@lenne.tech/cli 1.47.0 → 1.49.0

package/build/lib/migrate-scripts.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILD_GUARD_FILE = exports.COMPILED_MIGRATE_ARGS = exports.MIGRATE_ENVIRONMENTS = void 0;
+exports.deployedMigrateScripts = deployedMigrateScripts;
+exports.missingBuildGuardWarning = missingBuildGuardWarning;
+const path_1 = require("path");
+const cross_env_1 = require("./cross-env");
+/** Script suffix → `NODE_ENV` value. `prod` maps to `production`, the name Nest config keys off. */
+exports.MIGRATE_ENVIRONMENTS = [
+    ['develop', 'develop'],
+    ['test', 'test'],
+    ['preview', 'preview'],
+    ['prod', 'production'],
+];
+/** Where the build puts the compiled migrations and the store helper. */
+exports.COMPILED_MIGRATE_ARGS = '--store ./dist/migrations-utils/migrate.js --migrations-dir ./dist/migrations';
+/**
+ * Build guard in front of every deployed script — the same wiring nest-server-starter
+ * uses (`node scripts/… && <migrate>`), so the chain fails BEFORE migrate starts and
+ * `dp:prod` never reaches the server start.
+ *
+ * It is needed because the failure is otherwise SILENT: measured with nest-server
+ * 11.41.2, a missing migrations directory prints "treating as empty" and a missing or
+ * empty one both end in "No pending migrations", exit 0. An unbuilt checkout would
+ * report a successful migration run that never happened, and the server would then come
+ * up against an unmigrated database.
+ */
+exports.BUILD_GUARD_FILE = 'require-built-migrations.mjs';
+const BUILD_GUARD = `node scripts/${exports.BUILD_GUARD_FILE} && `;
+/**
+ * Build the four deployed migrate scripts.
+ *
+ * @param invocation How this project starts the migrate CLI: `'migrate'` in npm mode
+ *                   (the binary of `@lenne.tech/nest-server`, a production dependency),
+ *                   `'node ./dist/bin/migrate.js'` in vendor mode (the shim `copy:bin`
+ *                   ships into `dist/`).
+ */
+function deployedMigrateScripts(invocation) {
+    const scripts = {};
+    for (const [scriptEnv, nodeEnv] of exports.MIGRATE_ENVIRONMENTS) {
+        scripts[`migrate:${scriptEnv}:up`] =
+            BUILD_GUARD + (0, cross_env_1.withCrossEnv)({ NODE_ENV: nodeEnv }, `${invocation} up ${exports.COMPILED_MIGRATE_ARGS}`);
+    }
+    return scripts;
+}
+/**
+ * Warn when the build guard the deployed scripts call is not in the project.
+ *
+ * The file ships with nest-server-starter, which BOTH modes clone as their base
+ * (`server.ts`: "Both npm and vendor mode clone nest-server-starter as the base"), and
+ * nothing in the conversion prunes `scripts/` wholesale — only
+ * `strip-api-mode-markers.mjs`, `scripts/vendor/` and, in REST mode,
+ * `run-spectaql.mjs`. So the CLI does NOT ship its own copy: a second, nearly identical
+ * file is exactly the drift we are trying to avoid.
+ *
+ * What it does instead is fail loudly if the assumption stops holding — e.g. a project
+ * built from an older starter. Same treatment as `migrations-utils/mongo-uri.js`:
+ * without the file every deployed migrate script dies at the first `&&`.
+ *
+ * @returns A warning message, or null when the guard is present.
+ */
+function missingBuildGuardWarning(filesystem, projectDir) {
+    if (filesystem.exists((0, path_1.join)(projectDir, 'scripts', exports.BUILD_GUARD_FILE))) {
+        return null;
+    }
+    return (`  ⚠ scripts/${exports.BUILD_GUARD_FILE} is missing — the deployed migrate:<env>:up scripts call it ` +
+        'before migrating and would fail immediately. It ships with nest-server-starter; add it ' +
+        '(or update the starter this project was created from).');
+}

package/build/lib/module-specifiers.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileImportedSpecifiers = fileImportedSpecifiers;
+exports.importedSpecifiers = importedSpecifiers;
+exports.isPackageImport = isPackageImport;
+exports.isRelativeCoreImport = isRelativeCoreImport;
+/**
+ * The module specifiers a file imports — read from the syntax tree, never from text.
