@lenne.tech/cli 1.45.0 → 1.47.0

package/build/lib/dev-env.js

@@ -14,6 +14,8 @@ exports.buildDevEnv = buildDevEnv;
  * - `NUXT_PUBLIC_*` lock the App to its own API
  * - `NUXT_PUBLIC_STORAGE_PREFIX` namespaces localStorage/sessionStorage
  * - `NSC__MONGOOSE__URI` / `DATABASE_URL` namespace the database per project
+ * - `NUXT_SESSION_PASSWORD` is keyed per slug, so a session cookie sealed by one
+ *   stack cannot be unsealed by another (dev vs. `-test` vs. `-test-N` shard)
  *
  * CA trust for SSR fetches:
  * - Both API and App receive `NODE_EXTRA_CA_CERTS` pointing at the
@@ -21,6 +23,10 @@ exports.buildDevEnv = buildDevEnv;
  *   subdomains succeed. Without this Nuxt SSR fails with "unable to
  *   get local issuer certificate" when the app calls its own API.
  */
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
 const dev_env_bridge_1 = require("./dev-env-bridge");
 /**
  * Build the environment maps for both API and App processes.
@@ -29,7 +35,8 @@ const dev_env_bridge_1 = require("./dev-env-bridge");
  * vars survive. `lt dev`-managed keys win on top.
  */
 function buildDevEnv(input) {
-    const { apiInternalPort, appInternalPort, baseEnv = {}, dbName, identity } = input;
+    var _a;
+    const { apiInternalPort, appDir, appInternalPort, baseEnv = {}, dbName, identity } = input;
     const apiSub = identity.subdomains.api;
     const appSub = identity.subdomains.app;
     const apiUrl = apiSub ? `https://${apiSub.hostname}` : '';
@@ -52,14 +59,18 @@ function buildDevEnv(input) {
             internalPort: apiInternalPort,
         },
         app: {
-            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
+            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
                 // See API note above: pin the dev server to IPv4 so Caddy's
                 // `127.0.0.1` upstream is unambiguous.
                 HOST: '127.0.0.1', NITRO_HOST: '127.0.0.1' }), (apiUrl ? { API_URL: apiUrl, NUXT_API_URL: apiUrl, NUXT_PUBLIC_API_URL: apiUrl } : {})), (appUrl ? { NUXT_PUBLIC_SITE_URL: appUrl, SITE_URL: appUrl } : {})), { 
                 // Vite-API-Proxy is OFF by default in lt dev mode — Caddy serves
                 // both subdomains under HTTPS with shared cookie domain, so
                 // same-origin trickery is no longer required.
-                NUXT_PUBLIC_API_PROXY: 'false', NUXT_PUBLIC_STORAGE_PREFIX: identity.slug, PORT: String(appInternalPort) }), (process.platform === 'darwin' ? { TMPDIR: '/tmp' } : {})),
+                NUXT_PUBLIC_API_PROXY: 'false', NUXT_PUBLIC_STORAGE_PREFIX: identity.slug }), (baseEnv.NUXT_SESSION_PASSWORD
+                ? {}
+                : {
+                    NUXT_SESSION_PASSWORD: (_a = readEnvFileValue(appDir, 'NUXT_SESSION_PASSWORD')) !== null && _a !== void 0 ? _a : deriveSessionPassword(identity.slug),
+                })), { PORT: String(appInternalPort) }), (process.platform === 'darwin' ? { TMPDIR: '/tmp' } : {})),
             internalPort: appInternalPort,
         },
     };
@@ -68,3 +79,106 @@ function buildDevEnv(input) {
 function buildPostgresUrl(dbName) {
     return `postgresql://${dbName}:${dbName}@localhost:5432/${dbName}`;
 }
+/**
+ * Stable local session password for a project's app process.
+ *
+ * 32 hex chars — h3's floor. Deterministic per slug AND per machine: the same stack on the
+ * same machine always gets the same value, so a restart does not invalidate open sessions,
+ * while a different slug (or a different developer's machine) gets a different one.
