src/templates/check/` a verbatim copy of a PINNED lt-monorepo state.
+ *
+ * lt-monorepo is the upstream of the check wrapper. The copy here drifted two
+ * releases behind once, and because heal treats the bundled copy as canonical,
+ * `lt fullstack update` then downgraded freshly created projects. So the
+ * template is never edited by hand: `npm run sync:check-template -- --ref <tag|sha>`
+ * copies the wrapper plus its transitive imports from that ref and records the
+ * commit and a hash per file in a pin file. A Jest test compares the template
+ * against that pin without any network access.
+ */
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const heal_check_wrapper_1 = require("./heal-check-wrapper");
+exports.CHECK_TEMPLATE_REPOSITORY = 'lenneTech/lt-monorepo';
+exports.CHECK_TEMPLATE_PIN_FILE = 'lt-monorepo-pin.json';
+const DEFAULT_FROM = `https://github.com/${exports.CHECK_TEMPLATE_REPOSITORY}.git`;
+/** Read a pin file; null when it is missing or unparseable. */
+function readCheckTemplatePin(pinPath) {
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(pinPath, 'utf8'));
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/**
+ * Copy `scripts/check.mjs` and its transitive relative imports from `ref` into
+ * the template dir and write the pin. Files the previous pin listed but the new
+ * closure no longer contains are removed; nothing else in the dir is touched.
+ *
+ * Refuses a source without an `@lt-check-wrapper` marker: an unversioned
+ * template would switch the downgrade guard in heal off without a trace.
+ */
+function syncCheckTemplate(options) {
+    var _a, _b;
+    const { from = DEFAULT_FROM, ref, templateDir } = options;
+    const pinPath = (_a = options.pinPath) !== null && _a !== void 0 ? _a : (0, path_1.join)(templateDir, exports.CHECK_TEMPLATE_PIN_FILE);
+    const checkout = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'lt-check-template-'));
+    try {
+        const git = (...args) => (0, child_process_1.execFileSync)('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+        git('clone', '--quiet', '--no-checkout', from, checkout);
+        git('-C', checkout, '-c', 'advice.detachedHead=false', 'checkout', '--quiet', ref);
+        const commit = git('-C', checkout, 'rev-parse', 'HEAD');
+        const asset = (0, path_1.join)(checkout, 'scripts', 'check.mjs');
+        if (!(0, fs_1.existsSync)(asset)) {
+            throw new Error(`${ref}: scripts/check.mjs not found`);
+        }
+        const version = (0, heal_check_wrapper_1.readWrapperVersion)(asset);
+        if (!version) {
+            throw new Error(`${ref}: scripts/check.mjs carries no @lt-check-wrapper marker — refusing to pin it`);
+        }
+        if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+            throw new Error(`${ref}: @lt-check-wrapper marker "${version}" is not a version — refusing to pin it`);
+        }
+        const previous = readCheckTemplatePin(pinPath);
+        const files = {};
+        for (const { rel, source } of (0, heal_check_wrapper_1.resolveCopySet)(asset)) {
+            const name = rel.replace(/^scripts\//, '');
+            const target = (0, path_1.join)(templateDir, name);
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(target), { recursive: true });
+            (0, fs_1.copyFileSync)(source, target);
+            files[name] = hashFile(target);
+        }
+        for (const stale of Object.keys((_b = previous === null || previous === void 0 ? void 0 : previous.files) !== null && _b !== void 0 ? _b : {})) {
+            // Names come from the pin file; never let one reach outside the template dir.
+            if (!(stale in files) && !stale.split(/[\\/]/).includes('..')) {
+                (0, fs_1.rmSync)((0, path_1.join)(templateDir, stale), { force: true });
+            }
+        }
+        const pin = {
+            commit,
+            files: sortKeys(files),
+            ref,
+            repository: exports.CHECK_TEMPLATE_REPOSITORY,
+            version,
+        };
+        (0, fs_1.writeFileSync)(pinPath, `${JSON.stringify(pin, null, 2)}\n`);
+        return pin;
+    }
+    finally {
+        (0, fs_1.rmSync)(checkout, { force: true, recursive: true });
+    }
+}
+/**
+ * Differences between the template dir and its pin; empty when they match.
+ * Checks both directions: every pinned file with its hash, and every file the
+ * wrapper actually imports is pinned (a hand-added import would otherwise slip by).
+ */
+function verifyCheckTemplate(templateDir, pin) {
+    const problems = [];
+    const actual = new Set((0, heal_check_wrapper_1.resolveCopySet)((0, path_1.join)(templateDir, 'check.mjs')).map((c) => c.rel.replace(/^scripts\//, '')));
+    for (const [name, hash] of Object.entries(pin.files)) {
+        const file = (0, path_1.join)(templateDir, name);
+        if (!(0, fs_1.existsSync)(file)) {
+            problems.push(`${name}: pinned but missing`);
+        }
+        else if (hashFile(file) !== hash) {
+            problems.push(`${name}: differs from ${exports.CHECK_TEMPLATE_REPOSITORY}@${pin.commit.slice(0, 7)}`);
+        }
+    }
+    for (const name of actual) {
+        if (!(name in pin.files)) {
+            problems.push(`${name}: imported by the wrapper but not pinned`);
+        }
+    }
+    const version = (0, heal_check_wrapper_1.readWrapperVersion)((0, path_1.join)(templateDir, 'check.mjs'));
+    if (version !== pin.version) {
+        problems.push(`check.mjs: marker ${version !== null && version !== void 0 ? version : '(none)'} does not match pinned version ${pin.version}`);
+    }
+    return problems;
+}
+function hashFile(file) {
+    return (0, crypto_1.createHash)('sha256').update((0, fs_1.readFileSync)(file)).digest('hex');
+}
+function sortKeys(record) {
+    return Object.fromEntries(Object.entries(record).sort(([a], [b]) => a.localeCompare(b)));
+}

