@lenne.tech/cli 1.46.0 → 1.48.0

package/build/lib/platform.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findExecutable = findExecutable;
+exports.isWindows = isWindows;
+exports.spawnCmdSync = spawnCmdSync;
+exports.windowsAppData = windowsAppData;
+const cross_spawn_1 = require("cross-spawn");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
+/**
+ * Resolve a binary the way a shell would, without spawning `which`/`where.exe`.
+ *
+ * `candidates` win over PATH, in order. On Windows each PATH directory is
+ * probed with every PATHEXT extension; an extensionless file is never matched
+ * there, because Node cannot spawn it (it is typically a Git Bash script).
+ *
+ * @returns Absolute path of the first match, or null
+ */
+function findExecutable(name, options = {}) {
+    const { candidates = [], env = process.env, isExecutableFile = isExecutableFileOnDisk } = options;
+    const windows = isWindows(options.platform);
+    const pathApi = windows ? path_1.win32 : path_1.posix;
+    for (const candidate of candidates) {
+        if (isExecutableFile(candidate)) {
+            return candidate;
+        }
+    }
+    const dirs = (readEnv(env, 'PATH', windows) || '')
+        .split(pathApi.delimiter)
+        .map((dir) => dir.trim().replace(/^"(.*)"$/, '$1'))
+        .filter(Boolean);
+    const names = windows ? windowsNameVariants(name, readEnv(env, 'PATHEXT', windows)) : [name];
+    for (const dir of dirs) {
+        for (const variant of names) {
+            const full = pathApi.join(dir, variant);
+            if (isExecutableFile(full)) {
+                return full;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * True for native Windows (PowerShell, cmd.exe and Git Bash alike — Node
+ * reports `win32` in all three).
+ */
+function isWindows(platform = process.platform) {
+    return platform === 'win32';
+}
+/**
+ * `spawnSync` that also runs `.cmd`/`.bat` shims on Windows.
+ *
+ * Delegates to cross-spawn, which is a plain `child_process.spawnSync` on
+ * macOS/Linux. On Windows it resolves the shim and runs it through cmd.exe with
+ * escaped arguments.
+ *
+ * Limit on Windows: cross-spawn escapes cmd.exe metacharacters (`& | % ^ …`) twice
+ * only for shims under `node_modules\.bin`. A global npm shim such as
+ * `%APPDATA%\npm\claude.cmd` re-parses its `%*`, so there a metacharacter can
+ * still take effect. Pass plain arguments (names, slugs, paths), never
+ * untrusted free text.
+ */
+function spawnCmdSync(command, args = [], options = {}) {
+    return (0, cross_spawn_1.sync)(command, [...args], Object.assign({ encoding: 'utf-8' }, options));
+}
+/**
+ * `%APPDATA%` (roaming profile), home of npm's global `.cmd` shims on Windows.
+ */
+function windowsAppData(env, home) {
+    return readEnv(env, 'APPDATA', true) || path_1.win32.join(home, 'AppData', 'Roaming');
+}
+function isExecutableFileOnDisk(path) {
+    try {
+        if (!(0, fs_1.statSync)(path).isFile()) {
+            return false;
+        }
+        // Windows has no execute bit; X_OK degrades to an existence check there
+        (0, fs_1.accessSync)(path, fs_1.constants.X_OK);
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Windows environment keys are case-insensitive (`Path` is the usual spelling).
+ * `process.env` hides that, a plain object passed in a test does not.
+ */
+function readEnv(env, key, windows) {
+    if (!windows) {
+        return env[key];
+    }
+    const match = Object.keys(env).find((k) => k.toUpperCase() === key);
+    return match ? env[match] : undefined;
+}
+function windowsNameVariants(name, pathExt) {
+    const extensions = (pathExt || DEFAULT_PATHEXT)
+        .split(';')
+        .map((ext) => ext.trim().toLowerCase())
+        .filter(Boolean);
+    const ownExtension = path_1.win32.extname(name).toLowerCase();
+    if (ownExtension && extensions.includes(ownExtension)) {
+        return [name];
+    }
+    return extensions.map((ext) => `${name}${ext}`);
+}

package/build/lib/plugin-utils.js

@@ -21,12 +21,12 @@ exports.setupPermissions = setupPermissions;
  * Plugin utilities for Claude Code plugin management
  * Handles reading plugin contents, permissions, and post-installation setup
  */
-const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const claude_cli_1 = require("./claude-cli");
 const json_utils_1 = require("./json-utils");
+const platform_1 = require("./platform");
 const shell_config_1 = require("./shell-config");
 /**
  * Empty plugin contents constant (used for failed installations)
@@ -62,8 +62,8 @@ exports.PLUGIN_POST_INSTALL = {
         ],
         requirements: [
             {
-                checkCommand: 'which typescript-language-server',
                 description: 'TypeScript language server',
+                executable: 'typescript-language-server',
                 installCommand: 'npm install -g typescript-language-server typescript',
             },
         ],
@@ -245,10 +245,11 @@ function processPostInstall(pluginName, toolbox) {
     // Check and install requirements
     if (postInstall.requirements) {
         for (const req of postInstall.requirements) {
-            // If checkCommand is provided, verify if requirement is already met
-            if (req.checkCommand) {
+            // If executable or checkCommand is provided, verify if requirement is already met
+            if (req.executable || req.checkCommand) {
+                const isMet = () => req.executable ? (0, platform_1.findExecutable)(req.executable) !== null : (0, claude_cli_1.checkCommandExists)(req.checkCommand);
                 const checkSpinner = spin(`Checking ${req.description}`);
-                if ((0, claude_cli_1.checkCommandExists)(req.checkCommand)) {
+                if (isMet()) {
                     checkSpinner.succeed(`${req.description} already installed`);
                     continue;
                 }
@@ -257,7 +258,7 @@ function processPostInstall(pluginName, toolbox) {
                 try {
                     safeExecCommand(req.installCommand);
                     // Verify installation
-                    if ((0, claude_cli_1.checkCommandExists)(req.checkCommand)) {
+                    if (isMet()) {
                         checkSpinner.succeed(`${req.description} installed`);
                         result.requirementsInstalled.push(req.description);
                     }
@@ -377,7 +378,7 @@ function readPluginContents(marketplaceName, pluginName) {
     return result;
 }
 /**
- * Execute a shell command safely using spawnSync (no shell interpretation)
+ * Execute a shell command safely using spawnCmdSync (no shell interpretation, `.cmd` shims such as npm work on Windows)
  * Splits the command string into executable and arguments to prevent command injection
  * @param command - Command string to execute (e.g., 'npm install -g typescript')
  * @throws Error if command fails (non-zero exit code or signal)
@@ -385,7 +386,7 @@ function readPluginContents(marketplaceName, pluginName) {
 function safeExecCommand(command) {
     var _a;
     const [cmd, ...args] = command.trim().split(/\s+/);
-    const result = (0, child_process_1.spawnSync)(cmd, args, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+    const result = (0, platform_1.spawnCmdSync)(cmd, args, { stdio: ['pipe', 'pipe', 'pipe'] });
     if (result.status !== 0 || result.error) {
         throw new Error(result.stderr || ((_a = result.error) === null || _a === void 0 ? void 0 : _a.message) || `Command failed: ${command}`);
     }

package/build/lib/strip-vendor-schema-augmentation.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stripAugmentationBlocks = stripAugmentationBlocks;
 exports.stripVendorSchemaAugmentation = stripVendorSchemaAugmentation;
+const glob_1 = require("glob");
 const fs_utils_1 = require("./fs-utils");
 /**
  * Drop `declare module '<nuxt|@nuxt>/schema' { … }` blocks that only augment
@@ -118,7 +119,6 @@ function stripAugmentationBlocks(source, onSkip) {
  *          is still there and only the transform knows it.
  */
 function stripVendorSchemaAugmentation(options) {
-    var _a;
     const { coreDir, filesystem } = options;
     if (!filesystem.isDirectory(coreDir))
         return { touched: [], warnings: [] };
@@ -128,7 +128,18 @@ function stripVendorSchemaAugmentation(options) {
         return { touched: [], warnings: [] };
     const touched = [];
     const warnings = [];
-    for (const file of (_a = filesystem.find(coreDir, { matching: '**/*.ts' })) !== null && _a !== void 0 ? _a : []) {
+    // `glob`, not `filesystem.find`: gluegun's find is fs-jetpack, which builds its
+    // matcher by concatenating the resolved absolute base path in front of the glob
+    // (`fs-jetpack/lib/utils/matcher.js` → `convertPatternToAbsolutePath`). On Windows
+    // that base is backslash-separated and minimatch reads a backslash inside a
+    // PATTERN as an escape, so `D:\…\core/**/*.ts` collapses to `D:coresrc/**/*.ts`
+    // and matches nothing — minimatch normalises separators on the file side only.
+    // The strip then reported success while the TS2310 augmentation stayed in every
+    // Windows-converted project. `glob` keeps pattern and base directory apart and
+    // normalises separators itself. Same fix as `api-mode.ts`'s `globFiles`. glob does
+    // not follow symlinked directories, unlike jetpack — which is the direction the
+    // guard above already wants: nothing inside a linked checkout gets rewritten.
+    for (const file of (0, glob_1.globSync)('**/*.ts', { absolute: true, cwd: coreDir, dot: true, nodir: true })) {
         const content = filesystem.read(file);
         if (!content || !content.includes('PublicRuntimeConfig'))
             continue;

package/build/lib/vendor-claude-md.js

@@ -33,6 +33,7 @@ exports.healVendorClaudeMd = healVendorClaudeMd;
 exports.insertVendorBlockIfMissing = insertVendorBlockIfMissing;
 exports.removeVendorBlock = removeVendorBlock;
 exports.upsertVendorBlock = upsertVendorBlock;
+const path_1 = require("path");
 exports.BACKEND_VENDOR_MARKER = '<!-- lt-vendor-marker -->';
 exports.FRONTEND_VENDOR_MARKER = '<!-- lt-vendor-marker-frontend -->';
 exports.ROOT_VENDOR_MARKER = '<!-- lt-vendor-marker-root -->';
@@ -182,15 +183,20 @@ function healVendorClaudeMd(fs, state) {
             changed.push(path);
         }
     };
+    // `join`, not string concatenation with `/`: the returned paths are reported
+    // to the user and compared by callers, so they have to be the same spelling
+    // the rest of the CLI produces. Concatenating `/` onto a Windows directory
+    // yields `C:\ws\projects\api/CLAUDE.md` — it opens fine, but it matches
+    // nothing and reads like a bug in the output.
     if (state.apiDir) {
-        apply(joinPath(state.apiDir, 'CLAUDE.md'), exports.BACKEND_VENDOR_MARKER, state.backendVendor ? buildBackendVendorBlock() : null);
+        apply((0, path_1.join)(state.apiDir, 'CLAUDE.md'), exports.BACKEND_VENDOR_MARKER, state.backendVendor ? buildBackendVendorBlock() : null);
     }
     if (state.appDir) {
-        apply(joinPath(state.appDir, 'CLAUDE.md'), exports.FRONTEND_VENDOR_MARKER, state.frontendVendor ? buildFrontendVendorBlock() : null);
+        apply((0, path_1.join)(state.appDir, 'CLAUDE.md'), exports.FRONTEND_VENDOR_MARKER, state.frontendVendor ? buildFrontendVendorBlock() : null);
     }
     if (state.workspaceRoot) {
         const anyVendor = state.backendVendor || state.frontendVendor;
-        apply(joinPath(state.workspaceRoot, 'CLAUDE.md'), exports.ROOT_VENDOR_MARKER, anyVendor ? buildRootVendorBlock({ backend: state.backendVendor, frontend: state.frontendVendor }) : null);
+        apply((0, path_1.join)(state.workspaceRoot, 'CLAUDE.md'), exports.ROOT_VENDOR_MARKER, anyVendor ? buildRootVendorBlock({ backend: state.backendVendor, frontend: state.frontendVendor }) : null);
     }
     return changed;
 }
@@ -242,6 +248,3 @@ function blockRegex(marker) {
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-function joinPath(dir, file) {
-    return dir.endsWith('/') ? `${dir}${file}` : `${dir}/${file}`;
-}

package/build/lib/workspace-integration.js

@@ -81,6 +81,7 @@ exports.runStandaloneWorkspaceGate = runStandaloneWorkspaceGate;
 exports.shouldProceedAsStandalone = shouldProceedAsStandalone;
 exports.writeApiConfig = writeApiConfig;
 const yaml = __importStar(require("js-yaml"));
+const path_1 = require("path");
 const ensure_root_dockerignore_1 = require("./ensure-root-dockerignore");
 const hoist_workspace_pnpm_config_1 = require("./hoist-workspace-pnpm-config");
 const remove_nested_lockfiles_1 = require("./remove-nested-lockfiles");
@@ -104,11 +105,20 @@ function detectSubProjectContext(startDir, filesystem) {
     const appDir = filesystem.path(root, 'projects', 'app');
     // Resolve absolute prefixes for a clean startsWith compare. We use
     // the gluegun-resolved paths because all callers go through it.
+    //
+    // The prefix MUST carry the OS separator, not a literal `/`:
+    // `filesystem.path` resolves through Node's `path`, so on Windows both
+    // sides come back with backslashes and an `${apiDir}/` prefix can never
+    // match. Every cwd below `projects\api\` then read as "not a
+    // sub-project", and the standalone gate in `runStandaloneWorkspaceGate`
+    // waved the user through instead of pointing them at the workspace root
+    // — the exact case (cloning a sibling tree INSIDE an existing
+    // sub-project) the check exists to prevent.
     const startAbs = filesystem.path(startDir);
-    if (startAbs === apiDir || startAbs.startsWith(`${apiDir}/`)) {
+    if (startAbs === apiDir || startAbs.startsWith(apiDir + path_1.sep)) {
         return { kind: 'api', subProjectDir: apiDir, workspaceRoot: root };
     }
-    if (startAbs === appDir || startAbs.startsWith(`${appDir}/`)) {
+    if (startAbs === appDir || startAbs.startsWith(appDir + path_1.sep)) {
         return { kind: 'app', subProjectDir: appDir, workspaceRoot: root };
     }
     return null;