@lenne.tech/cli 1.46.0 → 1.48.0

package/build/lib/check-template-sync.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHECK_TEMPLATE_PIN_FILE = exports.CHECK_TEMPLATE_REPOSITORY = void 0;
+exports.readCheckTemplatePin = readCheckTemplatePin;
+exports.syncCheckTemplate = syncCheckTemplate;
+exports.verifyCheckTemplate = verifyCheckTemplate;
+/**
+ * Keep `src/templates/check/` a verbatim copy of a PINNED lt-monorepo state.
+ *
+ * lt-monorepo is the upstream of the check wrapper. The copy here drifted two
+ * releases behind once, and because heal treats the bundled copy as canonical,
+ * `lt fullstack update` then downgraded freshly created projects. So the
+ * template is never edited by hand: `npm run sync:check-template -- --ref <tag|sha>`
+ * copies the wrapper plus its transitive imports from that ref and records the
+ * commit and a hash per file in a pin file. A Jest test compares the template
+ * against that pin without any network access.
+ */
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const heal_check_wrapper_1 = require("./heal-check-wrapper");
+exports.CHECK_TEMPLATE_REPOSITORY = 'lenneTech/lt-monorepo';
+exports.CHECK_TEMPLATE_PIN_FILE = 'lt-monorepo-pin.json';
+const DEFAULT_FROM = `https://github.com/${exports.CHECK_TEMPLATE_REPOSITORY}.git`;
+/** Read a pin file; null when it is missing or unparseable. */
+function readCheckTemplatePin(pinPath) {
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(pinPath, 'utf8'));
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/**
+ * Copy `scripts/check.mjs` and its transitive relative imports from `ref` into
+ * the template dir and write the pin. Files the previous pin listed but the new
+ * closure no longer contains are removed; nothing else in the dir is touched.
+ *
+ * Refuses a source without an `@lt-check-wrapper` marker: an unversioned
+ * template would switch the downgrade guard in heal off without a trace.
+ */
+function syncCheckTemplate(options) {
+    var _a, _b;
+    const { from = DEFAULT_FROM, ref, templateDir } = options;
+    const pinPath = (_a = options.pinPath) !== null && _a !== void 0 ? _a : (0, path_1.join)(templateDir, exports.CHECK_TEMPLATE_PIN_FILE);
+    const checkout = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'lt-check-template-'));
+    try {
+        const git = (...args) => (0, child_process_1.execFileSync)('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+        git('clone', '--quiet', '--no-checkout', from, checkout);
+        git('-C', checkout, '-c', 'advice.detachedHead=false', 'checkout', '--quiet', ref);
+        const commit = git('-C', checkout, 'rev-parse', 'HEAD');
+        const asset = (0, path_1.join)(checkout, 'scripts', 'check.mjs');
+        if (!(0, fs_1.existsSync)(asset)) {
+            throw new Error(`${ref}: scripts/check.mjs not found`);
+        }
+        const version = (0, heal_check_wrapper_1.readWrapperVersion)(asset);
+        if (!version) {
+            throw new Error(`${ref}: scripts/check.mjs carries no @lt-check-wrapper marker — refusing to pin it`);
+        }
+        if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+            throw new Error(`${ref}: @lt-check-wrapper marker "${version}" is not a version — refusing to pin it`);
+        }
+        const previous = readCheckTemplatePin(pinPath);
+        const files = {};
+        for (const { rel, source } of (0, heal_check_wrapper_1.resolveCopySet)(asset)) {
+            const name = rel.replace(/^scripts\//, '');
+            const target = (0, path_1.join)(templateDir, name);
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(target), { recursive: true });
+            (0, fs_1.copyFileSync)(source, target);
+            files[name] = hashFile(target);
+        }
+        for (const stale of Object.keys((_b = previous === null || previous === void 0 ? void 0 : previous.files) !== null && _b !== void 0 ? _b : {})) {
+            // Names come from the pin file; never let one reach outside the template dir.
+            if (!(stale in files) && !stale.split(/[\\/]/).includes('..')) {
+                (0, fs_1.rmSync)((0, path_1.join)(templateDir, stale), { force: true });
+            }
+        }
+        const pin = {
+            commit,
+            files: sortKeys(files),
+            ref,
+            repository: exports.CHECK_TEMPLATE_REPOSITORY,
+            version,
+        };
+        (0, fs_1.writeFileSync)(pinPath, `${JSON.stringify(pin, null, 2)}\n`);
+        return pin;
+    }
+    finally {
+        (0, fs_1.rmSync)(checkout, { force: true, recursive: true });
+    }
+}
+/**
+ * Differences between the template dir and its pin; empty when they match.
+ * Checks both directions: every pinned file with its hash, and every file the
+ * wrapper actually imports is pinned (a hand-added import would otherwise slip by).
+ */
+function verifyCheckTemplate(templateDir, pin) {
+    const problems = [];
+    const actual = new Set((0, heal_check_wrapper_1.resolveCopySet)((0, path_1.join)(templateDir, 'check.mjs')).map((c) => c.rel.replace(/^scripts\//, '')));
+    for (const [name, hash] of Object.entries(pin.files)) {
+        const file = (0, path_1.join)(templateDir, name);
+        if (!(0, fs_1.existsSync)(file)) {
+            problems.push(`${name}: pinned but missing`);
+        }
+        else if (hashFile(file) !== hash) {
+            problems.push(`${name}: differs from ${exports.CHECK_TEMPLATE_REPOSITORY}@${pin.commit.slice(0, 7)}`);
+        }
+    }
+    for (const name of actual) {
+        if (!(name in pin.files)) {
+            problems.push(`${name}: imported by the wrapper but not pinned`);
+        }
+    }
+    const version = (0, heal_check_wrapper_1.readWrapperVersion)((0, path_1.join)(templateDir, 'check.mjs'));
+    if (version !== pin.version) {
+        problems.push(`check.mjs: marker ${version !== null && version !== void 0 ? version : '(none)'} does not match pinned version ${pin.version}`);
+    }
+    return problems;
+}
+function hashFile(file) {
+    return (0, crypto_1.createHash)('sha256').update((0, fs_1.readFileSync)(file)).digest('hex');
+}
+function sortKeys(record) {
+    return Object.fromEntries(Object.entries(record).sort(([a], [b]) => a.localeCompare(b)));
+}

package/build/lib/claude-cli.js

@@ -11,10 +11,10 @@ exports.runClaudeCommand = runClaudeCommand;
  * Claude CLI utilities
  * Handles detection and execution of Claude CLI commands
  */
-const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
+const platform_1 = require("./platform");
 /**
  * Path to Claude plugins marketplaces directory
  */
@@ -31,7 +31,7 @@ exports.CLAUDE_KNOWN_MARKETPLACES_PATH = (0, path_1.join)((0, os_1.homedir)(), '
 function checkCommandExists(command) {
     try {
         const [cmd, ...args] = command.trim().split(/\s+/);
-        const result = (0, child_process_1.spawnSync)(cmd, args, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+        const result = (0, platform_1.spawnCmdSync)(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'] });
         return result.status === 0;
     }
     catch (_a) {
@@ -48,27 +48,19 @@ function checkMarketplaceExists(marketplaceName) {
 }
 /**
  * Find the Claude CLI executable path
- * Checks common installation locations and falls back to 'which'
+ * Checks common installation locations first, then PATH
+ *
+ * On Windows the native installer puts `claude.exe` into `%USERPROFILE%\.local\bin`
+ * and `npm i -g` a `claude.cmd` shim into `%APPDATA%\npm`. Both are checked
+ * directly, because a shell opened before the install does not have them on PATH yet.
  * @returns Path to Claude CLI or null if not found
  */
-function findClaudeCli() {
-    const possiblePaths = [(0, path_1.join)((0, os_1.homedir)(), '.claude', 'local', 'claude'), '/usr/local/bin/claude', '/usr/bin/claude'];
-    for (const p of possiblePaths) {
-        if ((0, fs_1.existsSync)(p)) {
-            return p;
-        }
-    }
-    try {
-        const result = (0, child_process_1.spawnSync)('which', ['claude'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
-        const path = (result.stdout || '').trim();
-        if (result.status === 0 && path && (0, fs_1.existsSync)(path)) {
-            return path;
-        }
-    }
-    catch (_a) {
-        // Claude CLI not found in PATH
-    }
-    return null;
+function findClaudeCli(options = {}) {
+    const { env = process.env, home = (0, os_1.homedir)(), platform = process.platform } = options;
+    const candidates = (0, platform_1.isWindows)(platform)
+        ? [path_1.win32.join(home, '.local', 'bin', 'claude.exe'), path_1.win32.join((0, platform_1.windowsAppData)(env, home), 'npm', 'claude.cmd')]
+        : [path_1.posix.join(home, '.claude', 'local', 'claude'), '/usr/local/bin/claude', '/usr/bin/claude'];
+    return (0, platform_1.findExecutable)('claude', Object.assign(Object.assign({}, options), { candidates, env, platform }));
 }
 /**
  * List the names of all marketplaces known to the Claude CLI.
@@ -99,10 +91,7 @@ function readKnownMarketplaces() {
  */
 function runClaudeCommand(cli, args) {
     try {
-        const result = (0, child_process_1.spawnSync)(cli, args.split(' '), {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        const result = (0, platform_1.spawnCmdSync)(cli, args.split(' '), { stdio: ['pipe', 'pipe', 'pipe'] });
         return {
             output: result.stdout + result.stderr,
             success: result.status === 0,

package/build/lib/codex-cli.js

@@ -6,42 +6,35 @@ exports.runCodexCommand = runCodexCommand;
 /**
  * Codex CLI utilities.
  */
-const child_process_1 = require("child_process");
-const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
-exports.DEFAULT_CODEX_MARKETPLACE_ROOT = process.env.LT_CODEX_MARKETPLACE_ROOT || '/Users/kaihaase/code/lenneTech/codex';
-function findCodexCli() {
-    const possiblePaths = [
-        (0, path_1.join)((0, os_1.homedir)(), '.local', 'bin', 'codex'),
-        (0, path_1.join)((0, os_1.homedir)(), '.codex', 'bin', 'codex'),
-        '/usr/local/bin/codex',
-        '/opt/homebrew/bin/codex',
-        '/usr/bin/codex',
-    ];
-    for (const path of possiblePaths) {
-        if ((0, fs_1.existsSync)(path)) {
-            return path;
-        }
-    }
-    try {
-        const result = (0, child_process_1.spawnSync)('which', ['codex'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
-        const path = (result.stdout || '').trim();
-        if (result.status === 0 && path && (0, fs_1.existsSync)(path)) {
-            return path;
-        }
-    }
-    catch (_a) {
-        // Codex CLI not found in PATH.
-    }
-    return null;
+const platform_1 = require("./platform");
+/**
+ * Codex marketplace checkout used when `lt codex plugins` gets no `--path`.
+ * Defaults to the current directory, matching the command's own guidance to run it
+ * from a checkout that contains the generated marketplace.
+ */
+exports.DEFAULT_CODEX_MARKETPLACE_ROOT = process.env.LT_CODEX_MARKETPLACE_ROOT || process.cwd();
+/**
+ * Find the Codex CLI executable path: common installation locations first, then PATH.
+ * On Windows `npm i -g @openai/codex` leaves a `codex.cmd` shim in `%APPDATA%\npm`.
