@lenne.tech/cli 1.50.2 → 1.50.4

package/build/commands/dev/up.js

@@ -252,22 +252,19 @@ const UpCommand = {
                 process.exit(1);
             return 'dev up: port in use';
         }
-        // The CLAUDE.md URL block is written HERE, after the internal ports are
-        // resolved, so it can name both addresses: the `*.localhost` name a browser
-        // opens and the loopback address a script must use. It used to run before
-        // allocation, where only the name existed — which is why an agent following
-        // the block had nothing but a hostname that does not resolve for Node on
-        // Windows. NEVER for a ticket worktree: that CLAUDE.md is git-tracked and
-        // would carry per-ticket URLs into a commit.
+        // The CLAUDE.md URL block names both addresses: the `*.localhost` name a
+        // browser opens and, for a script, the env var that carries the loopback
+        // address. Not the port itself: the base CLAUDE.md is git-tracked too, and the
+        // port differs per machine, so writing it here dirtied every checkout on each
+        // `lt dev up` (see `patchClaudeMd`). NEVER for a ticket worktree: that
+        // CLAUDE.md would carry per-ticket URLs into a commit.
         if (!ticket) {
             const claudeCandidates = [
                 (0, path_1.join)(layout.root, 'CLAUDE.md'),
                 ...(layout.apiDir ? [(0, path_1.join)(layout.apiDir, 'CLAUDE.md')] : []),
                 ...(layout.appDir ? [(0, path_1.join)(layout.appDir, 'CLAUDE.md')] : []),
             ];
-            const patched = claudeCandidates
-                .map((f) => (0, dev_patches_1.patchClaudeMd)(f, { apiPort, appPort, dbName, identity }))
-                .filter((r) => r.patched);
+            const patched = claudeCandidates.map((f) => (0, dev_patches_1.patchClaudeMd)(f, { dbName, identity })).filter((r) => r.patched);
             if (patched.length > 0) {
                 info(colors.dim(`updated CLAUDE.md URL block in ${patched.length} file(s)`));
             }

package/build/lib/dev-patches.js

@@ -125,7 +125,7 @@ function patchApiConfig(file) {
  * in place.
  */
 function patchClaudeMd(file, options) {
-    const { apiPort, appPort, dbName, identity } = options;
+    const { dbName, identity } = options;
     const startMarker = '<!-- lt-dev:url-block:start -->';
     const endMarker = '<!-- lt-dev:url-block:end -->';
     const apiSub = identity.subdomains.api;
@@ -155,14 +155,22 @@ function patchClaudeMd(file, options) {
     // agent following it would `curl` a name that does not resolve for Node on
     // Windows, and fail silently. The browser address stays first: it is the one a
     // human opens.
-    if (appSub) {
-        lines.push(`- App: \`https://${appSub.hostname}\`${appPort ? ` — from a script: \`http://127.0.0.1:${appPort}\`` : ''}`);
-    }
-    if (apiSub) {
-        lines.push(`- API: \`https://${apiSub.hostname}\`${apiPort ? ` — from a script: \`http://127.0.0.1:${apiPort}\`` : ''}`);
-    }
-    if (appPort || apiPort) {
-        lines.push('- The `*.localhost` names are resolved by BROWSERS. Node, `curl` and other tools may not resolve them (they do not on Windows) — use the loopback address from a script.');
+    //
+    // The loopback address is named by its env var, never by its port. This file is
+    // committed, and the internal port is allocated per machine (4000 + whatever the
+    // other registered projects took), so writing `127.0.0.1:4031` here left every
+    // checkout modified after `lt dev up`, and committing it only moved the diff to
+    // the next developer. The env var names are the same everywhere.
+    if (appSub)
+        lines.push(`- App: \`https://${appSub.hostname}\``);
+    if (apiSub)
+        lines.push(`- API: \`https://${apiSub.hostname}\``);
+    const loopbackVars = [
+        ...(appSub ? ['`LT_DEV_APP_INTERNAL_URL`'] : []),
+        ...(apiSub ? ['`LT_DEV_API_INTERNAL_URL`'] : []),
+    ];
+    if (loopbackVars.length > 0) {
+        lines.push(`- The \`*.localhost\` names are resolved by BROWSERS. Node, \`curl\` and other tools may not resolve them (they do not on Windows), so a script uses the loopback address: ${loopbackVars.join(' / ')} (set in the processes and in \`.lt-dev/.env\`), or the \`→ 127.0.0.1:<port>\` that \`lt dev status\` prints. The port differs per machine, which is why it is not written here.`);
     }
     if (dbName)
         lines.push(`- DB: \`mongodb://127.0.0.1/${dbName}\``);
@@ -422,11 +430,14 @@ function patchPlaywrightConfig(file) {
  * identically to a live one: the block would silently never load
  * `.lt-dev/.env` again and Playwright would fall back to `localhost:3001`.
  *
- * Quote style and intra-line whitespace are normalised away because the
- * consumer's formatter owns this file (which direction it flips is
- * project-specific — do not assume). Blind spot to keep in mind: a change
- * that differs ONLY in quotes or whitespace is invisible here, which is
- * what `BRIDGE_VERSION` is for.
+ * Quote style, intra-line whitespace, the padding inside brackets and
+ * trailing commas are normalised away because the consumer's formatter owns
+ * this file (which direction it flips is project-specific — do not assume).
+ * oxfmt at printWidth 80 wraps the bridge imports and adds a trailing comma;
+ * read as a code change, that rewrote playwright.config.ts on every run.
+ * Blind spot to keep in mind: a change that differs ONLY in quotes,
+ * whitespace or trailing commas is invisible here, which is what
+ * `BRIDGE_VERSION` is for.
  */
 function normaliseBridgeBlock(s) {
     return s
@@ -435,6 +446,9 @@ function normaliseBridgeBlock(s) {
         .filter((l) => l !== '' && !l.startsWith('//'))
         .join(' ')
         .replace(/['"]/g, '"')
+        .replace(/,\s*([)\]}])/g, '$1')
+        .replace(/([([{])\s+/g, '$1')
+        .replace(/\s+([)\]}])/g, '$1')
         .replace(/\s+/g, ' ')
         .trim();
 }

package/build/lib/hoist-workspace-pnpm-config.js

@@ -4,7 +4,9 @@ exports.extractKeyComments = extractKeyComments;
 exports.reattachKeyComments = reattachKeyComments;
 exports.hoistPackageManager = hoistPackageManager;
 exports.hoistWorkspacePnpmConfig = hoistWorkspacePnpmConfig;
+const fs_1 = require("fs");
 const js_yaml_1 = require("js-yaml");
+const path_1 = require("path");
 const fs_utils_1 = require("./fs-utils");
 /**
  * pnpm workspace-scoped fields that must live at the workspace root.
@@ -37,8 +39,16 @@ const fs_utils_1 = require("./fs-utils");
  * the same trap one step later: the starter scope-allows known-stale peer ranges
  * there, and without the hoist the root `check:peers` step fails the first
  * `pnpm run check` of every generated project.
+ *
+ * `patchedDependencies` (`{ "pkg@version": "patches/pkg@version.patch" }`) is the
+ * same trap once more, with a file attached. nuxt-base-starter pairs an override
+ * (`simple-git: 4.0.2`) with a patch that restores the default export its consumer
+ * imports. