@lenne.tech/cli 1.46.0 → 1.48.0

package/build/lib/dev-test-session.js

@@ -16,12 +16,14 @@ exports.bringUpTestSession = bringUpTestSession;
 exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
 exports.buildTestAppEnv = buildTestAppEnv;
 exports.hasTestSession = hasTestSession;
+exports.isStackServing = isStackServing;
 exports.resolveTestSession = resolveTestSession;
 exports.runShardedTestSession = runShardedTestSession;
 exports.shardReportDir = shardReportDir;
 exports.tearDownAllTestSessions = tearDownAllTestSessions;
 exports.tearDownTestSession = tearDownTestSession;
 exports.testAppEntryCandidates = testAppEntryCandidates;
+exports.unreachableStackError = unreachableStackError;
 /**
  * Ephemeral, isolated test session for `lt dev test`.
  *
@@ -35,12 +37,16 @@ exports.testAppEntryCandidates = testAppEntryCandidates;
  *   - dev session  : svl.localhost / api.svl.localhost   → db `<…>-local`
  *   - test session : svl-test.localhost / api.svl-test.… → db `<…>-test`
  *
- * Both halves run BUILT for speed + prod-fidelity: the API COMPILED (`node dist`,
- * ts-node intermittently dies mid-run) and the App as the production Nitro output
- * (`nuxt build` → `node .output/server/index.mjs`, no Vite cold-compile). Each
- * falls back to its dev runner (`pnpm start` / `pnpm dev`) when no build output is
- * found. bringUp waits for a real 2xx on the API `/meta` before returning so the
- * suite never starts against a not-yet-serving API.
+ * Both halves run BUILT for speed + prod-fidelity: the API COMPILED (from `dist`,
+ * because ts-node intermittently dies mid-run) and the App as the production Nitro
+ * output (`nuxt build` → `node .output/server/index.mjs`, no Vite cold-compile).
+ * Each falls back to its dev runner (`pnpm start` / `pnpm dev`) when no build
+ * output is found. The API's runtime follows the project (`resolveApiRuntime`):
+ * a Bun-built bundle is started with `bun`, everything else with `node`.
+ *
+ * bringUp waits for BOTH halves to answer and THROWS when one never does, so the
+ * suite can never run against a dead stack (DEV-3208) — see `isStackServing` for
+ * what counts as answering.
  *
  * Lifecycle: `bringUpTestSession` → run Playwright → `tearDownTestSession`.
  * Teardown is idempotent and residue-free (processes, Caddy block, env bridge,
@@ -308,7 +314,10 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             const apiEnv = Object.assign(Object.assign(Object.assign({}, exports.TEST_INITIAL_ADMIN_ENV), devEnv.api.env), { NODE_ENV: 'local' });
             let apiSpawn;
             if (build === 0 && entry) {
-                apiSpawn = (0, dev_process_1.spawnDetached)('node', [entry], {
+                // Runtime follows the PROJECT, never a hardcoded default: a `nest-base` API
+                // bundles with `Bun.build({ target: 'bun' })` and dies under node with
+                // "__require is not a function" (DEV-3208).
+                apiSpawn = (0, dev_process_1.spawnDetached)((0, dev_api_launch_1.resolveApiRuntime)(layout.apiDir), [entry], {
                     cwd: layout.apiDir,
                     env: apiEnv,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
@@ -387,26 +396,43 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         (0, dev_state_1.saveSession)(layout.root, { pids, startedAt: new Date().toISOString() }, names.sessionFile);
         // ENV bridge for external tooling (kept separate from the dev `.env`).
         (0, dev_env_bridge_1.writeEnvBridge)(layout.root, devEnv, dbName, names.bridgeFile);
-        // Wait for the test App to answer (best-effort).
+        // THIS stack's log paths. Resolved BEFORE the readiness waits below, because
+        // the abort messages point at them: the log is the only place a crash-on-boot
+        // is recorded, and an abort that withholds it just relocates the guesswork.
+        // `apiLogPath` is also handed to the caller so the auth E2E specs (via
+        // NEST_SERVER_LOG) read the exact isolated log — correct per shard.