+ */
+function findCodexCli(options = {}) {
+    const { env = process.env, home = (0, os_1.homedir)(), platform = process.platform } = options;
+    const candidates = (0, platform_1.isWindows)(platform)
+        ? [path_1.win32.join((0, platform_1.windowsAppData)(env, home), 'npm', 'codex.cmd')]
+        : [
+            path_1.posix.join(home, '.local', 'bin', 'codex'),
+            path_1.posix.join(home, '.codex', 'bin', 'codex'),
+            '/usr/local/bin/codex',
+            '/opt/homebrew/bin/codex',
+            '/usr/bin/codex',
+        ];
+    return (0, platform_1.findExecutable)('codex', Object.assign(Object.assign({}, options), { candidates, env, platform }));
 }
 function runCodexCommand(cli, args) {
     try {
-        const result = (0, child_process_1.spawnSync)(cli, args, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        const result = (0, platform_1.spawnCmdSync)(cli, args, { stdio: ['pipe', 'pipe', 'pipe'] });
         return {
             output: result.stdout + result.stderr,
             success: result.status === 0,

package/build/lib/dev-api-launch.js

@@ -11,6 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findCompiledEntry = findCompiledEntry;
 exports.isApiCompiledRequested = isApiCompiledRequested;
+exports.resolveApiRuntime = resolveApiRuntime;
 exports.startCompiledApi = startCompiledApi;
 /**
  * Launch strategy for the API process under `lt dev up`.
@@ -47,6 +48,50 @@ function isApiCompiledRequested(options = {}) {
     const affirmative = (value) => value === true || ['1', 'true', 'yes'].includes(String(value).toLowerCase());
     return affirmative(options.apiCompiled) || affirmative(options['api-compiled']);
 }
+/**
+ * Which runtime to start the API's COMPILED bundle with.
+ *
+ * A bundle is only portable across runtimes by accident. `nest-base` builds with
+ * `Bun.build({ target: 'bun' })`, whose output calls `__require` — a Bun-only
+ * shim. Started under node it dies in milliseconds with "__require is not a
+ * function" (DEV-3208), and because the caller used to only WARN when the API
+ * never answered, the whole Playwright suite then ran against a dead API: every
+ * data-dependent spec passed trivially or skipped, so a run that checked nothing
+ * looked exactly like one that checked everything.
+ *
+ * Detected from the project rather than configured, because the project already
+ * states it three times over. Any one signal is enough:
+ *   - a `bun.lock` / `bun.lockb` IN THIS DIRECTORY (not a nested package's),
+ *   - `engines.bun` in its package.json,
+ *   - a `build` / `start` script that invokes `bun` as the COMMAND.
+ *
+ * The script check matches `bun` as a whole word at a command position, never as
+ * a substring: `rollup --bundle` and `node -r bunyan …` are Node projects, and a
+ * loose `includes('bun')` would switch them to a runtime they never installed.
+ *
+ * Defaults to `node` whenever nothing says otherwise, including an unreadable or
+ * missing package.json — the historical behaviour, and the safe one: guessing
+ * `bun` for a project that does not have it installed turns a working start into
+ * an exit-127.
+ *
+ * This deliberately does NOT live in `dev-package-manager`: that module resolves
+ * which PACKAGE MANAGER drives a directory (`pnpm run build`), a separate axis
+ * from which runtime executes an already-built bundle. A Bun project whose
+ * scripts pnpm happens to run still needs `bun dist/main.js`.
+ */
+function resolveApiRuntime(apiDir) {
+    var _a, _b, _c;
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(apiDir, 'bun.lock')) || (0, node_fs_1.existsSync)((0, node_path_1.join)(apiDir, 'bun.lockb')))
+        return 'bun';
+    const pkg = readPackageJson(apiDir);
+    if (!pkg)
+        return 'node';
+    if ((_a = pkg.engines) === null || _a === void 0 ? void 0 : _a.bun)
+        return 'bun';
+    // `bun` as the command itself, or after a shell separator (`&&`, `;`, `|`).
+    const invokesBun = /(?:^|[&|;]\s*)bun\b/;
+    return [(_b = pkg.scripts) === null || _b === void 0 ? void 0 : _b.build, (_c = pkg.scripts) === null || _c === void 0 ? void 0 : _c.start].some((script) => script && invokesBun.test(script)) ? 'bun' : 'node';
+}
 /**
  * Build the API and start it compiled (`node dist/src/main.js`). Applies pending
  * migrations first for parity with the ts-node path it replaces (`<pm> run start`
@@ -70,7 +115,11 @@ function startCompiledApi(options) {
                     return undefined;
                 }
             }
-            return (0, dev_process_1.spawnDetached)('node', [entry], { cwd: apiDir, env: Object.assign(Object.assign({}, env), { NODE_ENV: 'local' }), logFile });
+            return (0, dev_process_1.spawnDetached)(resolveApiRuntime(apiDir), [entry], {
+                cwd: apiDir,
+                env: Object.assign(Object.assign({}, env), { NODE_ENV: 'local' }),
+                logFile,
+            });
         }
         log.warn(`compiled API unavailable (build exit ${String(build)}) — falling back to \`${pm.bin} start\` (ts-node).`);
         return (0, dev_process_1.spawnDetached)(pm.bin, pm.runScript('start'), { cwd: apiDir, env, logFile });
@@ -78,12 +127,15 @@ function startCompiledApi(options) {
 }
 /** True when `package.json` in `apiDir` defines a script named `name`. */
 function hasScript(apiDir, name) {
-    var _a;
+    var _a, _b;
+    return typeof ((_b = (_a = readPackageJson(apiDir)) === null || _a === void 0 ? void 0 : _a.scripts) === null || _b === void 0 ? void 0 : _b[name]) === 'string';
+}
+/** The parsed `package.json` in `apiDir`, or `undefined` when it is missing or unparsable. */
+function readPackageJson(apiDir) {
     try {
-        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(apiDir, 'package.json'), 'utf8'));
-        return typeof ((_a = pkg.scripts) === null || _a === void 0 ? void 0 : _a[name]) === 'string';
+        return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(apiDir, 'package.json'), 'utf8'));
     }
-    catch (_b) {
-        return false;
+    catch (_a) {
+        return undefined;
     }
 }

package/build/lib/dev-process.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPortInUse = checkPortInUse;
+exports.detachedSpawnCommand = detachedSpawnCommand;
 exports.killProcessGroup = killProcessGroup;
 exports.listenSnapshot = listenSnapshot;
 exports.rotateLogFile = rotateLogFile;
@@ -59,6 +60,40 @@ function checkPortInUse(port) {
         });
     });
 }
+/**
+ * How a detached child is actually launched on this platform.
+ *
+ * POSIX raises the soft file-descriptor limit before exec-ing the real command.
+ * macOS's default soft RLIMIT_NOFILE is 256 (launchd/system default), inherited
+ * by the terminal that runs `lt dev up` and therefore by these detached children
+ * — it is NOT a consequence of the lt-dev LaunchAgent (which runs only Caddy).
+ * The dev file-watcher (nest/nuxt → chokidar) exhausts a soft-256 limit on a
+ * monorepo → intermittent "EMFILE: too many open files, watch" crashes on boot
+ * that force a manual `lt dev up`. Hence `sh -c "ulimit …; exec …"`:
+ *   - `exec` replaces the shell IN PLACE → the recorded PID and the detached
+ *     process group are still the real process (PID tracking + group-kill in
+ *     `terminateProcessGroup` keep working).
+ *   - `"$0" "$@"` pass cmd + args verbatim — no shell-quoting / injection.
+ *   - the cascade tries a high limit first, falling back on machines with a
+ *     lower `kern.maxfilesperproc`; `2>/dev/null` keeps it best-effort.