+ *
+ * The detectors that ask "does this file still import X?" used to search the raw source
+ * and blank out comments first, because a docblock that DOCUMENTS the conversion quotes
+ * the very syntax they look for (`nest-server-starter`'s
+ * `tests/unit/bootstrap-diagnostics.spec.ts` names `from '@lenne.tech/nest-server'` in
+ * prose, and the detector told the user to rewrite imports that file does not have).
+ *
+ * That workaround does not hold. `stripComments` drives a standalone `ts.createScanner`
+ * in a plain `scan()` loop, and a template literal WITH a substitution cannot be read
+ * that way: the scanner hands back `TemplateHead` and needs `reScanTemplateToken()` to
+ * continue. Without it every token after the first `` `x${…}` `` is misread, so comments
+ * from there on pass through verbatim. Bisected on `src/templates/check/check.mjs`: the
+ * first surviving comment appears right after `` `${s.toFixed(1)}s` `` on line 70, and a
+ * two-line fixture reproduces it. A plain template without substitution is fine; regex
+ * literals and division — the first suspects — are not the cause.
+ * Since template literals are everywhere, degradation was present in 23 of 76 real
+ * frontend files and 21 of 50 backend files; only the absence of a needle-quoting
+ * comment BELOW such a template kept it from producing false alarms.
+ *
+ * Asking the parser removes the whole class: a comment is not part of the AST, so there
+ * is nothing to strip and nothing to get wrong.
+ */
+const ts = __importStar(require("typescript"));
+/** `<script>` / `<script setup>` blocks of a Vue SFC, which is not valid TypeScript as a whole. */
+const VUE_SCRIPT_BLOCK = /<script\b[^>]*>([\s\S]*?)<\/script>/gi;
+/**
+ * Same, for a file on disk. A `.vue` SFC is not valid TypeScript, so its `<script>`
+ * blocks are extracted first and parsed individually — the template and style blocks
+ * cannot contain imports and are skipped. Everything else is parsed as-is.
+ *
+ * @returns The specifiers, or `[]` when the file cannot be read.
+ */
+function fileImportedSpecifiers(filePath, read) {
+    const source = read(filePath);
+    if (!source) {
+        return [];
+    }
+    if (!filePath.endsWith('.vue')) {
+        return importedSpecifiers(source, filePath);
+    }
+    const specifiers = [];
+    for (const [, block] of source.matchAll(VUE_SCRIPT_BLOCK)) {
+        specifiers.push(...importedSpecifiers(block, `${filePath}.ts`));
+    }
+    return specifiers;
+}
+/**
+ * Every module specifier `source` imports, exports from, dynamically imports or
+ * requires. Duplicates are preserved; order follows the file.
+ *
+ * Covers `import x from 'y'`, `import 'y'`, `export … from 'y'`, `export * from 'y'`,
+ * `import y = require('y')`, `await import('y')` and `require('y')`.
+ *
+ * @param source The file's text.
+ * @param fileName Only used to pick the parser dialect (`.tsx` vs `.ts`).
+ */
+function importedSpecifiers(source, fileName = 'file.ts') {
+    const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, true);
+    const specifiers = [];
+    const literalText = (node) => node && ts.isStringLiteralLike(node) ? node.text : null;
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
+            const text = literalText(node.moduleSpecifier);
+            if (text !== null) {
+                specifiers.push(text);
+            }
+        }
+        else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference)) {
+            const text = literalText(node.moduleReference.expression);
+            if (text !== null) {
+                specifiers.push(text);
+            }
+        }
+        else if (ts.isCallExpression(node)) {
+            const callee = node.expression;
+            const isRequire = ts.isIdentifier(callee) && callee.text === 'require';
+            const isDynamicImport = callee.kind === ts.SyntaxKind.ImportKeyword;
+            if (isRequire || isDynamicImport) {
+                const text = literalText(node.arguments[0]);
+                if (text !== null) {
+                    specifiers.push(text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return specifiers;
+}
+/** True when `specifier` is `pkg` itself or a deep import of it (`pkg/sub/path`). */
+function isPackageImport(specifier, pkg) {
+    return specifier === pkg || specifier.startsWith(`${pkg}/`);
+}
+/**
+ * True when `specifier` is a relative path whose last segment is `core`, or that leads
+ * into a `core` directory — `./core`, `../core`, `../../core/utils`.
+ */
+function isRelativeCoreImport(specifier) {
+    if (!specifier.startsWith('.')) {
+        return false;
+    }
+    return specifier.split('/').includes('core');
+}

package/build/lib/spinner-lifetime.js

@@ -0,0 +1,245 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findSpinnerLeaks = findSpinnerLeaks;
+/**
+ * Finds progress spinners that can be left running.
+ *
+ * gluegun's `spin(text)` is `require('ora')(text).start()`. ora 4.0.2 with the
+ * default `discardStdin: true` does three things on start that only a stop undoes:
+ * it puts the terminal into raw mode (remembering the value it found), it calls
+ * `stdin.resume()` and adds a `data` listener, and it starts a `setInterval` for
+ * the animation.
+ *
+ * A spinner that is never stopped therefore does not merely look untidy — the
+ * interval and the resumed stdin keep the Node event loop alive, so the process
+ * never exits, and the terminal stays in raw mode. That combination is how
+ * `lt fullstack init` could reach the end of its work and simply not return, with
+ * a spinner still turning. `failRun` deliberately sets `process.exitCode` instead
+ * of calling `process.exit()` (so a failure message is never truncated), which
+ * means "the event loop drains" is a precondition the CLI relies on.
+ *
+ * ## What "stopped" means here
+ *
+ * This is a dominance approximation, not a full control-flow analysis, and it is
+ * deliberately conservative in the direction that avoids false alarms — a guard
+ * that flags correct code gets switched off. A statement list definitely stops a
+ * spinner when it contains a direct stop call, or an `if` whose BOTH branches
+ * stop, or a `try` whose body and `catch` both stop (or whose `finally` stops).
+ * Anything else does not count.
+ *
+ * Two questions are asked per spinner:
+ *
+ * 1. Can the end of its enclosing block be reached without a stop? That is the
+ *    silent case — the command falls off the end, exit code 0, spinner running.
+ * 2. Is there a `return` after it that no stop dominates? That is the early-exit
+ *    case — an error path that prints and leaves.
+ *
+ * Returns inside a nested function are ignored: they leave the callback, not the
+ * command.
+ */
+const ts = __importStar(require("typescript"));
+/** Methods that stop an ora spinner. `stopAndPersist` is what `succeed`/`fail`/… call. */
+const STOP_METHODS = new Set(['fail', 'info', 'stop', 'stopAndPersist', 'succeed', 'warn']);
+/**
+ * Every spinner in `source` that can outlive the code path that started it.
+ *
+ * @param source The file's text.
+ * @param fileName Only used to pick the parser dialect.
+ */
+function findSpinnerLeaks(source, fileName = 'file.ts') {
+    const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, true);
+    const leaks = [];
+    const lineOf = (node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+    for (const declaration of spinnerDeclarations(sourceFile)) {
+        const name = declaration.name.getText(sourceFile);
+        const block = enclosingBlock(declaration);
+        if (!block) {
+            continue;
+        }
+        const returns = returnsAfter(block, declaration);
+        // `return spinner;` hands ownership to the caller, which is then responsible
+        // for stopping it — a factory like `logger.ts#spin` is not a leak. One such
+        // return exempts the whole declaration, because the spinner's lifetime is no
+        // longer decided in this function.
+        if (returns.some((statement) => handsOverOwnership(statement, name))) {
+            continue;
+        }
+        const after = statementsAfter(block, declaration);
+        if (!after.some((statement) => definitelyStops(statement, name, sourceFile))) {
+            leaks.push({
+                line: lineOf(declaration),
+                reason: after.length === 0 ? 'never-stopped' : 'falls-through',
+                spinner: name,
+            });
+        }
+        for (const returnStatement of returns) {
+            if (!dominatedByStop(returnStatement, block, declaration, name, sourceFile)) {
+                leaks.push({ line: lineOf(returnStatement), reason: 'return-without-stop', spinner: name });
+            }
+        }
+    }
+    return leaks.sort((a, b) => a.line - b.line);
+}
+/**
+ * True when executing `statement` always stops `name`.
+ *
+ * Only the shapes the CLI actually uses are recognised. Everything unrecognised
+ * answers false, so an unusual construct produces a finding to look at rather
+ * than a silent pass.
+ */
+function definitelyStops(statement, name, sourceFile) {
+    if (ts.isExpressionStatement(statement)) {
+        return isStopCall(statement.expression, name, sourceFile);
+    }
+    if (ts.isBlock(statement)) {
+        return statement.statements.some((child) => definitelyStops(child, name, sourceFile));
+    }
+    if (ts.isIfStatement(statement)) {
+        // Only an if/else that stops on BOTH sides stops unconditionally.
+        return (!!statement.elseStatement &&
+            definitelyStops(statement.thenStatement, name, sourceFile) &&
+            definitelyStops(statement.elseStatement, name, sourceFile));
+    }
+    if (ts.isTryStatement(statement)) {
+        if (statement.finallyBlock && definitelyStops(statement.finallyBlock, name, sourceFile)) {
+            return true;
+        }
+        return (definitelyStops(statement.tryBlock, name, sourceFile) &&
+            !!statement.catchClause &&
+            definitelyStops(statement.catchClause.block, name, sourceFile));
+    }
+    return false;
+}
+/**
+ * True when some stop of `name` is guaranteed to run before `returnStatement`.
+ *
+ * Walks out from the return towards `block`, and at each level checks the
+ * statements that precede the one we came from — a stop in any of them dominates.
+ */
+function dominatedByStop(returnStatement, block, declaration, name, sourceFile) {
+    let child = returnStatement;
+    let parent = returnStatement.parent;
+    while (parent) {
+        if (ts.isBlock(parent) || ts.isSourceFile(parent)) {
+            for (const statement of parent.statements) {
+                if (statement === child || statement.getStart(sourceFile) >= child.getStart(sourceFile)) {
+                    break;
+                }
+                if (statement.getStart(sourceFile) > declaration.getStart(sourceFile) &&
+                    definitelyStops(statement, name, sourceFile)) {
+                    return true;
+                }
+            }
+        }
+        if (parent === block) {
+            return false;
+        }
+        child = parent;
+        parent = parent.parent;
+    }
+    return false;
+}
+/** The nearest enclosing block of a declaration — the scope its spinner must not outlive. */
+function enclosingBlock(node) {
+    let current = node.parent;
+    while (current) {
+        if (ts.isBlock(current)) {
+            return current;
+        }
+        current = current.parent;
+    }
+    return undefined;
+}
+/** True for `return spinner;` — the caller becomes responsible for stopping it. */
+function handsOverOwnership(statement, name) {
+    return !!statement.expression && ts.isIdentifier(statement.expression) && statement.expression.text === name;
+}
+/** True for `x.succeed(…)` / `x.fail(…)` / … on the spinner called `name`. */
+function isStopCall(expression, name, sourceFile) {
+    if (!ts.isCallExpression(expression) || !ts.isPropertyAccessExpression(expression.expression)) {
+        return false;
+    }
+    const access = expression.expression;
+    return access.expression.getText(sourceFile) === name && STOP_METHODS.has(access.name.text);
+}
+/** Every `return` after `declaration` inside `block`, skipping nested functions. */
+function returnsAfter(block, declaration) {
+    const found = [];
+    const start = declaration.getStart();
+    const visit = (node) => {
+        if (ts.isFunctionLike(node)) {
+            return; // A return there leaves the callback, not the command.
+        }
+        if (ts.isReturnStatement(node) && node.getStart() > start) {
+            found.push(node);
+        }
+        ts.forEachChild(node, visit);
+    };
+    for (const statement of block.statements) {
+        if (statement.getStart() > start) {
+            visit(statement);
+        }
+    }
+    return found;
+}
+/** `const x = spin(…)` declarations, including `toolbox.print.spin(…)`. */
+function spinnerDeclarations(sourceFile) {
+    const found = [];
+    const visit = (node) => {
+        if (ts.isVariableDeclaration(node) &&
+            ts.isIdentifier(node.name) &&
+            node.initializer &&
+            ts.isCallExpression(node.initializer)) {
+            const callee = node.initializer.expression;
+            const name = ts.isPropertyAccessExpression(callee)
+                ? callee.name.text
+                : ts.isIdentifier(callee)
+                    ? callee.text
+                    : '';
+            if (name === 'spin') {
+                found.push(node);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return found;
+}
+/** The statements of `block` that follow `declaration`. */
+function statementsAfter(block, declaration) {
+    const start = declaration.getStart();
+    return block.statements.filter((statement) => statement.getStart() > start);
+}

package/build/lib/strip-vendor-schema-augmentation.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stripAugmentationBlocks = stripAugmentationBlocks;
 exports.stripVendorSchemaAugmentation = stripVendorSchemaAugmentation;
+const glob_1 = require("glob");
 const fs_utils_1 = require("./fs-utils");
 /**
  * Drop `declare module '<nuxt|@nuxt>/schema' { … }` blocks that only augment
@@ -118,7 +119,6 @@ function stripAugmentationBlocks(source, onSkip) {
  *          is still there and only the transform knows it.
  */
 function stripVendorSchemaAugmentation(options) {
-    var _a;
     const { coreDir, filesystem } = options;
     if (!filesystem.isDirectory(coreDir))
         return { touched: [], warnings: [] };
@@ -128,7 +128,18 @@ function stripVendorSchemaAugmentation(options) {
         return { touched: [], warnings: [] };
     const touched = [];
     const warnings = [];
-    for (const file of (_a = filesystem.find(coreDir, { matching: '**/*.ts' })) !== null && _a !== void 0 ? _a : []) {
+    // `glob`, not `filesystem.find`: gluegun's find is fs-jetpack, which builds its
+    // matcher by concatenating the resolved absolute base path in front of the glob
+    // (`fs-jetpack/lib/utils/matcher.js` → `convertPatternToAbsolutePath`). On Windows
+    // that base is backslash-separated and minimatch reads a backslash inside a
+    // PATTERN as an escape, so `D:\…\core/**/*.ts` collapses to `D:coresrc/**/*.ts`
+    // and matches nothing — minimatch normalises separators on the file side only.
+    // The strip then reported success while the TS2310 augmentation stayed in every
+    // Windows-converted project. `glob` keeps pattern and base directory apart and
+    // normalises separators itself. Same fix as `api-mode.ts`'s `globFiles`. glob does
+    // not follow symlinked directories, unlike jetpack — which is the direction the
+    // guard above already wants: nothing inside a linked checkout gets rewritten.
+    for (const file of (0, glob_1.globSync)('**/*.ts', { absolute: true, cwd: coreDir, dot: true, nodir: true })) {
         const content = filesystem.read(file);
         if (!content || !content.includes('PublicRuntimeConfig'))
             continue;

package/build/lib/vendor-claude-md.js

@@ -33,6 +33,7 @@ exports.healVendorClaudeMd = healVendorClaudeMd;
 exports.insertVendorBlockIfMissing = insertVendorBlockIfMissing;
 exports.removeVendorBlock = removeVendorBlock;
 exports.upsertVendorBlock = upsertVendorBlock;
+const path_1 = require("path");
 exports.BACKEND_VENDOR_MARKER = '<!-- lt-vendor-marker -->';
 exports.FRONTEND_VENDOR_MARKER = '<!-- lt-vendor-marker-frontend -->';
 exports.ROOT_VENDOR_MARKER = '<!-- lt-vendor-marker-root -->';
@@ -182,15 +183,20 @@ function healVendorClaudeMd(fs, state) {
             changed.push(path);
         }
     };
+    // `join`, not string concatenation with `/`: the returned paths are reported
+    // to the user and compared by callers, so they have to be the same spelling
+    // the rest of the CLI produces. Concatenating `/` onto a Windows directory
+    // yields `C:\ws\projects\api/CLAUDE.md` — it opens fine, but it matches
+    // nothing and reads like a bug in the output.
     if (state.apiDir) {
-        apply(joinPath(state.apiDir, 'CLAUDE.md'), exports.BACKEND_VENDOR_MARKER, state.backendVendor ? buildBackendVendorBlock() : null);
+        apply((0, path_1.join)(state.apiDir, 'CLAUDE.md'), exports.BACKEND_VENDOR_MARKER, state.backendVendor ? buildBackendVendorBlock() : null);
     }
     if (state.appDir) {
-        apply(joinPath(state.appDir, 'CLAUDE.md'), exports.FRONTEND_VENDOR_MARKER, state.frontendVendor ? buildFrontendVendorBlock() : null);
+        apply((0, path_1.join)(state.appDir, 'CLAUDE.md'), exports.FRONTEND_VENDOR_MARKER, state.frontendVendor ? buildFrontendVendorBlock() : null);
     }
     if (state.workspaceRoot) {
         const anyVendor = state.backendVendor || state.frontendVendor;
-        apply(joinPath(state.workspaceRoot, 'CLAUDE.md'), exports.ROOT_VENDOR_MARKER, anyVendor ? buildRootVendorBlock({ backend: state.backendVendor, frontend: state.frontendVendor }) : null);
+        apply((0, path_1.join)(state.workspaceRoot, 'CLAUDE.md'), exports.ROOT_VENDOR_MARKER, anyVendor ? buildRootVendorBlock({ backend: state.backendVendor, frontend: state.frontendVendor }) : null);
     }
     return changed;
 }
@@ -242,6 +248,3 @@ function blockRegex(marker) {
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
-function joinPath(dir, file) {
-    return dir.endsWith('/') ? `${dir}${file}` : `${dir}/${file}`;
-}

package/build/lib/workspace-integration.js

@@ -81,6 +81,7 @@ exports.runStandaloneWorkspaceGate = runStandaloneWorkspaceGate;
 exports.shouldProceedAsStandalone = shouldProceedAsStandalone;
 exports.writeApiConfig = writeApiConfig;
 const yaml = __importStar(require("js-yaml"));
+const path_1 = require("path");
 const ensure_root_dockerignore_1 = require("./ensure-root-dockerignore");
 const hoist_workspace_pnpm_config_1 = require("./hoist-workspace-pnpm-config");
 const remove_nested_lockfiles_1 = require("./remove-nested-lockfiles");
@@ -104,11 +105,20 @@ function detectSubProjectContext(startDir, filesystem) {
     const appDir = filesystem.path(root, 'projects', 'app');
     // Resolve absolute prefixes for a clean startsWith compare. We use
     // the gluegun-resolved paths because all callers go through it.
+    //
+    // The prefix MUST carry the OS separator, not a literal `/`:
+    // `filesystem.path` resolves through Node's `path`, so on Windows both
+    // sides come back with backslashes and an `${apiDir}/` prefix can never
+    // match. Every cwd below `projects\api\` then read as "not a
+    // sub-project", and the standalone gate in `runStandaloneWorkspaceGate`
+    // waved the user through instead of pointing them at the workspace root
+    // — the exact case (cloning a sibling tree INSIDE an existing
+    // sub-project) the check exists to prevent.
     const startAbs = filesystem.path(startDir);
-    if (startAbs === apiDir || startAbs.startsWith(`${apiDir}/`)) {
+    if (startAbs === apiDir || startAbs.startsWith(apiDir + path_1.sep)) {
         return { kind: 'api', subProjectDir: apiDir, workspaceRoot: root };
     }
-    if (startAbs === appDir || startAbs.startsWith(`${appDir}/`)) {
+    if (startAbs === appDir || startAbs.startsWith(appDir + path_1.sep)) {
         return { kind: 'app', subProjectDir: appDir, workspaceRoot: root };
     }
     return null;