@lenne.tech/cli 1.50.1 → 1.50.2

package/build/commands/npm/reinit.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
+const reinit_command_1 = require("../../lib/reinit-command");
 /**
  * Reinitialize npm packages
  */
@@ -83,8 +84,11 @@ const NewCommand = {
             if (system.which('rimraf')) {
                 yield system.run(pm.globalInstall('rimraf'));
             }
-            const lockfile = pm.getLockfileName(detectedPm);
-            yield system.run(`cd ${(0, path_1.dirname)(path)} && rimraf ${lockfile} && rimraf node_modules && ${pm.cacheClean(detectedPm)} && ${pm.install(detectedPm)}`);
+            yield system.run((0, reinit_command_1.buildReinitCommand)({
+                dir: (0, path_1.dirname)(path),
+                install: pm.install(detectedPm),
+                lockfile: pm.getLockfileName(detectedPm),
+            }));
             reinitSpin.succeed();
             if (data.scripts && data.scripts['test:e2e']) {
                 const testE2eSpin = spin('Run tests');

package/build/config/vendor-runtime-deps.json

@@ -1,4 +1,4 @@
 {
-  "$comment": "Upstream @lenne.tech/nest-server DEVDEPENDENCIES that must land in a vendored project's `dependencies`. Vendoring copies upstream `dependencies` verbatim and does not read `peerDependencies` at all, so a package the framework imports at runtime while keeping it in devDependencies would never reach the production runtime. Entries here are matched against upstream `devDependencies` only — see `isVendorRuntimeDep`, consulted in the `upstreamDevDeps` loop in `extensions/server.ts` — and promoted into `dependencies`, preferring the upstream peer RANGE over the exact devDep pin where one exists, so a generated project still receives patch-level security fixes. A package that appears ONLY in upstream `peerDependencies` cannot be promoted by this list: listing it here is a silent no-op. Two live cases: `find-file-up` (imported by the config loader, devDependency only), and the better-auth trio (declared as peerDependencies AND mirrored into devDependencies upstream; the mirror is what makes the promotion fire, so this list is the fallback if the starter ever stops declaring them itself).",
-  "runtimeHelpers": ["@better-auth/core", "@better-auth/passkey", "better-auth", "find-file-up"]
+  "$comment": "Upstream @lenne.tech/nest-server DEVDEPENDENCIES that must land in a vendored project's `dependencies`. Vendoring copies upstream `dependencies` verbatim and does not read `peerDependencies` at all, so a package the framework imports at runtime while keeping it in devDependencies would never reach the production runtime. Entries here are matched against upstream `devDependencies` only — see `isVendorRuntimeDep`, consulted in the `upstreamDevDeps` loop in `extensions/server.ts` — and promoted into `dependencies`, preferring the upstream peer RANGE over the exact devDep pin where one exists, so a generated project still receives patch-level security fixes. A package that appears ONLY in upstream `peerDependencies` cannot be promoted by this list: listing it here is a silent no-op. One live case: the better-auth trio (declared as peerDependencies AND mirrored into devDependencies upstream; the mirror is what makes the promotion fire, so this list is the fallback if the starter ever stops declaring them itself). `find-file-up` was listed here until 2026-10-03 and never needed: no nest-server release from 8.x to 11.x imports it from src/ (only the dev script extras/sync-version.ts did), and 11.41.8 dropped the package altogether.",
+  "runtimeHelpers": ["@better-auth/core", "@better-auth/passkey", "better-auth"]
 }

package/build/extensions/package-manager.js

@@ -43,21 +43,6 @@ class PackageManager {
         const manager = pm || this.detect();
         return manager;
     }
-    /**
-     * Get the cache clean command
-     * @param pm - Override detected package manager
-     */
-    cacheClean(pm) {
-        const manager = pm || this.detect();
-        switch (manager) {
-            case 'pnpm':
-                return 'pnpm store prune';
-            case 'yarn':
-                return 'yarn cache clean';
-            default:
-                return 'npm cache clean --force';
-        }
-    }
     /**
      * Detect the package manager for the given directory
      * Uses caching per directory for performance

package/build/extensions/server.js

@@ -1919,8 +1919,8 @@ class Server {
      * dep in disguise that needs to live in `dependencies` after vendoring?
      *
      * `@lenne.tech/nest-server` keeps a few packages in devDependencies that
-     * the framework code imports at runtime (e.g. `find-file-up` in its
-     * config loader). When we vendor the framework source into a consumer
+     * the framework code imports at runtime (e.g. the better-auth trio, which
+     * it mirrors from peerDependencies). When we vendor the framework source into a consumer
      * project, those must end up in `dependencies` so the compiled/dist
      * runtime has them available.
      *

package/build/lib/dev-log-tail.js

@@ -37,14 +37,23 @@ function describeLog(d) {
     }
     return [`Last lines of ${d.file}:`, ...d.tail.map((l) => `  ${l}`)];
 }
-/** Read `file` and keep its last `lines` non-empty lines. */
-function diagnoseLog(file, lines = 20) {
+/**
+ * How much of a log's end is read. A dev log reached 1 GB (Vue warnings carry
+ * serialized vnode traces of several MB each), and reading all of it to show 20
+ * lines threw "Cannot create a string longer than 0x1fffffe8 characters".
+ */
+const TAIL_BYTES = 64 * 1024;
+/** Longest line shown: one of those traces would otherwise flood the terminal. */
+const MAX_LINE_LENGTH = 500;
+/** Read the end of `file` and keep its last `lines` non-empty lines. */
+function diagnoseLog(file, lines = 20, maxBytes = TAIL_BYTES) {
     if (!(0, fs_1.existsSync)(file))
         return { file, size: -1, state: 'missing', tail: [] };
     const size = (0, fs_1.statSync)(file).size;
     if (size === 0)
         return { file, size, state: 'empty', tail: [] };
-    return { file, size, state: 'ok', tail: tailLines((0, fs_1.readFileSync)(file, 'utf8'), lines) };
+    const tail = tailLines(readEnd(file, size, maxBytes), lines).map((l) => l.length > MAX_LINE_LENGTH ? `${l.slice(0, MAX_LINE_LENGTH)}…` : l);
+    return { file, size, state: 'ok', tail };
 }
 /**
  * Components whose pid is gone within `budgetMs` of their start.
@@ -89,3 +98,24 @@ function tailLines(content, n) {
         .filter((l) => l.trim().length > 0)
         .slice(-n);
 }
+/**
+ * The last `maxBytes` of `file`. The first line of a cut window is partial and
+ * dropped, unless the window lies inside one line: then the fragment is kept,
+ * marked with a leading `…`.
+ */
+function readEnd(file, size, maxBytes) {
+    const length = Math.min(size, maxBytes);
+    const buffer = Buffer.alloc(length);
+    const fd = (0, fs_1.openSync)(file, 'r');
+    try {
+        (0, fs_1.readSync)(fd, buffer, 0, length, size - length);
+    }
+    finally {
+        (0, fs_1.closeSync)(fd);
+    }
+    const text = buffer.toString('utf8');
+    if (length === size)
+        return text;
+    const rest = text.slice(text.indexOf('\n') + 1);
+    return text.includes('\n') && rest.trim() ? rest : `…${text}`;
+}

package/build/lib/dev-patches.js

@@ -180,7 +180,18 @@ function patchClaudeMd(file, options) {
     if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
         const before = content.slice(0, startIdx);
         const after = content.slice(endIdx + endMarker.length);
-        next = before + block + after;
+        // Anything between the markers that is NOT this generated block is somebody's own writing,
+        // and it is kept — moved out in front of the block rather than overwritten.
+        //
+        // Replacing the span wholesale was silent data loss, observed in `offers`: a 29-line section
+        // of project documentation sat between the markers and one `lt dev up` deleted it, reporting
+        // only "updated CLAUDE.md URL block in 1 file(s)". Nothing about the markers suggests the
+        // span is owned — they are HTML comments, so they are invisible in every rendered view of the
+        // file, and a section appended after the preceding one lands inside them without anyone
+        // seeing it. The only reason it was noticed at all is that the file happened to be under
+        // review in the same minute.
+        const rescued = rescueForeignContent(content.slice(startIdx + startMarker.length, endIdx));
+        next = before + (rescued ? `${rescued}\n\n` : '') + block + after;
     }
     else {
         const sep = content.endsWith('\n\n') ? '' : content.endsWith('\n') ? '\n' : '\n\n';
@@ -427,3 +438,26 @@ function normaliseBridgeBlock(s) {
         .replace(/\s+/g, ' ')
         .trim();
 }
+/**
+ * Pull out the sections between the lt-dev markers that this tool did not write.
+ *
+ * The generated block is one section, `## Local Development (lt dev)`. Every other `##` section
+ * found inside the markers was written by somebody else and is returned so the caller can place
+ * it outside the block. Whitespace-only remainders are dropped — that is the generated block's
+ * own padding, not content.
+ *
+ * Deliberately conservative about what counts as ours: a section is discarded only when its
+ * heading matches exactly. A renamed or hand-edited heading is treated as foreign and kept, which
+ * leaves a duplicate for a human to resolve. A duplicate is visible; a deletion is not.
+ */
+function rescueForeignContent(span) {
+    const own = '## Local Development (lt dev)';
+    const sections = span.split(/\n(?=## )/);
+    // Compare the whole heading line, not a prefix: `## Local Development (lt dev) — notes` is a
+    // section somebody wrote next to ours, and a prefix match would delete it.
+    const foreign = sections
+        .filter((section) => section.trimStart().split(/\r?\n/, 1)[0].trim() !== own)
+        .map((section) => section.trim())
+        .filter(Boolean);
+    return foreign.join('\n\n');
+}

