@lenne.tech/cli 1.46.0 → 1.48.0

package/bin/postinstall.js

@@ -3,9 +3,13 @@
 /**
  * Postinstall script for lt CLI
  * Generates static completion files on install/update (no runtime overhead)
+ *
+ * Must never fail the install: npm runs this through cmd.exe on Windows, so the
+ * former `2>/dev/null || true` guard in package.json broke `npm i -g` there
+ * instead of protecting it. The guard now lives in this file (see bottom).
  */
 
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } = require('fs');
 const { homedir } = require('os');
 const { join } = require('path');
@@ -26,11 +30,17 @@ function addSourceLine(configFile, sourceLine) {
 
 /**
  * Detect user's shell
+ *
+ * Returns null when no supported shell can be identified. On Windows an unset
+ * SHELL means PowerShell or cmd.exe, which read none of the rc files below —
+ * appending to a ~/.bashrc nothing sources would only leave clutter behind.
+ * Git Bash sets SHELL, so it still gets bash completions.
  */
 function detectShell() {
   const shell = process.env.SHELL || '';
   if (shell.includes('zsh')) return 'zsh';
   if (shell.includes('fish')) return 'fish';
+  if (!shell && process.platform === 'win32') return null;
   return 'bash';
 }
 
@@ -45,8 +55,13 @@ function generateCompletionFile(shell, completionFile) {
       mkdirSync(dir, { recursive: true });
     }
 
-    // Generate completion script
-    const script = execSync(`lt completion ${shell}`, { encoding: 'utf-8' });
+    // Run this package's own entry point with the current Node binary instead of
+    // resolving `lt` from PATH: during a global install the bin link may not exist
+    // yet, and on Windows `lt` is a .cmd shim that cannot be spawned without a shell.
+    const script = execFileSync(process.execPath, [join(__dirname, 'lt'), 'completion', shell], {
+      encoding: 'utf-8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
     writeFileSync(completionFile, script);
     return true;
   } catch {
@@ -109,6 +124,10 @@ function main() {
   }
 
   const shell = detectShell();
+  if (!shell) {
+    return; // No supported shell (e.g. PowerShell) - nothing to install
+  }
+
   const paths = getCompletionPaths(shell);
   const isTTY = process.stdout.isTTY;
 
@@ -152,5 +171,9 @@ function main() {
   }
 }
 
-// Run
-main();
+// Run - completions are a convenience, so no failure may abort the install
+try {
+  main();
+} catch {
+  // Silent fail
+}

package/build/commands/dev/doctor.js

@@ -169,7 +169,7 @@ const DoctorCommand = {
             try {
                 const { readFileSync: read } = yield Promise.resolve().then(() => __importStar(require('fs')));
                 const { join: j } = yield Promise.resolve().then(() => __importStar(require('path')));
-                const { resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
+                const { keptWrapperReason, resolveCopySet } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-check-wrapper')));
                 const bundledCheck = j(__dirname, '..', '..', 'templates', 'check', 'check.mjs');
                 if (filesystem.exists(bundledCheck)) {
                     const missing = [];
@@ -183,12 +183,26 @@ const DoctorCommand = {
                             drifted.push(rel);
                         }
                     }
-                    if (missing.length > 0) {
+                    // A missing module only breaks `check` when the project's wrapper is the
+                    // canonical one that imports it (or the wrapper itself is missing). An
+                    // older wrapper does not import the newer modules (e.g. `lib/*.mjs`) and
+                    // still runs — calling that "cannot start" would be a false alarm.
+                    const wrapperDrifted = drifted.includes('scripts/check.mjs');
+                    // A project wrapper that heal refuses to replace (newer release, or the same
+                    // release with other content) is not drift to fix: pointing at
+                    // `lt fullstack update` there would recommend a no-op or a downgrade.
+                    const kept = keptWrapperReason(layout.root, bundledCheck);
+                    if (kept) {
+                        line('INFO', colors.cyan, `check wrapper: ${kept}`);
+                    }
+                    else if (missing.length > 0 && !wrapperDrifted) {
                         line('ERROR', colors.red, `check wrapper incomplete — missing ${missing.join(', ')}`);
                         line('ERROR', colors.red, '  `pnpm run check` cannot start; run `lt fullstack update` to install it');
                     }
                     else if (drifted.length > 0) {
-                        line('WARN', colors.yellow, `${drifted.join(', ')} differs from the canonical CLI version`);
+                        const outdated = [...drifted, ...missing.map((rel) => `${rel} (missing)`)];
+                        const verb = outdated.length === 1 ? 'differs' : 'differ';
+                        line('WARN', colors.yellow, `${outdated.join(', ')} ${verb} from the canonical CLI version`);
                         line('WARN', colors.yellow, '  run `lt fullstack update` to sync it (skips uncommitted local edits)');
                     }
                     else if (filesystem.exists(j(layout.root, 'scripts', 'check.mjs'))) {
@@ -199,6 +213,34 @@ const DoctorCommand = {
             catch (_a) {
                 /* best-effort diagnostics */
             }
+            // 7.6 oxlint config filename: oxlint only auto-discovers `.oxlintrc.json`.
+            //     Apps from the template before the rename carry `oxlint.json`, whose
+            //     rules then silently never apply — lint passes on code the project's
+            //     own rules forbid.
+            if (layout.appDir) {
+                // Behaviour-changing fix flags delete console calls once rules load.
+                try {
+                    const { findDangerousFixFlagUsage } = yield Promise.resolve().then(() => __importStar(require('../../lib/heal-oxlintrc')));
+                    const workspaceRoot = layout.root !== layout.appDir ? layout.root : undefined;
+                    const flagged = findDangerousFixFlagUsage(layout.appDir, workspaceRoot);
+                    if (flagged.length > 0) {
+                        line('WARN', colors.yellow, `oxlint --fix-suggestions/--fix-dangerously in ${flagged.join(', ')}`);
+                        line('WARN', colors.yellow, '  they apply behaviour-changing fixes (e.g. delete console calls); run `lt fullstack update`');
+                    }
+                }
+                catch (_b) {
+                    /* best-effort diagnostics */
+                }
+                const hasLegacy = filesystem.exists(filesystem.path(layout.appDir, 'oxlint.json'));
+                const hasCurrent = filesystem.exists(filesystem.path(layout.appDir, '.oxlintrc.json'));
+                if (hasLegacy && !hasCurrent) {
+                    line('WARN', colors.yellow, 'oxlint config not loaded — oxlint only reads .oxlintrc.json, the app has oxlint.json');
+                    line('WARN', colors.yellow, '  run `lt fullstack update` to rename it');
+                }
+                else if (hasLegacy) {
+                    line('WARN', colors.yellow, 'oxlint.json is ignored next to .oxlintrc.json — merge its rules and delete it');
+                }
+            }
             // 8. Slug ↔ path: is this project's slug registered to a DIFFERENT checkout?
             //    Two clones of the same project (same package.json "name") share the
             //    slug → Caddy block / ports / DB and collide. Surface it proactively.

package/build/commands/fullstack/update.js

@@ -14,6 +14,7 @@ const dev_patches_1 = require("../../lib/dev-patches");
 const framework_detection_1 = require("../../lib/framework-detection");
 const frontend_framework_detection_1 = require("../../lib/frontend-framework-detection");
 const heal_check_wrapper_1 = require("../../lib/heal-check-wrapper");
+const heal_oxlintrc_1 = require("../../lib/heal-oxlintrc");
 const heal_vendor_migrate_store_1 = require("../../lib/heal-vendor-migrate-store");
 const vendor_claude_md_1 = require("../../lib/vendor-claude-md");
 /**
@@ -213,6 +214,36 @@ const NewCommand = {
                 warning(`  Check wrapper NOT updated: ${entry}`);
             }
         }
+        // ── Self-heal: let oxlint actually load the app's config ───────────────
+        //
+        // oxlint only auto-discovers `.oxlintrc.json`; the app template shipped
+        // `oxlint.json`, so its rules never applied. Runs AFTER the check wrapper
+        // heal on purpose: the rename is refused while anything still passes
+        // `--fix-suggestions`, which would delete console calls once the config loads.
+        if (appDir) {
+            const workspaceRoot = isWorkspace ? cwd : undefined;
+            // 1. Strip the behaviour-changing fix flags first (the root wrapper was
+            // handled above). A file it has to skip keeps blocking the rename below.
+            const flags = (0, heal_oxlintrc_1.healDangerousOxlintFixFlags)(appDir, workspaceRoot);
+            if (flags.changed.length > 0) {
+                info('');
+                success(`  Removed --fix-suggestions/--fix-dangerously from: ${flags.changed.join(', ')}`);
+            }
+            for (const entry of flags.skipped) {
+                warning(`  Fix flag NOT removed: ${entry}`);
+            }
+            // 2. Rename — the gate inside re-checks every file.
+            const oxlintrc = (0, heal_oxlintrc_1.healOxlintrcFilename)(appDir, workspaceRoot);
+            if (oxlintrc.action === 'renamed') {
+                info('');
+                success(`  Renamed the oxlint config so oxlint loads it: ${oxlintrc.changed.join(', ')}`);
+                info('    Its rules apply from now on — expect new lint findings on the next check.');
+            }
+            else if (oxlintrc.detail) {
+                info('');
+                warning(`  oxlint config NOT renamed: ${oxlintrc.detail}`);
+            }
+        }
         // ── Self-heal: keep `.lt-dev/` out of git ──────────────────────────────
         //
         // Newer templates ship the entry, but pre-existing projects predate it —