+ *
+ * Windows gets the command directly. There is no `/bin/sh` to run the wrapper —
+ * spawning it fails outright — and no RLIMIT_NOFILE for `ulimit` to raise, so
+ * the wrapper has nothing to offer there even in principle.
+ *
+ * Note for the POSIX path: because `spawn('/bin/sh', …)` almost always succeeds,
+ * a bogus `cmd` does not surface as `pid === undefined` — the inner `exec` fails
+ * (exit 127) a few ms later. Callers briefly record a live-then-dead PID, which
+ * `classifyComponentHealth` reaps as `dead`/`crashed` on the next status/up. We
+ * deliberately don't watch for that here: a detached, unref'd child's 127 exit is
+ * racy to observe, and callers must be self-correcting against real crashes anyway.
+ */
+function detachedSpawnCommand(cmd, args, platform = process.platform) {
+    if (platform === 'win32')
+        return { args, command: cmd };
+    const raiseFdLimit = 'ulimit -n 65536 2>/dev/null || ulimit -n 10240 2>/dev/null || true';
+    return { args: ['-c', `${raiseFdLimit}; exec "$0" "$@"`, cmd, ...args], command: '/bin/sh' };
+}
 /** Send SIGTERM to a detached process group; falls back to single-PID kill. */
 function killProcessGroup(pid) {
     if (!(0, dev_state_1.isValidPid)(pid))
@@ -215,6 +250,8 @@ function runChildToFile(cmd, args, opts) {
  * so closing prevents fd leaks and avoids racing-write artifacts on
  * filesystems where O_APPEND is not atomic.
  *
+ * See `detachedSpawnCommand` for how the child is launched per platform.
+ *
  * Returns the child PID, or undefined if spawn failed.
  */
 function spawnDetached(cmd, args, opts) {
@@ -223,32 +260,22 @@ function spawnDetached(cmd, args, opts) {
     const out = (0, fs_1.openSync)(opts.logFile, 'a');
     let child;
     try {
-        // Raise the soft file-descriptor limit before exec-ing the real command.
-        // macOS's default soft RLIMIT_NOFILE is 256 (launchd/system default), inherited
-        // by the terminal that runs `lt dev up` and therefore by these detached children
-        // — it is NOT a consequence of the lt-dev LaunchAgent (which runs only Caddy).
-        // The dev file-watcher (nest/nuxt → chokidar) exhausts a soft-256 limit on a
-        // monorepo → intermittent "EMFILE: too many open files, watch" crashes on boot
-        // that force a manual `lt dev up`. We wrap the command in `sh -c "ulimit …; exec …"`:
-        //   - `exec` replaces the shell IN PLACE → the recorded PID and the detached
-        //     process group are still the real process (PID tracking + group-kill in
-        //     `terminateProcessGroup` keep working).
-        //   - `"$0" "$@"` pass cmd + args verbatim — no shell-quoting / injection.
-        //   - the cascade tries a high limit first, falling back on machines with a
-        //     lower `kern.maxfilesperproc`; `2>/dev/null` keeps it best-effort.
-        // Note: because the outer `spawn('/bin/sh', …)` almost always succeeds, a bogus
-        // `cmd` no longer surfaces as `pid === undefined` here — the inner `exec` fails
-        // (exit 127) a few ms later. Callers briefly record a live-then-dead PID, which
-        // `classifyComponentHealth` reaps as `dead`/`crashed` on the next status/up. We
-        // deliberately don't watch for that here: a detached, unref'd child's 127 exit is
-        // racy to observe, and callers must be self-correcting against real crashes anyway.
