@lenne.tech/cli 1.49.0 → 1.50.1

package/build/lib/dev-prune.js

@@ -43,6 +43,7 @@ const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const dev_project_1 = require("./dev-project");
+const dev_state_1 = require("./dev-state");
 const dev_ticket_1 = require("./dev-ticket");
 /** Branch prefix `lt ticket start` creates worktrees on. */
 const TICKET_BRANCH_PREFIX = 'feat/';
@@ -188,9 +189,15 @@ function planOrphanTicketDbSweep(args) {
  * never auto-dropped).
  */
 function planRegistryPrune(registry) {
-    return Object.entries(registry.projects)
-        .filter(([, entry]) => entry.path && !(0, fs_1.existsSync)(entry.path))
-        .map(([key]) => key);
+    return (Object.entries(registry.projects)
+        // A relative stored path is not evidence of anything: `existsSync` resolves
+        // it against the current process's cwd, so a perfectly live project reads as
+        // gone from any other directory — and pruning it reclaims its slug and its
+        // reserved internal ports for the next project that asks. "Cannot verify" is
+        // not "absent"; these are left alone until a registry write from inside the
+        // project replaces the path with an absolute one.
+        .filter(([, entry]) => (0, dev_state_1.isVerifiablePath)(entry.path) && !(0, fs_1.existsSync)(entry.path))
+        .map(([key]) => key));
 }
 /**
  * Orphaned smoke-test databases. The `/lt-dev:fullstack:smoke-test` command
@@ -218,12 +225,15 @@ function planSmokeTestDbSweep(args) {
     const entries = Object.entries(registry.projects);
     const smokeRunLive = entries.some(([key, entry]) => (key === exports.SMOKE_TEST_DB_PREFIX || key.startsWith(`${exports.SMOKE_TEST_DB_PREFIX}-`)) &&
         entry.path &&
-        (0, fs_1.existsSync)(entry.path));
+        (!(0, dev_state_1.isVerifiablePath)(entry.path) || (0, fs_1.existsSync)(entry.path)));
     if (smokeRunLive)
         return [];
     const protectedNames = new Set();
     for (const [, entry] of entries) {
-        if (entry.dbName && entry.path && (0, fs_1.existsSync)(entry.path)) {
+        // `!isVerifiablePath` → we cannot prove the checkout is gone, so the database
+        // keeps its protection. Erring the other way would expose a live project's DB
+        // to the orphan sweep on the strength of a path we know we cannot read.
+        if (entry.dbName && entry.path && (!(0, dev_state_1.isVerifiablePath)(entry.path) || (0, fs_1.existsSync)(entry.path))) {
             protectedNames.add(entry.dbName);
             protectedNames.add((0, dev_project_1.deriveTestDbName)(entry.dbName));
         }

package/build/lib/dev-service.js

@@ -51,6 +51,8 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const caddy_1 = require("./caddy");
+const dev_process_1 = require("./dev-process");
+const platform_1 = require("./platform");
 /**
  * Resolve the user's home directory in a test-overridable way.
  *
@@ -139,12 +141,12 @@ function installService() {
                 ok: false,
             };
         }
-        const caddyBin = opts.caddyBin || (yield resolveCaddyBin());
+        const caddyBin = opts.caddyBin || (yield resolveCaddyBin(opts.lookup));
         if (!caddyBin) {
             return {
                 bootstrapped: false,
                 created: false,
-                message: 'caddy not found on PATH. Install with `brew install caddy` (macOS) or your package manager (Linux).',
+                message: caddyMissingMessage(),
                 ok: false,
             };
         }
@@ -249,14 +251,19 @@ StandardError=append:${cfg.errFile}
 WantedBy=default.target
 `;
 }
-/** Resolve the absolute path of `caddy` via `which` so launchd has a guaranteed path. */
+/**
+ * Absolute path of `caddy`, so launchd/systemd get a guaranteed path rather than
+ * a PATH lookup in an environment they do not share with the user's shell.
+ *
+ * Resolved in-process instead of by spawning `which`: there is no `which` on
+ * Windows, and `where.exe` prints every match rather than the first. The async
+ * signature is kept because callers await it and a future platform may need to
+ * ask something that does spawn.
+ */
 function resolveCaddyBin() {
-    return __awaiter(this, void 0, void 0, function* () {
-        const r = yield activeRunner('which', ['caddy']);
-        if (!r.ok)
-            return undefined;
-        const line = r.stdout.split('\n').find((s) => s.trim().length > 0);
-        return line ? line.trim() : undefined;
+    return __awaiter(this, arguments, void 0, function* (options = {}) {
+        var _a;
+        return (_a = (0, platform_1.findExecutable)('caddy', options)) !== null && _a !== void 0 ? _a : undefined;
     });
 }
 /** Inject a custom runner (tests). Pass `null` to reset to the real spawner. */
@@ -315,6 +322,16 @@ function waitForServiceReady() {
         return false;
     });
 }
+/** Install hint for the current platform — `brew` is not advice on Linux or Windows. */
+function caddyMissingMessage() {
+    if (process.platform === 'darwin') {
+        return 'caddy not found on PATH. Install with `brew install caddy`.';
+    }
+    if (process.platform === 'win32') {
+        return 'caddy not found on PATH. Install with `winget install CaddyServer.Caddy` or `scoop install caddy`.';
+    }
+    return 'caddy not found on PATH. Install it with your package manager.';
+}
 function defaultShellRunner(cmd, args) {
     return new Promise((resolve) => {
         var _a, _b;
@@ -396,13 +413,10 @@ function installLinux(paths, changed, existed) {
         };
     });
 }
+/** See `caddy.ts#caddyDaemonRunning` for why this is not a `curl` any more. */
 function pingCaddyAdmin() {
-    return new Promise((resolve) => {
-        const child = (0, child_process_1.spawn)('curl', ['-fsS', '-o', '/dev/null', '--max-time', '1', 'http://127.0.0.1:2019/config/'], {
-            stdio: ['ignore', 'ignore', 'ignore'],
-        });
-        child.on('error', () => resolve(false));
-        child.on('close', (code) => resolve(code === 0));
+    return __awaiter(this, void 0, void 0, function* () {
+        return (yield (0, dev_process_1.httpStatus)('http://127.0.0.1:2019/config/', 1000)) !== null;
     });
 }
 function sleep(ms) {

package/build/lib/dev-state.js

@@ -18,6 +18,7 @@ exports.clearSession = clearSession;
 exports.detectSlugConflict = detectSlugConflict;
 exports.isPidAlive = isPidAlive;
 exports.isValidPid = isValidPid;
+exports.isVerifiablePath = isVerifiablePath;
 exports.loadRegistry = loadRegistry;
 exports.loadSession = loadSession;
 exports.sameRealPath = sameRealPath;
@@ -142,13 +143,33 @@ function clearSession(root, sessionFile = SESSION_FILE) {
  */
 function detectSlugConflict(slug, root) {
     const entry = loadRegistry().projects[slug];
-    if (!(entry === null || entry === void 0 ? void 0 : entry.path) || sameRealPath(entry.path, root))
+    // A relative stored path cannot be compared to anything: its base is lost, so
+    // it names a different directory from every cwd. Entries like that were written
+    // by `lt fullstack init` before the path was absolutised, and comparing one
+    // produced "slug 't-5' is also registered to another checkout: t-5". Claiming a
+    // conflict we cannot establish is worse than staying quiet — the next registry
+    // write from inside the project repairs the entry anyway.
+    if (!(entry === null || entry === void 0 ? void 0 : entry.path) || !isVerifiablePath(entry.path) || sameRealPath(entry.path, root))
         return null;
     const session = loadSession(entry.path);
     const otherSessionAlive = !!session && [session.pids.api, session.pids.app].some((p) => typeof p === 'number' && isPidAlive(p));
     return { otherPath: entry.path, otherSessionAlive };
 }
-/** Check whether a process with the given PID is currently alive. */
+/**
+ * Check whether a process with the given PID is currently alive.
+ *
+ * Signal 0 delivers nothing; it only asks the kernel whether the target exists
+ * and may be signalled. The two failures mean opposite things, and collapsing
+ * them was a bug:
+ *
+ * - `ESRCH` — no such process. Dead.
+ * - `EPERM` — **the process EXISTS**, this user may not signal it.
+ *
+ * Reading `EPERM` as dead made `classifyComponentHealth` report a running
+ * component as `dead`, so `lt dev up` killed and restarted a healthy stack.
+ * Reproducible on any POSIX machine: `process.kill(1, 0)` throws `EPERM`.
+ * More likely on Windows, where an elevated shell is ordinary.
+ */
 function isPidAlive(pid) {
     if (!isValidPid(pid))
         return false;
@@ -156,14 +177,29 @@ function isPidAlive(pid) {
         process.kill(pid, 0);
         return true;
     }
-    catch (_a) {
-        return false;
+    catch (err) {
+        return (err === null || err === void 0 ? void 0 : err.code) === 'EPERM';
     }
 }
 /** Validate a PID — positive integer, within plausible range. */
 function isValidPid(pid) {
     return typeof pid === 'number' && Number.isInteger(pid) && pid > 0 && pid < 4194304;
 }
+/**
+ * True when a stored registry path can be checked against the file system.
+ *
+ * A relative path in the registry has lost the directory it was relative TO, so
+ * `existsSync` / `realpathSync` answer about whatever directory the current
+ * process started in. Every such answer is meaningless, and two of them were
+ * actively harmful: `planRegistryPrune` reclaimed a live project's slug and
+ * reserved ports, and `detectSlugConflict` reported a project as colliding with
+ * itself. Legacy entries are therefore treated as "cannot determine" rather than
+ * as "gone"; running any `lt dev` command inside the project rewrites the entry
+ * with an absolute path and clears the condition.
+ */
+function isVerifiablePath(storedPath) {
+    return !!storedPath && (0, path_1.isAbsolute)(storedPath);
+}
 /** Load the central registry; returns an empty one if missing or unreadable. */
 function loadRegistry() {
     if (!(0, fs_1.existsSync)(REGISTRY_PATH))

package/build/lib/dev-test-session.js

@@ -1,31 +1,4 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TEST_NITRO_OUTPUT_DIR = exports.TEST_NUXT_BUILD_DIR = exports.TEST_INITIAL_ADMIN_ENV = void 0;
-exports.ensurePlaywrightBrowsers = ensurePlaywrightBrowsers;
-exports.autoShardCount = autoShardCount;
-exports.bringUpTestSession = bringUpTestSession;
-exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
-exports.buildTestAppEnv = buildTestAppEnv;
-exports.hasTestSession = hasTestSession;
-exports.isStackServing = isStackServing;
-exports.migrationFailedError = migrationFailedError;
-exports.resolveTestSession = resolveTestSession;
-exports.runShardedTestSession = runShardedTestSession;
-exports.shardReportDir = shardReportDir;
-exports.startTestApi = startTestApi;
-exports.tearDownAllTestSessions = tearDownAllTestSessions;
-exports.tearDownTestSession = tearDownTestSession;
-exports.testAppEntryCandidates = testAppEntryCandidates;
-exports.unreachableStackError = unreachableStackError;
 /**
  * Ephemeral, isolated test session for `lt dev test`.
  *
@@ -56,7 +29,33 @@ exports.unreachableStackError = unreachableStackError;
  * Teardown is idempotent and residue-free (processes, Caddy block, env bridge,
  * session file, registry entry), so a stale session is always safely reclaimed.
  */
-const child_process_1 = require("child_process");
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_NITRO_OUTPUT_DIR = exports.TEST_NUXT_BUILD_DIR = exports.TEST_INITIAL_ADMIN_ENV = void 0;
+exports.ensurePlaywrightBrowsers = ensurePlaywrightBrowsers;
+exports.autoShardCount = autoShardCount;
+exports.bringUpTestSession = bringUpTestSession;
+exports.buildShardPlaywrightInvocation = buildShardPlaywrightInvocation;
+exports.buildTestAppEnv = buildTestAppEnv;
+exports.hasTestSession = hasTestSession;
+exports.isStackServing = isStackServing;
+exports.migrationFailedError = migrationFailedError;
+exports.resolveTestSession = resolveTestSession;
+exports.runShardedTestSession = runShardedTestSession;
+exports.shardReportDir = shardReportDir;
+exports.startTestApi = startTestApi;
+exports.tearDownAllTestSessions = tearDownAllTestSessions;
+exports.tearDownTestSession = tearDownTestSession;
+exports.testAppEntryCandidates = testAppEntryCandidates;
+exports.unreachableStackError = unreachableStackError;
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -69,6 +68,7 @@ const dev_package_manager_1 = require("./dev-package-manager");
 const dev_patches_1 = require("./dev-patches");
 const dev_process_1 = require("./dev-process");
 const dev_project_1 = require("./dev-project");
+const platform_1 = require("./platform");
 const dev_state_1 = require("./dev-state");
 /**
  * Make sure the Playwright browser build the app's OWN playwright version needs
@@ -83,12 +83,22 @@ const dev_state_1 = require("./dev-state");
  * fails (offline), the suite still runs and Playwright's own error explains it.
  */
 function ensurePlaywrightBrowsers(appDir, pm, logInfo) {
+    const note = () => {
+        logInfo === null || logInfo === void 0 ? void 0 : logInfo('playwright install chromium failed — continuing (the suite reports missing browsers itself).');
+    };
     try {
         const args = pm.exec('playwright', ['install', 'chromium']);
-        (0, child_process_1.execFileSync)(pm.bin, args, { cwd: appDir, stdio: 'ignore', timeout: 300000 });
+        // `spawnCmdSync` (spawnSync) does NOT throw on a non-zero exit, unlike the
+        // `execFileSync` this replaced — so the status is checked explicitly.
+        // Without it the failure would be silent and the suite would die later on a
+        // missing browser, which reads as a broken spec rather than a missing install.
+        const result = (0, platform_1.spawnCmdSync)(pm.bin, args, { cwd: appDir, stdio: 'ignore', timeout: 300000 });
+        if (result.error || result.status !== 0) {
+            note();
+        }
     }
     catch (_a) {
-        logInfo === null || logInfo === void 0 ? void 0 : logInfo('playwright install chromium failed — continuing (the suite reports missing browsers itself).');
+        note();
     }
 }
 const TEST_API_LOG = 'api.test.log';
@@ -240,11 +250,14 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
                 taken.add(apiPort);
             appPort = layout.appDir ? (0, dev_state_1.allocateInternalPort)(TEST_PORT_BASE, taken) : undefined;
             const portsToCheck = [apiPort, appPort].filter((p) => typeof p === 'number');
-            const snap = yield (0, dev_process_1.listenSnapshot)(portsToCheck);
+            const probe = yield (0, dev_process_1.probePorts)(portsToCheck);
             for (const p of portsToCheck) {
-                const r = snap.get(p);
-                if (r)
-                    throw new Error(`test internal port ${p} already in use by ${r.command} (pid ${r.pid}).`);
+                if (!probe.bound.has(p))
+                    continue;
+                const owner = probe.owners.get(p);
+                throw new Error(owner
+                    ? `test internal port ${p} already in use by ${owner.command} (pid ${owner.pid}).`
+                    : `test internal port ${p} already in use by an unidentified process.`);
             }
             // Reserve immediately (still under the lock) so a concurrent run sees these
             // ports as taken. PIDs are written to the session file after spawn, below.
@@ -405,10 +418,19 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // left to wait for. Being wrong here costs nothing — the timeout still bounds
         // the wait, so this only ever makes the abort arrive sooner.
         const gone = (pid) => pid === undefined || !(0, dev_state_1.isPidAlive)(pid);
+        // The probes go to the LOOPBACK address, not the public name: this is Node
+        // asking, and on Windows `*.localhost` does not resolve for Node at all — the
+        // waits would time out against a stack that is up, and `bringUpTestSession`
+        // aborts before Playwright ever starts. Probing the port directly also measures
+        // the component rather than the proxy, which is the better question here.
+        // The public name stays in the MESSAGES, because that is what the developer
+        // opens; the loopback pair is printed next to it above.
+        const appProbeUrl = (0, dev_env_1.internalUrl)(appPort) || appUrl;
+        const apiProbeUrl = (0, dev_env_1.internalUrl)(apiPort) || apiUrl;
         // Wait for the test App to answer.
         if (appUrl) {
             log.info(log.dim(`Waiting for ${appUrl} …`));
-            const appReady = yield (0, dev_process_1.waitForHttp)(appUrl, 90000, isStackServing, () => gone(pids.app));
+            const appReady = yield (0, dev_process_1.waitForHttp)(appProbeUrl, 90000, isStackServing, () => gone(pids.app));
             if (!appReady)
                 throw unreachableStackError('App', appUrl, appLogPath);
         }
@@ -418,7 +440,7 @@ function bringUpTestSession(layout_1, baseIdentity_1, log_1) {
         // `ensureApiReachableOrSkip` guard (the API-readiness race).
         if (apiUrl) {
             log.info(log.dim(`Waiting for ${apiUrl}/meta …`));
-            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiUrl}/meta`, 120000, isStackServing, () => gone(pids.api));
+            const apiReady = yield (0, dev_process_1.waitForHttp)(`${apiProbeUrl}/meta`, 120000, isStackServing, () => gone(pids.api));
             if (!apiReady)
                 throw unreachableStackError('API', `${apiUrl}/meta`, apiLogPath);
         }

package/build/lib/dev-ticket.js

@@ -57,6 +57,7 @@ const dev_package_manager_1 = require("./dev-package-manager");
 const dev_patches_1 = require("./dev-patches");
 const dev_project_1 = require("./dev-project");
 const dev_state_1 = require("./dev-state");
+const platform_1 = require("./platform");
 /** Marker file (under `.lt-dev/`) that tags a worktree with its ticket id. */
 const TICKET_MARKER = 'ticket';
 /** Where ticket databases live. Deliberately loopback-only — never a remote/prod host. */
@@ -281,8 +282,19 @@ function gitRefExists(repoDir, ref) {
  * for fresh scaffolds without a lockfile yet.
  */
 function installWorktreeDeps(dir) {
+    var _a;
     const pm = (0, dev_package_manager_1.pickPackageManager)(dir);
-    (0, child_process_1.execFileSync)(pm.bin, pm.installArgs, { cwd: dir, stdio: 'inherit' });
+    // `spawnCmdSync` (spawnSync) does NOT throw on a non-zero exit, unlike the
+    // `execFileSync` this replaced. The contract here is to throw: the only caller
+    // (`lt ticket start`) catches and warns, and swallowing the failure would hand
+    // the developer a half-installed worktree with no hint that anything went wrong.
+    const result = (0, platform_1.spawnCmdSync)(pm.bin, pm.installArgs, { cwd: dir, stdio: 'inherit' });
+    if (result.error) {
+        throw result.error;
+    }
+    if (result.status !== 0) {
+        throw new Error(`${pm.bin} ${pm.installArgs.join(' ')} exited with ${(_a = result.status) !== null && _a !== void 0 ? _a : 'a signal'}`);
+    }
 }
 /**
  * True for ticket ids whose derived database would collide with a project-level

package/build/lib/hoist-workspace-pnpm-config.js

@@ -32,11 +32,16 @@ const fs_utils_1 = require("./fs-utils");
  * starter's assessed-advisory allowlist is destroyed rather than merely ignored,
  * and the generated project's very first pipeline goes red on an advisory that
  * was already justified upstream.
+ *
+ * `peerDependencyRules` (`{ allowedVersions: {...}, ignoreMissing: [...] }`) is
+ * the same trap one step later: the starter scope-allows known-stale peer ranges
+ * there, and without the hoist the root `check:peers` step fails the first
+ * `pnpm run check` of every generated project.
  */
 const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
 const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
-/** Objects whose values are arrays to be unioned, not replaced. */
-const NESTED_ARRAY_FIELDS = ['auditConfig'];
+/** Objects whose inner arrays are unioned and inner maps merged, not replaced. */
+const NESTED_ARRAY_FIELDS = ['auditConfig', 'peerDependencyRules'];
 /** The union of all three, in declaration order. Declared here, with its inputs,
  * because the comment-carrying helpers below default their `fields` parameter to it. */
 const WORKSPACE_SCOPED_PNPM_FIELDS = [...OBJECT_FIELDS, ...ARRAY_FIELDS, ...NESTED_ARRAY_FIELDS];
@@ -611,11 +616,13 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
         const subArr = Array.isArray(subValue) ? subValue : [];
         return Array.from(new Set([...rootArr, ...subArr])).sort((a, b) => a.localeCompare(b));
     }
-    // Nested (`auditConfig.ignoreGhsas` / `.ignoreCves`): union each inner array
-    // instead of letting the sub-project's object replace the root's. A plain
-    // key-by-key merge would drop every advisory the root had already justified.
+    // Nested (`auditConfig.ignoreGhsas`, `peerDependencyRules.allowedVersions`, …):
+    // union each inner array and merge each inner map instead of letting the
+    // sub-project's object replace the root's. A plain key-by-key merge would drop
+    // every advisory or peer rule the root had already justified.
     if (isNestedArrayField(field)) {
-        const asObj = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : {};
+        const isMap = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+        const asObj = (v) => (isMap(v) ? v : {});
         const rootObj = asObj(rootValue);
         const subObj = asObj(subValue);
         const merged = Object.assign({}, rootObj);
@@ -625,6 +632,10 @@ function mergePnpmFieldValue(field, rootValue, subValue) {
                 const b = Array.isArray(value) ? value : [];
                 merged[key] = Array.from(new Set([...a, ...b])).sort((x, y) => x.localeCompare(y));
             }
+            else if (isMap(value) && isMap(merged[key])) {
+                const inner = Object.assign(Object.assign({}, merged[key]), value);
+                merged[key] = Object.fromEntries(Object.entries(inner).sort(([x], [y]) => x.localeCompare(y)));
+            }
             else {
                 merged[key] = value;
             }

package/build/lib/platform.js

@@ -1,10 +1,44 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findExecutable = findExecutable;
 exports.isWindows = isWindows;
+exports.spawnCmd = spawnCmd;
 exports.spawnCmdSync = spawnCmdSync;
 exports.windowsAppData = windowsAppData;
-const cross_spawn_1 = require("cross-spawn");
+const cross_spawn_1 = __importStar(require("cross-spawn"));
 const fs_1 = require("fs");
 const path_1 = require("path");
 const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
@@ -48,6 +82,24 @@ function findExecutable(name, options = {}) {
 function isWindows(platform = process.platform) {
     return platform === 'win32';
 }
+/**
+ * `spawn` that also runs `.cmd`/`.bat` shims on Windows.
+ *
+ * The asynchronous counterpart of `spawnCmdSync`, with the same delegation and
+ * the same argument limit — see there. Needed because every long-running child
+ * the CLI starts (`pnpm run dev`, `pnpm start`, a Playwright run) is spawned
+ * asynchronously, and `pnpm` is `pnpm.cmd` on Windows: Node refuses to exec a
+ * `.cmd` directly (CVE-2024-27980, `EINVAL`), so without this nothing starts
+ * there at all.
+ *
+ * `detached` and `stdio` pass through unchanged, so a caller keeps its process
+ * group and its log-file descriptors. On Windows cross-spawn interposes
+ * `cmd.exe /c`, which means the reported pid is that of `cmd.exe` — the child
+ * tree, not a process group, is what a killer has to walk there.
+ */
+function spawnCmd(command, args = [], options = {}) {
+    return (0, cross_spawn_1.default)(command, [...args], options);
+}
 /**
  * `spawnSync` that also runs `.cmd`/`.bat` shims on Windows.
  *

package/build/templates/check/check.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// @lt-check-wrapper 3.13.1
+// @lt-check-wrapper 3.14.1
 /**
  * Quiet, report-driven wrapper around the project `check` pipeline.
  *
@@ -33,7 +33,7 @@
  * scripts/check-wrapper-version.test.mjs fails when it drifts from
  * package.json. In a generated project it keeps the release it came from.
  */
-import { execFileSync, execSync, spawn } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { readFileSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -430,7 +430,21 @@ const IDLE_TIMEOUT_MS = (() => {
 const RUNNING = new Set();
 
 /**
- * How to kill a process tree on this platform.
+ * Whether a number may become a kill target at all.
+ *
+ * A spawn that failed leaves `child.pid` undefined. On POSIX that only made `pgrep` and
+ * `process.kill` throw, but on Windows it became `taskkill /PID undefined /T /F` — a kill
+ * command built from a word that is not a pid. And the small numbers are not processes you
+ * own: POSIX pid 1 is init/launchd, and 0 and -1 are the group and the kill(2) broadcast to
+ * every process of the user (the shape that rebooted a Mac on 2026-09-23). Windows reserves
+ * 0 (System Idle) and 4 (System). Nothing a check step spawns can have any of these pids.
+ */
+export function isKillablePid(pid, platform = process.platform) {
+  return Number.isInteger(pid) && pid > (platform === 'win32' ? 4 : 1);
+}
+
+/**
+ * How to kill a process tree on this platform, or null when `pid` must not be touched.
  *
  * Windows has neither `pgrep` nor signals: `process.kill(pid, 'SIGTERM')` there ends the one
  * process and orphans its children, and `taskkill /T` alone was measured to leave the tree
@@ -445,46 +459,85 @@ const RUNNING = new Set();
  * Split out as a pure function so both branches can be tested from either platform.
  */
 export function killTreePlan(pid, signal, platform = process.platform) {
+  if (!isKillablePid(pid, platform)) return null;
   return platform === 'win32' ? { args: ['/PID', String(pid), '/T', '/F'], command: 'taskkill' } : { signal };
 }
 
-// Best-effort kill of a child's whole process tree (sh → pnpm → vitest →
-// fork workers). Killing only the direct child orphans the tree — exactly the
-// zombie workers a deadlock leaves behind. Children are collected via pgrep
-// and killed leaves-first.
-function killTree(child, signal = 'SIGTERM') {
-  const plan = killTreePlan(child.pid, signal);
+/**
+ * Kill `pid` and its whole process tree, with every effect injected.
+ *
+ * Injecting the platform alone is not enough: the effects would still run for real, against
+ * this machine, with whatever pid the test chose. So all four are required and nothing
+ * defaults — a test cannot reach a real `taskkill`, `pgrep` or `process.kill` by leaving one
+ * out. `killTree` below is the only caller that passes the real ones.
+ *
+ * - `run(command, args)` executes the Windows plan.
+ * - `childrenOf(pid)` returns the direct children of `pid` (POSIX).
+ * - `signal(pid, sig)` delivers `sig` to `pid` (POSIX).
+ *
+ * POSIX order is leaves first, so a parent cannot respawn a child that was just killed, and
+ * each pid is signalled at most once. Pids a lookup returns pass the same check as the root —
+ * a stray 1 in `pgrep` output must not become a signal to init.
+ */
+export function killTreeWith(pid, sig, { childrenOf, platform, run, signal }) {
+  for (const [name, fn] of Object.entries({ childrenOf, run, signal })) {
+    if (typeof fn !== 'function') throw new TypeError(`killTreeWith: \`${name}\` must be injected`);
+  }
+  if (typeof platform !== 'string') throw new TypeError('killTreeWith: `platform` must be injected');
+  const plan = killTreePlan(pid, sig, platform);
+  if (!plan) return;
   if (plan.command) {
     try {
-      execFileSync(plan.command, plan.args, { stdio: 'ignore' });
+      run(plan.command, plan.args);
     } catch {
       /* already gone, or taskkill refused — nothing further to try */
     }
     return;
   }
-  const pids = [];
-  const collect = (pid) => {
-    pids.push(pid);
-    let out = '';
+  const seen = new Set();
+  const order = [];
+  const collect = (p) => {
+    if (seen.has(p) || !isKillablePid(p, platform)) return;
+    seen.add(p);
+    let children = [];
     try {
-      out = execSync(`pgrep -P ${pid}`, { stdio: ['ignore', 'pipe', 'ignore'] })
-        .toString()
-        .trim();
+      children = childrenOf(p);
     } catch {
       /* no children */
     }
-    if (out) for (const p of out.split('\n')) collect(Number(p));
+    for (const c of children) collect(c);
+    order.push(p);
   };
-  collect(child.pid);
-  for (const pid of pids.reverse()) {
+  collect(pid);
+  for (const p of order) {
     try {
-      process.kill(pid, signal);
+      signal(p, plan.signal);
     } catch {
       /* already gone */
     }
   }
 }
 
+/** Direct children of `pid` via `pgrep -P`; empty when there are none (pgrep exits 1). */
+function pgrepChildren(pid) {
+  const out = execFileSync('pgrep', ['-P', String(pid)], { stdio: ['ignore', 'pipe', 'ignore'] })
+    .toString()
+    .trim();
+  return out ? out.split('\n').map(Number) : [];
+}
+
+// Best-effort kill of a child's whole process tree (sh → pnpm → vitest →
+// fork workers). Killing only the direct child orphans the tree — exactly the
+// zombie workers a deadlock leaves behind.
+function killTree(child, signal = 'SIGTERM') {
+  killTreeWith(child.pid, signal, {
+    childrenOf: pgrepChildren,
+    platform: process.platform,
+    run: (command, args) => execFileSync(command, args, { stdio: 'ignore' }),
+    signal: (pid, sig) => process.kill(pid, sig),
+  });
+}
+
 // idleTimeoutMs > 0 arms the no-output watchdog for this child; 0 (the default)
 // runs it unwatched. Only callers that KNOW the child streams progress (test
 // steps) should pass a timeout — see runGroup.