+ *
+ * The machine salt is what makes it unguessable. Without it the only input is the slug, which
+ * the app publishes itself via `NUXT_PUBLIC_STORAGE_PREFIX`, so anyone who loaded a page —
+ * including any visitor of a `lt dev tunnel` URL — could recompute the key and forge a sealed
+ * session cookie. With it, an attacker would have to read the developer's home directory.
+ */
+function deriveSessionPassword(slug) {
+    var _a;
+    // No salt means the home directory is unwritable. Fall back to a constant key rather than a
+    // random one: determinism is the property every caller depends on, and a fresh value per run
+    // would log everybody out on every restart. The fallback is guessable — hence last resort.
+    return (0, node_crypto_1.createHmac)('sha256', (_a = machineSessionSalt()) !== null && _a !== void 0 ? _a : 'lt-dev')
+        .update(`lt-dev:session:${slug}`)
+        .digest('hex')
+        .slice(0, 32);
+}
+/**
+ * Read (or create) the machine-local salt at `~/.lenneTech/dev-session-salt`, mode 0600.
+ *
+ * Returns `null` when it can be neither read nor created — see {@link deriveSessionPassword}
+ * for what happens then.
+ */
+function machineSessionSalt() {
+    const file = sessionSaltPath();
+    try {
+        const existing = (0, node_fs_1.readFileSync)(file, 'utf8').trim();
+        if (existing) {
+            return existing;
+        }
+    }
+    catch (_a) {
+        // Not created yet — fall through and create it.
+    }
+    try {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(file), { recursive: true });
+        // `wx` fails when the file already exists, so two shards racing on a cold machine can
+        // never end up with two different salts: the loser falls into the catch and re-reads.
+        const salt = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        (0, node_fs_1.writeFileSync)(file, `${salt}\n`, { flag: 'wx', mode: 0o600 });
+        return salt;
+    }
+    catch (_b) {
+        try {
+            return (0, node_fs_1.readFileSync)(file, 'utf8').trim() || null;
+        }
+        catch (_c) {
+            return null;
+        }
+    }
+}
+/**
+ * Read one key out of `<dir>/.env` without pulling in a dotenv dependency.
+ *
+ * Deliberately minimal: no interpolation, no multi-line values, no `.env.local` cascade. It
+ * exists to answer one question — did the project set this key itself? — for a value the built
+ * Nitro server would otherwise never see.
+ */
+function readEnvFileValue(dir, key) {
+    if (!dir) {
+        return undefined;
+    }
+    let content;
+    try {
+        content = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, '.env'), 'utf8');
+    }
+    catch (_a) {
+        return undefined;
+    }
+    for (const line of content.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+        }
+        const eq = trimmed.indexOf('=');
+        if (eq === -1) {
+            continue;
+        }
+        if (trimmed
+            .slice(0, eq)
+            .replace(/^export\s+/, '')
+            .trim() !== key) {
+            continue;
+        }
+        const raw = trimmed.slice(eq + 1).trim();
+        const quoted = raw.length >= 2 && ((raw.startsWith('"') && raw.endsWith('"')) || (raw.startsWith("'") && raw.endsWith("'")));
+        return (quoted ? raw.slice(1, -1) : raw) || undefined;
+    }
+    return undefined;
+}
+/**
+ * Path of the machine-local salt. `LT_DEV_SESSION_SALT_PATH` overrides it, and `HOME` is read
+ * before `os.homedir()` — both so tests can redirect the write to a tmpdir, the same reason
+ * `dev-service.ts#userHome` does it.
+ */
+function sessionSaltPath() {
+    return process.env.LT_DEV_SESSION_SALT_PATH || (0, node_path_1.join)(process.env.HOME || (0, node_os_1.homedir)(), '.lenneTech', 'dev-session-salt');
+}

package/build/lib/dev-patches.js

@@ -157,7 +157,7 @@ function patchClaudeMd(file, options) {
     if (dbName)
         lines.push(`- DB: \`mongodb://127.0.0.1/${dbName}\``);
     lines.push('');
-    lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
+    lines.push('Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NUXT_SESSION_PASSWORD`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.');
     lines.push('');
     lines.push(endMarker);
     const block = lines.join('\n');

package/build/lib/dev-test-session.js

@@ -274,6 +274,9 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         log.info('');
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
+            // The built server this stack runs reads no `.env` at all, so a key the project set
+            // there has to be forwarded explicitly — that is the whole reason this argument exists.
+            appDir: layout.appDir,
             appInternalPort: appPort !== null && appPort !== void 0 ? appPort : 0,
             baseEnv: process.env,
             dbName,

package/build/lib/ensure-root-dockerignore.js

@@ -16,8 +16,15 @@ exports.ensureRootDockerignore = ensureRootDockerignore;
 // bundle itself changes.
 const REQUIRED_PATTERNS = [
     '**/node_modules',
+    // `**/.output` matches a path component EXACTLY, so the isolated build dirs of
+    // `lt dev test` (`.output-test`, `.nuxt-test`, `.nuxt-test-2`, …) need their own
+    // globs. They are built with the app's full dev env, so Nitro freezes values like
+    // `NUXT_SESSION_PASSWORD` into them as runtime-config defaults — and a `--keep`
+    // run or a crashed teardown leaves the tree on disk for the next `docker build`.
     '**/.output',
+    '**/.output-*',
     '**/.nuxt',
+    '**/.nuxt-*',
     '**/dist',
     // `**/.env` matches a path component EXACTLY, so it does NOT cover
     // `.env.production` / `.env.staging` / `.env.test` — all of which routinely

package/build/lib/heal-check-wrapper.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareVersions = compareVersions;
+exports.compareWrapperVersions = compareWrapperVersions;
 exports.healCheckWrapper = healCheckWrapper;
+exports.keptWrapperReason = keptWrapperReason;
+exports.readWrapperVersion = readWrapperVersion;
 exports.resolveCopySet = resolveCopySet;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
@@ -9,6 +13,63 @@ const path_1 = require("path");
 const WRAPPER = 'node scripts/check.mjs';
 /** Where the wrapper and its imports live inside a project. */
 const SCRIPTS_DIR = 'scripts';
+/**
+ * `// @lt-check-wrapper 3.12.0` on line 2 of the wrapper: the lt-monorepo RELEASE it belongs
+ * to (never a project's own package version). Same expression as lt-monorepo's
+ * `scripts/check-wrapper-version.cjs#MARKER_RE`, so both sides agree on the format: a whole
+ * line, so prose mentioning the tag never matches, and `\r?` for a CRLF checkout.
+ */
+const VERSION_MARKER = /^\/\/ @lt-check-wrapper (\S+)\r?$/m;
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+/**
+ * Compare two `x.y.z[-pre]` versions: negative when `a < b`, 0 when equal,
+ * positive when `a > b`. A prerelease sorts before its release.
+ */
+function compareVersions(a, b) {
+    const parse = (v) => {
+        const [core, pre = ''] = v.split('-', 2);
+        return { core: core.split('.').map(Number), pre };
+    };
+    const pa = parse(a);
+    const pb = parse(b);
+    for (let i = 0; i < 3; i++) {
+        const diff = (pa.core[i] || 0) - (pb.core[i] || 0);
+        if (diff !== 0) {
+            return diff;
+        }
+    }
+    if (pa.pre === pb.pre) {
+        return 0;
+    }
+    if (!pa.pre) {
+        return 1;
+    }
+    if (!pb.pre) {
+        return -1;
+    }
+    return pa.pre < pb.pre ? -1 : 1;
+}
+/** Read both wrapper markers and classify how the project relates to the bundle. */
+function compareWrapperVersions(projectRoot, assetPath) {
+    const bundled = readWrapperVersion(assetPath);
+    const project = readWrapperVersion((0, path_1.join)(projectRoot, SCRIPTS_DIR, 'check.mjs'));
+    let relation;
+    if (project === null) {
+        relation = 'legacy';
+    }
+    else if (!SEMVER.test(project)) {
+        relation = 'unrecognised';
+    }
+    else if (bundled === null || !SEMVER.test(bundled)) {
+        // A marked project against an unmarked bundle: the bundle predates markers.