+        const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
+        const appLogPath = layout.appDir ? (0, path_1.join)(layout.root, '.lt-dev', names.appLog) : undefined;
+        // Both waits below ABORT rather than warn (DEV-3208). A warning let Playwright
+        // run the whole suite against a dead stack: every data-dependent spec passed
+        // trivially or skipped, so a run that verified NOTHING was indistinguishable
+        // from one that verified everything — worse than a red run, because nobody
+        // goes looking. `isStackServing` decides what counts as up, and the liveness
+        // guard turns a crash-on-boot into an abort in the same 300ms it took to
+        // happen, instead of after the full timeout.
+        //
+        // `gone` is deliberately true for an ABSENT pid too: reaching here means the
+        // spawn was attempted, so no pid means it failed outright and there is nothing
+        // left to wait for. Being wrong here costs nothing — the timeout still bounds
+        // the wait, so this only ever makes the abort arrive sooner.
+        const gone = (pid) => pid === undefined || !(0, dev_state_1.isPidAlive)(pid);
+        // Wait for the test App to answer.
         if (appUrl) {
             log.info(log.dim(`Waiting for ${appUrl} …`));
-            yield (0, dev_process_1.waitForHttp)(appUrl, 90000);
+            const appReady = yield (0, dev_process_1.waitForHttp)(appUrl, 90000, isStackServing, () => gone(pids.app));
+            if (!appReady)
+                throw unreachableStackError('App', appUrl, appLogPath);
         }
-        // Wait for the test API to actually SERVE (real 2xx on /meta) before handing
-        // off to Playwright. Previously bringUp only waited for the App, so a compiled
-        // API still connecting to Mongo made the first specs skip via the suite's
-        // `ensureApiReachableOrSkip` guard (the API-readiness race). A strict 2xx is
-        // required: Caddy answers 502 while its upstream is still booting, which the
-        // default (lenient) predicate would accept as "up".
+        // Wait for the test API to actually SERVE before handing off to Playwright.
+        // Previously bringUp only waited for the App, so a compiled API still
+        // connecting to its database made the first specs skip via the suite's
+        // `ensureApiReachableOrSkip` guard (the API-readiness race).
         if (apiUrl) {
             log.info(log.dim(`Waiting for ${apiUrl}/meta …`));
-            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, (status) => status >= 200 && status < 300);
+            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, isStackServing, () => gone(pids.api));
             if (!apiReady)
-                log.warn(`Test API did not answer 2xx on ${apiUrl}/meta within 120s — the first specs may skip.`);
+                throw unreachableStackError('API', `${apiUrl}/meta`, apiLogPath);
         }
-        // Expose THIS stack's API log path so the caller can point the auth E2E specs
-        // (via NEST_SERVER_LOG) at the exact isolated log — correct per shard.
-        const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
         return { apiLogPath, apiUrl, appEnv, appUrl, dbName, pids, testIdentity };
     });
 }
@@ -467,6 +493,28 @@ function buildTestAppEnv(appEnv) {
 function hasTestSession(root) {
     return (0, dev_state_1.loadSession)(root, dev_state_1.TEST_SESSION_FILE) !== null;
 }
+/**
+ * Whether an HTTP status proves the component ITSELF answered.
+ *
+ * Readiness here means liveness, not health: the question is "did my process get
+ * far enough to serve HTTP", not "did it like this particular request". So a 404
+ * and a 500 both count as ready — they came FROM the upstream — while Caddy's
+ * gateway errors do not, because Caddy returns those for the entire window in
+ * which its upstream is not yet listening.
+ *
+ * The 404 case is the load-bearing one. The API probe targets `/meta`, an
+ * endpoint `@lenne.tech/nest-server` provides and `nest-base` does not: a healthy
+ * nest-base API answers 404 there (verified against a live one). The previous
+ * strict-2xx predicate was harmless while a failed wait only logged a warning,
+ * but this module now ABORTS on it — under strict 2xx that would block
+ * `lt dev test` for every nest-base project on a perfectly healthy API, which is
+ * worse than the false-green it replaces. Probing a list of per-framework paths
+ * would work too, but it needs updating for every new template; "something other
+ * than the proxy answered" needs no such list.
+ */
+function isStackServing(status) {
+    return status > 0 && ![502, 503, 504].includes(status);
+}
 /** Build the dedicated test identity + test DB name for a project. */
 function resolveTestSession(layout, baseIdentity, shardIndex, devDbName) {
     const names = testStackNames(shardIndex);
@@ -661,6 +709,23 @@ function tearDownTestSession(layout_1, baseIdentity_1, log_1) {
 function testAppEntryCandidates() {
     return [`${exports.TEST_NITRO_OUTPUT_DIR}/server/index.mjs`, '.output/server/index.mjs'];
 }
+/**
+ * The abort thrown when a test-stack component never becomes reachable.
+ *
+ * Phrased as an abort, not a diagnosis, because the cause lives in the component's
+ * own log and nowhere else — the process is detached, so its stderr never reaches
+ * this terminal. Naming the log file is therefore the whole value of the message:
+ * an abort that only says "did not come up" moves the guesswork one step later
+ * instead of ending it.
+ *
+ * `lt dev test` catches this, reports it, tears the stack down and exits non-zero,
+ * so Playwright never starts (DEV-3208).
+ */
+function unreachableStackError(component, url, logFile) {
+    const where = logFile ? ` Why it never came up: ${logFile}` : '';
+    return new Error(`Test ${component} never became reachable at ${url} — aborting before Playwright runs, ` +
+        `because a suite run against a dead ${component} passes trivially and proves nothing.${where}`);
+}
 /**
  * Resolve the per-stack file/identity names. For a sharded run (`shardIndex`
  * given) everything gets a `.<i>` / `-<i>` suffix so N stacks coexist without

package/build/lib/git-env.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonInteractiveGitEnv = nonInteractiveGitEnv;
+/**
+ * The environment git subprocesses run with so they never block on a prompt.
+ *
+ * Two variables, one rule each:
+ *
+ * `GIT_TERMINAL_PROMPT=0` stops git asking for credentials on a dead terminal.
+ * A prompt in a detached or CI child is not a question anyone can answer — it is
+ * a hang that looks like a slow network.
+ *
+ * `GIT_SSH_COMMAND` only supplies a DEFAULT, and the distinction is expensive.
+ * `BatchMode=yes` makes ssh fail rather than PROMPT — but an agent that stalls is
+ * not a prompt. On a 1Password-backed machine the agent is reachable and every
+ * signature needs interactive approval; unattended it waits, then reports
+ * `communication with agent failed`. Measured at 61s per fetch, which made
+ * `lt git update --dry-run` take 62s and `lt git create --dry-run` 123s (two
+ * fetches). `ConnectTimeout` does not bound that — it covers the TCP connect,
+ * not the agent.
+ *
+ * Waiting for a human to approve a key is legitimate for an interactive command,
+ * so the default itself is unchanged. What was wrong was assigning it
+ * UNCONDITIONALLY: that overrode anyone who had configured ssh deliberately,
+ * including a test harness trying to make the behaviour deterministic. A
+ * caller's own value therefore always wins (`IdentityAgent=none` in their env
+ * drops the same fetch to ~1s with a clean `Permission denied (publickey)`); the
+ * fallback only keeps an unconfigured machine from hanging.
+ *
+ * This exists as an environment object rather than a shell prefix because
+ * `VAR=value git …` is not assignment syntax to cmd.exe — it reads the whole
+ * thing as a command name and fails with "'GIT_TERMINAL_PROMPT' is not
+ * recognized". Handing the child an env works on every platform, and it is the
+ * only spelling that does. Keep it here rather than inline at each call site:
+ * this is the single place the default is defined, which is what lets a test
+ * assert that nobody assigns GIT_SSH_COMMAND unconditionally anywhere else.
