@lenne.tech/cli 1.47.0 → 1.48.0

package/build/commands/git/force-pull.js

@@ -55,8 +55,17 @@ const NewCommand = {
             else {
                 info('No local changes to discard.');
             }
-            // Show commits that would be lost
-            const localCommits = yield run(`git log origin/${branch}..HEAD --oneline 2>/dev/null || echo ""`);
+            // Show commits that would be lost (none listed when the upstream ref is unknown locally).
+            // `2>/dev/null || echo ""` used to swallow the failure, but cmd.exe on Windows has no
+            // /dev/null: the redirect failed first and `echo ""` then reported success, so the preview
+            // silently claimed there was nothing ahead. try/catch behaves the same on every platform.
+            let localCommits = '';
+            try {
+                localCommits = yield run(`git log origin/${branch}..HEAD --oneline`);
+            }
+            catch (_d) {
+                // ignore - no upstream ref, so nothing ahead to report
+            }
             if (localCommits === null || localCommits === void 0 ? void 0 : localCommits.trim()) {
                 info('');
                 info('Local commits that would be lost:');

package/build/commands/git/rebase.js

@@ -54,7 +54,17 @@ const NewCommand = {
             warning('DRY-RUN MODE - No changes will be made');
             info('');
             // Show commits that would be rebased
-            const commitsToRebase = yield run(`git log ${baseBranchPreview}..HEAD --oneline 2>/dev/null || echo ""`);
+            // try/catch, not `2>/dev/null || echo ""`: on Windows that `echo` succeeds
+            // and the git log never runs, so a dry-run would report zero commits to
+            // rebase for a branch that has some — a preview that quietly understates
+            // what the real command will do.
+            let commitsToRebase = '';
+            try {
+                commitsToRebase = yield run(`git log ${baseBranchPreview}..HEAD --oneline`);
+            }
+            catch (_k) {
+                // Unknown base ref — nothing to preview, which the check below handles.
+            }
             if (commitsToRebase === null || commitsToRebase === void 0 ? void 0 : commitsToRebase.trim()) {
                 const commitCount = commitsToRebase.trim().split('\n').length;
                 info(`Would rebase ${commitCount} commit(s) from branch "${branch}" onto "${baseBranchPreview}":`);

package/build/commands/git/reset.js

@@ -10,6 +10,24 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const git_env_1 = require("../../lib/git-env");
+/**
+ * Environment that keeps the `git ls-remote` below non-interactive.
+ *
+ * This used to be a POSIX prefix on the command string
+ * (`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-…}" git …`).
+ * `system.run` shells out through `cmd.exe` on Windows, which reads
+ * `VAR=value cmd` as a command name, not as an assignment. Paired with the
+ * trailing `|| true` the call then "succeeded" with empty output, so every
+ * `lt git reset` on Windows aborted with "No remote branch … found!" — the
+ * ls-remote had never run. Handing the variables to the child as its
+ * environment works on every platform.
+ *
+ * The `||` keeps the semantics of the shell's `:-` default: a caller who
+ * configured ssh deliberately (a user with a custom agent, or a test harness
+ * pinning the behaviour) still wins. See `git.ts#gitInstalled` for why the
+ * assignment must never be unconditional.
+ */
 /**
  * Reset current branch
  */
@@ -46,7 +64,13 @@ const NewCommand = {
             return;
         }
         // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
-        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
+        let remoteBranch = '';
+        try {
+            remoteBranch = yield system.run(`git ls-remote --heads origin ${branch}`, { env: (0, git_env_1.nonInteractiveGitEnv)() });
+        }
+        catch (_d) {
+            // ignore - unreachable remote is reported as "no remote branch" below
+        }
         if (!remoteBranch) {
             error(`No remote branch ${branch} found!`);
             return;
@@ -68,8 +92,14 @@ const NewCommand = {
             else {
                 info('No local changes to discard.');
             }
-            // Show commits that would be lost
-            const localCommits = yield system.run(`git log origin/${branch}..HEAD --oneline 2>/dev/null || echo ""`);
+            // Show commits that would be lost (none listed when the upstream ref is unknown locally)
+            let localCommits = '';
+            try {
+                localCommits = yield system.run(`git log origin/${branch}..HEAD --oneline`);
+            }
+            catch (_e) {
+                // ignore - no upstream ref, so nothing ahead to report
+            }
             if (localCommits === null || localCommits === void 0 ? void 0 : localCommits.trim()) {
                 info('');
                 info('Local commits that would be lost:');
@@ -109,7 +139,9 @@ const NewCommand = {
             const projectDir = (0, path_1.dirname)(pkgPath);
             const detectedPm = toolbox.pm.detect(projectDir);
             const installSpin = spin(`Install packages using ${detectedPm}`);
-            yield system.run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+            // `cwd` instead of `cd <dir> &&`: cmd.exe's `cd` does not switch drives,
+            // and it needs no quoting for paths with spaces.
+            yield system.run(toolbox.pm.install(detectedPm), { cwd: projectDir });
             installSpin.succeed();
         }
         // Success info

package/build/commands/git/update.js

@@ -10,6 +10,22 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const git_env_1 = require("../../lib/git-env");
+/**
+ * Environment that keeps the `git` calls below non-interactive.
+ *
+ * This used to be a POSIX prefix on the command string
+ * (`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-…}" git …`).
+ * `system.run` shells out through `cmd.exe` on Windows, which does not read
+ * `VAR=value cmd` as an assignment but as a command name — so every `lt git
+ * update` failed there with "'GIT_TERMINAL_PROMPT' is not recognized". Handing
+ * the variables to the child as its environment works on every platform.
+ *
+ * The `||` keeps the semantics of the shell's `:-` default: a caller who
+ * configured ssh deliberately (a user with a custom agent, or a test harness
+ * pinning the behaviour) still wins. See `git.ts#gitInstalled` for why the
+ * assignment must never be unconditional.
+ */
 /**
  * Update branch
  */
@@ -47,10 +63,22 @@ const NewCommand = {
             info('');
             info(`Current branch: ${branch}`);
             info('');
-            // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline)
-            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
-            // Check for incoming commits
-            const incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline 2>/dev/null || echo ""`);
+            // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline).
+            // Best effort: offline or without credentials the preview falls back to the local refs.
+            try {
+                yield run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_d) {
+                // ignore - a failed fetch only makes the preview less current
+            }
+            // Check for incoming commits (none yet when the upstream ref is unknown locally)
+            let incomingCommits = '';
+            try {
+                incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline`);
+            }
+            catch (_e) {
+                // ignore - no upstream ref, so nothing incoming to report
+            }
             const commits = (incomingCommits === null || incomingCommits === void 0 ? void 0 : incomingCommits.trim().split('\n').filter((c) => c)) || [];
             if (commits.length > 0) {
                 info(`Incoming commits (${commits.length}):`);
@@ -78,7 +106,13 @@ const NewCommand = {
         const timer = startTimer();
         // Update
         const updateSpin = spin(`Update branch ${branch}`);
-        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git pull --rebase');
+        try {
+            yield run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+        }
+        catch (_f) {
+            // ignore - `git pull --rebase` below fetches again and reports the real failure
+        }
+        yield run('git pull --rebase', { env: (0, git_env_1.nonInteractiveGitEnv)() });
         updateSpin.succeed();
         // Install packages (unless skipped) with correctly detected package manager (supports monorepo lockfiles)
         if (!skipInstall) {
@@ -87,7 +121,9 @@ const NewCommand = {
                 const projectDir = (0, path_1.dirname)(pkgPath);
                 const detectedPm = toolbox.pm.detect(projectDir);
                 const installSpin = spin(`Install packages using ${detectedPm}`);
-                yield run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+                // `cwd` instead of `cd <dir> &&`: cmd.exe's `cd` does not switch drives,
+                // and it needs no quoting for paths with spaces.
+                yield run(toolbox.pm.install(detectedPm), { cwd: projectDir });
                 installSpin.succeed();
             }
         }

package/build/extensions/api-mode.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiMode = void 0;
+const glob_1 = require("glob");
 const path_1 = require("path");
 /**
  * API Mode processing for nest-server-starter template
@@ -114,10 +115,7 @@ class ApiMode {
             // 1. Delete files matching filePatterns
             if (modeConfig.filePatterns) {
                 for (const pattern of modeConfig.filePatterns) {
-                    const matches = this.filesystem.find(projectPath, {
-                        matching: pattern,
-                    });
-                    for (const file of matches) {
+                    for (const file of this.globFiles(projectPath, pattern)) {
                         this.filesystem.remove(file);
                     }
                 }
@@ -169,6 +167,29 @@ class ApiMode {
             this.cleanOrphanImports(projectPath);
         });
     }
+    /**
+     * Resolve a POSIX-style glob pattern against `baseDir` and return the
+     * matching files as absolute, OS-native paths.
+     *
+     * Deliberately NOT `filesystem.find()`: gluegun/fs-jetpack builds its
+     * matcher by string-concatenating the *resolved* base path in front of
+     * the pattern (fs-jetpack/lib/utils/matcher.js). On Windows that base
+     * path is backslash-separated, and minimatch reads a backslash inside a
+     * pattern as an escape character — so a base of `C:\project\src`
+     * collapses to the literal `C:projectsrc` and nothing ever matches.
+     * Effect: on Windows no file was deleted and no region was stripped,
+     * silently. `glob` keeps pattern and base directory apart and
+     * normalises separators itself, so it behaves the same on every
+     * platform.
+     */
+    globFiles(baseDir, pattern) {
+        return (0, glob_1.globSync)(pattern, {
+            absolute: true,
+            cwd: baseDir,
+            dot: true,
+            nodir: true,
+        });
+    }
     /**
      * Strip region markers from all .ts files
      *
@@ -181,7 +202,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {
@@ -196,7 +217,10 @@ class ApiMode {
                 // graphql` block with an explicit `graphQl: false,` so GraphQL
                 // is cleanly disabled.
                 let processed;
-                if (removeMarker === 'graphql' && file.endsWith('/config.env.ts')) {
+                // `basename` instead of `endsWith('/config.env.ts')`: on Windows the
+                // path separator is a backslash, so the POSIX-only suffix check never
+                // matched and config.env.ts was processed like any other file.
+                if (removeMarker === 'graphql' && (0, path_1.basename)(file) === 'config.env.ts') {
                     processed = this.replaceGraphqlRegionsWithDisabled(content, keepMarker);
                 }
                 else {
@@ -299,7 +323,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {
@@ -444,7 +468,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {

package/build/extensions/git.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Git = void 0;
+const git_env_1 = require("../lib/git-env");
 /**
  * Git functions
  */
@@ -119,8 +120,17 @@ class Git {
             const result = [];
             // Toolbox features
             const { system } = this.toolbox;
-            // Get branches (use short SSH timeout so fetch doesn't hang in offline environments)
-            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null; git show-branch --list');
+            // Refresh first, but never let a failed fetch cost us the branch list: the
+            // two commands used to be chained with `;`, which cmd.exe does not honour as
+            // a separator at all, so on Windows this ran neither reliably. They are two
+            // calls now — the fetch is best-effort, the listing is the actual result.
+            try {
+                yield system.run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_a) {
+                // Offline or no remote — `git show-branch` still lists what is local.
+            }
+            const branches = yield system.run('git show-branch --list');
             branches.split('\n').forEach((item) => {
                 const matches = item.match(/\[(.*?)]/);
                 if (matches) {
@@ -197,27 +207,6 @@ class Git {
     /**
      * Check if git is installed (cached for performance)
      */
-    /**
-     * Why the git calls in this repo spell `GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-…}"` (shell default)
-     * rather than assigning it outright.
-     *
-     * These commands do a best-effort `git fetch` to see whether the branch is
-     * behind. They set `BatchMode=yes` so ssh fails instead of PROMPTING — but an
-     * agent that stalls is not a prompt. On a 1Password-backed machine the agent is
-     * reachable and every signature needs an interactive approval; unattended it
-     * waits and then reports `communication with agent failed`. Measured: **61 s per
-     * fetch**, so `lt git update --dry-run` took 62 s and `lt git create --dry-run`
-     * 123 s (two fetches). `ConnectTimeout` does not bound it — that covers the TCP
-     * connect, not the agent.
-     *
-     * Waiting for a human to approve a key is legitimate for an interactive command,
-     * so the default is unchanged. What was wrong is that the assignment was
-     * UNCONDITIONAL: it overrode a caller who had deliberately configured ssh,
-     * including a test harness trying to make the behaviour deterministic. The
-     * `:-` default respects an existing value and keeps the old behaviour when there
-     * is none. `IdentityAgent=none` in the caller's env then drops the same fetch to
-     * ~1 s with a clean `Permission denied (publickey)`.
-     */
     gitInstalled() {
         return __awaiter(this, void 0, void 0, function* () {
             // Return cached result if available
@@ -272,8 +261,17 @@ class Git {
             if (opts.spin) {
                 searchSpin = spin(opts.spinText);
             }
-            // Update infos (use short SSH timeout so fetch doesn't hang in offline environments)
-            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
+            // Update infos. Best-effort, but expressed as try/catch rather than
+            // `2>/dev/null || true`: on Windows `true` resolves to Git-for-Windows'
+            // `true.exe`, so the pipeline succeeded with empty output and the fetch
+            // never ran — a silent no-op that read as a successful refresh.
+            let fetch = '';
+            try {
+                fetch = yield system.run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_b) {
+                // Offline or no remote — the branch search below still works on local refs.
+            }
             if (fetch.length && !fetch.startsWith('remote')) {
                 info(`Could not update infos ${fetch.length}`);
             }

package/build/extensions/server.js

@@ -44,6 +44,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Server = void 0;
 const crypto = __importStar(require("crypto"));
+const glob_1 = require("glob");
 const path_1 = require("path");
 const ts = __importStar(require("typescript"));
 const adopt_upstream_build_allowlist_1 = require("../lib/adopt-upstream-build-allowlist");
@@ -1232,13 +1233,15 @@ class Server {
             // only as type annotations — any runtime `new Request(...)` calls refer
             // to the global Fetch API Request, not the express one.
             const expressImportRegex = /^import\s+\{([^}]*)\}\s+from\s+['"]express['"]\s*;?\s*$/gm;
-            const vendoredTsFiles = filesystem.find(coreDir, {
-                matching: '**/*.ts',
-                recursive: true,
-            }) || [];
-            for (const filePath of vendoredTsFiles) {
-                // filesystem.find returns paths relative to jetpack cwd — use absolute resolution
-                const absPath = filePath.startsWith('/') ? filePath : require('node:path').resolve(filePath);
+            // `glob`, not `filesystem.find`: jetpack builds its matcher by concatenating the
+            // RESOLVED base path in front of the pattern, and minimatch reads a backslash
+            // inside a PATTERN as an escape. On Windows `C:\…\core` + `**/*.ts` therefore
+            // collapses to a literal that matches nothing, so this loop silently patched
+            // no files at all. (minimatch 3 normalised the pattern's separators; the repo
+            // now resolves the hoisted minimatch 10, which does not — see package.json.)
+            // `glob` keeps base and pattern apart and returns absolute OS-native paths.
+            const vendoredTsFiles = (0, glob_1.globSync)('**/*.ts', { absolute: true, cwd: coreDir, dot: true, nodir: true });
+            for (const absPath of vendoredTsFiles) {
                 if (!filesystem.exists(absPath))
                     continue;
                 const content = filesystem.read(absPath) || '';
@@ -2516,20 +2519,24 @@ class Server {
      * @param pattern   Optional regex for more flexible matching
      */
     findStaleImports(dest, needle, pattern) {
+        // Patterns are relative to `dest` and passed to `glob` rather than
+        // `filesystem.find`: jetpack concatenates the resolved base path in front of
+        // the pattern, and minimatch treats a backslash inside a PATTERN as an escape,
+        // so on Windows every slash-bearing pattern below matched nothing. This
+        // function would then report "no stale imports" for a project that has them —
+        // a false clean bill of health on the one check meant to catch a broken
+        // conversion. See the same fix at the vendored-express patch above.
         const globs = [
-            `${dest}/src/server/**/*.ts`,
-            `${dest}/src/main.ts`,
-            `${dest}/src/config.env.ts`,
-            `${dest}/tests/**/*.ts`,
-            `${dest}/migrations/**/*.ts`,
-            `${dest}/scripts/**/*.ts`,
+            'src/server/**/*.ts',
+            'src/main.ts',
+            'src/config.env.ts',
+            'tests/**/*.ts',
+            'migrations/**/*.ts',
+            'scripts/**/*.ts',
         ];
         const stale = [];
         for (const glob of globs) {
-            const files = this.filesystem.find(dest, {
-                matching: glob.replace(`${dest}/`, ''),
-                recursive: true,
-            }) || [];
+            const files = (0, glob_1.globSync)(glob, { absolute: true, cwd: dest, dot: true, nodir: true });
             for (const file of files) {
                 const raw = this.filesystem.read(file) || '';
                 // Strip comments before matching. The keyword-anchored pattern is not enough on its own:

package/build/lib/dev-api-launch.js

@@ -11,6 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findCompiledEntry = findCompiledEntry;
 exports.isApiCompiledRequested = isApiCompiledRequested;
+exports.resolveApiRuntime = resolveApiRuntime;
 exports.startCompiledApi = startCompiledApi;
 /**
  * Launch strategy for the API process under `lt dev up`.
@@ -47,6 +48,50 @@ function isApiCompiledRequested(options = {}) {
     const affirmative = (value) => value === true || ['1', 'true', 'yes'].includes(String(value).toLowerCase());
     return affirmative(options.apiCompiled) || affirmative(options['api-compiled']);
 }
+/**
+ * Which runtime to start the API's COMPILED bundle with.
+ *
+ * A bundle is only portable across runtimes by accident. `nest-base` builds with
+ * `Bun.build({ target: 'bun' })`, whose output calls `__require` — a Bun-only
+ * shim. Started under node it dies in milliseconds with "__require is not a
+ * function" (DEV-3208), and because the caller used to only WARN when the API
+ * never answered, the whole Playwright suite then ran against a dead API: every
+ * data-dependent spec passed trivially or skipped, so a run that checked nothing
+ * looked exactly like one that checked everything.
+ *
+ * Detected from the project rather than configured, because the project already
+ * states it three times over. Any one signal is enough:
+ *   - a `bun.lock` / `bun.lockb` IN THIS DIRECTORY (not a nested package's),
+ *   - `engines.bun` in its package.json,
+ *   - a `build` / `start` script that invokes `bun` as the COMMAND.
+ *
+ * The script check matches `bun` as a whole word at a command position, never as
+ * a substring: `rollup --bundle` and `node -r bunyan …` are Node projects, and a
+ * loose `includes('bun')` would switch them to a runtime they never installed.
+ *
+ * Defaults to `node` whenever nothing says otherwise, including an unreadable or
+ * missing package.json — the historical behaviour, and the safe one: guessing
+ * `bun` for a project that does not have it installed turns a working start into
+ * an exit-127.
+ *
+ * This deliberately does NOT live in `dev-package-manager`: that module resolves
+ * which PACKAGE MANAGER drives a directory (`pnpm run build`), a separate axis
+ * from which runtime executes an already-built bundle. A Bun project whose
+ * scripts pnpm happens to run still needs `bun dist/main.js`.
+ */
+function resolveApiRuntime(apiDir) {
+    var _a, _b, _c;
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(apiDir, 'bun.lock')) || (0, node_fs_1.existsSync)((0, node_path_1.join)(apiDir, 'bun.lockb')))
+        return 'bun';
+    const pkg = readPackageJson(apiDir);
+    if (!pkg)
+        return 'node';
+    if ((_a = pkg.engines) === null || _a === void 0 ? void 0 : _a.bun)
+        return 'bun';
+    // `bun` as the command itself, or after a shell separator (`&&`, `;`, `|`).
+    const invokesBun = /(?:^|[&|;]\s*)bun\b/;
+    return [(_b = pkg.scripts) === null || _b === void 0 ? void 0 : _b.build, (_c = pkg.scripts) === null || _c === void 0 ? void 0 : _c.start].some((script) => script && invokesBun.test(script)) ? 'bun' : 'node';
+}
 /**
  * Build the API and start it compiled (`node dist/src/main.js`). Applies pending
  * migrations first for parity with the ts-node path it replaces (`<pm> run start`
@@ -70,7 +115,11 @@ function startCompiledApi(options) {
                     return undefined;
                 }
             }
-            return (0, dev_process_1.spawnDetached)('node', [entry], { cwd: apiDir, env: Object.assign(Object.assign({}, env), { NODE_ENV: 'local' }), logFile });
+            return (0, dev_process_1.spawnDetached)(resolveApiRuntime(apiDir), [entry], {
+                cwd: apiDir,
+                env: Object.assign(Object.assign({}, env), { NODE_ENV: 'local' }),
+                logFile,
+            });
         }
         log.warn(`compiled API unavailable (build exit ${String(build)}) — falling back to \`${pm.bin} start\` (ts-node).`);
         return (0, dev_process_1.spawnDetached)(pm.bin, pm.runScript('start'), { cwd: apiDir, env, logFile });
@@ -78,12 +127,15 @@ function startCompiledApi(options) {
 }
 /** True when `package.json` in `apiDir` defines a script named `name`. */
 function hasScript(apiDir, name) {
-    var _a;
+    var _a, _b;
+    return typeof ((_b = (_a = readPackageJson(apiDir)) === null || _a === void 0 ? void 0 : _a.scripts) === null || _b === void 0 ? void 0 : _b[name]) === 'string';
+}
+/** The parsed `package.json` in `apiDir`, or `undefined` when it is missing or unparsable. */
+function readPackageJson(apiDir) {
     try {
-        const pkg = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(apiDir, 'package.json'), 'utf8'));
-        return typeof ((_a = pkg.scripts) === null || _a === void 0 ? void 0 : _a[name]) === 'string';
+        return JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(apiDir, 'package.json'), 'utf8'));
     }
-    catch (_b) {
-        return false;
+    catch (_a) {
+        return undefined;
     }
 }

package/build/lib/dev-process.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPortInUse = checkPortInUse;
+exports.detachedSpawnCommand = detachedSpawnCommand;
 exports.killProcessGroup = killProcessGroup;
 exports.listenSnapshot = listenSnapshot;
 exports.rotateLogFile = rotateLogFile;
@@ -59,6 +60,40 @@ function checkPortInUse(port) {
         });
     });
 }
+/**
+ * How a detached child is actually launched on this platform.
+ *
+ * POSIX raises the soft file-descriptor limit before exec-ing the real command.
+ * macOS's default soft RLIMIT_NOFILE is 256 (launchd/system default), inherited
+ * by the terminal that runs `lt dev up` and therefore by these detached children
+ * — it is NOT a consequence of the lt-dev LaunchAgent (which runs only Caddy).
+ * The dev file-watcher (nest/nuxt → chokidar) exhausts a soft-256 limit on a
+ * monorepo → intermittent "EMFILE: too many open files, watch" crashes on boot
+ * that force a manual `lt dev up`. Hence `sh -c "ulimit …; exec …"`:
+ *   - `exec` replaces the shell IN PLACE → the recorded PID and the detached
+ *     process group are still the real process (PID tracking + group-kill in
+ *     `terminateProcessGroup` keep working).
+ *   - `"$0" "$@"` pass cmd + args verbatim — no shell-quoting / injection.
+ *   - the cascade tries a high limit first, falling back on machines with a
+ *     lower `kern.maxfilesperproc`; `2>/dev/null` keeps it best-effort.
+ *
+ * Windows gets the command directly. There is no `/bin/sh` to run the wrapper —
+ * spawning it fails outright — and no RLIMIT_NOFILE for `ulimit` to raise, so
+ * the wrapper has nothing to offer there even in principle.
+ *
+ * Note for the POSIX path: because `spawn('/bin/sh', …)` almost always succeeds,
+ * a bogus `cmd` does not surface as `pid === undefined` — the inner `exec` fails
+ * (exit 127) a few ms later. Callers briefly record a live-then-dead PID, which
+ * `classifyComponentHealth` reaps as `dead`/`crashed` on the next status/up. We
+ * deliberately don't watch for that here: a detached, unref'd child's 127 exit is
+ * racy to observe, and callers must be self-correcting against real crashes anyway.
+ */
+function detachedSpawnCommand(cmd, args, platform = process.platform) {
+    if (platform === 'win32')
+        return { args, command: cmd };
+    const raiseFdLimit = 'ulimit -n 65536 2>/dev/null || ulimit -n 10240 2>/dev/null || true';
+    return { args: ['-c', `${raiseFdLimit}; exec "$0" "$@"`, cmd, ...args], command: '/bin/sh' };
+}
 /** Send SIGTERM to a detached process group; falls back to single-PID kill. */
 function killProcessGroup(pid) {
     if (!(0, dev_state_1.isValidPid)(pid))
@@ -215,6 +250,8 @@ function runChildToFile(cmd, args, opts) {
  * so closing prevents fd leaks and avoids racing-write artifacts on
  * filesystems where O_APPEND is not atomic.
  *
+ * See `detachedSpawnCommand` for how the child is launched per platform.
+ *
  * Returns the child PID, or undefined if spawn failed.
  */
 function spawnDetached(cmd, args, opts) {
@@ -223,32 +260,22 @@ function spawnDetached(cmd, args, opts) {
     const out = (0, fs_1.openSync)(opts.logFile, 'a');
     let child;
     try {
-        // Raise the soft file-descriptor limit before exec-ing the real command.
-        // macOS's default soft RLIMIT_NOFILE is 256 (launchd/system default), inherited
-        // by the terminal that runs `lt dev up` and therefore by these detached children
-        // — it is NOT a consequence of the lt-dev LaunchAgent (which runs only Caddy).
-        // The dev file-watcher (nest/nuxt → chokidar) exhausts a soft-256 limit on a
-        // monorepo → intermittent "EMFILE: too many open files, watch" crashes on boot
-        // that force a manual `lt dev up`. We wrap the command in `sh -c "ulimit …; exec …"`:
-        //   - `exec` replaces the shell IN PLACE → the recorded PID and the detached
-        //     process group are still the real process (PID tracking + group-kill in
-        //     `terminateProcessGroup` keep working).
-        //   - `"$0" "$@"` pass cmd + args verbatim — no shell-quoting / injection.
-        //   - the cascade tries a high limit first, falling back on machines with a
-        //     lower `kern.maxfilesperproc`; `2>/dev/null` keeps it best-effort.
-        // Note: because the outer `spawn('/bin/sh', …)` almost always succeeds, a bogus
-        // `cmd` no longer surfaces as `pid === undefined` here — the inner `exec` fails
-        // (exit 127) a few ms later. Callers briefly record a live-then-dead PID, which
-        // `classifyComponentHealth` reaps as `dead`/`crashed` on the next status/up. We
-        // deliberately don't watch for that here: a detached, unref'd child's 127 exit is
-        // racy to observe, and callers must be self-correcting against real crashes anyway.
-        const raiseFdLimit = 'ulimit -n 65536 2>/dev/null || ulimit -n 10240 2>/dev/null || true';
-        child = (0, child_process_1.spawn)('/bin/sh', ['-c', `${raiseFdLimit}; exec "$0" "$@"`, cmd, ...args], {
+        const spawned = detachedSpawnCommand(cmd, args);
+        child = (0, child_process_1.spawn)(spawned.command, spawned.args, {
             cwd: opts.cwd,
             detached: true,
             env: opts.env,
             stdio: ['ignore', out, out],
         });
+        // spawn reports "could not start this at all" (missing executable, bad cwd)
+        // through an ASYNCHRONOUS 'error' event — the try/catch around spawn() never
+        // sees it. With no listener, Node escalates an unhandled 'error' to a process
+        // crash, so one unstartable child would take the whole CLI down with it. That
+        // is not hypothetical: on Windows `/bin/sh` does not exist, and this line is
+        // what turned that into "Test suite failed to run" instead of one red test.
+        // Nothing to do but swallow it — the child is detached and its log file is
+        // already closed below; callers are self-correcting against a dead PID.
+        child.on('error', () => undefined);
         child.unref();
         if (child.pid === undefined)
             return undefined;
@@ -330,7 +357,15 @@ function terminateProcessGroup(pid_1) {
  *
  * Resolves `true` on the first matching response, `false` on timeout. Never rejects.
  */
-function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status < 600) {
+function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status < 600, 
+/**
+ * Optional early exit: return `true` once there is nothing left to wait FOR —
+ * typically "the process I am waiting on has exited". Without it a server that
+ * crashes on boot is indistinguishable from one that is still starting, and the
+ * caller burns the entire timeout (120s for the `lt dev test` API) before
+ * learning something that was decided in the first 300ms.
+ */
+abort = () => false) {
     const start = Date.now();
     return new Promise((resolve) => {
         const tick = () => {
@@ -340,20 +375,21 @@ function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status
             });
             let status = '';
             (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (b) => (status += String(b)));
+            const retry = () => {
+                // Order matters: a LAST probe already ran above, so a server that came up
+                // just before dying is still reported ready. Only then does `abort` end it.
+                if (Date.now() - start > timeoutMs || abort())
+                    return resolve(false);
+                setTimeout(tick, 500);
+            };
             child.on('close', () => {
                 const code = Number(status.trim());
                 // `000` (curl could not connect) parses to 0 → never "ready".
                 if (Number.isFinite(code) && code > 0 && ready(code))
                     return resolve(true);
-                if (Date.now() - start > timeoutMs)
-                    return resolve(false);
-                setTimeout(tick, 500);
-            });
-            child.on('error', () => {
-                if (Date.now() - start > timeoutMs)
-                    return resolve(false);
-                setTimeout(tick, 500);
+                retry();
             });
+            child.on('error', retry);
         };
         tick();
     });

package/build/lib/dev-state.js

@@ -204,10 +204,21 @@ function loadSession(root, sessionFile = SESSION_FILE) {
     }
     return null;
 }
-/** True if two paths resolve to the same location (normalising symlinks, e.g. /var → /private/var). */
+/**
+ * True if two paths resolve to the same location (normalising symlinks, e.g. /var → /private/var).
+ *
+ * `.native` rather than plain `realpathSync`, because on Windows the JS
+ * implementation follows symlinks but keeps 8.3 short components: a path spelled
+ * `C:\Users\RUNNER~1\…` and the same directory spelled `C:\Users\runneradmin\…`
+ * stay different strings. Both spellings occur in practice — `os.tmpdir()` hands
+ * out the short form while git prints the long one — so a registry entry written
+ * under one and a cwd under the other would read as a DIFFERENT checkout. The
+ * native variant asks the OS for the final name and collapses both.
+ * No behavioural difference on POSIX.
+ */
 function sameRealPath(a, b) {
     try {
-        return (0, fs_1.realpathSync)(a) === (0, fs_1.realpathSync)(b);
+        return fs_1.realpathSync.native(a) === fs_1.realpathSync.native(b);
     }
     catch (_a) {
         return a === b;

package/build/lib/dev-test-session.js

@@ -16,12 +16,14 @@ exports.bringUpTestSession = bringUpTestSession;
 exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
 exports.buildTestAppEnv = buildTestAppEnv;
 exports.hasTestSession = hasTestSession;
+exports.isStackServing = isStackServing;
 exports.resolveTestSession = resolveTestSession;
 exports.runShardedTestSession = runShardedTestSession;
 exports.shardReportDir = shardReportDir;
 exports.tearDownAllTestSessions = tearDownAllTestSessions;
 exports.tearDownTestSession = tearDownTestSession;
 exports.testAppEntryCandidates = testAppEntryCandidates;
+exports.unreachableStackError = unreachableStackError;
 /**
  * Ephemeral, isolated test session for `lt dev test`.
  *
@@ -35,12 +37,16 @@ exports.testAppEntryCandidates = testAppEntryCandidates;
  *   - dev session  : svl.localhost / api.svl.localhost   → db `<…>-local`
  *   - test session : svl-test.localhost / api.svl-test.… → db `<…>-test`
  *
- * Both halves run BUILT for speed + prod-fidelity: the API COMPILED (`node dist`,
- * ts-node intermittently dies mid-run) and the App as the production Nitro output
- * (`nuxt build` → `node .output/server/index.mjs`, no Vite cold-compile). Each
- * falls back to its dev runner (`pnpm start` / `pnpm dev`) when no build output is
- * found. bringUp waits for a real 2xx on the API `/meta` before returning so the
- * suite never starts against a not-yet-serving API.
+ * Both halves run BUILT for speed + prod-fidelity: the API COMPILED (from `dist`,
+ * because ts-node intermittently dies mid-run) and the App as the production Nitro
+ * output (`nuxt build` → `node .output/server/index.mjs`, no Vite cold-compile).
+ * Each falls back to its dev runner (`pnpm start` / `pnpm dev`) when no build
+ * output is found. The API's runtime follows the project (`resolveApiRuntime`):
+ * a Bun-built bundle is started with `bun`, everything else with `node`.
+ *
+ * bringUp waits for BOTH halves to answer and THROWS when one never does, so the
+ * suite can never run against a dead stack (DEV-3208) — see `isStackServing` for
+ * what counts as answering.
  *
  * Lifecycle: `bringUpTestSession` → run Playwright → `tearDownTestSession`.
  * Teardown is idempotent and residue-free (processes, Caddy block, env bridge,
@@ -308,7 +314,10 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             const apiEnv = Object.assign(Object.assign(Object.assign({}, exports.TEST_INITIAL_ADMIN_ENV), devEnv.api.env), { NODE_ENV: 'local' });
             let apiSpawn;
             if (build === 0 && entry) {
-                apiSpawn = (0, dev_process_1.spawnDetached)('node', [entry], {
+                // Runtime follows the PROJECT, never a hardcoded default: a `nest-base` API
+                // bundles with `Bun.build({ target: 'bun' })` and dies under node with
+                // "__require is not a function" (DEV-3208).
+                apiSpawn = (0, dev_process_1.spawnDetached)((0, dev_api_launch_1.resolveApiRuntime)(layout.apiDir), [entry], {
                     cwd: layout.apiDir,
                     env: apiEnv,
                     logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
@@ -387,26 +396,43 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         (0, dev_state_1.saveSession)(layout.root, { pids, startedAt: new Date().toISOString() }, names.sessionFile);
         // ENV bridge for external tooling (kept separate from the dev `.env`).
         (0, dev_env_bridge_1.writeEnvBridge)(layout.root, devEnv, dbName, names.bridgeFile);
-        // Wait for the test App to answer (best-effort).
+        // THIS stack's log paths. Resolved BEFORE the readiness waits below, because
+        // the abort messages point at them: the log is the only place a crash-on-boot
+        // is recorded, and an abort that withholds it just relocates the guesswork.
+        // `apiLogPath` is also handed to the caller so the auth E2E specs (via
+        // NEST_SERVER_LOG) read the exact isolated log — correct per shard.
+        const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
+        const appLogPath = layout.appDir ? (0, path_1.join)(layout.root, '.lt-dev', names.appLog) : undefined;
+        // Both waits below ABORT rather than warn (DEV-3208). A warning let Playwright
+        // run the whole suite against a dead stack: every data-dependent spec passed
+        // trivially or skipped, so a run that verified NOTHING was indistinguishable
+        // from one that verified everything — worse than a red run, because nobody
+        // goes looking. `isStackServing` decides what counts as up, and the liveness
+        // guard turns a crash-on-boot into an abort in the same 300ms it took to
+        // happen, instead of after the full timeout.
+        //
+        // `gone` is deliberately true for an ABSENT pid too: reaching here means the
+        // spawn was attempted, so no pid means it failed outright and there is nothing
+        // left to wait for. Being wrong here costs nothing — the timeout still bounds
+        // the wait, so this only ever makes the abort arrive sooner.
+        const gone = (pid) => pid === undefined || !(0, dev_state_1.isPidAlive)(pid);
+        // Wait for the test App to answer.
         if (appUrl) {
             log.info(log.dim(`Waiting for ${appUrl} …`));
-            yield (0, dev_process_1.waitForHttp)(appUrl, 90000);
+            const appReady = yield (0, dev_process_1.waitForHttp)(appUrl, 90000, isStackServing, () => gone(pids.app));
+            if (!appReady)
+                throw unreachableStackError('App', appUrl, appLogPath);
         }
-        // Wait for the test API to actually SERVE (real 2xx on /meta) before handing
-        // off to Playwright. Previously bringUp only waited for the App, so a compiled
-        // API still connecting to Mongo made the first specs skip via the suite's
-        // `ensureApiReachableOrSkip` guard (the API-readiness race). A strict 2xx is
-        // required: Caddy answers 502 while its upstream is still booting, which the
-        // default (lenient) predicate would accept as "up".
+        // Wait for the test API to actually SERVE before handing off to Playwright.
+        // Previously bringUp only waited for the App, so a compiled API still
+        // connecting to its database made the first specs skip via the suite's
+        // `ensureApiReachableOrSkip` guard (the API-readiness race).
         if (apiUrl) {
             log.info(log.dim(`Waiting for ${apiUrl}/meta …`));
-            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, (status) => status >= 200 && status < 300);
+            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, isStackServing, () => gone(pids.api));
             if (!apiReady)
-                log.warn(`Test API did not answer 2xx on ${apiUrl}/meta within 120s — the first specs may skip.`);
+                throw unreachableStackError('API', `${apiUrl}/meta`, apiLogPath);
         }
-        // Expose THIS stack's API log path so the caller can point the auth E2E specs
-        // (via NEST_SERVER_LOG) at the exact isolated log — correct per shard.
-        const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
         return { apiLogPath, apiUrl, appEnv, appUrl, dbName, pids, testIdentity };
     });
 }
@@ -467,6 +493,28 @@ function buildTestAppEnv(appEnv) {
 function hasTestSession(root) {
     return (0, dev_state_1.loadSession)(root, dev_state_1.TEST_SESSION_FILE) !== null;
 }
+/**
+ * Whether an HTTP status proves the component ITSELF answered.
+ *
+ * Readiness here means liveness, not health: the question is "did my process get
+ * far enough to serve HTTP", not "did it like this particular request". So a 404
+ * and a 500 both count as ready — they came FROM the upstream — while Caddy's
+ * gateway errors do not, because Caddy returns those for the entire window in
+ * which its upstream is not yet listening.
+ *
+ * The 404 case is the load-bearing one. The API probe targets `/meta`, an
+ * endpoint `@lenne.tech/nest-server` provides and `nest-base` does not: a healthy
+ * nest-base API answers 404 there (verified against a live one). The previous
+ * strict-2xx predicate was harmless while a failed wait only logged a warning,
+ * but this module now ABORTS on it — under strict 2xx that would block
+ * `lt dev test` for every nest-base project on a perfectly healthy API, which is
+ * worse than the false-green it replaces. Probing a list of per-framework paths
+ * would work too, but it needs updating for every new template; "something other
+ * than the proxy answered" needs no such list.
+ */
+function isStackServing(status) {
+    return status > 0 && ![502, 503, 504].includes(status);
+}
 /** Build the dedicated test identity + test DB name for a project. */
 function resolveTestSession(layout, baseIdentity, shardIndex, devDbName) {
     const names = testStackNames(shardIndex);
@@ -661,6 +709,23 @@ function tearDownTestSession(layout_1, baseIdentity_1, log_1) {
 function testAppEntryCandidates() {
     return [`${exports.TEST_NITRO_OUTPUT_DIR}/server/index.mjs`, '.output/server/index.mjs'];
 }
+/**
+ * The abort thrown when a test-stack component never becomes reachable.
+ *
+ * Phrased as an abort, not a diagnosis, because the cause lives in the component's
+ * own log and nowhere else — the process is detached, so its stderr never reaches
+ * this terminal. Naming the log file is therefore the whole value of the message:
+ * an abort that only says "did not come up" moves the guesswork one step later
+ * instead of ending it.
+ *
+ * `lt dev test` catches this, reports it, tears the stack down and exits non-zero,
+ * so Playwright never starts (DEV-3208).
+ */
+function unreachableStackError(component, url, logFile) {
+    const where = logFile ? ` Why it never came up: ${logFile}` : '';
+    return new Error(`Test ${component} never became reachable at ${url} — aborting before Playwright runs, ` +
+        `because a suite run against a dead ${component} passes trivially and proves nothing.${where}`);
+}
 /**
  * Resolve the per-stack file/identity names. For a sharded run (`shardIndex`
  * given) everything gets a `.<i>` / `-<i>` suffix so N stacks coexist without

package/build/lib/git-env.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonInteractiveGitEnv = nonInteractiveGitEnv;
+/**
+ * The environment git subprocesses run with so they never block on a prompt.
+ *
+ * Two variables, one rule each:
+ *
+ * `GIT_TERMINAL_PROMPT=0` stops git asking for credentials on a dead terminal.
+ * A prompt in a detached or CI child is not a question anyone can answer — it is
+ * a hang that looks like a slow network.
+ *
+ * `GIT_SSH_COMMAND` only supplies a DEFAULT, and the distinction is expensive.
+ * `BatchMode=yes` makes ssh fail rather than PROMPT — but an agent that stalls is
+ * not a prompt. On a 1Password-backed machine the agent is reachable and every
+ * signature needs interactive approval; unattended it waits, then reports
+ * `communication with agent failed`. Measured at 61s per fetch, which made
+ * `lt git update --dry-run` take 62s and `lt git create --dry-run` 123s (two
+ * fetches). `ConnectTimeout` does not bound that — it covers the TCP connect,
+ * not the agent.
+ *
+ * Waiting for a human to approve a key is legitimate for an interactive command,
+ * so the default itself is unchanged. What was wrong was assigning it
+ * UNCONDITIONALLY: that overrode anyone who had configured ssh deliberately,
+ * including a test harness trying to make the behaviour deterministic. A
+ * caller's own value therefore always wins (`IdentityAgent=none` in their env
+ * drops the same fetch to ~1s with a clean `Permission denied (publickey)`); the
+ * fallback only keeps an unconfigured machine from hanging.
+ *
+ * This exists as an environment object rather than a shell prefix because
+ * `VAR=value git …` is not assignment syntax to cmd.exe — it reads the whole
+ * thing as a command name and fails with "'GIT_TERMINAL_PROMPT' is not
+ * recognized". Handing the child an env works on every platform, and it is the
+ * only spelling that does. Keep it here rather than inline at each call site:
+ * this is the single place the default is defined, which is what lets a test
+ * assert that nobody assigns GIT_SSH_COMMAND unconditionally anywhere else.
+ *
+ * One caveat if you ever read a variable back off the returned object: spreading
+ * `process.env` produces a PLAIN object, which on Windows loses the
+ * case-insensitive lookup the real `process.env` proxy provides. The value is
+ * intact under its original spelling (`Path`, not `PATH`), and handing the whole
+ * object to `spawn` works — but `result.PATH` is undefined there.
+ */
+function nonInteractiveGitEnv(base = process.env) {
+    return Object.assign(Object.assign({}, base), { GIT_SSH_COMMAND: base.GIT_SSH_COMMAND || 'ssh -o ConnectTimeout=5 -o BatchMode=yes', GIT_TERMINAL_PROMPT: '0' });
+}

package/build/lib/heal-oxlintrc.js

@@ -38,8 +38,11 @@ const LINT_STAGED_FILES = [
  */
 function findDangerousFixFlagUsage(appDir, workspaceRoot) {
     const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
-    const files = [...(workspaceRoot ? [(0, path_1.join)(workspaceRoot, 'scripts', 'check.mjs')] : []), ...fixFlagFiles(appDir, workspaceRoot)];
-    return [...new Set(files)].filter((file) => usesDangerousFixFlag(file)).map((file) => (0, path_1.relative)(base, file) || file);
+    const files = [
+        ...(workspaceRoot ? [(0, path_1.join)(workspaceRoot, 'scripts', 'check.mjs')] : []),
+        ...fixFlagFiles(appDir, workspaceRoot),
+    ];
+    return [...new Set(files)].filter((file) => usesDangerousFixFlag(file)).map((file) => repoRelative(base, file));
 }
 /**
  * Remove `--fix-suggestions` and `--fix-dangerously` from the project's lint commands
@@ -57,7 +60,7 @@ function healDangerousOxlintFixFlags(appDir, workspaceRoot) {
         if (!usesDangerousFixFlag(file)) {
             continue;
         }
-        const rel = (0, path_1.relative)(base, file) || file;
+        const rel = repoRelative(base, file);
         const dir = (0, path_1.join)(file, '..');
         const name = (0, path_1.relative)(dir, file);
         if (isSymlink(file)) {
@@ -203,6 +206,20 @@ function isTracked(dir, relPath) {
         return false;
     }
 }
+/**
+ * `file` relative to `base`, always with forward slashes.
+ *
+ * These strings are reported to the user next to git facts ("not tracked by
+ * git", "uncommitted changes") and name files inside the repository, which git
+ * itself always spells with `/`. `relative()` returns the OS-native form, so on
+ * Windows the report would say `projects\app\package.json` while `git status`
+ * says `projects/app/package.json` for the same file. Falls back to the
+ * absolute path when there is no relative form (`base` IS the file).
+ */
+function repoRelative(base, file) {
+    const rel = (0, path_1.relative)(base, file);
+    return rel ? rel.split(path_1.sep).join('/') : file;
+}
 function usesDangerousFixFlag(file) {
     try {
         // Follows a symlink on purpose: a linked config still feeds the lint run, so it

package/build/lib/strip-vendor-schema-augmentation.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stripAugmentationBlocks = stripAugmentationBlocks;
 exports.stripVendorSchemaAugmentation = stripVendorSchemaAugmentation;
+const glob_1 = require("glob");
 const fs_utils_1 = require("./fs-utils");
 /**
  * Drop `declare module '<nuxt|@nuxt>/schema' { … }` blocks that only augment
@@ -118,7 +119,6 @@ function stripAugmentationBlocks(source, onSkip) {
  *          is still there and only the transform knows it.
  */
 function stripVendorSchemaAugmentation(options) {
-    var _a;
     const { coreDir, filesystem } = options;
     if (!filesystem.isDirectory(coreDir))
         return { touched: [], warnings: [] };
@@ -128,7 +128,18 @@ function stripVendorSchemaAugmentation(options) {
         return { touched: [], warnings: [] };
     const touched = [];
     const warnings = [];
-    for (const file of (_a = filesystem.find(coreDir, { matching: '**/*.ts' })) !== null && _a !== void 0 ? _a : []) {
+    // `glob`, not `filesystem.find`: gluegun's find is fs-jetpack, which builds its
+    // matcher by concatenating the resolved absolute base path in front of the glob
+    // (`fs-jetpack/lib/utils/matcher.js` → `convertPatternToAbsolutePath`). On Windows
+    // that base is backslash-separated and minimatch reads a backslash inside a
+    // PATTERN as an escape, so `D:\…\core/**/*.ts` collapses to `D:coresrc/**/*.ts`
+    // and matches nothing — minimatch normalises separators on the file side only.
+    // The strip then reported success while the TS2310 augmentation stayed in every
+    // Windows-converted project. `glob` keeps pattern and base directory apart and
+    // normalises separators itself. Same fix as `api-mode.ts`'s `globFiles`. glob does
+    // not follow symlinked directories, unlike jetpack — which is the direction the
+    // guard above already wants: nothing inside a linked checkout gets rewritten.
+    for (const file of (0, glob_1.globSync)('**/*.ts', { absolute: true, cwd: coreDir, dot: true, nodir: true })) {
         const content = filesystem.read(file);
         if (!content || !content.includes('PublicRuntimeConfig'))
             continue;

package/build/lib/vendor-claude-md.js

@@ -33,6 +33,7 @@ exports.healVendorClaudeMd = healVendorClaudeMd;
 exports.insertVendorBlockIfMissing = insertVendorBlockIfMissing;
 exports.removeVendorBlock = removeVendorBlock;
 exports.upsertVendorBlock = upsertVendorBlock;
+const path_1 = require("path");
 exports.BACKEND_VENDOR_MARKER = '<!-- lt-vendor-marker -->';
 exports.FRONTEND_VENDOR_MARKER = '<!-- lt-vendor-marker-frontend -->';
 exports.ROOT_VENDOR_MARKER = '<!-- lt-vendor-marker-root -->';
@@ -182,15 +183,20 @@ function healVendorClaudeMd(fs, state) {
             changed.push(path);
         }
     };
+    // `join`, not string concatenation with `/`: the returned paths are reported
+    // to the user and compared by callers, so they have to be the same spelling
+    // the rest of the CLI produces. Concatenating `/` onto a Windows directory
+    // yields `C:\ws\projects\api/CLAUDE.md` — it opens fine, but it matches
+    // nothing and reads like a bug in the output.
     if (state.apiDir) {
-        apply(joinPath(state.apiDir, 'CLAUDE.md'), exports.BACKEND_VENDOR_MARKER, state.backendVendor ? buildBackendVendorBlock() : null);
+        apply((0, path_1.join)(state.apiDir, 'CLAUDE.md'), exports.BACKEND_VENDOR_MARKER, state.backendVendor ? buildBackendVendorBlock() : null);
     }
     if (state.appDir) {
-        apply(joinPath(state.appDir, 'CLAUDE.md'), exports.FRONTEND_VENDOR_MARKER, state.frontendVendor ? buildFrontendVendorBlock() : null);
+        apply((0, path_1.join)(state.appDir, 'CLAUDE.md'), exports.FRONTEND_VENDOR_MARKER, state.frontendVendor ? buildFrontendVendorBlock() : null);
     }
     if (state.workspaceRoot) {
         const anyVendor = state.backendVendor || state.frontendVendor;
-        apply(joinPath(state.workspaceRoot, 'CLAUDE.md'), exports.ROOT_VENDOR_MARKER, anyVendor ? buildRootVendorBlock({ backend: state.backendVendor, frontend: state.frontendVendor }) : null);
+        apply((0, path_1.join)(state.workspaceRoot, 'CLAUDE.md'), exports.ROOT_VENDOR_MARKER, anyVendor ? buildRootVendorBlock({ backend: state.backendVendor, frontend: state.frontendVendor }) : null);
     }
     return changed;
 }
@@ -242,6 +248,3 @@ function blockRegex(marker) {
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-function joinPath(dir, file) {
-    return dir.endsWith('/') ? `${dir}${file}` : `${dir}/${file}`;
-}

package/build/lib/workspace-integration.js

@@ -81,6 +81,7 @@ exports.runStandaloneWorkspaceGate = runStandaloneWorkspaceGate;
 exports.shouldProceedAsStandalone = shouldProceedAsStandalone;
 exports.writeApiConfig = writeApiConfig;
 const yaml = __importStar(require("js-yaml"));
+const path_1 = require("path");
 const ensure_root_dockerignore_1 = require("./ensure-root-dockerignore");
 const hoist_workspace_pnpm_config_1 = require("./hoist-workspace-pnpm-config");
 const remove_nested_lockfiles_1 = require("./remove-nested-lockfiles");
@@ -104,11 +105,20 @@ function detectSubProjectContext(startDir, filesystem) {
     const appDir = filesystem.path(root, 'projects', 'app');
     // Resolve absolute prefixes for a clean startsWith compare. We use
     // the gluegun-resolved paths because all callers go through it.
+    //
+    // The prefix MUST carry the OS separator, not a literal `/`:
+    // `filesystem.path` resolves through Node's `path`, so on Windows both
+    // sides come back with backslashes and an `${apiDir}/` prefix can never
+    // match. Every cwd below `projects\api\` then read as "not a
+    // sub-project", and the standalone gate in `runStandaloneWorkspaceGate`
+    // waved the user through instead of pointing them at the workspace root
+    // — the exact case (cloning a sibling tree INSIDE an existing
+    // sub-project) the check exists to prevent.
     const startAbs = filesystem.path(startDir);
-    if (startAbs === apiDir || startAbs.startsWith(`${apiDir}/`)) {
+    if (startAbs === apiDir || startAbs.startsWith(apiDir + path_1.sep)) {
         return { kind: 'api', subProjectDir: apiDir, workspaceRoot: root };
     }
-    if (startAbs === appDir || startAbs.startsWith(`${appDir}/`)) {
+    if (startAbs === appDir || startAbs.startsWith(appDir + path_1.sep)) {
         return { kind: 'app', subProjectDir: appDir, workspaceRoot: root };
     }
     return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",