package/build/lib/claude-cli.js

@@ -11,10 +11,10 @@ exports.runClaudeCommand = runClaudeCommand;
  * Claude CLI utilities
  * Handles detection and execution of Claude CLI commands
  */
-const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
+const platform_1 = require("./platform");
 /**
  * Path to Claude plugins marketplaces directory
  */
@@ -31,7 +31,7 @@ exports.CLAUDE_KNOWN_MARKETPLACES_PATH = (0, path_1.join)((0, os_1.homedir)(), '
 function checkCommandExists(command) {
     try {
         const [cmd, ...args] = command.trim().split(/\s+/);
-        const result = (0, child_process_1.spawnSync)(cmd, args, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        const result = (0, platform_1.spawnCmdSync)(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'] });
         return result.status === 0;
     }
     catch (_a) {
@@ -48,27 +48,19 @@ function checkMarketplaceExists(marketplaceName) {
 }
 /**
  * Find the Claude CLI executable path
- * Checks common installation locations and falls back to 'which'
+ * Checks common installation locations first, then PATH
+ *
+ * On Windows the native installer puts `claude.exe` into `%USERPROFILE%\.local\bin`
+ * and `npm i -g` a `claude.cmd` shim into `%APPDATA%\npm`. Both are checked
+ * directly, because a shell opened before the install does not have them on PATH yet.
  * @returns Path to Claude CLI or null if not found
  */
-function findClaudeCli() {
-    const possiblePaths = [(0, path_1.join)((0, os_1.homedir)(), '.claude', 'local', 'claude'), '/usr/local/bin/claude', '/usr/bin/claude'];
-    for (const p of possiblePaths) {
-        if ((0, fs_1.existsSync)(p)) {
-            return p;
-        }
-    }
-    try {
-        const result = (0, child_process_1.spawnSync)('which', ['claude'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
-        const path = (result.stdout || '').trim();
-        if (result.status === 0 && path && (0, fs_1.existsSync)(path)) {
-            return path;
-        }
-    }
-    catch (_a) {
-        // Claude CLI not found in PATH
-    }
-    return null;
+function findClaudeCli(options = {}) {
+    const { env = process.env, home = (0, os_1.homedir)(), platform = process.platform } = options;
+    const candidates = (0, platform_1.isWindows)(platform)
+        ? [path_1.win32.join(home, '.local', 'bin', 'claude.exe'), path_1.win32.join((0, platform_1.windowsAppData)(env, home), 'npm', 'claude.cmd')]
+        : [path_1.posix.join(home, '.claude', 'local', 'claude'), '/usr/local/bin/claude', '/usr/bin/claude'];
+    return (0, platform_1.findExecutable)('claude', Object.assign(Object.assign({}, options), { candidates, env, platform }));
 }
 /**
  * List the names of all marketplaces known to the Claude CLI.
@@ -99,10 +91,7 @@ function readKnownMarketplaces() {
  */
 function runClaudeCommand(cli, args) {
     try {
-        const result = (0, child_process_1.spawnSync)(cli, args.split(' '), {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        const result = (0, platform_1.spawnCmdSync)(cli, args.split(' '), { stdio: ['pipe', 'pipe', 'pipe'] });
         return {
             output: result.stdout + result.stderr,
             success: result.status === 0,

package/build/lib/codex-cli.js

@@ -6,42 +6,35 @@ exports.runCodexCommand = runCodexCommand;
 /**
  * Codex CLI utilities.
  */
-const child_process_1 = require("child_process");
-const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
-exports.DEFAULT_CODEX_MARKETPLACE_ROOT = process.env.LT_CODEX_MARKETPLACE_ROOT || '/Users/kaihaase/code/lenneTech/codex';
-function findCodexCli() {
-    const possiblePaths = [
-        (0, path_1.join)((0, os_1.homedir)(), '.local', 'bin', 'codex'),
-        (0, path_1.join)((0, os_1.homedir)(), '.codex', 'bin', 'codex'),
-        '/usr/local/bin/codex',
-        '/opt/homebrew/bin/codex',
-        '/usr/bin/codex',
-    ];
-    for (const path of possiblePaths) {
-        if ((0, fs_1.existsSync)(path)) {
-            return path;
-        }
-    }
-    try {
-        const result = (0, child_process_1.spawnSync)('which', ['codex'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
-        const path = (result.stdout || '').trim();
-        if (result.status === 0 && path && (0, fs_1.existsSync)(path)) {
-            return path;
-        }
-    }
-    catch (_a) {
-        // Codex CLI not found in PATH.
-    }
-    return null;
+const platform_1 = require("./platform");
+/**
+ * Codex marketplace checkout used when `lt codex plugins` gets no `--path`.
+ * Defaults to the current directory, matching the command's own guidance to run it
+ * from a checkout that contains the generated marketplace.
+ */
+exports.DEFAULT_CODEX_MARKETPLACE_ROOT = process.env.LT_CODEX_MARKETPLACE_ROOT || process.cwd();
+/**
+ * Find the Codex CLI executable path: common installation locations first, then PATH.
+ * On Windows `npm i -g @openai/codex` leaves a `codex.cmd` shim in `%APPDATA%\npm`.
+ */
+function findCodexCli(options = {}) {
+    const { env = process.env, home = (0, os_1.homedir)(), platform = process.platform } = options;
+    const candidates = (0, platform_1.isWindows)(platform)
+        ? [path_1.win32.join((0, platform_1.windowsAppData)(env, home), 'npm', 'codex.cmd')]
+        : [
+            path_1.posix.join(home, '.local', 'bin', 'codex'),
+            path_1.posix.join(home, '.codex', 'bin', 'codex'),
+            '/usr/local/bin/codex',
+            '/opt/homebrew/bin/codex',
+            '/usr/bin/codex',
+        ];
+    return (0, platform_1.findExecutable)('codex', Object.assign(Object.assign({}, options), { candidates, env, platform }));
 }
 function runCodexCommand(cli, args) {
     try {
-        const result = (0, child_process_1.spawnSync)(cli, args, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        const result = (0, platform_1.spawnCmdSync)(cli, args, { stdio: ['pipe', 'pipe', 'pipe'] });
         return {
             output: result.stdout + result.stderr,
             success: result.status === 0,

package/build/lib/dev-env-bridge.js

@@ -16,8 +16,11 @@ exports.writeEnvBridge = writeEnvBridge;
  * Shell B does not inherit shell A's exports. Reading a file solves
  * this without polluting global state.
  *
- * The file is gitignored via `.lt-dev/`. It contains only public URLs +
- * the local CA path — no secrets. Format: standard dotenv KEY=VALUE.
+ * The file is gitignored via `.lt-dev/` and written 0600, because it is no longer
+ * URLs only: `NUXT_SESSION_PASSWORD` is a session-sealing key. Usually that is the
+ * value `lt dev` derived itself, but when the project exported its own it is THAT
+ * one being copied here — so treat the file as credential-bearing, and think twice
+ * before adding a key to it. Format: standard dotenv KEY=VALUE.
  */
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -84,6 +87,11 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
         'NUXT_PUBLIC_SITE_URL',
         'NUXT_PUBLIC_STORAGE_PREFIX',
         'NUXT_PUBLIC_API_PROXY',
+        // Not needed by the runner itself, but external suites check it to tell a stack that
+        // can log in from one that will 500 on every login, and a suite that seals its own
+        // session cookie to skip the login form needs the value (see dev-env.ts). This is the
+        // one credential-shaped key in the bridge — it is why the file is written 0600.
+        'NUXT_SESSION_PASSWORD',
         'NSC__MONGOOSE__URI',
         'DATABASE_URL',
         // Legacy aliases — see dev-env.ts for the rationale.
@@ -107,6 +115,9 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
     if ((0, fs_1.existsSync)(file) && (0, fs_1.readFileSync)(file, 'utf8') === content)
         return file;
     (0, fs_1.mkdirSync)((0, path_1.dirname)(file), { recursive: true });
-    (0, fs_1.writeFileSync)(file, content, 'utf8');
+    (0, fs_1.writeFileSync)(file, content, { encoding: 'utf8', mode: 0o600 });
+    // `mode` only applies when the file is CREATED, so an existing bridge from an older
+    // lt version would keep its 0644. chmod unconditionally to heal those.
+    (0, fs_1.chmodSync)(file, 0o600);
     return file;
 }