@lenne.tech/cli 1.47.0 → 1.49.0

package/build/commands/dev/test.js

@@ -23,8 +23,10 @@ const dev_ticket_1 = require("../../lib/dev-ticket");
  * App mode (default) runs the Playwright suite against a fully ISOLATED test
  * stack (own URLs / ports / Caddy block / dedicated `<…>-test` database) that
  * runs parallel to — and never touches — the developer's `lt dev up` session.
- * Playwright's global-setup resets that dedicated DB once before the first test.
- * The stack is torn down automatically when the run finishes (residue-free).
+ * That DB outlives the run, so pending migrations are applied to it before the
+ * API starts; a project's Playwright global-setup may reset it on top (the CLI
+ * does not). The stack is torn down automatically when the run finishes
+ * (residue-free).
  *
  * API mode (`--api`) runs the standalone API test suite (`pnpm test:e2e` in the
  * API), which already isolates itself on its own DB — no stack is brought up.
@@ -225,7 +227,7 @@ const TestCommand = {
         try {
             const ctx = yield (0, dev_test_session_1.bringUpTestSession)(layout, identity, log, { devDbName });
             const env = Object.assign(Object.assign(Object.assign(Object.assign({}, process.env), readBridgeEnv(layout.root)), { 
-                // Playwright global-setup resets THIS db (allow-listed) before the suite.
+                // THIS db, for a project whose global-setup resets or cleans it (allow-listed).
                 MONGO_URI: `mongodb://127.0.0.1/${ctx.dbName}` }), (ctx.apiLogPath ? { NEST_SERVER_LOG: ctx.apiLogPath } : {}));
             if (debug) {
                 env.PWDEBUG = '1';

package/build/commands/fullstack/init.js

@@ -488,7 +488,7 @@ const NewCommand = {
             yield system.run(`cd ${projectDir} && git init --initial-branch=dev`);
         }
         catch (err) {
-            error(`Failed to initialize git: ${err.message}`);
+            ngBaseSpinner.fail(`Failed to initialize git: ${err.message}`);
             (0, fail_run_1.failRun)(toolbox);
             return;
         }
@@ -498,7 +498,7 @@ const NewCommand = {
                 yield system.run(`cd ${projectDir} && git remote add origin ${gitLink}`);
             }
             catch (err) {
-                error(`Failed to add remote: ${err.message}`);
+                ngBaseSpinner.fail(`Failed to add remote: ${err.message}`);
                 (0, fail_run_1.failRun)(toolbox);
                 return;
             }
@@ -526,7 +526,7 @@ const NewCommand = {
             });
         }
         if (!frontendResult.success) {
-            error(`Failed to set up ${frontend} frontend: ${frontendResult.path}`);
+            ngBaseSpinner.fail(`Failed to set up ${frontend} frontend: ${frontendResult.path}`);
             (0, fail_run_1.failRun)(toolbox);
             return;
         }
@@ -774,6 +774,15 @@ const NewCommand = {
             // For tests
             return `new workspace ${projectDir} with ${name}`;
         }
+        else {
+            // The frontend setup reported success but left no `projects/app`. Without this
+            // branch the command fell off the end here: no message, no failing exit code,
+            // and `ngBaseSpinner` still spinning — which keeps the event loop alive (see
+            // the spinner note in CLAUDE.md), so the process never returned at all.
+            ngBaseSpinner.fail(`${frontend} was set up but "${projectDir}/projects/app" does not exist — cannot continue`);
+            (0, fail_run_1.failRun)(toolbox);
+            return;
+        }
     }),
 };
 exports.default = NewCommand;

package/build/commands/git/force-pull.js

@@ -55,8 +55,17 @@ const NewCommand = {
             else {
                 info('No local changes to discard.');
             }
-            // Show commits that would be lost
-            const localCommits = yield run(`git log origin/${branch}..HEAD --oneline 2>/dev/null || echo ""`);
+            // Show commits that would be lost (none listed when the upstream ref is unknown locally).
+            // `2>/dev/null || echo ""` used to swallow the failure, but cmd.exe on Windows has no
+            // /dev/null: the redirect failed first and `echo ""` then reported success, so the preview
+            // silently claimed there was nothing ahead. try/catch behaves the same on every platform.
+            let localCommits = '';
+            try {
+                localCommits = yield run(`git log origin/${branch}..HEAD --oneline`);
+            }
+            catch (_d) {
+                // ignore - no upstream ref, so nothing ahead to report
+            }
             if (localCommits === null || localCommits === void 0 ? void 0 : localCommits.trim()) {
                 info('');
                 info('Local commits that would be lost:');

package/build/commands/git/rebase.js

@@ -54,7 +54,17 @@ const NewCommand = {
             warning('DRY-RUN MODE - No changes will be made');
             info('');
             // Show commits that would be rebased
-            const commitsToRebase = yield run(`git log ${baseBranchPreview}..HEAD --oneline 2>/dev/null || echo ""`);
+            // try/catch, not `2>/dev/null || echo ""`: on Windows that `echo` succeeds
+            // and the git log never runs, so a dry-run would report zero commits to
+            // rebase for a branch that has some — a preview that quietly understates
+            // what the real command will do.
+            let commitsToRebase = '';
+            try {
+                commitsToRebase = yield run(`git log ${baseBranchPreview}..HEAD --oneline`);
+            }
+            catch (_k) {
+                // Unknown base ref — nothing to preview, which the check below handles.
+            }
             if (commitsToRebase === null || commitsToRebase === void 0 ? void 0 : commitsToRebase.trim()) {
                 const commitCount = commitsToRebase.trim().split('\n').length;
                 info(`Would rebase ${commitCount} commit(s) from branch "${branch}" onto "${baseBranchPreview}":`);

package/build/commands/git/reset.js

@@ -10,6 +10,24 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const git_env_1 = require("../../lib/git-env");
+/**
+ * Environment that keeps the `git ls-remote` below non-interactive.
+ *
+ * This used to be a POSIX prefix on the command string
+ * (`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-…}" git …`).
+ * `system.run` shells out through `cmd.exe` on Windows, which reads
+ * `VAR=value cmd` as a command name, not as an assignment. Paired with the
+ * trailing `|| true` the call then "succeeded" with empty output, so every
+ * `lt git reset` on Windows aborted with "No remote branch … found!" — the
+ * ls-remote had never run. Handing the variables to the child as its
+ * environment works on every platform.
+ *
+ * The `||` keeps the semantics of the shell's `:-` default: a caller who
+ * configured ssh deliberately (a user with a custom agent, or a test harness
+ * pinning the behaviour) still wins. See `git.ts#gitInstalled` for why the
+ * assignment must never be unconditional.
+ */
 /**
  * Reset current branch
  */
@@ -46,7 +64,13 @@ const NewCommand = {
             return;
         }
         // Check remote (use short SSH timeout so ls-remote doesn't hang in offline environments)
-        const remoteBranch = yield system.run(`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git ls-remote --heads origin ${branch} 2>/dev/null || true`);
+        let remoteBranch = '';
+        try {
+            remoteBranch = yield system.run(`git ls-remote --heads origin ${branch}`, { env: (0, git_env_1.nonInteractiveGitEnv)() });
+        }
+        catch (_d) {
+            // ignore - unreachable remote is reported as "no remote branch" below
+        }
         if (!remoteBranch) {
             error(`No remote branch ${branch} found!`);
             return;
@@ -68,8 +92,14 @@ const NewCommand = {
             else {
                 info('No local changes to discard.');
             }
-            // Show commits that would be lost
-            const localCommits = yield system.run(`git log origin/${branch}..HEAD --oneline 2>/dev/null || echo ""`);
+            // Show commits that would be lost (none listed when the upstream ref is unknown locally)
+            let localCommits = '';
+            try {
+                localCommits = yield system.run(`git log origin/${branch}..HEAD --oneline`);
+            }
+            catch (_e) {
+                // ignore - no upstream ref, so nothing ahead to report
+            }
             if (localCommits === null || localCommits === void 0 ? void 0 : localCommits.trim()) {
                 info('');
                 info('Local commits that would be lost:');
@@ -109,7 +139,9 @@ const NewCommand = {
             const projectDir = (0, path_1.dirname)(pkgPath);
             const detectedPm = toolbox.pm.detect(projectDir);
             const installSpin = spin(`Install packages using ${detectedPm}`);
-            yield system.run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+            // `cwd` instead of `cd <dir> &&`: cmd.exe's `cd` does not switch drives,
+            // and it needs no quoting for paths with spaces.
+            yield system.run(toolbox.pm.install(detectedPm), { cwd: projectDir });
             installSpin.succeed();
         }
         // Success info

package/build/commands/git/squash.js

@@ -129,7 +129,10 @@ const NewCommand = {
         const mergeBaseSpin = spin(`Get merge ${base}`);
         const mergeBase = yield git.getMergeBase(base);
         if (!mergeBase) {
-            error('No merge base found!');
+            // `fail` rather than `error` + `return`: a running spinner holds the event
+            // loop open (ora resumes stdin and keeps a render interval), so the old
+            // shape did not just print and leave — the command never exited at all.
+            mergeBaseSpin.fail(`No merge base found with ${base}!`);
             return;
         }
         mergeBaseSpin.succeed();

package/build/commands/git/update.js

@@ -10,6 +10,22 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const git_env_1 = require("../../lib/git-env");
+/**
+ * Environment that keeps the `git` calls below non-interactive.
+ *
+ * This used to be a POSIX prefix on the command string
+ * (`GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-…}" git …`).
+ * `system.run` shells out through `cmd.exe` on Windows, which does not read
+ * `VAR=value cmd` as an assignment but as a command name — so every `lt git
+ * update` failed there with "'GIT_TERMINAL_PROMPT' is not recognized". Handing
+ * the variables to the child as its environment works on every platform.
+ *
+ * The `||` keeps the semantics of the shell's `:-` default: a caller who
+ * configured ssh deliberately (a user with a custom agent, or a test harness
+ * pinning the behaviour) still wins. See `git.ts#gitInstalled` for why the
+ * assignment must never be unconditional.
+ */
 /**
  * Update branch
  */
@@ -47,10 +63,22 @@ const NewCommand = {
             info('');
             info(`Current branch: ${branch}`);
             info('');
-            // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline)
-            yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
-            // Check for incoming commits
-            const incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline 2>/dev/null || echo ""`);
+            // Fetch to see incoming changes (use short SSH timeout so it doesn't hang offline).
+            // Best effort: offline or without credentials the preview falls back to the local refs.
+            try {
+                yield run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_d) {
+                // ignore - a failed fetch only makes the preview less current
+            }
+            // Check for incoming commits (none yet when the upstream ref is unknown locally)
+            let incomingCommits = '';
+            try {
+                incomingCommits = yield run(`git log ${branch}..origin/${branch} --oneline`);
+            }
+            catch (_e) {
+                // ignore - no upstream ref, so nothing incoming to report
+            }
             const commits = (incomingCommits === null || incomingCommits === void 0 ? void 0 : incomingCommits.trim().split('\n').filter((c) => c)) || [];
             if (commits.length > 0) {
                 info(`Incoming commits (${commits.length}):`);
@@ -78,7 +106,13 @@ const NewCommand = {
         const timer = startTimer();
         // Update
         const updateSpin = spin(`Update branch ${branch}`);
-        yield run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true && GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git pull --rebase');
+        try {
+            yield run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+        }
+        catch (_f) {
+            // ignore - `git pull --rebase` below fetches again and reports the real failure
+        }
+        yield run('git pull --rebase', { env: (0, git_env_1.nonInteractiveGitEnv)() });
         updateSpin.succeed();
         // Install packages (unless skipped) with correctly detected package manager (supports monorepo lockfiles)
         if (!skipInstall) {
@@ -87,7 +121,9 @@ const NewCommand = {
                 const projectDir = (0, path_1.dirname)(pkgPath);
                 const detectedPm = toolbox.pm.detect(projectDir);
                 const installSpin = spin(`Install packages using ${detectedPm}`);
-                yield run(`cd ${projectDir} && ${toolbox.pm.install(detectedPm)}`);
+                // `cwd` instead of `cd <dir> &&`: cmd.exe's `cd` does not switch drives,
+                // and it needs no quoting for paths with spaces.
+                yield run(toolbox.pm.install(detectedPm), { cwd: projectDir });
                 installSpin.succeed();
             }
         }

package/build/extensions/api-mode.js

@@ -10,7 +10,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiMode = void 0;
+const glob_1 = require("glob");
 const path_1 = require("path");
+const config_env_graphql_1 = require("../lib/config-env-graphql");
 /**
  * API Mode processing for nest-server-starter template
  *
@@ -45,11 +47,18 @@ class ApiMode {
                 // REST mode: remove graphql regions, keep rest regions
                 yield this.removeMode(projectPath, manifest, 'graphql', 'rest');
                 yield this.modifyConfigEnvForRest(projectPath);
+                this.assertGraphQlDisabled(projectPath);
             }
             else if (mode === 'GraphQL') {
                 // GraphQL mode: remove rest regions, keep graphql regions
                 yield this.removeMode(projectPath, manifest, 'rest', 'graphql');
             }
+            // Both conversions above must leave no marker behind. Verified rather than
+            // assumed: a strip that quietly does nothing reports success just as loudly as
+            // one that worked (see assertNoMarkersRemain).
+            if (mode !== 'Both') {
+                this.assertNoMarkersRemain(projectPath, mode === 'Rest' ? 'graphql' : 'rest');
+            }
             // Remove manifest and strip-markers script
             this.filesystem.remove(manifestPath);
             this.filesystem.remove((0, path_1.join)(projectPath, 'scripts', 'strip-api-mode-markers.mjs'));
@@ -114,10 +123,7 @@ class ApiMode {
             // 1. Delete files matching filePatterns
             if (modeConfig.filePatterns) {
                 for (const pattern of modeConfig.filePatterns) {
-                    const matches = this.filesystem.find(projectPath, {
-                        matching: pattern,
-                    });
-                    for (const file of matches) {
+                    for (const file of this.globFiles(projectPath, pattern)) {
                         this.filesystem.remove(file);
                     }
                 }
@@ -169,6 +175,90 @@ class ApiMode {
             this.cleanOrphanImports(projectPath);
         });
     }
+    /**
+     * Final check of the REST conversion: every environment block in `config.env.ts`
+     * must disable GraphQL.
+     *
+     * `CoreModule.forRoot` reads a missing `graphQl` as ENABLED, so a block without it
+     * yields a project that fails at START time with `Cannot determine a GraphQL output
+     * type for the "arguments"` — long after the generator reported success. Every step
+     * before this one REPLACES an existing property; none of them adds a missing one, so
+     * nothing guaranteed the outcome.
+     *
+     * Repairs what it can (insert the switch) and throws when a block still lacks it,
+     * rather than handing over a project that cannot boot.
+     */
+    assertGraphQlDisabled(projectPath) {
+        const configPath = (0, path_1.join)(projectPath, 'src', 'config.env.ts');
+        const content = this.filesystem.read(configPath);
+        if (!content) {
+            return;
+        }
+        const { added, content: repaired } = (0, config_env_graphql_1.disableGraphQlInEveryEnvBlock)(content);
+        if (added.length > 0) {
+            this.filesystem.write(configPath, repaired);
+        }
+        const offenders = (0, config_env_graphql_1.envBlocksWithoutGraphQlDisabled)(repaired);
+        if (offenders.length > 0) {
+            throw new Error(`REST conversion incomplete: src/config.env.ts has no \`graphQl: false\` in ${offenders.join(', ')}. ` +
+                'The framework treats a missing switch as GraphQL ENABLED, and the server would fail to start. ' +
+                'Add it to those environment blocks and re-run.');
+        }
+    }
+    /**
+     * Refuse to hand over a project that still carries markers of the removed mode.
+     *
+     * A leftover `// #region graphql` announces a mode the project does not have — and,
+     * worse, means the region CONTENT is still there: resolvers, graphql-only wiring,
+     * e2e specs. That is what a silent no-op looks like from the outside, and the strip
+     * used to be exactly that on Windows (fixed in the glob helper above): it reported
+     * success while touching nothing.
+     *
+     * Cheap, and it fails at generation time instead of in the user's editor.
+     */
+    assertNoMarkersRemain(projectPath, removedMarker) {
+        const marked = [];
+        for (const dir of ['src', 'tests']) {
+            const base = (0, path_1.join)(projectPath, dir);
+            if (!this.filesystem.exists(base)) {
+                continue;
+            }
+            for (const file of this.globFiles(base, '**/*.ts')) {
+                const content = this.filesystem.read(file);
+                if ((content === null || content === void 0 ? void 0 : content.includes(`// #region ${removedMarker}`)) || (content === null || content === void 0 ? void 0 : content.includes(`// #endregion ${removedMarker}`))) {
+                    marked.push(`${dir}/${(0, path_1.basename)(file)}`);
+                }
+            }
+        }
+        if (marked.length > 0) {
+            throw new Error(`API-mode conversion incomplete: ${marked.length} file(s) still carry \`// #region ${removedMarker}\` ` +
+                `markers (${marked.slice(0, 5).join(', ')}${marked.length > 5 ? ', …' : ''}). ` +
+                'The region content was not removed, so this project still contains code of a mode it does not have.');
+        }
+    }
+    /**
+     * Resolve a POSIX-style glob pattern against `baseDir` and return the
+     * matching files as absolute, OS-native paths.
+     *
+     * Deliberately NOT `filesystem.find()`: gluegun/fs-jetpack builds its
+     * matcher by string-concatenating the *resolved* base path in front of
+     * the pattern (fs-jetpack/lib/utils/matcher.js). On Windows that base
+     * path is backslash-separated, and minimatch reads a backslash inside a
+     * pattern as an escape character — so a base of `C:\project\src`
+     * collapses to the literal `C:projectsrc` and nothing ever matches.
+     * Effect: on Windows no file was deleted and no region was stripped,
+     * silently. `glob` keeps pattern and base directory apart and
+     * normalises separators itself, so it behaves the same on every
+     * platform.
+     */
+    globFiles(baseDir, pattern) {
+        return (0, glob_1.globSync)(pattern, {
+            absolute: true,
+            cwd: baseDir,
+            dot: true,
+            nodir: true,
+        });
+    }
     /**
      * Strip region markers from all .ts files
      *
@@ -181,7 +271,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {
@@ -196,7 +286,10 @@ class ApiMode {
                 // graphql` block with an explicit `graphQl: false,` so GraphQL
                 // is cleanly disabled.
                 let processed;
-                if (removeMarker === 'graphql' && file.endsWith('/config.env.ts')) {
+                // `basename` instead of `endsWith('/config.env.ts')`: on Windows the
+                // path separator is a backslash, so the POSIX-only suffix check never
+                // matched and config.env.ts was processed like any other file.
+                if (removeMarker === 'graphql' && (0, path_1.basename)(file) === 'config.env.ts') {
                     processed = this.replaceGraphqlRegionsWithDisabled(content, keepMarker);
                 }
                 else {
@@ -299,7 +392,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {
@@ -444,7 +537,7 @@ class ApiMode {
             if (!this.filesystem.exists(dir)) {
                 continue;
             }
-            const files = this.filesystem.find(dir, { matching: '**/*.ts' });
+            const files = this.globFiles(dir, '**/*.ts');
             for (const file of files) {
                 const content = this.filesystem.read(file);
                 if (!content) {

package/build/extensions/frontend-helper.js

@@ -12,7 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrontendHelper = void 0;
 const check_freshness_hooks_1 = require("../lib/check-freshness-hooks");
 const markdown_table_1 = require("../lib/markdown-table");
-const strip_comments_1 = require("../lib/strip-comments");
+const module_specifiers_1 = require("../lib/module-specifiers");
 const strip_vendor_schema_augmentation_1 = require("../lib/strip-vendor-schema-augmentation");
 const vendor_claude_md_1 = require("../lib/vendor-claude-md");
 /**
@@ -399,7 +399,7 @@ class FrontendHelper {
                 }
             }
             // ── Post-conversion verification ─────────────────────────────────────
-            const stale = this.findStaleFrontendImports(dest, /from\s+['"]\..*\/core['"]/);
+            const stale = this.findStaleFrontendImports(dest, module_specifiers_1.isRelativeCoreImport);
             if (stale.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`${stale.length} file(s) still contain relative core imports after npm conversion:`);
@@ -716,8 +716,7 @@ class FrontendHelper {
                 ].join('\n'));
             }
             // ── Post-conversion verification ─────────────────────────────────────
-            // Only match actual import/from statements, not comments or strings
-            const staleImports = this.findStaleFrontendImports(dest, /(?:^|\s)(?:import|from)\s+['"][^'"]*@lenne\.tech\/nuxt-extensions/m, 'app/core/');
+            const staleImports = this.findStaleFrontendImports(dest, (specifier) => (0, module_specifiers_1.isPackageImport)(specifier, '@lenne.tech/nuxt-extensions'), 'app/core/');
             if (staleImports.length > 0) {
                 const { print } = this.toolbox;
                 print.warning(`${staleImports.length} file(s) still contain '@lenne.tech/nuxt-extensions' imports after vendor conversion:`);
@@ -826,20 +825,20 @@ class FrontendHelper {
     /**
      * Scan consumer files for stale imports matching a pattern.
      */
-    findStaleFrontendImports(appDir, needle, skipPathContaining) {
+    findStaleFrontendImports(appDir, matches, skipPathContaining) {
         const { filesystem } = this.toolbox;
         const allFiles = this.walkConsumerFiles(appDir);
         const stale = [];
         for (const absFile of allFiles) {
             if (skipPathContaining && absFile.includes(skipPathContaining))
                 continue;
-            // Strip comments first — a docblock that DOCUMENTS the conversion legitimately quotes the
-            // very import syntax this looks for, and would otherwise be reported as a file the user has
-            // to fix by hand. Same false-positive class that hit the backend detector on
-            // nest-server-starter's bootstrap-diagnostics.spec.ts.
-            const content = (0, strip_comments_1.stripComments)(filesystem.read(absFile) || '');
-            const matches = typeof needle === 'string' ? content.includes(needle) : needle.test(content);
-            if (matches) {
+            // Ask the parser for the file's module specifiers instead of searching its text.
+            // A docblock that DOCUMENTS the conversion quotes the very import syntax a text
+            // search looks for, and blanking comments first does not hold either — see
+            // src/lib/module-specifiers.ts. A comment is not part of the AST, so the whole
+            // false-positive class is gone rather than worked around.
+            const specifiers = (0, module_specifiers_1.fileImportedSpecifiers)(absFile, (path) => filesystem.read(path) || undefined);
+            if (specifiers.some(matches)) {
                 stale.push(absFile.replace(`${appDir}/`, ''));
             }
         }

package/build/extensions/git.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Git = void 0;
+const git_env_1 = require("../lib/git-env");
 /**
  * Git functions
  */
@@ -119,8 +120,17 @@ class Git {
             const result = [];
             // Toolbox features
             const { system } = this.toolbox;
-            // Get branches (use short SSH timeout so fetch doesn't hang in offline environments)
-            const branches = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null; git show-branch --list');
+            // Refresh first, but never let a failed fetch cost us the branch list: the
+            // two commands used to be chained with `;`, which cmd.exe does not honour as
+            // a separator at all, so on Windows this ran neither reliably. They are two
+            // calls now — the fetch is best-effort, the listing is the actual result.
+            try {
+                yield system.run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_a) {
+                // Offline or no remote — `git show-branch` still lists what is local.
+            }
+            const branches = yield system.run('git show-branch --list');
             branches.split('\n').forEach((item) => {
                 const matches = item.match(/\[(.*?)]/);
                 if (matches) {
@@ -197,27 +207,6 @@ class Git {
     /**
      * Check if git is installed (cached for performance)
      */
-    /**
-     * Why the git calls in this repo spell `GIT_SSH_COMMAND="\${GIT_SSH_COMMAND:-…}"` (shell default)
-     * rather than assigning it outright.
-     *
-     * These commands do a best-effort `git fetch` to see whether the branch is
-     * behind. They set `BatchMode=yes` so ssh fails instead of PROMPTING — but an
-     * agent that stalls is not a prompt. On a 1Password-backed machine the agent is
-     * reachable and every signature needs an interactive approval; unattended it
-     * waits and then reports `communication with agent failed`. Measured: **61 s per
-     * fetch**, so `lt git update --dry-run` took 62 s and `lt git create --dry-run`
-     * 123 s (two fetches). `ConnectTimeout` does not bound it — that covers the TCP
-     * connect, not the agent.
-     *
-     * Waiting for a human to approve a key is legitimate for an interactive command,
-     * so the default is unchanged. What was wrong is that the assignment was
-     * UNCONDITIONAL: it overrode a caller who had deliberately configured ssh,
-     * including a test harness trying to make the behaviour deterministic. The
-     * `:-` default respects an existing value and keeps the old behaviour when there
-     * is none. `IdentityAgent=none` in the caller's env then drops the same fetch to
-     * ~1 s with a clean `Permission denied (publickey)`.
-     */
     gitInstalled() {
         return __awaiter(this, void 0, void 0, function* () {
             // Return cached result if available
@@ -272,8 +261,17 @@ class Git {
             if (opts.spin) {
                 searchSpin = spin(opts.spinText);
             }
-            // Update infos (use short SSH timeout so fetch doesn't hang in offline environments)
-            const fetch = yield system.run('GIT_TERMINAL_PROMPT=0 GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o ConnectTimeout=5 -o BatchMode=yes}" git fetch 2>/dev/null || true');
+            // Update infos. Best-effort, but expressed as try/catch rather than
+            // `2>/dev/null || true`: on Windows `true` resolves to Git-for-Windows'
+            // `true.exe`, so the pipeline succeeded with empty output and the fetch
+            // never ran — a silent no-op that read as a successful refresh.
+            let fetch = '';
+            try {
+                fetch = yield system.run('git fetch', { env: (0, git_env_1.nonInteractiveGitEnv)() });
+            }
+            catch (_b) {
+                // Offline or no remote — the branch search below still works on local refs.
+            }
             if (fetch.length && !fetch.startsWith('remote')) {
                 info(`Could not update infos ${fetch.length}`);
             }