+        relation = 'project-newer';
+    }
+    else {
+        const order = compareVersions(bundled, project);
+        relation = order > 0 ? 'bundled-newer' : order < 0 ? 'project-newer' : 'same-release';
+    }
+    return { bundled, project, relation };
+}
 /**
  * Idempotently install the report-driven check wrapper — and every module it
  * imports — into a project.
@@ -68,7 +129,13 @@ function healCheckWrapper(projectRoot, assetPath) {
     // the doc block above.
     const plans = copies.map((copy) => planCopy(projectRoot, copy));
     const blocked = plans.filter((p) => p.action === 'skip');
-    if (blocked.length > 0) {
+    // Never downgrade: a project created from a newer lt-monorepo than this CLI
+    // bundles keeps its wrapper. Replacing it silently dropped fixes before.
+    const kept = keptWrapperReason(projectRoot, assetPath);
+    if (kept) {
+        changed.push(`${copies.map((c) => c.rel).join(' + ')} (skipped: ${kept})`);
+    }
+    else if (blocked.length > 0) {
         // One entry for the whole set: the set is what could not be updated, and
         // naming only the blocking member would suggest the others did land.
         const names = blocked.map((p) => p.rel).join(', ');
@@ -94,6 +161,39 @@ function healCheckWrapper(projectRoot, assetPath) {
     }
     return changed;
 }
+/**
+ * Why the project's wrapper must be kept as it is, or null when heal may replace it.
+ * Shared by heal (skip reason) and doctor (INFO line), so both say the same thing.
+ */
+function keptWrapperReason(projectRoot, assetPath) {
+    const { bundled, project, relation } = compareWrapperVersions(projectRoot, assetPath);
+    switch (relation) {
+        case 'project-newer':
+            return `project wrapper ${project} is newer than this CLI's ${bundled !== null && bundled !== void 0 ? bundled : '(unversioned)'} — update lt`;
+        case 'same-release': {
+            // Identical content is simply up to date; a missing sibling may still be installed.
+            const projectCheck = (0, path_1.join)(projectRoot, SCRIPTS_DIR, 'check.mjs');
+            if ((0, fs_1.readFileSync)(projectCheck, 'utf8') === (0, fs_1.readFileSync)(assetPath, 'utf8')) {
+                return null;
+            }
+            return `project wrapper differs from this CLI's copy of the same release ${project} — kept, because the release number cannot tell which one is newer; update lt after the next lt-monorepo release`;
+        }
+        case 'unrecognised':
+            return `project wrapper carries an unrecognised @lt-check-wrapper marker "${project}" — kept`;
+        default:
+            return null;
+    }
+}
+/** The `@lt-check-wrapper` version of a wrapper, or null when the file is missing or unmarked. */
+function readWrapperVersion(file) {
+    var _a, _b;
+    try {
+        return (_b = (_a = VERSION_MARKER.exec((0, fs_1.readFileSync)(file, 'utf8'))) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : null;
+    }
+    catch (_c) {
+        return null;
+    }
+}
 /**
  * The wrapper plus the transitive closure of its relative imports.
  *
@@ -103,11 +203,6 @@ function healCheckWrapper(projectRoot, assetPath) {
  */
 function resolveCopySet(assetPath) {
     const assetDir = (0, path_1.dirname)(assetPath);
-    // Regular files only — a directory named `*.mjs` would otherwise reach
-    // copyFileSync and abort the whole migration with EISDIR.
-    const available = new Set((0, fs_1.readdirSync)(assetDir, { withFileTypes: true })
-        .filter((entry) => entry.isFile())
-        .map((entry) => entry.name));
     const copies = [{ rel: `${SCRIPTS_DIR}/check.mjs`, source: assetPath }];
     // Keyed by target rel, NOT by source basename: the asset lands as
     // `scripts/check.mjs` whatever it is called, so a `check.mjs` sitting beside a
@@ -128,14 +223,23 @@ function resolveCopySet(assetPath) {
         catch (_a) {
             continue;
         }
-        for (const match of source.matchAll(/\bfrom\s+['"]\.\/([^'"/]+)['"]/g)) {
-            const name = match[1];
-            const rel = `${SCRIPTS_DIR}/${name}`;
-            if (claimed.has(rel) || !available.has(name)) {
+        // Resolved against the IMPORTING file, so `./lib/audit-report.mjs` in the
+        // wrapper and `./ansi.mjs` inside `lib/` both land where Node looks for them.
+        // Subdirectories count: copying only the wrapper's direct siblings installed
+        // a `check.mjs` whose `./lib/*` imports resolved to nothing.
+        for (const match of source.matchAll(/\bfrom\s+['"](\.\/[^'"]+)['"]/g)) {
+            const resolved = (0, path_1.resolve)((0, path_1.dirname)(file), match[1]);
+            const inAsset = (0, path_1.relative)(assetDir, resolved);
+            // Never out of the asset dir: an import that climbs out (`./../x.mjs`)
+            // must not claim a path in the project's scripts/.
+            if (!inAsset || inAsset === '..' || inAsset.startsWith(`..${path_1.sep}`) || (0, path_1.isAbsolute)(inAsset)) {
+                continue;
+            }
+            const rel = `${SCRIPTS_DIR}/${inAsset.split(path_1.sep).join('/')}`;
+            if (claimed.has(rel) || !isRegularFile(resolved)) {
                 continue;
             }
             claimed.add(rel);
-            const resolved = (0, path_1.join)(assetDir, name);
             copies.push({ rel, source: resolved });
             queue.push(resolved);
         }
@@ -159,6 +263,19 @@ function hasUncommittedChanges(projectRoot, relPath) {
         return false;
     }
 }
+/**
+ * True for a regular file, checked without following a symlink. A directory
+ * named `*.mjs` would otherwise reach copyFileSync and abort the whole migration
+ * with EISDIR.
+ */
+function isRegularFile(target) {
+    try {
+        return (0, fs_1.lstatSync)(target).isFile();
+    }
+    catch (_a) {
+        return false;
+    }
+}
 /** True when `target` is a symlink (checked without following it). */
 function isSymlink(target) {
     try {

package/build/lib/heal-oxlintrc.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDangerousFixFlagUsage = findDangerousFixFlagUsage;
+exports.healDangerousOxlintFixFlags = healDangerousOxlintFixFlags;
+exports.healOxlintrcFilename = healOxlintrcFilename;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const LEGACY = 'oxlint.json';
+const TARGET = '.oxlintrc.json';
+/** A `-c`/`--config` flag pointing at the legacy file, e.g. `-c oxlint.json`, `--config=./oxlint.json`. */
+const CONFIG_FLAG = /(-c|--config)(\s+|=)(\.\/)?oxlint\.json(?![\w.-])/g;
+/**
+ * oxlint flags that apply behaviour-changing fixes: `--fix-suggestions` (e.g. deletes
+ * console calls for no-console) and `--fix-dangerously`. Matches a USE of the flag —
+ * preceded by whitespace or a quote — not a mention in backticks such as the comment
+ * "Never `--fix-suggestions`" the current templates carry.
+ */
+const DANGEROUS_FIX_FLAG_USE = /(?:^|[\s'"])--fix-(?:suggestions|dangerously)(?![\w-])/m;
+/** The removable form: the flag as a further argument after whitespace. `--fix` itself stays. */
+const DANGEROUS_FIX_FLAG_ARG = /[ \t]+--fix-(?:suggestions|dangerously)(?![\w-])/g;
+const LINT_STAGED_FILES = [
+    '.lintstagedrc',
+    '.lintstagedrc.json',
+    '.lintstagedrc.yaml',
+    '.lintstagedrc.yml',
+    '.lintstagedrc.js',
+    '.lintstagedrc.cjs',
+    '.lintstagedrc.mjs',
+    'lint-staged.config.js',
+    'lint-staged.config.cjs',
+    'lint-staged.config.mjs',
+];
+/**
+ * Files in which a dangerous fix flag is still USED. The root `scripts/check.mjs` counts
+ * for the gate but is not stripped here — `healCheckWrapper` owns that file.
+ * Paths are relative to `workspaceRoot` (or `appDir` for a standalone app).
+ */
+function findDangerousFixFlagUsage(appDir, workspaceRoot) {
+    const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
+    const files = [...(workspaceRoot ? [(0, path_1.join)(workspaceRoot, 'scripts', 'check.mjs')] : []), ...fixFlagFiles(appDir, workspaceRoot)];
+    return [...new Set(files)].filter((file) => usesDangerousFixFlag(file)).map((file) => (0, path_1.relative)(base, file) || file);
+}
+/**
+ * Remove `--fix-suggestions` and `--fix-dangerously` from the project's lint commands
+ * — root and app `package.json` (scripts and inline lint-staged), lint-staged configs
+ * and the app's own `scripts/check.mjs` — so the oxlint config can be loaded safely.
+ *
+ * Textual, so formatting stays exactly as it was. Only tracked files without
+ * uncommitted changes are edited (git can restore them); an untracked, dirty or
+ * symlinked file is reported in `skipped` and keeps blocking the rename.
+ */
+function healDangerousOxlintFixFlags(appDir, workspaceRoot) {
+    const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
+    const result = { changed: [], skipped: [] };
+    for (const file of fixFlagFiles(appDir, workspaceRoot)) {
+        if (!usesDangerousFixFlag(file)) {
+            continue;
+        }
+        const rel = (0, path_1.relative)(base, file) || file;
+        const dir = (0, path_1.join)(file, '..');
+        const name = (0, path_1.relative)(dir, file);
+        if (isSymlink(file)) {
+            result.skipped.push(`${rel} (symlink)`);
+        }
+        else if (!isTracked(dir, name)) {
+            result.skipped.push(`${rel} (not tracked by git — remove the flag by hand)`);
+        }
+        else if (hasUncommittedChanges(dir, name)) {
+            result.skipped.push(`${rel} (uncommitted changes — commit or discard them, then re-run)`);
+        }
+        else {
+            const content = (0, fs_1.readFileSync)(file, 'utf8');
+            const stripped = content.replace(DANGEROUS_FIX_FLAG_ARG, '');
+            if (stripped !== content) {
+                (0, fs_1.writeFileSync)(file, stripped);
+                result.changed.push(rel);
+            }
+            if (DANGEROUS_FIX_FLAG_USE.test(stripped)) {
+                result.skipped.push(`${rel} (a flag use that is not a plain argument remains — remove it by hand)`);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Heal the oxlint config filename of an app project: `oxlint.json` → `.oxlintrc.json`.
+ *
+ * oxlint only auto-discovers `.oxlintrc.json`. nuxt-base-template and
+ * nuxt-extensions shipped the config as `oxlint.json`, so every rule in it was
+ * silently ignored — projects linted with oxlint's defaults only. The templates
+ * renamed the file; existing projects keep the old name until this runs.
+ *
+ * Loading the config is not neutral. It turns on rules such as `no-console`, and
+ * an auto-fix run with `--fix-suggestions` applies that rule's suggestion, which
+ * deletes console calls. So the rename is GATED: it only happens once no check
+ * wrapper, script or lint-staged entry of the project still passes
+ * `--fix-suggestions`. Run it after `healCheckWrapper`, which removes the flag
+ * from the root wrapper in the same update.
+ *
+ * Same recoverability rules as the other heals: never through a symlink, never
+ * over uncommitted changes to the file, `git mv` for a tracked file so history
+ * follows the rename.
+ *
+ * @param appDir        The app project (e.g. `<workspace>/projects/app`).
+ * @param workspaceRoot The monorepo root, whose `scripts/check.mjs` and
+ *                      `package.json` also gate the rename. Omit for a standalone app.
+ */
+function healOxlintrcFilename(appDir, workspaceRoot) {
+    const legacy = (0, path_1.join)(appDir, LEGACY);
+    const target = (0, path_1.join)(appDir, TARGET);
+    if (!(0, fs_1.existsSync)(legacy) && !isSymlink(legacy)) {
+        return { action: 'none', changed: [] };
+    }
+    if ((0, fs_1.existsSync)(target) || isSymlink(target)) {
+        return {
+            action: 'both-present',
+            changed: [],
+            detail: `both ${LEGACY} and ${TARGET} exist — oxlint only loads ${TARGET}; merge the rules from ${LEGACY} by hand, then delete it`,
+        };
+    }
+    if (isSymlink(legacy)) {
+        return { action: 'skipped', changed: [], detail: `${LEGACY} is a symlink — rename it by hand` };
+    }
+    const withFlag = findDangerousFixFlagUsage(appDir, workspaceRoot);
+    if (withFlag.length > 0) {
+        return {
+            action: 'skipped',
+            changed: [],
+            detail: `--fix-suggestions/--fix-dangerously is still used in ${withFlag.join(', ')}; loading the config would let it delete console calls — remove the flag, then re-run`,
+        };
+    }
+    const tracked = isTracked(appDir, LEGACY);
+    if (tracked && hasUncommittedChanges(appDir, LEGACY)) {
+        return {
+            action: 'skipped',
+            changed: [],
+            detail: `${LEGACY} has uncommitted changes — commit or discard them, then re-run`,
+        };
+    }
+    if (tracked) {
+        (0, child_process_1.execFileSync)('git', ['-C', appDir, 'mv', '--', LEGACY, TARGET], { stdio: 'ignore' });
+    }
+    else {
+        // Nothing is overwritten (the target does not exist), so an untracked file
+        // keeps its content under the new name — no backup needed.
+        (0, fs_1.renameSync)(legacy, target);
+    }
+    const changed = [`${LEGACY} → ${TARGET}`];
+    const pkgPath = (0, path_1.join)(appDir, 'package.json');
+    if ((0, fs_1.existsSync)(pkgPath) && !isSymlink(pkgPath)) {
+        const pkg = (0, fs_1.readFileSync)(pkgPath, 'utf8');
+        // Textual, not JSON round-trip: only the flag value changes, the file keeps its formatting.
+        const updated = pkg.replace(CONFIG_FLAG, (_match, flag, sep, dot = '') => `${flag}${sep}${dot}${TARGET}`);
+        if (updated !== pkg) {
+            (0, fs_1.writeFileSync)(pkgPath, updated);
+            changed.push('package.json');
+        }
+    }
+    return { action: 'renamed', changed };
+}
+/**
+ * Files that may pass a dangerous fix flag and are ours to strip: both package.json
+ * files (scripts and inline lint-staged), lint-staged configs, and the app's own
+ * check wrapper.
+ */
+function fixFlagFiles(appDir, workspaceRoot) {
+    const roots = [...new Set([workspaceRoot, appDir].filter((dir) => Boolean(dir)))];
+    return [
+        ...roots.flatMap((dir) => ['package.json', ...LINT_STAGED_FILES].map((name) => (0, path_1.join)(dir, name))),
+        (0, path_1.join)(appDir, 'scripts', 'check.mjs'),
+    ];
+}
+/** True when the TRACKED `relPath` has uncommitted modifications. */
+function hasUncommittedChanges(dir, relPath) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['-C', dir, 'status', '--porcelain', '--', relPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return out.trim().length > 0;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True when `path` is a symlink (checked without following it). */
+function isSymlink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True when git tracks `relPath`; false outside a repository as well. */
+function isTracked(dir, relPath) {
+    try {
+        (0, child_process_1.execFileSync)('git', ['-C', dir, 'ls-files', '--error-unmatch', '--', relPath], { stdio: 'ignore' });
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function usesDangerousFixFlag(file) {
+    try {
+        // Follows a symlink on purpose: a linked config still feeds the lint run, so it
+        // must block the rename, even though the strip refuses to write through it.
+        return DANGEROUS_FIX_FLAG_USE.test((0, fs_1.readFileSync)(file, 'utf8'));
+    }
+    catch (_a) {
+        return false;
+    }
+}