package/build/commands/git/force-pull.js

@@ -55,8 +55,17 @@ const NewCommand = {
             else {
                 info('No local changes to discard.');
             }
-            // Show commits that would be lost
-            const localCommits = yield run(`git log origin/${branch}..HEAD --oneline 2>/dev/null || echo ""`);
+            // Show commits that would be lost (none listed when the upstream ref is unknown locally).
+            // `2>/dev/null || echo ""` used to swallow the failure, but cmd.exe on Windows has no
+            // /dev/null: the redirect failed first and `echo ""` then reported success, so the preview
+            // silently claimed there was nothing ahead. try/catch behaves the same on every platform.
+            let localCommits = '';
+            try {
+                localCommits = yield run(`git log origin/${branch}..HEAD --oneline`);
+            }
+            catch (_d) {
+                // ignore - no upstream ref, so nothing ahead to report
+            }
             if (localCommits === null || localCommits === void 0 ? void 0 : localCommits.trim()) {
                 info('');
                 info('Local commits that would be lost:');

package/build/commands/git/rebase.js

@@ -54,7 +54,17 @@ const NewCommand = {
             warning('DRY-RUN MODE - No changes will be made');
             info('');
             // Show commits that would be rebased
-            const commitsToRebase = yield run(`git log ${baseBranchPreview}..HEAD --oneline 2>/dev/null || echo ""`);
+            // try/catch, not `2>/dev/null || echo ""`: on Windows that `echo` succeeds
+            // and the git log never runs, so a dry-run would report zero commits to
+            // rebase for a branch that has some — a preview that quietly understates
+            // what the real command will do.
+            let commitsToRebase = '';
+            try {
+                commitsToRebase = yield run(`git log ${baseBranchPreview}..HEAD --oneline`);
+            }
+            catch (_k) {
+                // Unknown base ref — nothing to preview, which the check below handles.
+            }
             if (commitsToRebase === null || commitsToRebase === void 0 ? void 0 : commitsToRebase.trim()) {
                 const commitCount = commitsToRebase.trim().split('\n').length;
                 info(`Would rebase ${commitCount} commit(s) from branch "${branch}" onto "${baseBranchPreview}":`);

package/build/commands/git/reset.js

@@ -10,6 +10,24 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const git_env_1 = require("../../lib/git-env");
+/**
+ * Environment that keeps the `git ls-remote` below non-interactive.
+ *
+ * This used to be a POSIX prefix on the command string
+ * (`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-…}" git …`).
+ * `system.run` shells out through `cmd.exe` on Windows, which reads
+ * `VAR=value cmd` as a command name, not as an assignment. Paired with the
+ * trailing `|| true` the call then "succeeded" with empty output, so every
+ * `lt git reset` on Windows aborted with "No remote branch … found!" — the
+ * ls-remote had never run. Handing the variables to the child as its
+ * environment works on every platform.
+ *
+ * The `||` keeps the semantics of the shell's `:-` default: a caller who
+ * configured ssh deliberately (a user with a custom agent, or a test harness
+ * pinning the behaviour) still wins. See `git.ts#gitInstalled` for why the
+ * assignment must never be unconditional.
+ */
 /**
  * Reset current branch
  */
@@ -46,7 +64,13 @@ const NewCommand = {
             return;
         }
         // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
-        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
+        let remoteBranch = '';
+        try {
+            remoteBranch = yield system.run(`git ls-remote --heads origin ${branch}`, { env: (0, git_env_1.nonInteractiveGitEnv)() });
+        }
+        catch (_d) {
+            // ignore - unreachable remote is reported as "no remote branch" below
+        }
         if (!remoteBranch) {
             error(`No remote branch ${branch} found!`);
             return;
@@ -68,8 +92,14 @@ const NewCommand = {
             else {
                 info('No local changes to discard.');
             }
-            // Show commits that would be lost
-            const localCommits = yield system.run(`git log origin/${branch}..HEAD --oneline 2>/dev/null || echo ""`);
+            // Show commits that would be lost (none listed when the upstream ref is unknown locally)
+            let localCommits = '';
+            try {
+                localCommits = yield system.run(`git log origin/${branch}..HEAD --oneline`);
+            }
+            catch (_e) {
+                // ignore - no upstream ref, so nothing ahead to report
+            }
             if (localCommits === null || localCommits === void 0 ? void 0 : localCommits.trim()) {
                 info('');
                 info('Local commits that would be lost:');
@@ -109,7 +139,9 @@ const NewCommand = {
             const projectDir = (0, path_1.dirname)(pkgPath);
             const detectedPm = toolbox.pm.detect(projectDir);
             const installSpin = spin(`Install packages using ${detectedPm}`);
-            yield system.run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+            // `cwd` instead of `cd <dir> &&`: cmd.exe's `cd` does not switch drives,
+            // and it needs no quoting for paths with spaces.
+            yield system.run(toolbox.pm.install(detectedPm), { cwd: projectDir });
             installSpin.succeed();
         }
         // Success info