+ *
+ * One caveat if you ever read a variable back off the returned object: spreading
+ * `process.env` produces a PLAIN object, which on Windows loses the
+ * case-insensitive lookup the real `process.env` proxy provides. The value is
+ * intact under its original spelling (`Path`, not `PATH`), and handing the whole
+ * object to `spawn` works — but `result.PATH` is undefined there.
+ */
+function nonInteractiveGitEnv(base = process.env) {
+    return Object.assign(Object.assign({}, base), { GIT_SSH_COMMAND: base.GIT_SSH_COMMAND || 'ssh -o ConnectTimeout=5 -o BatchMode=yes', GIT_TERMINAL_PROMPT: '0' });
+}

package/build/lib/heal-check-wrapper.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareVersions = compareVersions;
+exports.compareWrapperVersions = compareWrapperVersions;
 exports.healCheckWrapper = healCheckWrapper;
+exports.keptWrapperReason = keptWrapperReason;
+exports.readWrapperVersion = readWrapperVersion;
 exports.resolveCopySet = resolveCopySet;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
@@ -9,6 +13,63 @@ const path_1 = require("path");
 const WRAPPER = 'node scripts/check.mjs';
 /** Where the wrapper and its imports live inside a project. */
 const SCRIPTS_DIR = 'scripts';
+/**
+ * `// @lt-check-wrapper 3.12.0` on line 2 of the wrapper: the lt-monorepo RELEASE it belongs
+ * to (never a project's own package version). Same expression as lt-monorepo's
+ * `scripts/check-wrapper-version.cjs#MARKER_RE`, so both sides agree on the format: a whole
+ * line, so prose mentioning the tag never matches, and `\r?` for a CRLF checkout.
+ */
+const VERSION_MARKER = /^\/\/ @lt-check-wrapper (\S+)\r?$/m;
+const SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+/**
+ * Compare two `x.y.z[-pre]` versions: negative when `a < b`, 0 when equal,
+ * positive when `a > b`. A prerelease sorts before its release.
+ */
+function compareVersions(a, b) {
+    const parse = (v) => {
+        const [core, pre = ''] = v.split('-', 2);
+        return { core: core.split('.').map(Number), pre };
+    };
+    const pa = parse(a);
+    const pb = parse(b);
+    for (let i = 0; i < 3; i++) {
+        const diff = (pa.core[i] || 0) - (pb.core[i] || 0);
+        if (diff !== 0) {
+            return diff;
+        }
+    }
+    if (pa.pre === pb.pre) {
+        return 0;
+    }
+    if (!pa.pre) {
+        return 1;
+    }
+    if (!pb.pre) {
+        return -1;
+    }
+    return pa.pre < pb.pre ? -1 : 1;
+}
+/** Read both wrapper markers and classify how the project relates to the bundle. */
+function compareWrapperVersions(projectRoot, assetPath) {
+    const bundled = readWrapperVersion(assetPath);
+    const project = readWrapperVersion((0, path_1.join)(projectRoot, SCRIPTS_DIR, 'check.mjs'));
+    let relation;
+    if (project === null) {
+        relation = 'legacy';
+    }
+    else if (!SEMVER.test(project)) {
+        relation = 'unrecognised';
+    }
+    else if (bundled === null || !SEMVER.test(bundled)) {
+        // A marked project against an unmarked bundle: the bundle predates markers.
+        relation = 'project-newer';
+    }
+    else {
+        const order = compareVersions(bundled, project);
+        relation = order > 0 ? 'bundled-newer' : order < 0 ? 'project-newer' : 'same-release';
+    }
+    return { bundled, project, relation };
+}
 /**
  * Idempotently install the report-driven check wrapper — and every module it
  * imports — into a project.
@@ -68,7 +129,13 @@ function healCheckWrapper(projectRoot, assetPath) {
     // the doc block above.
     const plans = copies.map((copy) => planCopy(projectRoot, copy));
     const blocked = plans.filter((p) => p.action === 'skip');
-    if (blocked.length > 0) {
+    // Never downgrade: a project created from a newer lt-monorepo than this CLI
+    // bundles keeps its wrapper. Replacing it silently dropped fixes before.
+    const kept = keptWrapperReason(projectRoot, assetPath);
+    if (kept) {
+        changed.push(`${copies.map((c) => c.rel).join(' + ')} (skipped: ${kept})`);
+    }
+    else if (blocked.length > 0) {
         // One entry for the whole set: the set is what could not be updated, and
         // naming only the blocking member would suggest the others did land.
         const names = blocked.map((p) => p.rel).join(', ');
@@ -94,6 +161,39 @@ function healCheckWrapper(projectRoot, assetPath) {
     }
     return changed;
 }
+/**
+ * Why the project's wrapper must be kept as it is, or null when heal may replace it.
+ * Shared by heal (skip reason) and doctor (INFO line), so both say the same thing.
+ */
+function keptWrapperReason(projectRoot, assetPath) {
+    const { bundled, project, relation } = compareWrapperVersions(projectRoot, assetPath);
+    switch (relation) {
+        case 'project-newer':
+            return `project wrapper ${project} is newer than this CLI's ${bundled !== null && bundled !== void 0 ? bundled : '(unversioned)'} — update lt`;
+        case 'same-release': {
+            // Identical content is simply up to date; a missing sibling may still be installed.
+            const projectCheck = (0, path_1.join)(projectRoot, SCRIPTS_DIR, 'check.mjs');
+            if ((0, fs_1.readFileSync)(projectCheck, 'utf8') === (0, fs_1.readFileSync)(assetPath, 'utf8')) {
+                return null;
+            }
+            return `project wrapper differs from this CLI's copy of the same release ${project} — kept, because the release number cannot tell which one is newer; update lt after the next lt-monorepo release`;
+        }
+        case 'unrecognised':
+            return `project wrapper carries an unrecognised @lt-check-wrapper marker "${project}" — kept`;
+        default:
+            return null;
+    }
+}
+/** The `@lt-check-wrapper` version of a wrapper, or null when the file is missing or unmarked. */
+function readWrapperVersion(file) {
+    var _a, _b;
+    try {
+        return (_b = (_a = VERSION_MARKER.exec((0, fs_1.readFileSync)(file, 'utf8'))) === null || _a === void 0 ? void 0 : _a[1]) !== null && _b !== void 0 ? _b : null;
+    }
+    catch (_c) {
+        return null;
+    }
+}
 /**
  * The wrapper plus the transitive closure of its relative imports.
  *
@@ -103,11 +203,6 @@ function healCheckWrapper(projectRoot, assetPath) {
  */
 function resolveCopySet(assetPath) {
     const assetDir = (0, path_1.dirname)(assetPath);
-    // Regular files only — a directory named `*.mjs` would otherwise reach
-    // copyFileSync and abort the whole migration with EISDIR.
-    const available = new Set((0, fs_1.readdirSync)(assetDir, { withFileTypes: true })
-        .filter((entry) => entry.isFile())
-        .map((entry) => entry.name));
     const copies = [{ rel: `${SCRIPTS_DIR}/check.mjs`, source: assetPath }];
     // Keyed by target rel, NOT by source basename: the asset lands as
     // `scripts/check.mjs` whatever it is called, so a `check.mjs` sitting beside a
@@ -128,14 +223,23 @@ function resolveCopySet(assetPath) {
         catch (_a) {
             continue;
         }
-        for (const match of source.matchAll(/\bfrom\s+['"]\.\/([^'"/]+)['"]/g)) {
-            const name = match[1];
-            const rel = `${SCRIPTS_DIR}/${name}`;
-            if (claimed.has(rel) || !available.has(name)) {
+        // Resolved against the IMPORTING file, so `./lib/audit-report.mjs` in the
+        // wrapper and `./ansi.mjs` inside `lib/` both land where Node looks for them.
+        // Subdirectories count: copying only the wrapper's direct siblings installed
+        // a `check.mjs` whose `./lib/*` imports resolved to nothing.
+        for (const match of source.matchAll(/\bfrom\s+['"](\.\/[^'"]+)['"]/g)) {
+            const resolved = (0, path_1.resolve)((0, path_1.dirname)(file), match[1]);
+            const inAsset = (0, path_1.relative)(assetDir, resolved);
+            // Never out of the asset dir: an import that climbs out (`./../x.mjs`)
+            // must not claim a path in the project's scripts/.
+            if (!inAsset || inAsset === '..' || inAsset.startsWith(`..${path_1.sep}`) || (0, path_1.isAbsolute)(inAsset)) {
+                continue;
+            }
+            const rel = `${SCRIPTS_DIR}/${inAsset.split(path_1.sep).join('/')}`;
+            if (claimed.has(rel) || !isRegularFile(resolved)) {
                 continue;
             }
             claimed.add(rel);
-            const resolved = (0, path_1.join)(assetDir, name);
             copies.push({ rel, source: resolved });
             queue.push(resolved);
         }
@@ -159,6 +263,19 @@ function hasUncommittedChanges(projectRoot, relPath) {
         return false;
     }
 }
+/**
+ * True for a regular file, checked without following a symlink. A directory
+ * named `*.mjs` would otherwise reach copyFileSync and abort the whole migration
+ * with EISDIR.
+ */
+function isRegularFile(target) {
+    try {
+        return (0, fs_1.lstatSync)(target).isFile();
+    }
+    catch (_a) {
+        return false;
+    }
+}
 /** True when `target` is a symlink (checked without following it). */
 function isSymlink(target) {
     try {

package/build/lib/heal-oxlintrc.js

@@ -0,0 +1,232 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDangerousFixFlagUsage = findDangerousFixFlagUsage;
+exports.healDangerousOxlintFixFlags = healDangerousOxlintFixFlags;
+exports.healOxlintrcFilename = healOxlintrcFilename;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const LEGACY = 'oxlint.json';
+const TARGET = '.oxlintrc.json';
+/** A `-c`/`--config` flag pointing at the legacy file, e.g. `-c oxlint.json`, `--config=./oxlint.json`. */
+const CONFIG_FLAG = /(-c|--config)(\s+|=)(\.\/)?oxlint\.json(?![\w.-])/g;
+/**
+ * oxlint flags that apply behaviour-changing fixes: `--fix-suggestions` (e.g. deletes
+ * console calls for no-console) and `--fix-dangerously`. Matches a USE of the flag —
+ * preceded by whitespace or a quote — not a mention in backticks such as the comment
+ * "Never `--fix-suggestions`" the current templates carry.
+ */
+const DANGEROUS_FIX_FLAG_USE = /(?:^|[\s'"])--fix-(?:suggestions|dangerously)(?![\w-])/m;
+/** The removable form: the flag as a further argument after whitespace. `--fix` itself stays. */
+const DANGEROUS_FIX_FLAG_ARG = /[ \t]+--fix-(?:suggestions|dangerously)(?![\w-])/g;
+const LINT_STAGED_FILES = [
+    '.lintstagedrc',
+    '.lintstagedrc.json',
+    '.lintstagedrc.yaml',
+    '.lintstagedrc.yml',
+    '.lintstagedrc.js',
+    '.lintstagedrc.cjs',
+    '.lintstagedrc.mjs',
+    'lint-staged.config.js',
+    'lint-staged.config.cjs',
+    'lint-staged.config.mjs',
+];
+/**
+ * Files in which a dangerous fix flag is still USED. The root `scripts/check.mjs` counts
+ * for the gate but is not stripped here — `healCheckWrapper` owns that file.
+ * Paths are relative to `workspaceRoot` (or `appDir` for a standalone app).
+ */
+function findDangerousFixFlagUsage(appDir, workspaceRoot) {
+    const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
+    const files = [
+        ...(workspaceRoot ? [(0, path_1.join)(workspaceRoot, 'scripts', 'check.mjs')] : []),
+        ...fixFlagFiles(appDir, workspaceRoot),
+    ];
+    return [...new Set(files)].filter((file) => usesDangerousFixFlag(file)).map((file) => repoRelative(base, file));
+}
+/**
+ * Remove `--fix-suggestions` and `--fix-dangerously` from the project's lint commands
+ * — root and app `package.json` (scripts and inline lint-staged), lint-staged configs
+ * and the app's own `scripts/check.mjs` — so the oxlint config can be loaded safely.
+ *
+ * Textual, so formatting stays exactly as it was. Only tracked files without
+ * uncommitted changes are edited (git can restore them); an untracked, dirty or
+ * symlinked file is reported in `skipped` and keeps blocking the rename.
+ */
+function healDangerousOxlintFixFlags(appDir, workspaceRoot) {
+    const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
+    const result = { changed: [], skipped: [] };
+    for (const file of fixFlagFiles(appDir, workspaceRoot)) {
+        if (!usesDangerousFixFlag(file)) {
+            continue;
+        }
+        const rel = repoRelative(base, file);
+        const dir = (0, path_1.join)(file, '..');
+        const name = (0, path_1.relative)(dir, file);
+        if (isSymlink(file)) {
+            result.skipped.push(`${rel} (symlink)`);
+        }
+        else if (!isTracked(dir, name)) {
+            result.skipped.push(`${rel} (not tracked by git — remove the flag by hand)`);
+        }
+        else if (hasUncommittedChanges(dir, name)) {
+            result.skipped.push(`${rel} (uncommitted changes — commit or discard them, then re-run)`);
+        }
+        else {
+            const content = (0, fs_1.readFileSync)(file, 'utf8');
+            const stripped = content.replace(DANGEROUS_FIX_FLAG_ARG, '');
+            if (stripped !== content) {
+                (0, fs_1.writeFileSync)(file, stripped);
+                result.changed.push(rel);
+            }
+            if (DANGEROUS_FIX_FLAG_USE.test(stripped)) {
+                result.skipped.push(`${rel} (a flag use that is not a plain argument remains — remove it by hand)`);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Heal the oxlint config filename of an app project: `oxlint.json` → `.oxlintrc.json`.
+ *
+ * oxlint only auto-discovers `.oxlintrc.json`. nuxt-base-template and
+ * nuxt-extensions shipped the config as `oxlint.json`, so every rule in it was
+ * silently ignored — projects linted with oxlint's defaults only. The templates
+ * renamed the file; existing projects keep the old name until this runs.
+ *
+ * Loading the config is not neutral. It turns on rules such as `no-console`, and
+ * an auto-fix run with `--fix-suggestions` applies that rule's suggestion, which
+ * deletes console calls. So the rename is GATED: it only happens once no check
+ * wrapper, script or lint-staged entry of the project still passes
+ * `--fix-suggestions`. Run it after `healCheckWrapper`, which removes the flag
+ * from the root wrapper in the same update.
+ *
+ * Same recoverability rules as the other heals: never through a symlink, never
+ * over uncommitted changes to the file, `git mv` for a tracked file so history
+ * follows the rename.
+ *
+ * @param appDir        The app project (e.g. `<workspace>/projects/app`).
+ * @param workspaceRoot The monorepo root, whose `scripts/check.mjs` and
+ *                      `package.json` also gate the rename. Omit for a standalone app.
+ */
+function healOxlintrcFilename(appDir, workspaceRoot) {
+    const legacy = (0, path_1.join)(appDir, LEGACY);
+    const target = (0, path_1.join)(appDir, TARGET);
+    if (!(0, fs_1.existsSync)(legacy) && !isSymlink(legacy)) {
+        return { action: 'none', changed: [] };
+    }
+    if ((0, fs_1.existsSync)(target) || isSymlink(target)) {
+        return {
+            action: 'both-present',
+            changed: [],
+            detail: `both ${LEGACY} and ${TARGET} exist — oxlint only loads ${TARGET}; merge the rules from ${LEGACY} by hand, then delete it`,
+        };
+    }
+    if (isSymlink(legacy)) {
+        return { action: 'skipped', changed: [], detail: `${LEGACY} is a symlink — rename it by hand` };
+    }
+    const withFlag = findDangerousFixFlagUsage(appDir, workspaceRoot);
+    if (withFlag.length > 0) {
+        return {
+            action: 'skipped',
+            changed: [],
+            detail: `--fix-suggestions/--fix-dangerously is still used in ${withFlag.join(', ')}; loading the config would let it delete console calls — remove the flag, then re-run`,
+        };
+    }
+    const tracked = isTracked(appDir, LEGACY);
+    if (tracked && hasUncommittedChanges(appDir, LEGACY)) {
+        return {
+            action: 'skipped',
+            changed: [],
+            detail: `${LEGACY} has uncommitted changes — commit or discard them, then re-run`,
+        };
+    }
+    if (tracked) {
+        (0, child_process_1.execFileSync)('git', ['-C', appDir, 'mv', '--', LEGACY, TARGET], { stdio: 'ignore' });
+    }
+    else {
+        // Nothing is overwritten (the target does not exist), so an untracked file
+        // keeps its content under the new name — no backup needed.
+        (0, fs_1.renameSync)(legacy, target);
+    }
+    const changed = [`${LEGACY} → ${TARGET}`];
+    const pkgPath = (0, path_1.join)(appDir, 'package.json');
+    if ((0, fs_1.existsSync)(pkgPath) && !isSymlink(pkgPath)) {
+        const pkg = (0, fs_1.readFileSync)(pkgPath, 'utf8');
+        // Textual, not JSON round-trip: only the flag value changes, the file keeps its formatting.
+        const updated = pkg.replace(CONFIG_FLAG, (_match, flag, sep, dot = '') => `${flag}${sep}${dot}${TARGET}`);
+        if (updated !== pkg) {
+            (0, fs_1.writeFileSync)(pkgPath, updated);
+            changed.push('package.json');
+        }
+    }
+    return { action: 'renamed', changed };
+}
+/**
+ * Files that may pass a dangerous fix flag and are ours to strip: both package.json
+ * files (scripts and inline lint-staged), lint-staged configs, and the app's own
+ * check wrapper.
+ */
+function fixFlagFiles(appDir, workspaceRoot) {
+    const roots = [...new Set([workspaceRoot, appDir].filter((dir) => Boolean(dir)))];
+    return [
+        ...roots.flatMap((dir) => ['package.json', ...LINT_STAGED_FILES].map((name) => (0, path_1.join)(dir, name))),
+        (0, path_1.join)(appDir, 'scripts', 'check.mjs'),
+    ];
+}
+/** True when the TRACKED `relPath` has uncommitted modifications. */
+function hasUncommittedChanges(dir, relPath) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['-C', dir, 'status', '--porcelain', '--', relPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return out.trim().length > 0;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True when `path` is a symlink (checked without following it). */
+function isSymlink(path) {
+    try {
+        return (0, fs_1.lstatSync)(path).isSymbolicLink();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** True when git tracks `relPath`; false outside a repository as well. */
+function isTracked(dir, relPath) {
+    try {
+        (0, child_process_1.execFileSync)('git', ['-C', dir, 'ls-files', '--error-unmatch', '--', relPath], { stdio: 'ignore' });
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * `file` relative to `base`, always with forward slashes.
+ *
+ * These strings are reported to the user next to git facts ("not tracked by
+ * git", "uncommitted changes") and name files inside the repository, which git
+ * itself always spells with `/`. `relative()` returns the OS-native form, so on
+ * Windows the report would say `projects\app\package.json` while `git status`
+ * says `projects/app/package.json` for the same file. Falls back to the
+ * absolute path when there is no relative form (`base` IS the file).
+ */
+function repoRelative(base, file) {
+    const rel = (0, path_1.relative)(base, file);
+    return rel ? rel.split(path_1.sep).join('/') : file;
+}
+function usesDangerousFixFlag(file) {
+    try {
+        // Follows a symlink on purpose: a linked config still feeds the lint run, so it
+        // must block the rename, even though the strip refuses to write through it.
+        return DANGEROUS_FIX_FLAG_USE.test((0, fs_1.readFileSync)(file, 'utf8'));
+    }
+    catch (_a) {
+        return false;
+    }
+}