@lenne.tech/cli 1.49.0 → 1.50.0

package/build/commands/dev/doctor.js

@@ -117,18 +117,31 @@ const DoctorCommand = {
                 line('WARN', colors.yellow, `Caddyfile validation: ${v.stderr.split('\n')[0]}`);
         }
         // 4. Port 80 / 443 free or held by Caddy
+        //
+        // "Is it bound" is now a TCP connect, so it answers on every platform — the
+        // old `lsof`-only probe degraded to a WARN on Windows and doctor then exited
+        // 0 while nothing worked. Only the OCCUPANT'S NAME can still be unavailable,
+        // and that is reported as its own state rather than folded into either
+        // verdict: a bound port we cannot attribute is not "free", and it is not
+        // proof that Caddy is blocked either.
+        const portProbe = yield (0, dev_process_1.probePorts)([80, 443]);
         for (const port of [80, 443]) {
-            const r = yield (0, dev_process_1.checkPortInUse)(port);
-            if (r === null)
-                line('WARN', colors.yellow, `lsof unavailable — cannot probe port ${port}`);
-            else if (!r.inUse)
+            if (!portProbe.bound.has(port)) {
                 line('OK', colors.green, `port ${port} free`);
-            else if (r.command === 'caddy')
-                line('OK', colors.green, `port ${port} held by caddy (pid ${r.pid})`);
-            else {
-                line('FAIL', colors.red, `port ${port} held by ${r.command} (pid ${r.pid}) — Caddy cannot bind`);
-                fails++;
+                continue;
+            }
+            const owner = portProbe.owners.get(port);
+            if (!owner) {
+                line('WARN', colors.yellow, `port ${port} is in use but the occupant could not be identified` +
+                    `${portProbe.ownersUnavailable ? ' (no lsof/netstat available)' : ''}`);
+                continue;
             }
+            if (owner.command.toLowerCase().startsWith('caddy')) {
+                line('OK', colors.green, `port ${port} held by caddy (pid ${owner.pid})`);
+                continue;
+            }
+            line('FAIL', colors.red, `port ${port} held by ${owner.command} (pid ${owner.pid}) — Caddy cannot bind`);
+            fails++;
         }
         // 5. *.localhost resolves to 127.0.0.1
         const dnsOk = yield dnsResolvesLocalhost('lt-dev-doctor.localhost');
@@ -273,7 +286,11 @@ const DoctorCommand = {
  */
 function dnsResolvesLocalhost(host) {
     return new Promise((resolve) => {
-        const child = (0, child_process_1.spawn)('node', [
+        const child = (0, child_process_1.spawn)(
+        // `process.execPath`, not a bare `node`: the CLI may run from a Node that
+        // is not on PATH at all (a version manager, a packaged install), and a
+        // different `node` on PATH would answer for a different runtime.
+        process.execPath, [
             '-e',
             `require('dns').lookup(${JSON.stringify(host)}, { all: true }, (e, addrs) => {
            if (e) process.exit(1);

package/build/commands/dev/down.js

@@ -16,12 +16,20 @@ const dev_project_1 = require("../../lib/dev-project");
 const dev_state_1 = require("../../lib/dev-state");
 const dev_test_session_1 = require("../../lib/dev-test-session");
 const dev_ticket_1 = require("../../lib/dev-ticket");
+const platform_1 = require("../../lib/platform");
 /**
  * Stop the processes started by `lt dev up` and remove the project's
  * Caddy block.
  *
- * - SIGTERM is sent to the detached process GROUP (negative PID) so
- *   children (Vite, Nest watcher) receive the signal too.
+ * - POSIX: SIGTERM to the detached process GROUP (negative PID), so children
+ *   (Vite, Nest watcher) receive it too and can shut down gracefully. No
+ *   escalation — `down` is the polite stop.
+ * - Windows: `taskkill /T /F`, i.e. FORCED, while `up`'s reclaim keeps the
+ *   two-phase `terminateProcessGroup`. Not a choice: Windows has no gentle step
+ *   (`/T` without `/F` was measured to leave the tree and its port alive), so
+ *   shutdown hooks do not run there. Details in `killWindowsTree`.
+ * - Either way the pid is verified gone afterwards; a survivor is reported,
+ *   never listed as stopped.
  * - The Caddy block is removed and `caddy reload` is invoked, so the
  *   subdomain stops resolving immediately.
  */
@@ -46,10 +54,27 @@ const DownCommand = {
                     stopped.push(`${name} (pid ${pid}, already dead)`);
                     continue;
                 }
-                if ((0, dev_process_1.killProcessGroup)(pid))
+                // A pid the plan refuses (1, this CLI, a system pid — i.e. a corrupted
+                // state.json) is neither signalled nor offered as a copy-paste kill hint:
+                // `kill -9 -1` is the broadcast that rebooted a Mac on 2026-09-23.
+                const plan = (0, dev_process_1.planTermination)(pid);
+                if (plan.kind === 'refuse') {
+                    warning(`Not stopping ${name}: ${plan.reason} — .lt-dev/state.json looks corrupted.`);
+                    continue;
+                }
+                (0, dev_process_1.killProcessGroup)(pid);
+                // Verify rather than assume: `killProcessGroup` reports that the signal
+                // was delivered, not that the process went. A compiled API with shutdown
+                // hooks can sit on SIGTERM while it waits for Mongo; claiming "stopped"
+                // then sends the user into the next `lt dev up` with a port collision
+                // nobody can trace back.
+                if (yield waitForExit(pid, 3000)) {
                     stopped.push(`${name} (pid ${pid})`);
-                else
-                    warning(`Failed to stop ${name} (pid ${pid})`);
+                }
+                else {
+                    warning(`${name} (pid ${pid}) did not stop — it may still hold its port.`);
+                    info(colors.dim(`  Check with \`lt dev status\`; force it with ${forceKillHint(pid)}`));
+                }
             }
             (0, dev_state_1.clearSession)(layout.root);
         }
@@ -98,3 +123,21 @@ const DownCommand = {
     }),
 };
 module.exports = DownCommand;
+/** The command that actually ends a process tree on this platform. */
+function forceKillHint(pid) {
+    // `/F` is not optional on Windows: measured, `taskkill /PID <pid> /T` without it
+    // fails on the children and leaves the port bound.
+    return (0, platform_1.isWindows)() ? `\`taskkill /PID ${pid} /T /F\`` : `\`kill -9 -${pid}\``;
+}
+/** Poll until `pid` is gone, or the budget runs out. */
+function waitForExit(pid, budgetMs) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const deadline = Date.now() + budgetMs;
+        while (Date.now() < deadline) {
+            if (!(0, dev_state_1.isPidAlive)(pid))
+                return true;
+            yield new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        return !(0, dev_state_1.isPidAlive)(pid);
+    });
+}

package/build/commands/dev/status.js

@@ -9,7 +9,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = require("path");
 const caddy_1 = require("../../lib/caddy");
+const dev_log_tail_1 = require("../../lib/dev-log-tail");
 const dev_process_1 = require("../../lib/dev-process");
 const dev_project_1 = require("../../lib/dev-project");
 const dev_state_1 = require("../../lib/dev-state");
@@ -50,7 +52,7 @@ const StatusCommand = {
                     if (e.internalPorts.app)
                         allPorts.push(e.internalPorts.app);
                 }
-                const snap = yield (0, dev_process_1.listenSnapshot)(allPorts);
+                const probe = yield (0, dev_process_1.probePorts)(allPorts);
                 for (const slug of slugs) {
                     const e = reg.projects[slug];
                     const session = (0, dev_state_1.loadSession)(e.path);
@@ -60,14 +62,14 @@ const StatusCommand = {
                     if (e.internalPorts.api) {
                         comps.push((0, dev_state_1.classifyComponentHealth)({
                             pid: session === null || session === void 0 ? void 0 : session.pids.api,
-                            portBound: snap.has(e.internalPorts.api),
+                            portBound: probe.bound.has(e.internalPorts.api),
                             startedAt: session === null || session === void 0 ? void 0 : session.startedAt,
                         }));
                     }
                     if (e.internalPorts.app) {
                         comps.push((0, dev_state_1.classifyComponentHealth)({
                             pid: session === null || session === void 0 ? void 0 : session.pids.app,
-                            portBound: snap.has(e.internalPorts.app),
+                            portBound: probe.bound.has(e.internalPorts.app),
                             startedAt: session === null || session === void 0 ? void 0 : session.startedAt,
                         }));
                     }
@@ -186,15 +188,15 @@ const StatusCommand = {
             // ts-node leaves nodemon alive ("waiting for file changes"), so the
             // wrapper PID alone reads as "running" while nothing serves the port.
             const ports = [entry.internalPorts.api, entry.internalPorts.app].filter((p) => typeof p === 'number');
-            const snap = yield (0, dev_process_1.listenSnapshot)(ports);
+            const probe = yield (0, dev_process_1.probePorts)(ports);
             const apiHealth = (0, dev_state_1.classifyComponentHealth)({
                 pid: session.pids.api,
-                portBound: entry.internalPorts.api ? snap.has(entry.internalPorts.api) : false,
+                portBound: entry.internalPorts.api ? probe.bound.has(entry.internalPorts.api) : false,
                 startedAt: session.startedAt,
             });
             const appHealth = (0, dev_state_1.classifyComponentHealth)({
                 pid: session.pids.app,
-                portBound: entry.internalPorts.app ? snap.has(entry.internalPorts.app) : false,
+                portBound: entry.internalPorts.app ? probe.bound.has(entry.internalPorts.app) : false,
                 startedAt: session.startedAt,
             });
             const label = (health) => health === 'running'
@@ -216,8 +218,13 @@ const StatusCommand = {
                 info('');
                 info(colors.bold('  Live upstream state'));
                 for (const p of ports) {
-                    const r = snap.get(p);
-                    info(`    ${p}: ${r ? colors.green(`bound to ${r.command} (pid ${r.pid})`) : colors.dim('free')}`);
+                    if (!probe.bound.has(p)) {
+                        info(`    ${p}: ${colors.dim('free')}`);
+                        continue;
+                    }
+                    const owner = probe.owners.get(p);
+                    // "bound" is measured; the occupant's name is not always obtainable.
+                    info(`    ${p}: ${owner ? colors.green(`bound to ${owner.command} (pid ${owner.pid})`) : colors.green('bound')}`);
                 }
             }
             // Surface any present-but-not-serving component (crashed OR dead) and
@@ -241,6 +248,23 @@ const StatusCommand = {
                 info('');
                 warning(`  ${down.join(' + ')} not serving${crashed ? ' (supervisor still up — crashed)' : ''}. ` +
                     `Run \`lt dev up\` to restart ${down.length === 1 ? 'it' : 'them'}.`);
+                // Why it is down is in its log, so show it here instead of sending the
+                // reader to look. An empty log is said out loud: that is a finding too.
+                for (const name of down) {
+                    (0, dev_log_tail_1.describeLog)((0, dev_log_tail_1.diagnoseLog)((0, path_1.join)(layout.root, '.lt-dev', `${name}.log`), 8)).forEach((l) => info(colors.dim(`  ${l}`)));
+                }
+            }
+            // A log that exists but stays empty while its component runs: the output
+            // is going somewhere else (on Windows it once went to an extra console
+            // window). Worse than no log, because it looks trustworthy.
+            for (const [name, present] of [
+                ['api', apiPresent],
+                ['app', appPresent],
+            ]) {
+                const logDiagnosis = (0, dev_log_tail_1.diagnoseLog)((0, path_1.join)(layout.root, '.lt-dev', `${name}.log`));
+                if (present && !down.includes(name) && (0, dev_log_tail_1.isSilentLog)(logDiagnosis, session.startedAt, Date.now())) {
+                    warning(`  ${name}: ${logDiagnosis.file} is still EMPTY — its output is not being captured.`);
+                }
             }
         }
         // Isolated test stack (`lt dev test`), if one is up / left with --keep.

package/build/commands/dev/up.js

@@ -17,6 +17,7 @@ const dev_api_launch_1 = require("../../lib/dev-api-launch");
 const dev_env_1 = require("../../lib/dev-env");
 const dev_env_bridge_1 = require("../../lib/dev-env-bridge");
 const dev_identity_1 = require("../../lib/dev-identity");
+const dev_log_tail_1 = require("../../lib/dev-log-tail");
 const dev_package_manager_1 = require("../../lib/dev-package-manager");
 const dev_patches_1 = require("../../lib/dev-patches");
 const dev_process_1 = require("../../lib/dev-process");
@@ -144,17 +145,6 @@ const UpCommand = {
             // plugin hook surfaces the ticket context per prompt instead (from the
             // gitignored `.lt-dev/ticket` marker). For the base project we keep the
             // committed URL block up to date as before.
-            if (!ticket) {
-                const claudeCandidates = [
-                    (0, path_1.join)(layout.root, 'CLAUDE.md'),
-                    ...(layout.apiDir ? [(0, path_1.join)(layout.apiDir, 'CLAUDE.md')] : []),
-                    ...(layout.appDir ? [(0, path_1.join)(layout.appDir, 'CLAUDE.md')] : []),
-                ];
-                const patched = claudeCandidates.map((f) => (0, dev_patches_1.patchClaudeMd)(f, { dbName, identity })).filter((r) => r.patched);
-                if (patched.length > 0) {
-                    info(colors.dim(`updated CLAUDE.md URL block in ${patched.length} file(s)`));
-                }
-            }
             // Always keep `.lt-dev/` (state, env bridge, ticket marker) out of git.
             if ((0, dev_patches_1.addToGitignore)(layout.root, '.lt-dev/')) {
                 info(colors.dim('added `.lt-dev/` to .gitignore'));
@@ -231,11 +221,16 @@ const UpCommand = {
                 // process). Free-checking a reused port would falsely abort a partial
                 // restart of just the crashed half.
                 const portsToCheck = [apiPortReused ? undefined : apiPort, appPortReused ? undefined : appPort].filter((p) => typeof p === 'number');
-                const snap = yield (0, dev_process_1.listenSnapshot)(portsToCheck);
+                const probe = yield (0, dev_process_1.probePorts)(portsToCheck);
                 for (const p of portsToCheck) {
-                    const r = snap.get(p);
-                    if (r)
-                        throw new Error(`Internal port ${p} already in use by ${r.command} (pid ${r.pid}).`);
+                    if (!probe.bound.has(p))
+                        continue;
+                    const owner = probe.owners.get(p);
+                    // The port is occupied either way; naming the occupant is a courtesy the
+                    // platform may not be able to extend.
+                    throw new Error(owner
+                        ? `Internal port ${p} already in use by ${owner.command} (pid ${owner.pid}).`
+                        : `Internal port ${p} already in use by an unidentified process.`);
                 }
                 // Reserve immediately so a concurrent `lt dev up` sees these as taken.
                 const subdomainMap = {};
@@ -257,6 +252,26 @@ const UpCommand = {
                 process.exit(1);
             return 'dev up: port in use';
         }
+        // The CLAUDE.md URL block is written HERE, after the internal ports are
+        // resolved, so it can name both addresses: the `*.localhost` name a browser
+        // opens and the loopback address a script must use. It used to run before
+        // allocation, where only the name existed — which is why an agent following
+        // the block had nothing but a hostname that does not resolve for Node on
+        // Windows. NEVER for a ticket worktree: that CLAUDE.md is git-tracked and
+        // would carry per-ticket URLs into a commit.
+        if (!ticket) {
+            const claudeCandidates = [
+                (0, path_1.join)(layout.root, 'CLAUDE.md'),
+                ...(layout.apiDir ? [(0, path_1.join)(layout.apiDir, 'CLAUDE.md')] : []),
+                ...(layout.appDir ? [(0, path_1.join)(layout.appDir, 'CLAUDE.md')] : []),
+            ];
+            const patched = claudeCandidates
+                .map((f) => (0, dev_patches_1.patchClaudeMd)(f, { apiPort, appPort, dbName, identity }))
+                .filter((r) => r.patched);
+            if (patched.length > 0) {
+                info(colors.dim(`updated CLAUDE.md URL block in ${patched.length} file(s)`));
+            }
+        }
         // ── Health-aware (re)start decision ──────────────────────────────────────
         // Probe the just-resolved ports so we can tell a still-serving component
         // from a crashed one (supervisor PID alive, port free). Only dead/crashed
@@ -269,18 +284,18 @@ const UpCommand = {
         // false-positive the `starting` state exists to prevent).
         const hasApi = Boolean(layout.apiDir && (0, fs_1.existsSync)((0, path_1.join)(layout.apiDir, 'package.json')) && apiPort);
         const hasApp = Boolean(layout.appDir && (0, fs_1.existsSync)((0, path_1.join)(layout.appDir, 'package.json')) && appPort);
-        const healthSnap = yield (0, dev_process_1.listenSnapshot)([apiPort, appPort].filter((p) => typeof p === 'number'));
+        const healthProbe = yield (0, dev_process_1.probePorts)([apiPort, appPort].filter((p) => typeof p === 'number'));
         const apiHealth = hasApi
             ? (0, dev_state_1.classifyComponentHealth)({
                 pid: existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.api,
-                portBound: !!apiPort && healthSnap.has(apiPort),
+                portBound: !!apiPort && healthProbe.bound.has(apiPort),
                 startedAt: existingSession === null || existingSession === void 0 ? void 0 : existingSession.startedAt,
             })
             : undefined;
         const appHealth = hasApp
             ? (0, dev_state_1.classifyComponentHealth)({
                 pid: existingSession === null || existingSession === void 0 ? void 0 : existingSession.pids.app,
-                portBound: !!appPort && healthSnap.has(appPort),
+                portBound: !!appPort && healthProbe.bound.has(appPort),
                 startedAt: existingSession === null || existingSession === void 0 ? void 0 : existingSession.startedAt,
             })
             : undefined;
@@ -374,9 +389,19 @@ const UpCommand = {
         const reclaimPort = (prevPid, port, health) => __awaiter(void 0, void 0, void 0, function* () {
             if (health === 'crashed' && prevPid)
                 yield (0, dev_process_1.terminateProcessGroup)(prevPid);
-            const bound = port ? healthSnap.get(port) : undefined;
-            if (bound === null || bound === void 0 ? void 0 : bound.pid)
-                yield (0, dev_process_1.terminateProcessGroup)(bound.pid);
+            if (!port || !healthProbe.bound.has(port))
+                return;
+            const owner = healthProbe.owners.get(port);
+            if (owner === null || owner === void 0 ? void 0 : owner.pid) {
+                yield (0, dev_process_1.terminateProcessGroup)(owner.pid);
+                return;
+            }
+            // Occupied, but the platform could not name the occupant — so there is
+            // nothing to terminate. Saying so beats respawning onto a taken port and
+            // letting the component fail with an address-in-use nobody connects to this.
+            warning(`port ${port} is in use and the occupant could not be identified` +
+                `${healthProbe.ownersUnavailable ? ' (no lsof/netstat available)' : ''} — ` +
+                'not reclaiming it; the component may fail to bind.');
         });
         if (hasApi && layout.apiDir && apiPort) {
             if (isKeepable(apiHealth)) {
@@ -454,6 +479,19 @@ const UpCommand = {
         //     grace window indefinitely.
         const startedAt = started.length > 0 ? new Date().toISOString() : ((_h = existingSession === null || existingSession === void 0 ? void 0 : existingSession.startedAt) !== null && _h !== void 0 ? _h : new Date().toISOString());
         (0, dev_state_1.saveSession)(layout.root, { pids, startedAt });
+        // A component that dies right after its start used to be reported as
+        // "Started": the spawn succeeded, and nothing looked again. Watch the fresh
+        // pids for a moment and show what the log says (or that it is empty).
+        const earlyExits = yield (0, dev_log_tail_1.findEarlyExits)(started.map((name) => ({ name, pid: pids[name] })), { budgetMs: 3000, isAlive: dev_state_1.isPidAlive });
+        if (earlyExits.length > 0) {
+            for (const name of earlyExits) {
+                error(`${name} exited right after its start (pid ${pids[name]}).`);
+                (0, dev_log_tail_1.describeLog)((0, dev_log_tail_1.diagnoseLog)((0, path_1.join)(layout.root, '.lt-dev', `${name}.log`))).forEach((l) => info(l));
+            }
+            if (!parameters.options.fromGluegunMenu)
+                process.exit(1);
+            return `dev up: ${earlyExits.join('+')} exited on start`;
+        }
         // Write the ENV bridge so external tools (Playwright, IDE test runners,
         // custom shell scripts) can pick up the URLs without inheriting our shell.
         const bridgePath = (0, dev_env_bridge_1.writeEnvBridge)(layout.root, devEnv, dbName);

package/build/extensions/server.js

@@ -664,7 +664,7 @@ class Server {
                     if (!experimental) {
                         // Generate README
                         yield template.generate({
-                            props: { description, name },
+                            props: { description, name, vendor: frameworkMode === 'vendor' },
                             target: `${dest}/README.md`,
                             template: 'nest-server-starter/README.md.ejs',
                         });

package/build/lib/caddy.js

@@ -36,10 +36,11 @@ exports.writeCaddyfile = writeCaddyfile;
  * Lifecycle is owned by `lt dev install` (one-time setup) and
  * `lt dev up`/`lt dev down` (per-project block management).
  */
-const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
+const dev_process_1 = require("./dev-process");
+const platform_1 = require("./platform");
 const CADDYFILE_PATH = process.env.LT_DEV_CADDYFILE || (0, path_1.join)((0, os_1.homedir)(), '.lenneTech', 'Caddyfile');
 const HEADER = '# Managed by `lt dev`. Per-project blocks are bounded by `# >>> lt-dev:<slug> >>>` markers.';
 /** Detect whether `caddy` is on PATH. */
@@ -49,16 +50,22 @@ function caddyAvailable() {
         return result.ok;
     });
 }
-/** Detect whether the Caddy admin endpoint is reachable (i.e. a daemon is running). */
+/**
+ * Detect whether the Caddy admin endpoint is reachable (i.e. a daemon is running).
+ *
+ * This asked `curl -fsS -o /dev/null`, and on Windows that reported a running
+ * Caddy as down: `/dev/null` is an ordinary file path there, so curl completed
+ * the request, received the 226-byte answer, failed to WRITE it, and exited 23.
+ * The exit code was all this function looked at. Measured on the laptop against a
+ * Caddy that was listening on :2019 and answering 200.
+ *
+ * `127.0.0.1` rather than `localhost` for consistency with the reverse-proxy
+ * upstreams (see the note above `renderProjectBlock`) — not because `localhost`
+ * was the fault here; it was measured to resolve correctly on that machine.
+ */
 function caddyDaemonRunning() {
     return __awaiter(this, void 0, void 0, function* () {
-        return new Promise((resolve) => {
-            const child = (0, child_process_1.spawn)('curl', ['-fsS', '-o', '/dev/null', 'http://localhost:2019/config/'], {
-                stdio: ['ignore', 'ignore', 'ignore'],
-            });
-            child.on('error', () => resolve(false));
-            child.on('close', (code) => resolve(code === 0));
-        });
+        return (yield (0, dev_process_1.httpStatus)('http://127.0.0.1:2019/config/', 2000)) !== null;
     });
 }
 /** Read the current Caddyfile (or empty string). */
@@ -162,7 +169,7 @@ function writeCaddyfile(content) {
 function runCaddy(args) {
     return new Promise((resolve) => {
         var _a, _b;
-        const child = (0, child_process_1.spawn)('caddy', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        const child = (0, platform_1.spawnCmd)('caddy', args, { stdio: ['ignore', 'pipe', 'pipe'] });
         let stdout = '';
         let stderr = '';
         let errored = false;

package/build/lib/check-template-sync.js

@@ -84,7 +84,7 @@ function syncCheckTemplate(options) {
         if (spawned.length > 0) {
             throw new Error(`${ref}: the template starts sibling script(s) it does not ship: ${spawned.join(', ')}. ` +
                 'resolveCopySet only follows imports, so these would be missing in every generated project. ' +
-                'Add them to the wrapper\'s import closure, ship them deliberately, or remove the call upstream.');
+                "Add them to the wrapper's import closure, ship them deliberately, or remove the call upstream.");
         }
         const pin = {
             commit,

package/build/lib/dev-env-bridge.js

@@ -97,6 +97,13 @@ function writeEnvBridge(projectRoot, devEnv, dbName, fileName = '.env') {
         // Legacy aliases — see dev-env.ts for the rationale.
         'API_URL',
         'SITE_URL',
+        // The loopback addresses. An external runner that RESOLVES a URL from Node —
+        // an API helper, a seeding script, a readiness check — needs these: on Windows
+        // `*.localhost` does not resolve for Node at all, only for browsers. The
+        // public names above stay, because browser-facing values (a Playwright
+        // `baseURL`, a link a developer opens) must keep them. See `dev-env.ts#internalUrl`.
+        'LT_DEV_API_INTERNAL_URL',
+        'LT_DEV_APP_INTERNAL_URL',
     ];
     for (const key of exported) {
         const v = devEnv.app.env[key];

package/build/lib/dev-env.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildDevEnv = buildDevEnv;
+exports.internalUrl = internalUrl;
 /**
  * Build environment variables for `lt dev up`.
  *
@@ -41,13 +42,16 @@ function buildDevEnv(input) {
     const appSub = identity.subdomains.app;
     const apiUrl = apiSub ? `https://${apiSub.hostname}` : '';
     const appUrl = appSub ? `https://${appSub.hostname}` : '';
+    // Same two services, addressed the way Node can reach them. See `internalUrl`.
+    const apiInternal = internalUrl(apiInternalPort);
+    const appInternal = internalUrl(appInternalPort);
     const caPath = (0, dev_env_bridge_1.detectCaddyRootCa)();
-    const sharedKeys = Object.assign(Object.assign(Object.assign(Object.assign({ 
+    const sharedKeys = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ 
         // Marks the API + App processes as running under `lt dev`. Consumed by the
         // backend to relax dev-only behaviour (rate limiting, Better-Auth
         // user-cache) so E2E suites run without a separate VITEST/PLAYWRIGHT flag.
         // (Also written to the .lt-dev/.env bridge for external test runners.)
-        LT_DEV_ACTIVE: 'true' }, (apiUrl ? { BASE_URL: apiUrl, NSC__BASE_URL: apiUrl } : {})), (appUrl ? { APP_URL: appUrl, NSC__APP_URL: appUrl } : {})), (dbName ? { DATABASE_URL: buildPostgresUrl(dbName), NSC__MONGOOSE__URI: `mongodb://127.0.0.1/${dbName}` } : {})), (caPath ? { NODE_EXTRA_CA_CERTS: caPath } : {}));
+        LT_DEV_ACTIVE: 'true' }, (apiInternal ? { LT_DEV_API_INTERNAL_URL: apiInternal } : {})), (appInternal ? { LT_DEV_APP_INTERNAL_URL: appInternal } : {})), (apiUrl ? { BASE_URL: apiUrl, NSC__BASE_URL: apiUrl } : {})), (appUrl ? { APP_URL: appUrl, NSC__APP_URL: appUrl } : {})), (dbName ? { DATABASE_URL: buildPostgresUrl(dbName), NSC__MONGOOSE__URI: `mongodb://127.0.0.1/${dbName}` } : {})), (caPath ? { NODE_EXTRA_CA_CERTS: caPath } : {}));
     return {
         api: {
             env: Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
@@ -59,10 +63,10 @@ function buildDevEnv(input) {
             internalPort: apiInternalPort,
         },
         app: {
-            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
+            env: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, baseEnv), sharedKeys), { 
                 // See API note above: pin the dev server to IPv4 so Caddy's
                 // `127.0.0.1` upstream is unambiguous.
-                HOST: '127.0.0.1', NITRO_HOST: '127.0.0.1' }), (apiUrl ? { API_URL: apiUrl, NUXT_API_URL: apiUrl, NUXT_PUBLIC_API_URL: apiUrl } : {})), (appUrl ? { NUXT_PUBLIC_SITE_URL: appUrl, SITE_URL: appUrl } : {})), { 
+                HOST: '127.0.0.1', NITRO_HOST: '127.0.0.1' }), (apiUrl ? { API_URL: apiUrl, NUXT_PUBLIC_API_URL: apiUrl } : {})), (apiInternal || apiUrl ? { NUXT_API_URL: apiInternal || apiUrl } : {})), (appUrl ? { NUXT_PUBLIC_SITE_URL: appUrl, SITE_URL: appUrl } : {})), { 
                 // Vite-API-Proxy is OFF by default in lt dev mode — Caddy serves
                 // both subdomains under HTTPS with shared cookie domain, so
                 // same-origin trickery is no longer required.
@@ -75,6 +79,42 @@ function buildDevEnv(input) {
         },
     };
 }
+/**
+ * The loopback address of a component, for anything that RESOLVES a name.
+ *
+ * `lt dev` is URL-first: a project is reached at `https://<slug>.localhost`, and
+ * Caddy proxies that to an opaque internal port. That promise holds for
+ * **browsers**. It does not hold for Node: on Windows `*.localhost` subdomains do
+ * not resolve at all (`dns.lookup('api.demo.localhost')` → ENOTFOUND, and `curl`
+ * agrees), while Chromium resolves them internally without asking a resolver.
+ *
+ * So the question at every call site is not "which URL" but **"who reads it"**:
+ *
+ * | | example | address to use |
+ * |---|---|---|
+ * | a browser resolves it | Playwright `baseURL`, a printed link | the public name |
+ * | Node resolves it | readiness probes, SSR fetches, a proxy target | **this** |
+ * | another binary resolves it | `cloudflared` | **this** |
+ * | nobody resolves it — it is COMPARED | `APP_URL` (CORS / `trustedOrigins`), the Caddy vhost matcher, the tunnel `Host:` header | the public name, untouched |
+ *
+ * That last row is why "rewrite every internal URL to 127.0.0.1" would be wrong:
+ * `APP_URL` is matched as a string against the `Origin` header a browser sends,
+ * and the browser arrives from `https://<slug>.localhost`. Rewriting it would
+ * break every login — on the platform where only a health probe was broken before.
+ *
+ * **Loopback on every platform, not only on Windows.** 127.0.0.1 works everywhere,
+ * so there is no branch to get wrong, and the path Windows depends on is the one
+ * macOS exercises daily. A branch only the other platform runs is an unchecked
+ * branch.
+ *
+ * One consequence to keep in mind: this goes PAST Caddy. For "is the component
+ * alive?" that is an advantage — it measures the component, not the proxy. For
+ * "does the routing work?" it is the wrong question, and that one belongs to
+ * `lt dev doctor` over the public name.
+ */
+function internalUrl(port) {
+    return port ? `http://127.0.0.1:${port}` : '';
+}
 /** Postgres convenience URL — used by Postgres-based projects (e.g. nest-base). */
 function buildPostgresUrl(dbName) {
     return `postgresql://${dbName}:${dbName}@localhost:5432/${dbName}`;

package/build/lib/dev-log-tail.js

@@ -0,0 +1,91 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeLog = describeLog;
+exports.diagnoseLog = diagnoseLog;
+exports.findEarlyExits = findEarlyExits;
+exports.isSilentLog = isSilentLog;
+exports.tailLines = tailLines;
+/**
+ * What a component's log can tell someone whose component just died.
+ *
+ * Two silent failures made this necessary, both seen on a Windows laptop:
+ * `lt dev up` reported success for an API that was dead seconds later, and its
+ * log file existed, was even rotated, but stayed at 0 bytes, so nobody looked in
+ * the extra console window that held the actual error. A diagnosis therefore has
+ * to tell "the log says X" apart from "the log is empty", and say the latter out
+ * loud instead of printing nothing.
+ */
+const fs_1 = require("fs");
+/**
+ * The lines to print under "<name> is not running". Never an empty list: an
+ * empty or missing log is itself the finding.
+ */
+function describeLog(d) {
+    if (d.state === 'missing')
+        return [`No log at ${d.file}.`];
+    if (d.state === 'empty') {
+        return [`${d.file} is EMPTY — the output was not captured, so the reason is not in the log.`];
+    }
+    return [`Last lines of ${d.file}:`, ...d.tail.map((l) => `  ${l}`)];
+}
+/** Read `file` and keep its last `lines` non-empty lines. */
+function diagnoseLog(file, lines = 20) {
+    if (!(0, fs_1.existsSync)(file))
+        return { file, size: -1, state: 'missing', tail: [] };
+    const size = (0, fs_1.statSync)(file).size;
+    if (size === 0)
+        return { file, size, state: 'empty', tail: [] };
+    return { file, size, state: 'ok', tail: tailLines((0, fs_1.readFileSync)(file, 'utf8'), lines) };
+}
+/**
+ * Components whose pid is gone within `budgetMs` of their start.
+ *
+ * Catches what dies at once: a missing script, a package manager that cannot
+ * start, a crash before any watcher takes over. A crash under nodemon keeps the
+ * supervisor alive and is `lt dev status`'s job (`crashed` after the grace window).
+ */
+function findEarlyExits(components, opts) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const sleep = (_a = opts.sleep) !== null && _a !== void 0 ? _a : ((ms) => new Promise((r) => setTimeout(r, ms)));
+        const watched = components.filter((c) => typeof c.pid === 'number');
+        const dead = new Set();
+        const deadline = Date.now() + opts.budgetMs;
+        do {
+            for (const c of watched)
+                if (!dead.has(c.name) && !opts.isAlive(c.pid))
+                    dead.add(c.name);
+            if (dead.size === watched.length)
+                break;
+            yield sleep(250);
+        } while (Date.now() < deadline);
+        return watched.filter((c) => dead.has(c.name)).map((c) => c.name);
+    });
+}
+/**
+ * True when a component has been up for `minAgeMs` and its log is still empty.
+ * A booting app writes within seconds (nuxt/nest print a banner), so an empty
+ * log after that means output is going somewhere else, not that nothing happened.
+ */
+function isSilentLog(d, startedAt, now, minAgeMs = 15000) {
+    if (d.state !== 'empty' || !startedAt)
+        return false;
+    const age = now - new Date(startedAt).getTime();
+    return Number.isFinite(age) && age >= minAgeMs;
+}
+/** Last `n` non-empty lines of `content`, oldest first. */
+function tailLines(content, n) {
+    return content
+        .split(/\r?\n/)
+        .filter((l) => l.trim().length > 0)
+        .slice(-n);
+}