package/build/commands/git/update.js

@@ -10,6 +10,22 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const git_env_1 = require("../../lib/git-env");
+/**
+ * Environment that keeps the `git` calls below non-interactive.
+ *
+ * This used to be a POSIX prefix on the command string
+ * (`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-…}" git …`).
+ * `system.run` shells out through `cmd.exe` on Windows, which does not read
+ * `VAR=value cmd` as an assignment but as a command name — so every `lt git
+ * update` failed there with "'GIT_TERMINAL_PROMPT' is not recognized". Handing
+ * the variables to the child as its environment works on every platform.
+ *
+ * The `||` keeps the semantics of the shell's `:-` default: a caller who
+ * configured ssh deliberately (a user with a custom agent, or a test harness
+ * pinning the behaviour) still wins. See `git.ts#gitInstalled` for why the
+ * assignment must never be unconditional.
+ */
 /**
  * Update branch
  */
@@ -47,10 +63,22 @@ const NewCommand = {
             info('');
             info(`Current branch: ${branch}`);
             info('');
-            // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline)
-            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
-            // Check for incoming commits
-            const incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline 2>/dev/null || echo ""`);
+            // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline).
+            // Best effort: offline or without credentials the preview falls back to the local refs.
+            try {
+                yield run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_d) {
+                // ignore - a failed fetch only makes the preview less current
+            }
+            // Check for incoming commits (none yet when the upstream ref is unknown locally)
+            let incomingCommits = '';
+            try {
+                incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline`);
+            }
+            catch (_e) {
+                // ignore - no upstream ref, so nothing incoming to report
+            }
             const commits = (incomingCommits === null || incomingCommits === void 0 ? void 0 : incomingCommits.trim().split('\n').filter((c) => c)) || [];
             if (commits.length > 0) {
                 info(`Incoming commits (${commits.length}):`);
@@ -78,7 +106,13 @@ const NewCommand = {
         const timer = startTimer();
         // Update
         const updateSpin = spin(`Update branch ${branch}`);
-        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git pull --rebase');
+        try {
+            yield run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+        }
+        catch (_f) {
+            // ignore - `git pull --rebase` below fetches again and reports the real failure
+        }
+        yield run('git pull --rebase', { env: (0, git_env_1.nonInteractiveGitEnv)() });
         updateSpin.succeed();
         // Install packages (unless skipped) with correctly detected package manager (supports monorepo lockfiles)
         if (!skipInstall) {
@@ -87,7 +121,9 @@ const NewCommand = {
                 const projectDir = (0, path_1.dirname)(pkgPath);
                 const detectedPm = toolbox.pm.detect(projectDir);
                 const installSpin = spin(`Install packages using ${detectedPm}`);
-                yield run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+                // `cwd` instead of `cd <dir> &&`: cmd.exe's `cd` does not switch drives,
+                // and it needs no quoting for paths with spaces.
+                yield run(toolbox.pm.install(detectedPm), { cwd: projectDir });
                 installSpin.succeed();
             }
         }