-        const raiseFdLimit = 'ulimit -n 65536 2>/dev/null || ulimit -n 10240 2>/dev/null || true';
-        child = (0, child_process_1.spawn)('/bin/sh', ['-c', `${raiseFdLimit}; exec "$0" "$@"`, cmd, ...args], {
+        const spawned = detachedSpawnCommand(cmd, args);
+        child = (0, child_process_1.spawn)(spawned.command, spawned.args, {
             cwd: opts.cwd,
             detached: true,
             env: opts.env,
             stdio: ['ignore', out, out],
         });
+        // spawn reports "could not start this at all" (missing executable, bad cwd)
+        // through an ASYNCHRONOUS 'error' event — the try/catch around spawn() never
+        // sees it. With no listener, Node escalates an unhandled 'error' to a process
+        // crash, so one unstartable child would take the whole CLI down with it. That
+        // is not hypothetical: on Windows `/bin/sh` does not exist, and this line is
+        // what turned that into "Test suite failed to run" instead of one red test.
+        // Nothing to do but swallow it — the child is detached and its log file is
+        // already closed below; callers are self-correcting against a dead PID.
+        child.on('error', () => undefined);
         child.unref();
         if (child.pid === undefined)
             return undefined;
@@ -330,7 +357,15 @@ function terminateProcessGroup(pid_1) {
  *
  * Resolves `true` on the first matching response, `false` on timeout. Never rejects.
  */
-function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status < 600) {
+function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status < 600, 
+/**
+ * Optional early exit: return `true` once there is nothing left to wait FOR —
+ * typically "the process I am waiting on has exited". Without it a server that
+ * crashes on boot is indistinguishable from one that is still starting, and the
+ * caller burns the entire timeout (120s for the `lt dev test` API) before
+ * learning something that was decided in the first 300ms.
+ */
+abort = () => false) {
     const start = Date.now();
     return new Promise((resolve) => {
         const tick = () => {
@@ -340,20 +375,21 @@ function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status
             });
             let status = '';
             (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (b) => (status += String(b)));
+            const retry = () => {
+                // Order matters: a LAST probe already ran above, so a server that came up
+                // just before dying is still reported ready. Only then does `abort` end it.
+                if (Date.now() - start > timeoutMs || abort())
+                    return resolve(false);
+                setTimeout(tick, 500);
+            };
             child.on('close', () => {
                 const code = Number(status.trim());
                 // `000` (curl could not connect) parses to 0 → never "ready".
                 if (Number.isFinite(code) && code > 0 && ready(code))
                     return resolve(true);
-                if (Date.now() - start > timeoutMs)
-                    return resolve(false);
-                setTimeout(tick, 500);
-            });
-            child.on('error', () => {
-                if (Date.now() - start > timeoutMs)
-                    return resolve(false);
-                setTimeout(tick, 500);
+                retry();
             });
+            child.on('error', retry);
         };
         tick();
     });

package/build/lib/dev-state.js

@@ -204,10 +204,21 @@ function loadSession(root, sessionFile = SESSION_FILE) {
     }
     return null;
 }
-/** True if two paths resolve to the same location (normalising symlinks, e.g. /var → /private/var). */
+/**
+ * True if two paths resolve to the same location (normalising symlinks, e.g. /var → /private/var).
+ *
+ * `.native` rather than plain `realpathSync`, because on Windows the JS
+ * implementation follows symlinks but keeps 8.3 short components: a path spelled
+ * `C:\Users\RUNNER~1\…` and the same directory spelled `C:\Users\runneradmin\…`
+ * stay different strings. Both spellings occur in practice — `os.tmpdir()` hands
+ * out the short form while git prints the long one — so a registry entry written
+ * under one and a cwd under the other would read as a DIFFERENT checkout. The
+ * native variant asks the OS for the final name and collapses both.
+ * No behavioural difference on POSIX.
+ */
 function sameRealPath(a, b) {
     try {
-        return (0, fs_1.realpathSync)(a) === (0, fs_1.realpathSync)(b);
+        return fs_1.realpathSync.native(a) === fs_1.realpathSync.native(b);
     }
     catch (_a) {
         return a === b;