package/build/lib/reinit-command.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReinitCommand = buildReinitCommand;
+/**
+ * Shell command for `lt npm reinit` in a project without its own `reinit` script:
+ * remove the lockfile and node_modules, then install fresh.
+ *
+ * Deliberately no cache step. `pnpm store prune` empties the machine-wide store on APFS
+ * (clone imports leave every store file with link count 1, which is exactly what prune
+ * deletes), and `npm cache clean --force` / `yarn cache clean` wipe the shared caches the
+ * same way — every other project then downloads again, and a parallel install loses the
+ * files it is linking. A fresh resolution needs neither: deleting the lockfile is what
+ * makes the package manager ask the registry again, and pnpm verifies store integrity
+ * on every install.
+ */
+function buildReinitCommand(opts) {
+    const { dir, install, lockfile } = opts;
+    return `cd ${dir} && rimraf ${lockfile} && rimraf node_modules && ${install}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.50.1",
+  "version": "1.50.2",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -41,7 +41,7 @@
     "lint:fix": "eslint \"./src/**/*.{ts,js,vue}\" --fix",
     "prepublishOnly": "npm run build",
     "preversion": "npm run lint",
-    "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm cache clean --force && npm i && npm run build",
+    "reinit": "npx rimraf package-lock.json && npx rimraf node_modules && npm i && npm run build",
     "snapupdate": "jest --updateSnapshot",
     "start": "node bin/lt",
     "start:build": "npm run build && node bin/lt --compiled-build",
@@ -58,12 +58,13 @@
     "bin"
   ],
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1100.0",
+    "@aws-sdk/client-s3": "3.1146.0",
     "@lenne.tech/cli-plugin-helper": "0.0.14",
-    "axios": "1.19.0",
+    "axios": "1.20.0",
     "bcrypt": "6.0.0",
     "cross-spawn": "7.0.6",
-    "defuddle": "0.19.2",
+    "defuddle": "0.19.4",
+    "ejs": "6.0.1",
     "glob": "13.0.6",
     "gluegun": "5.2.2",
     "js-sha256": "1.0.0",
@@ -71,8 +72,8 @@
     "jsdom": "29.1.1",
     "jsonc-parser": "3.3.1",
     "lodash": "4.18.1",
-    "open": "11.0.0",
-    "playwright-core": "1.62.1",
+    "open": "11.0.4",
+    "playwright-core": "1.63.0",
     "ts-morph": "28.0.0",
     "ts-node": "10.9.2",
     "turndown": "7.2.4",
@@ -84,8 +85,8 @@
     "@emnapi/runtime": "Same as @emnapi/core."
   },
   "devDependencies": {
-    "@emnapi/core": "^1.11.3",
-    "@emnapi/runtime": "^1.11.3",
+    "@emnapi/core": "1.11.3",
+    "@emnapi/runtime": "1.11.3",
     "@lenne.tech/eslint-config-ts": "2.3.0",
     "@lenne.tech/npm-package-helper": "0.0.12",
     "@types/cross-spawn": "6.0.6",
@@ -93,33 +94,32 @@
     "@types/jest": "30.0.0",
     "@types/js-yaml": "4.0.9",
     "@types/jsdom": "28.0.1",
-    "@types/lodash": "4.17.24",
-    "@types/node": "26.1.2",
+    "@types/lodash": "4.17.25",
+    "@types/node": "26.6.4",
     "@types/turndown": "5.0.6",
-    "ejs": "6.0.1",
-    "eslint": "10.8.0",
+    "eslint": "10.12.0",
     "husky": "9.1.7",
-    "jest": "30.4.2",
+    "jest": "30.5.2",
     "minimatch": "10.2.6",
-    "prettier": "3.8.3",
+    "prettier": "3.9.9",
     "rimraf": "6.1.3",
-    "ts-jest": "29.4.12"
+    "ts-jest": "29.4.14"
   },
   "//overrides": {
     "semver@*": "Force latest semver 7.x across all sub-deps; gluegun@5.2.2 pins semver@7.7.0 which is stale - remove once gluegun updates its dep.",
-    "brace-expansion@<1.1.18": "Two DoS advisories: exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high) and unbounded expansion length causing an OOM crash (GHSA-mh99-v99m-4gvg, high). Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude/ts-morph > minimatch. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
-    "brace-expansion@>=2.0.0 <2.1.4": "Same advisories, 2.x line.",
-    "brace-expansion@>=5.0.0 <5.0.9": "Same advisories, 5.x line. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors.",
-    "//minimatch-note": "brace-expansion 1.x and 2.x are END OF LINE for GHSA-mh99-v99m-4gvg: the advisory range is <=5.0.7 across ALL majors and upstream patched ONLY 5.0.8+. 1.1.18 and 2.1.4 are the newest releases of their majors and remain vulnerable. Forcing brace-expansion 5.x globally is NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. The only real fix is to raise each CONSUMER off minimatch 3.x/5.x, which is what the scoped entries below do. Each was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
-    "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. Covers filelist (gluegun > ejs > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1), @typescript-eslint/typescript-estree (^9.0.4) and jest-config/jest-runtime/@jest/reporters (^9). Verified safe per consumer: filelist calls only the static helper `minimatch.match(files, pat, opts)`; typescript-estree calls the named `minimatch(filePath, pattern, { dot: true })`; the three jest packages declare minimatch but never require it. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Drop once these consumers request minimatch >=10 themselves.",
-    "babel-plugin-istanbul > test-exclude@<8": "test-exclude 6.0.0 pins minimatch ^3.0.4 and glob ^7. test-exclude 8.0.0 uses minimatch ^10.2.2 + glob ^13 (the glob major this project already ships) and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul's _interopRequireDefault + `new TestExclude(opts)` keeps working. Drop once babel-plugin-istanbul widens its ^6.0.0 range.",
+    "brace-expansion@<1.1.21": "Five DoS advisories, all patched in the 1.x line by 1.1.21: exponential-time expansion of consecutive non-expanding {} groups (GHSA-3jxr-9vmj-r5cp, high, fixed 1.1.16), unbounded expansion length causing an OOM crash (GHSA-mh99-v99m-4gvg, high, fixed 1.1.17), uncontrolled recursion in parseCommaParts (GHSA-6j4f-fj2g-mc7p, high, fixed 1.1.19), uncontrolled recursion on nested brace groups (GHSA-qhr7-859c-m2p7, high, fixed 1.1.20) and quadratic-time `{a},b}` rewrite (GHSA-q2hr-2g5m-vwhr, medium, fixed 1.1.21). Raised from 1.1.18 on 2026-10-03: 1.1.18 was still open to the last three. Transitive via dotgitignore/eslint/fs-jetpack/glob/test-exclude/ts-morph > minimatch. Latent today: the minimatch raises below leave no 1.x install in the tree (only brace-expansion 5.0.12), so this key catches a future minimatch 3.x consumer. One bounded key per affected major so each can only raise a vulnerable version, never cap a patched one - remove once minimatch requests the patched ranges.",
+    "brace-expansion@>=2.0.0 <2.1.7": "Same five advisories, 2.x line (fixed 2.1.2 / 2.1.3 / 2.1.5 / 2.1.6 / 2.1.7). Raised from 2.1.4 on 2026-10-03. Latent today, like the 1.x key.",
+    "brace-expansion@>=5.0.0 <5.0.12": "Same advisories, 5.x line, plus three newer DoS advisories fixed only in 5.0.10-5.0.12 (GHSA-6j4f-fj2g-mc7p, GHSA-qhr7-859c-m2p7, GHSA-q2hr-2g5m-vwhr; all high). Reaches production via gluegun > fs-jetpack > minimatch. Floored at >=5.0.0 so a future 3.x/4.x dependency is not silently forced across two majors.",
+    "//minimatch-note": "Why the minimatch raises exist: when they were added, brace-expansion 1.x and 2.x were END OF LINE for GHSA-mh99-v99m-4gvg (advisory range <=5.0.7 across ALL majors, patched only 5.0.8+), so the only fix was to raise each CONSUMER off minimatch 3.x/5.x/9.x. That premise no longer holds: upstream has since backported every fix (GHSA-mh99 now reads <1.1.17 / >=2.0.0 <2.1.3, and 1.1.21 / 2.1.7 patch all five current advisories). Verified 2026-10-03 with fresh lockfile resolves: without `minimatch@>=4 <10` and `fs-jetpack > minimatch@<10` npm audit is still clean, the tree only gains minimatch 3.1.5 + 5.1.9 and brace-expansion 1.1.21 + 2.1.7 (7 packages). So both are now a DEDUPE measure (one minimatch 10.2.6, one brace-expansion 5.0.12), not a security fix - dropping them is a judgment call, it reopens no advisory. Forcing brace-expansion 5.x globally is still NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. Each scoped entry was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
+    "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. As of 2026-10-03 the only consumer it still raises is filelist (gluegun > ejs 3.1.10 > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1): @typescript-eslint/typescript-estree 8.65 requests ^10.2.2 itself and the jest 30.5 packages no longer depend on minimatch. Verified safe: filelist calls only the static helper `minimatch.match(files, pat, opts)`. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Dedupe, not security (see //minimatch-note). Drop once filelist requests minimatch >=10.",
+    "babel-plugin-istanbul > test-exclude@<8": "Dedupe override, no longer a security fix. Added when babel-plugin-istanbul requested test-exclude ^6.0.0, whose 6.0.0 pins minimatch ^3.0.4 and glob ^7. Since jest 30.5 (babel-plugin-istanbul 8.0.0) the request is ^7.0.1, and test-exclude 7.0.2 already uses minimatch ^10.2.2: a fresh resolve without this entry audits clean (2026-10-03) but adds 23 packages (glob 10.5.0 and its subtree). 8.0.0 uses glob ^13, the major this project already ships, and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul 8's _interopRequireDefault + `new _testExclude.default(opts)` keeps working. Drop once babel-plugin-istanbul requests test-exclude ^8.",
     "fs-jetpack > minimatch@<10": "Same chain, PRODUCTION-reachable (gluegun > fs-jetpack). Safe: lib/utils/matcher.js does `require('minimatch').Minimatch` and uses only `new Minimatch(pattern, { matchBase, nocomment, nocase, dot })`, `.negate` and `.match()` - all verified against 10.x. Not fixable by upgrading fs-jetpack: gluegun@5.2.2 is the latest release and fs-jetpack@5.1.0 still requests minimatch ^5.1.0 (brace-expansion ^2.0.1, also unpatched)."
   },
   "overrides": {
     "semver@*": "7.8.5",
-    "brace-expansion@<1.1.18": "1.1.18",
-    "brace-expansion@>=2.0.0 <2.1.4": "2.1.4",
-    "brace-expansion@>=5.0.0 <5.0.9": "5.0.9",
+    "brace-expansion@<1.1.21": "1.1.21",
+    "brace-expansion@>=2.0.0 <2.1.7": "2.1.7",
+    "brace-expansion@>=5.0.0 <5.0.12": "5.0.12",
     "fs-jetpack": {
       "minimatch@<10": "10.2.6"
     },