package/build/extensions/api-mode.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiMode = void 0;
+const glob_1 = require("glob");
 const path_1 = require("path");
 /**
  * API Mode processing for nest-server-starter template
@@ -114,10 +115,7 @@ class ApiMode {
             // 1. Delete files matching filePatterns
             if (modeConfig.filePatterns) {
                 for (const pattern of modeConfig.filePatterns) {
-                    const matches = this.filesystem.find(projectPath, {
-                        matching: pattern,
-                    });
-                    for (const file of matches) {
+                    for (const file of this.globFiles(projectPath, pattern)) {
                         this.filesystem.remove(file);
                     }
                 }
@@ -169,6 +167,29 @@ class ApiMode {
             this.cleanOrphanImports(projectPath);
         });
     }
+    /**
+     * Resolve a POSIX-style glob pattern against `baseDir` and return the
+     * matching files as absolute, OS-native paths.
+     *
+     * Deliberately NOT `filesystem.find()`: gluegun/fs-jetpack builds its
+     * matcher by string-concatenating the *resolved* base path in front of
+     * the pattern (fs-jetpack/lib/utils/matcher.js). On Windows that base
+     * path is backslash-separated, and minimatch reads a backslash inside a
+     * pattern as an escape character — so a base of `C:\project\src`
+     * collapses to the literal `C:projectsrc` and nothing ever matches.
+     * Effect: on Windows no file was deleted and no region was stripped,
+     * silently. `glob` keeps pattern and base directory apart and
+     * normalises separators itself, so it behaves the same on every
+     * platform.
+     */
+    globFiles(baseDir, pattern) {
+        return (0, glob_1.globSync)(pattern, {
+            absolute: true,
+            cwd: baseDir,
+            dot: true,
+            nodir: true,
+        });
+    }
     /**
      * Strip region markers from all .ts files
      *
@@ -181,7 +202,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {
@@ -196,7 +217,10 @@ class ApiMode {
                 // graphql` block with an explicit `graphQl: false,` so GraphQL
                 // is cleanly disabled.
                 let processed;
-                if (removeMarker === 'graphql' && file.endsWith('/config.env.ts')) {
+                // `basename` instead of `endsWith('/config.env.ts')`: on Windows the
+                // path separator is a backslash, so the POSIX-only suffix check never
+                // matched and config.env.ts was processed like any other file.
+                if (removeMarker === 'graphql' && (0, path_1.basename)(file) === 'config.env.ts') {
                     processed = this.replaceGraphqlRegionsWithDisabled(content, keepMarker);
                 }
                 else {
@@ -299,7 +323,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {
@@ -444,7 +468,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {

package/build/extensions/git.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Git = void 0;
+const git_env_1 = require("../lib/git-env");
 /**
  * Git functions
  */
@@ -119,8 +120,17 @@ class Git {
             const result = [];
             // Toolbox features
             const { system } = this.toolbox;
-            // Get branches (use short SSH timeout so fetch doesn't hang in offline environments)
-            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null; git show-branch --list');
+            // Refresh first, but never let a failed fetch cost us the branch list: the
+            // two commands used to be chained with `;`, which cmd.exe does not honour as
+            // a separator at all, so on Windows this ran neither reliably. They are two
+            // calls now — the fetch is best-effort, the listing is the actual result.
+            try {
+                yield system.run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_a) {
+                // Offline or no remote — `git show-branch` still lists what is local.
+            }
+            const branches = yield system.run('git show-branch --list');
             branches.split('\n').forEach((item) => {
                 const matches = item.match(/\[(.*?)]/);
                 if (matches) {
@@ -197,27 +207,6 @@ class Git {
     /**
      * Check if git is installed (cached for performance)
      */
-    /**
-     * Why the git calls in this repo spell `GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-…}"` (shell default)
-     * rather than assigning it outright.
-     *
-     * These commands do a best-effort `git fetch` to see whether the branch is
-     * behind. They set `BatchMode=yes` so ssh fails instead of PROMPTING — but an
-     * agent that stalls is not a prompt. On a 1Password-backed machine the agent is
-     * reachable and every signature needs an interactive approval; unattended it
-     * waits and then reports `communication with agent failed`. Measured: **61 s per
-     * fetch**, so `lt git update --dry-run` took 62 s and `lt git create --dry-run`
-     * 123 s (two fetches). `ConnectTimeout` does not bound it — that covers the TCP
-     * connect, not the agent.
-     *
-     * Waiting for a human to approve a key is legitimate for an interactive command,
-     * so the default is unchanged. What was wrong is that the assignment was
-     * UNCONDITIONAL: it overrode a caller who had deliberately configured ssh,
-     * including a test harness trying to make the behaviour deterministic. The
-     * `:-` default respects an existing value and keeps the old behaviour when there
-     * is none. `IdentityAgent=none` in the caller's env then drops the same fetch to
-     * ~1 s with a clean `Permission denied (publickey)`.
-     */
     gitInstalled() {
         return __awaiter(this, void 0, void 0, function* () {
             // Return cached result if available
@@ -272,8 +261,17 @@ class Git {
             if (opts.spin) {
                 searchSpin = spin(opts.spinText);
             }
-            // Update infos (use short SSH timeout so fetch doesn't hang in offline environments)
-            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
+            // Update infos. Best-effort, but expressed as try/catch rather than
+            // `2>/dev/null || true`: on Windows `true` resolves to Git-for-Windows'
+            // `true.exe`, so the pipeline succeeded with empty output and the fetch
+            // never ran — a silent no-op that read as a successful refresh.
+            let fetch = '';
+            try {
+                fetch = yield system.run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_b) {
+                // Offline or no remote — the branch search below still works on local refs.
+            }
             if (fetch.length && !fetch.startsWith('remote')) {
                 info(`Could not update infos ${fetch.length}`);
             }

