@lenne.tech/cli 1.47.0 → 1.49.0

package/build/lib/dev-package-manager.js

@@ -74,16 +74,20 @@ function buildCommand(bin, name) {
         },
     };
 }
+/**
+ * Manager behind an override like `LT_PM_BIN`.
+ *
+ * Reads the file NAME, split on both separators and stripped of a Windows launcher
+ * extension: there the binary is `C:\\…\\pnpm.cmd`, which neither `endsWith('pnpm')`
+ * nor `includes('/pnpm')` matched — the override then resolved to `unknown` and the
+ * caller drove the wrong manager.
+ */
 function inferNameFromBin(bin) {
-    const lower = bin.toLowerCase();
-    if (lower.endsWith('pnpm') || lower.includes('/pnpm')) {
-        return 'pnpm';
-    }
-    if (lower.endsWith('yarn') || lower.includes('/yarn')) {
-        return 'yarn';
-    }
-    if (lower.endsWith('npm') || lower.includes('/npm')) {
-        return 'npm';
+    var _a;
+    const file = (_a = bin.toLowerCase().split(/[\\/]/).pop()) !== null && _a !== void 0 ? _a : '';
+    const name = file.replace(/\.(bat|cmd|exe|ps1)$/, '');
+    if (name === 'pnpm' || name === 'yarn' || name === 'npm') {
+        return name;
     }
     return 'unknown';
 }

package/build/lib/dev-process.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkPortInUse = checkPortInUse;
+exports.detachedSpawnCommand = detachedSpawnCommand;
 exports.killProcessGroup = killProcessGroup;
 exports.listenSnapshot = listenSnapshot;
 exports.rotateLogFile = rotateLogFile;
@@ -59,6 +60,40 @@ function checkPortInUse(port) {
         });
     });
 }
+/**
+ * How a detached child is actually launched on this platform.
+ *
+ * POSIX raises the soft file-descriptor limit before exec-ing the real command.
+ * macOS's default soft RLIMIT_NOFILE is 256 (launchd/system default), inherited
+ * by the terminal that runs `lt dev up` and therefore by these detached children
+ * — it is NOT a consequence of the lt-dev LaunchAgent (which runs only Caddy).
+ * The dev file-watcher (nest/nuxt → chokidar) exhausts a soft-256 limit on a
+ * monorepo → intermittent "EMFILE: too many open files, watch" crashes on boot
+ * that force a manual `lt dev up`. Hence `sh -c "ulimit …; exec …"`:
+ *   - `exec` replaces the shell IN PLACE → the recorded PID and the detached
+ *     process group are still the real process (PID tracking + group-kill in
+ *     `terminateProcessGroup` keep working).
+ *   - `"$0" "$@"` pass cmd + args verbatim — no shell-quoting / injection.
+ *   - the cascade tries a high limit first, falling back on machines with a
+ *     lower `kern.maxfilesperproc`; `2>/dev/null` keeps it best-effort.
+ *
+ * Windows gets the command directly. There is no `/bin/sh` to run the wrapper —
+ * spawning it fails outright — and no RLIMIT_NOFILE for `ulimit` to raise, so
+ * the wrapper has nothing to offer there even in principle.
+ *
+ * Note for the POSIX path: because `spawn('/bin/sh', …)` almost always succeeds,
+ * a bogus `cmd` does not surface as `pid === undefined` — the inner `exec` fails
+ * (exit 127) a few ms later. Callers briefly record a live-then-dead PID, which
+ * `classifyComponentHealth` reaps as `dead`/`crashed` on the next status/up. We
+ * deliberately don't watch for that here: a detached, unref'd child's 127 exit is
+ * racy to observe, and callers must be self-correcting against real crashes anyway.
+ */
+function detachedSpawnCommand(cmd, args, platform = process.platform) {
+    if (platform === 'win32')
+        return { args, command: cmd };
+    const raiseFdLimit = 'ulimit -n 65536 2>/dev/null || ulimit -n 10240 2>/dev/null || true';
+    return { args: ['-c', `${raiseFdLimit}; exec "$0" "$@"`, cmd, ...args], command: '/bin/sh' };
+}
 /** Send SIGTERM to a detached process group; falls back to single-PID kill. */
 function killProcessGroup(pid) {
     if (!(0, dev_state_1.isValidPid)(pid))
@@ -215,6 +250,8 @@ function runChildToFile(cmd, args, opts) {
  * so closing prevents fd leaks and avoids racing-write artifacts on
  * filesystems where O_APPEND is not atomic.
  *
+ * See `detachedSpawnCommand` for how the child is launched per platform.
+ *
  * Returns the child PID, or undefined if spawn failed.
  */
 function spawnDetached(cmd, args, opts) {
@@ -223,32 +260,22 @@ function spawnDetached(cmd, args, opts) {
     const out = (0, fs_1.openSync)(opts.logFile, 'a');
     let child;
     try {
-        // Raise the soft file-descriptor limit before exec-ing the real command.
-        // macOS's default soft RLIMIT_NOFILE is 256 (launchd/system default), inherited
-        // by the terminal that runs `lt dev up` and therefore by these detached children
-        // — it is NOT a consequence of the lt-dev LaunchAgent (which runs only Caddy).
-        // The dev file-watcher (nest/nuxt → chokidar) exhausts a soft-256 limit on a
-        // monorepo → intermittent "EMFILE: too many open files, watch" crashes on boot
-        // that force a manual `lt dev up`. We wrap the command in `sh -c "ulimit …; exec …"`:
-        //   - `exec` replaces the shell IN PLACE → the recorded PID and the detached
-        //     process group are still the real process (PID tracking + group-kill in
-        //     `terminateProcessGroup` keep working).
-        //   - `"$0" "$@"` pass cmd + args verbatim — no shell-quoting / injection.
-        //   - the cascade tries a high limit first, falling back on machines with a
-        //     lower `kern.maxfilesperproc`; `2>/dev/null` keeps it best-effort.
-        // Note: because the outer `spawn('/bin/sh', …)` almost always succeeds, a bogus
-        // `cmd` no longer surfaces as `pid === undefined` here — the inner `exec` fails
-        // (exit 127) a few ms later. Callers briefly record a live-then-dead PID, which
-        // `classifyComponentHealth` reaps as `dead`/`crashed` on the next status/up. We
-        // deliberately don't watch for that here: a detached, unref'd child's 127 exit is
-        // racy to observe, and callers must be self-correcting against real crashes anyway.
-        const raiseFdLimit = 'ulimit -n 65536 2>/dev/null || ulimit -n 10240 2>/dev/null || true';
-        child = (0, child_process_1.spawn)('/bin/sh', ['-c', `${raiseFdLimit}; exec "$0" "$@"`, cmd, ...args], {
+        const spawned = detachedSpawnCommand(cmd, args);
+        child = (0, child_process_1.spawn)(spawned.command, spawned.args, {
             cwd: opts.cwd,
             detached: true,
             env: opts.env,
             stdio: ['ignore', out, out],
         });
+        // spawn reports "could not start this at all" (missing executable, bad cwd)
+        // through an ASYNCHRONOUS 'error' event — the try/catch around spawn() never
+        // sees it. With no listener, Node escalates an unhandled 'error' to a process
+        // crash, so one unstartable child would take the whole CLI down with it. That
+        // is not hypothetical: on Windows `/bin/sh` does not exist, and this line is
+        // what turned that into "Test suite failed to run" instead of one red test.
+        // Nothing to do but swallow it — the child is detached and its log file is
+        // already closed below; callers are self-correcting against a dead PID.
+        child.on('error', () => undefined);
         child.unref();
         if (child.pid === undefined)
             return undefined;
@@ -330,7 +357,15 @@ function terminateProcessGroup(pid_1) {
  *
  * Resolves `true` on the first matching response, `false` on timeout. Never rejects.
  */
-function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status < 600) {
+function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status < 600, 
+/**
+ * Optional early exit: return `true` once there is nothing left to wait FOR —
+ * typically "the process I am waiting on has exited". Without it a server that
+ * crashes on boot is indistinguishable from one that is still starting, and the
+ * caller burns the entire timeout (120s for the `lt dev test` API) before
+ * learning something that was decided in the first 300ms.
+ */
+abort = () => false) {
     const start = Date.now();
     return new Promise((resolve) => {
         const tick = () => {
@@ -340,20 +375,21 @@ function waitForHttp(url, timeoutMs, ready = (status) => status >= 100 && status
             });
             let status = '';
             (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on('data', (b) => (status += String(b)));
+            const retry = () => {
+                // Order matters: a LAST probe already ran above, so a server that came up
+                // just before dying is still reported ready. Only then does `abort` end it.
+                if (Date.now() - start > timeoutMs || abort())
+                    return resolve(false);
+                setTimeout(tick, 500);
+            };
             child.on('close', () => {
                 const code = Number(status.trim());
                 // `000` (curl could not connect) parses to 0 → never "ready".
                 if (Number.isFinite(code) && code > 0 && ready(code))
                     return resolve(true);
-                if (Date.now() - start > timeoutMs)
-                    return resolve(false);
-                setTimeout(tick, 500);
-            });
-            child.on('error', () => {
-                if (Date.now() - start > timeoutMs)
-                    return resolve(false);
-                setTimeout(tick, 500);
+                retry();
             });
+            child.on('error', retry);
         };
         tick();
     });

package/build/lib/dev-state.js

@@ -204,10 +204,21 @@ function loadSession(root, sessionFile = SESSION_FILE) {
     }
     return null;
 }
-/** True if two paths resolve to the same location (normalising symlinks, e.g. /var → /private/var). */
+/**
+ * True if two paths resolve to the same location (normalising symlinks, e.g. /var → /private/var).
+ *
+ * `.native` rather than plain `realpathSync`, because on Windows the JS
+ * implementation follows symlinks but keeps 8.3 short components: a path spelled
+ * `C:\Users\RUNNER~1\…` and the same directory spelled `C:\Users\runneradmin\…`
+ * stay different strings. Both spellings occur in practice — `os.tmpdir()` hands
+ * out the short form while git prints the long one — so a registry entry written
+ * under one and a cwd under the other would read as a DIFFERENT checkout. The
+ * native variant asks the OS for the final name and collapses both.
+ * No behavioural difference on POSIX.
+ */
 function sameRealPath(a, b) {
     try {
-        return (0, fs_1.realpathSync)(a) === (0, fs_1.realpathSync)(b);
+        return fs_1.realpathSync.native(a) === fs_1.realpathSync.native(b);
     }
     catch (_a) {
         return a === b;

package/build/lib/dev-test-session.js

@@ -16,31 +16,41 @@ exports.bringUpTestSession = bringUpTestSession;
 exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
 exports.buildTestAppEnv = buildTestAppEnv;
 exports.hasTestSession = hasTestSession;
+exports.isStackServing = isStackServing;
+exports.migrationFailedError = migrationFailedError;
 exports.resolveTestSession = resolveTestSession;
 exports.runShardedTestSession = runShardedTestSession;
 exports.shardReportDir = shardReportDir;
+exports.startTestApi = startTestApi;
 exports.tearDownAllTestSessions = tearDownAllTestSessions;
 exports.tearDownTestSession = tearDownTestSession;
 exports.testAppEntryCandidates = testAppEntryCandidates;
+exports.unreachableStackError = unreachableStackError;
 /**
  * Ephemeral, isolated test session for `lt dev test`.
  *
  * Brings up a SECOND, fully separate stack (own URLs, own internal ports,
  * own Caddy block, own database) that runs PARALLEL to — and never touches —
  * the developer's `lt dev up` session. Used to run the Playwright E2E suite
- * against a clean, dedicated database so a developer can keep working in their
- * own environment while tests run, and so a test run never pollutes dev data.
+ * against a dedicated database so a developer can keep working in their own
+ * environment while tests run, and so a test run never pollutes dev data. That
+ * database outlives the run — the CLI never drops it — so the API is migrated
+ * before it starts, like every other environment (DEV-3289).
  *
  * Topology (for slug `svl`):
  *   - dev session  : svl.localhost / api.svl.localhost   → db `<…>-local`
  *   - test session : svl-test.localhost / api.svl-test.… → db `<…>-test`
  *
- * Both halves run BUILT for speed + prod-fidelity: the API COMPILED (`node dist`,
- * ts-node intermittently dies mid-run) and the App as the production Nitro output
- * (`nuxt build` → `node .output/server/index.mjs`, no Vite cold-compile). Each
- * falls back to its dev runner (`pnpm start` / `pnpm dev`) when no build output is
- * found. bringUp waits for a real 2xx on the API `/meta` before returning so the
- * suite never starts against a not-yet-serving API.
+ * Both halves run BUILT for speed + prod-fidelity: the API COMPILED (from `dist`,
+ * because ts-node intermittently dies mid-run) and the App as the production Nitro
+ * output (`nuxt build` → `node .output/server/index.mjs`, no Vite cold-compile).
+ * Each falls back to its dev runner (`pnpm start` / `pnpm dev`) when no build
+ * output is found. The API's runtime follows the project (`resolveApiRuntime`):
+ * a Bun-built bundle is started with `bun`, everything else with `node`.
+ *
+ * bringUp waits for BOTH halves to answer and THROWS when one never does, so the
+ * suite can never run against a dead stack (DEV-3208) — see `isStackServing` for
+ * what counts as answering.
  *
  * Lifecycle: `bringUpTestSession` → run Playwright → `tearDownTestSession`.
  * Teardown is idempotent and residue-free (processes, Caddy block, env bridge,
@@ -93,12 +103,13 @@ const TEST_PORT_BASE = 4500;
  * `systemSetup.initialAdmin.*` and seeds the admin ONCE on an empty DB (it never
  * overwrites an existing admin), so a set-up system exists before the suite runs.
  * A fresh template project's standard auth E2E specs assume such a system — they
- * do no self-setup — so without this they fail LOCALLY on the empty per-run DB.
+ * do no self-setup — so without this they fail LOCALLY on a test DB that has no
+ * users yet (its first run, or after a global-setup reset it).
  * These are the exact values the lt-monorepo template CI uses
  * (`.gitlab-ci.yml` / `.github/workflows/test.yml`), keeping CI ↔ local parity.
  *
- * Injected ONLY into the `lt dev test` API process (its DB is fresh + discarded
- * per run), NEVER into `lt dev up` — no surprise admin in the persistent dev DB.
+ * Injected ONLY into the `lt dev test` API process (its DB is the dedicated
+ * `<…>-test` one), NEVER into `lt dev up` — no surprise admin in the dev DB.
  */
 exports.TEST_INITIAL_ADMIN_ENV = {
     NSC__SYSTEM_SETUP__INITIAL_ADMIN__EMAIL: 'ci-admin@test.com',
@@ -270,7 +281,11 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
             log.info(`  app: ${appUrl}  →  127.0.0.1:${appPort}`);
         if (apiUrl)
             log.info(`  api: ${apiUrl}  →  127.0.0.1:${apiPort}`);
-        log.info(`  db:  mongodb://127.0.0.1/${dbName}  (reset before the suite by Playwright global-setup)`);
+        // No claim about resetting here: the CLI never drops this DB, and whether a
+        // project's global-setup does is the project's business. The claim used to be
+        // printed unconditionally and sent a diagnosis looking for a reset that never
+        // happened instead of at the un-migrated DB (DEV-3289).
+        log.info(`  db:  mongodb://127.0.0.1/${dbName}`);
         log.info('');
         const devEnv = (0, dev_env_1.buildDevEnv)({
             apiInternalPort: apiPort !== null && apiPort !== void 0 ? apiPort : 0,
@@ -288,40 +303,23 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // hands it to the Playwright child as well.
         const appEnv = buildTestAppEnv(devEnv.app.env);
         const pids = {};
-        // --- API: compiled (`node dist`) for stability; fall back to the project's
-        // own dev start script. `skipBuild` (sibling shards) reuses the dist the
-        // first shard produced. Per-component PM detection mirrors `lt dev up`:
-        // a monorepo with an npm api and a pnpm app must drive each correctly. ---
+        // --- API: compiled (`node dist`) for stability, migrated first; falls back to
+        // the project's own start script (see `startTestApi`). ---
         if (layout.apiDir && apiPort) {
-            const apiPm = (0, dev_package_manager_1.pickPackageManager)(layout.apiDir);
-            let build = 0;
-            if (!skipBuild) {
-                log.info(log.dim('Building API (compiled, for stable long runs) …'));
-                build = yield (0, dev_process_1.runChildInherit)(apiPm.bin, apiPm.runScript('build'), { cwd: layout.apiDir, env: process.env });
-            }
-            const entry = (0, dev_api_launch_1.findCompiledEntry)(layout.apiDir);
-            // Seed a throwaway initial admin into the fresh, isolated test DB so the
-            // standard auth E2E specs run against a set-up system — locally exactly like
-            // the lt-monorepo template CI. Defaults first so an explicitly inherited
+            // Seed a throwaway initial admin into the isolated test DB so the standard
+            // auth E2E specs run against a set-up system — locally exactly like the
+            // lt-monorepo template CI. Defaults first so an explicitly inherited
             // `NSC__…INITIAL_ADMIN__…` still wins (deliberate override respected). Only
             // reached from `lt dev test` — `lt dev up` never calls bringUpTestSession.
             const apiEnv = Object.assign(Object.assign(Object.assign({}, exports.TEST_INITIAL_ADMIN_ENV), devEnv.api.env), { NODE_ENV: 'local' });
-            let apiSpawn;
-            if (build === 0 && entry) {
-                apiSpawn = (0, dev_process_1.spawnDetached)('node', [entry], {
-                    cwd: layout.apiDir,
-                    env: apiEnv,
-                    logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
-                });
-            }
-            else {
-                log.warn(`compiled API not available — falling back to \`${apiPm.bin} start\` (ts-node).`);
-                apiSpawn = (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), {
-                    cwd: layout.apiDir,
-                    env: apiEnv,
-                    logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
-                });
-            }
+            const apiSpawn = yield startTestApi({
+                apiDir: layout.apiDir,
+                apiEnv,
+                dbName,
+                log,
+                logFile: (0, path_1.join)(layout.root, '.lt-dev', names.apiLog),
+                skipBuild,
+            });
             if (apiSpawn)
                 pids.api = apiSpawn.pid;
         }
@@ -387,26 +385,43 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         (0, dev_state_1.saveSession)(layout.root, { pids, startedAt: new Date().toISOString() }, names.sessionFile);
         // ENV bridge for external tooling (kept separate from the dev `.env`).
         (0, dev_env_bridge_1.writeEnvBridge)(layout.root, devEnv, dbName, names.bridgeFile);
-        // Wait for the test App to answer (best-effort).
+        // THIS stack's log paths. Resolved BEFORE the readiness waits below, because
+        // the abort messages point at them: the log is the only place a crash-on-boot
+        // is recorded, and an abort that withholds it just relocates the guesswork.
+        // `apiLogPath` is also handed to the caller so the auth E2E specs (via
+        // NEST_SERVER_LOG) read the exact isolated log — correct per shard.
+        const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
+        const appLogPath = layout.appDir ? (0, path_1.join)(layout.root, '.lt-dev', names.appLog) : undefined;
+        // Both waits below ABORT rather than warn (DEV-3208). A warning let Playwright
+        // run the whole suite against a dead stack: every data-dependent spec passed
+        // trivially or skipped, so a run that verified NOTHING was indistinguishable
+        // from one that verified everything — worse than a red run, because nobody
+        // goes looking. `isStackServing` decides what counts as up, and the liveness
+        // guard turns a crash-on-boot into an abort in the same 300ms it took to
+        // happen, instead of after the full timeout.
+        //
+        // `gone` is deliberately true for an ABSENT pid too: reaching here means the
+        // spawn was attempted, so no pid means it failed outright and there is nothing
+        // left to wait for. Being wrong here costs nothing — the timeout still bounds
+        // the wait, so this only ever makes the abort arrive sooner.
+        const gone = (pid) => pid === undefined || !(0, dev_state_1.isPidAlive)(pid);
+        // Wait for the test App to answer.
         if (appUrl) {
             log.info(log.dim(`Waiting for ${appUrl} …`));
-            yield (0, dev_process_1.waitForHttp)(appUrl, 90000);
+            const appReady = yield (0, dev_process_1.waitForHttp)(appUrl, 90000, isStackServing, () => gone(pids.app));
+            if (!appReady)
+                throw unreachableStackError('App', appUrl, appLogPath);
         }
-        // Wait for the test API to actually SERVE (real 2xx on /meta) before handing
-        // off to Playwright. Previously bringUp only waited for the App, so a compiled
-        // API still connecting to Mongo made the first specs skip via the suite's
-        // `ensureApiReachableOrSkip` guard (the API-readiness race). A strict 2xx is
-        // required: Caddy answers 502 while its upstream is still booting, which the
-        // default (lenient) predicate would accept as "up".
+        // Wait for the test API to actually SERVE before handing off to Playwright.
+        // Previously bringUp only waited for the App, so a compiled API still
+        // connecting to its database made the first specs skip via the suite's
+        // `ensureApiReachableOrSkip` guard (the API-readiness race).
         if (apiUrl) {
             log.info(log.dim(`Waiting for ${apiUrl}/meta …`));
-            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, (status) => status >= 200 && status < 300);
+            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, isStackServing, () => gone(pids.api));
             if (!apiReady)
-                log.warn(`Test API did not answer 2xx on ${apiUrl}/meta within 120s — the first specs may skip.`);
+                throw unreachableStackError('API', `${apiUrl}/meta`, apiLogPath);
         }
-        // Expose THIS stack's API log path so the caller can point the auth E2E specs
-        // (via NEST_SERVER_LOG) at the exact isolated log — correct per shard.
-        const apiLogPath = layout.apiDir ? (0, path_1.join)(layout.root, '.lt-dev', names.apiLog) : undefined;
         return { apiLogPath, apiUrl, appEnv, appUrl, dbName, pids, testIdentity };
     });
 }
@@ -467,6 +482,41 @@ function buildTestAppEnv(appEnv) {
 function hasTestSession(root) {
     return (0, dev_state_1.loadSession)(root, dev_state_1.TEST_SESSION_FILE) !== null;
 }
+/**
+ * Whether an HTTP status proves the component ITSELF answered.
+ *
+ * Readiness here means liveness, not health: the question is "did my process get
+ * far enough to serve HTTP", not "did it like this particular request". So a 404
+ * and a 500 both count as ready — they came FROM the upstream — while Caddy's
+ * gateway errors do not, because Caddy returns those for the entire window in
+ * which its upstream is not yet listening.
+ *
+ * The 404 case is the load-bearing one. The API probe targets `/meta`, an
+ * endpoint `@lenne.tech/nest-server` provides and `nest-base` does not: a healthy
+ * nest-base API answers 404 there (verified against a live one). The previous
+ * strict-2xx predicate was harmless while a failed wait only logged a warning,
+ * but this module now ABORTS on it — under strict 2xx that would block
+ * `lt dev test` for every nest-base project on a perfectly healthy API, which is
+ * worse than the false-green it replaces. Probing a list of per-framework paths
+ * would work too, but it needs updating for every new template; "something other
+ * than the proxy answered" needs no such list.
+ */
+function isStackServing(status) {
+    return status > 0 && ![502, 503, 504].includes(status);
+}
+/**
+ * The abort thrown when the test DB cannot be migrated.
+ *
+ * An abort rather than a warning for the same reason as `unreachableStackError`:
+ * a suite run on an un-migrated DB tests a data state no environment has, and
+ * whatever it reports is about the test setup, not about the feature. Unlike the
+ * API's boot, `migrate:up` runs in the foreground, so its output is already on
+ * screen right above this message.
+ */
+function migrationFailedError(dbName, exitCode) {
+    return new Error(`migrate:up failed (exit ${String(exitCode)}) against the test DB "${dbName}" — test API not started, ` +
+        'because a suite on an un-migrated DB tests a state no environment has. The migration output is above.');
+}
 /** Build the dedicated test identity + test DB name for a project. */
 function resolveTestSession(layout, baseIdentity, shardIndex, devDbName) {
     const names = testStackNames(shardIndex);
@@ -551,6 +601,50 @@ function runShardedTestSession(layout, baseIdentity, log, opts) {
 function shardReportDir(root, shardIndex) {
     return (0, path_1.join)(root, '.lt-dev', `shard.${shardIndex}.playwright-report`);
 }
+/**
+ * Start the test stack's API: build → apply pending migrations → start the
+ * compiled bundle, or fall back to the project's own `start` script when no
+ * bundle is available.
+ *
+ * The compiled start bypasses that `start` script and therefore the
+ * `migrate:up` it chains in front of the server. The test DB outlives every
+ * run — the CLI never drops it — so without the explicit step here it drifted
+ * behind every environment that does migrate (DEV-3289). The migration runs
+ * with `apiEnv`, the API's own env, so both resolve the same database, and
+ * before the spawn, because the API syncs its indexes against whatever it finds
+ * on boot. A failed migration throws `migrationFailedError`.
+ *
+ * `skipBuild` (sibling shards) reuses the dist the first shard produced but
+ * still migrates: every shard has a database of its own. The fallback does not
+ * migrate itself — the `start` script it runs owns that, exactly as under
+ * `lt dev up`. Per-directory package manager, like `lt dev up`: a monorepo with
+ * an npm API and a pnpm App must drive each with its own.
+ */
+function startTestApi(opts) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { apiDir, apiEnv, dbName, log, logFile, skipBuild } = opts;
+        const apiPm = (0, dev_package_manager_1.pickPackageManager)(apiDir);
+        let build = 0;
+        if (!skipBuild) {
+            log.info(log.dim('Building API (compiled, for stable long runs) …'));
+            build = yield (0, dev_process_1.runChildInherit)(apiPm.bin, apiPm.runScript('build'), { cwd: apiDir, env: process.env });
+        }
+        const entry = (0, dev_api_launch_1.findCompiledEntry)(apiDir);
+        if (build === 0 && entry) {
+            const migration = yield (0, dev_api_launch_1.applyPendingMigrations)({ apiDir, env: apiEnv, pm: apiPm });
+            if (migration.status === 'failed')
+                throw migrationFailedError(dbName, migration.exitCode);
+            if (migration.status === 'skipped')
+                log.info(log.dim(`no migrate:up script — ${dbName} is not migrated`));
+            // Runtime follows the PROJECT, never a hardcoded default: a `nest-base` API
+            // bundles with `Bun.build({ target: 'bun' })` and dies under node with
+            // "__require is not a function" (DEV-3208).
+            return (0, dev_process_1.spawnDetached)((0, dev_api_launch_1.resolveApiRuntime)(apiDir), [entry], { cwd: apiDir, env: apiEnv, logFile });
+        }
+        log.warn(`compiled API not available — falling back to \`${apiPm.bin} start\` (ts-node).`);
+        return (0, dev_process_1.spawnDetached)(apiPm.bin, apiPm.runScript('start'), { cwd: apiDir, env: apiEnv, logFile });
+    });
+}
 /**
  * Tear down the unsharded test stack AND every sharded stack discovered on disk
  * (`state.test.<i>.json` in `.lt-dev/`). Used by `lt dev test down` so a
@@ -661,6 +755,23 @@ function tearDownTestSession(layout_1, baseIdentity_1, log_1) {
 function testAppEntryCandidates() {
     return [`${exports.TEST_NITRO_OUTPUT_DIR}/server/index.mjs`, '.output/server/index.mjs'];
 }
+/**
+ * The abort thrown when a test-stack component never becomes reachable.
+ *
+ * Phrased as an abort, not a diagnosis, because the cause lives in the component's
+ * own log and nowhere else — the process is detached, so its stderr never reaches
+ * this terminal. Naming the log file is therefore the whole value of the message:
+ * an abort that only says "did not come up" moves the guesswork one step later
+ * instead of ending it.
+ *
+ * `lt dev test` catches this, reports it, tears the stack down and exits non-zero,
+ * so Playwright never starts (DEV-3208).
+ */
+function unreachableStackError(component, url, logFile) {
+    const where = logFile ? ` Why it never came up: ${logFile}` : '';
+    return new Error(`Test ${component} never became reachable at ${url} — aborting before Playwright runs, ` +
+        `because a suite run against a dead ${component} passes trivially and proves nothing.${where}`);
+}
 /**
  * Resolve the per-stack file/identity names. For a sharded run (`shardIndex`
  * given) everything gets a `.<i>` / `-<i>` suffix so N stacks coexist without

package/build/lib/fail-run.js

@@ -20,6 +20,17 @@ exports.failRun = failRun;
  * buffered output, including the spinner's own failure message, which is the one
  * line the operator actually needs.
  *
+ * That choice carries a precondition worth stating, because it was violated:
+ * setting `process.exitCode` only ends the process once **the event loop drains**,
+ * and `bin/lt` has no terminal `process.exit()` after `run()`. A running ora
+ * spinner holds the loop open on two counts — its `setInterval` for the animation
+ * and the `stdin.resume()` its stdin discarder performs. So a command that called
+ * `failRun` and returned while a spinner was still spinning did not exit at all:
+ * no message, no prompt back, and the terminal left in raw mode. The remedy is to
+ * stop the spinner, NOT to switch this helper to `process.exit()` — that would
+ * trade a hang for the truncated-output bug this helper exists to avoid.
+ * `__tests__/spinner-lifetime.test.ts` enforces the spinner half.
+ *
  * **Guarded by `fromGluegunMenu`**, like the CLI's other exit-code call sites
  * (`dev test`, `dev tunnel`, `tools ocr`, `workspace-integration`): inside the
  * interactive `lt` menu a command is one step of a longer session, and failing

package/build/lib/git-env.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonInteractiveGitEnv = nonInteractiveGitEnv;
+/**
+ * The environment git subprocesses run with so they never block on a prompt.
+ *
+ * Two variables, one rule each:
+ *
+ * `GIT_TERMINAL_PROMPT=0` stops git asking for credentials on a dead terminal.
+ * A prompt in a detached or CI child is not a question anyone can answer — it is
+ * a hang that looks like a slow network.
+ *
+ * `GIT_SSH_COMMAND` only supplies a DEFAULT, and the distinction is expensive.
+ * `BatchMode=yes` makes ssh fail rather than PROMPT — but an agent that stalls is
+ * not a prompt. On a 1Password-backed machine the agent is reachable and every
+ * signature needs interactive approval; unattended it waits, then reports
+ * `communication with agent failed`. Measured at 61s per fetch, which made
+ * `lt git update --dry-run` take 62s and `lt git create --dry-run` 123s (two
+ * fetches). `ConnectTimeout` does not bound that — it covers the TCP connect,
+ * not the agent.
+ *
+ * Waiting for a human to approve a key is legitimate for an interactive command,
+ * so the default itself is unchanged. What was wrong was assigning it
+ * UNCONDITIONALLY: that overrode anyone who had configured ssh deliberately,
+ * including a test harness trying to make the behaviour deterministic. A
+ * caller's own value therefore always wins (`IdentityAgent=none` in their env
+ * drops the same fetch to ~1s with a clean `Permission denied (publickey)`); the
+ * fallback only keeps an unconfigured machine from hanging.
+ *
+ * This exists as an environment object rather than a shell prefix because
+ * `VAR=value git …` is not assignment syntax to cmd.exe — it reads the whole
+ * thing as a command name and fails with "'GIT_TERMINAL_PROMPT' is not
+ * recognized". Handing the child an env works on every platform, and it is the
+ * only spelling that does. Keep it here rather than inline at each call site:
+ * this is the single place the default is defined, which is what lets a test
+ * assert that nobody assigns GIT_SSH_COMMAND unconditionally anywhere else.
+ *
+ * One caveat if you ever read a variable back off the returned object: spreading
+ * `process.env` produces a PLAIN object, which on Windows loses the
+ * case-insensitive lookup the real `process.env` proxy provides. The value is
+ * intact under its original spelling (`Path`, not `PATH`), and handing the whole
+ * object to `spawn` works — but `result.PATH` is undefined there.
+ */
+function nonInteractiveGitEnv(base = process.env) {
+    return Object.assign(Object.assign({}, base), { GIT_SSH_COMMAND: base.GIT_SSH_COMMAND || 'ssh -o ConnectTimeout=5 -o BatchMode=yes', GIT_TERMINAL_PROMPT: '0' });
+}

package/build/lib/heal-oxlintrc.js

@@ -38,8 +38,11 @@ const LINT_STAGED_FILES = [
  */
 function findDangerousFixFlagUsage(appDir, workspaceRoot) {
     const base = workspaceRoot !== null && workspaceRoot !== void 0 ? workspaceRoot : appDir;
-    const files = [...(workspaceRoot ? [(0, path_1.join)(workspaceRoot, 'scripts', 'check.mjs')] : []), ...fixFlagFiles(appDir, workspaceRoot)];
-    return [...new Set(files)].filter((file) => usesDangerousFixFlag(file)).map((file) => (0, path_1.relative)(base, file) || file);
+    const files = [
+        ...(workspaceRoot ? [(0, path_1.join)(workspaceRoot, 'scripts', 'check.mjs')] : []),
+        ...fixFlagFiles(appDir, workspaceRoot),
+    ];
+    return [...new Set(files)].filter((file) => usesDangerousFixFlag(file)).map((file) => repoRelative(base, file));
 }
 /**
  * Remove `--fix-suggestions` and `--fix-dangerously` from the project's lint commands
@@ -57,7 +60,7 @@ function healDangerousOxlintFixFlags(appDir, workspaceRoot) {
         if (!usesDangerousFixFlag(file)) {
             continue;
         }
-        const rel = (0, path_1.relative)(base, file) || file;
+        const rel = repoRelative(base, file);
         const dir = (0, path_1.join)(file, '..');
         const name = (0, path_1.relative)(dir, file);
         if (isSymlink(file)) {
@@ -203,6 +206,20 @@ function isTracked(dir, relPath) {
         return false;
     }
 }
+/**
+ * `file` relative to `base`, always with forward slashes.
+ *
+ * These strings are reported to the user next to git facts ("not tracked by
+ * git", "uncommitted changes") and name files inside the repository, which git
+ * itself always spells with `/`. `relative()` returns the OS-native form, so on
+ * Windows the report would say `projects\app\package.json` while `git status`
+ * says `projects/app/package.json` for the same file. Falls back to the
+ * absolute path when there is no relative form (`base` IS the file).
+ */
+function repoRelative(base, file) {
+    const rel = (0, path_1.relative)(base, file);
+    return rel ? rel.split(path_1.sep).join('/') : file;
+}
 function usesDangerousFixFlag(file) {
     try {
         // Follows a symlink on purpose: a linked config still feeds the lint run, so it

package/build/lib/heal-vendor-migrate-store.js

@@ -90,9 +90,10 @@ const ts = __importStar(require("typescript"));
  * Detection runs on the TypeScript AST, not on regex-stripped text. A regex
  * "lexer" has no string/template/regex-literal state, so a `/*` or `//` inside a
  * literal earlier in the file silently erased the guard and triggered the very
- * overwrite this function must avoid. `lib/strip-comments.ts` solves the comment
- * half properly (TS scanner) and would have been the right reuse; the AST solves
- * comments AND nesting in one step, and recognises a backtick require for free.
+ * overwrite this function must avoid. Scanning is not enough either: a standalone
+ * `ts.createScanner` loop desynchronises on the first interpolating template
+ * literal (that is what retired `lib/strip-comments.ts`). The AST solves comments
+ * AND nesting in one step, and recognises a backtick require for free.
  *
  * ## Recoverability
  *