package/build/extensions/server.js

@@ -44,6 +44,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
+const glob_1 = require("glob");
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
@@ -1232,13 +1233,15 @@ class Server {
             // only as type annotations — any runtime `new Request(...)` calls refer
             // to the global Fetch API Request, not the express one.
             const expressImportRegex = /^import\s+\{([^}]*)\}\s+from\s+['"]express['"]\s*;?\s*$/gm;
-            const vendoredTsFiles = filesystem.find(coreDir, {
-                matching: '**/*.ts',
-                recursive: true,
-            }) || [];
-            for (const filePath of vendoredTsFiles) {
-                // filesystem.find returns paths relative to jetpack cwd — use absolute resolution
-                const absPath = filePath.startsWith('/') ? filePath : require('node:path').resolve(filePath);
+            // `glob`, not `filesystem.find`: jetpack builds its matcher by concatenating the
+            // RESOLVED base path in front of the pattern, and minimatch reads a backslash
+            // inside a PATTERN as an escape. On Windows `C:\…\core` + `**/*.ts` therefore
+            // collapses to a literal that matches nothing, so this loop silently patched
+            // no files at all. (minimatch 3 normalised the pattern's separators; the repo
+            // now resolves the hoisted minimatch 10, which does not — see package.json.)
+            // `glob` keeps base and pattern apart and returns absolute OS-native paths.
+            const vendoredTsFiles = (0, glob_1.globSync)('**/*.ts', { absolute: true, cwd: coreDir, dot: true, nodir: true });
+            for (const absPath of vendoredTsFiles) {
                 if (!filesystem.exists(absPath))
                     continue;
                 const content = filesystem.read(absPath) || '';
@@ -2516,20 +2519,24 @@ class Server {
      * @param pattern   Optional regex for more flexible matching
      */
     findStaleImports(dest, needle, pattern) {
+        // Patterns are relative to `dest` and passed to `glob` rather than
+        // `filesystem.find`: jetpack concatenates the resolved base path in front of
+        // the pattern, and minimatch treats a backslash inside a PATTERN as an escape,
+        // so on Windows every slash-bearing pattern below matched nothing. This
+        // function would then report "no stale imports" for a project that has them —
+        // a false clean bill of health on the one check meant to catch a broken
+        // conversion. See the same fix at the vendored-express patch above.
         const globs = [
-            `${dest}/src/server/**/*.ts`,
-            `${dest}/src/main.ts`,
-            `${dest}/src/config.env.ts`,
-            `${dest}/tests/**/*.ts`,
-            `${dest}/migrations/**/*.ts`,
-            `${dest}/scripts/**/*.ts`,
+            'src/server/**/*.ts',
+            'src/main.ts',
+            'src/config.env.ts',
+            'tests/**/*.ts',
+            'migrations/**/*.ts',
+            'scripts/**/*.ts',
         ];
         const stale = [];
         for (const glob of globs) {
-            const files = this.filesystem.find(dest, {
-                matching: glob.replace(`${dest}/`, ''),
-                recursive: true,
-            }) || [];
+            const files = (0, glob_1.globSync)(glob, { absolute: true, cwd: dest, dot: true, nodir: true });
             for (const file of files) {
                 const raw = this.filesystem.read(file) || '';
                 // Strip comments before matching. The keyword-anchored pattern is not enough on its own: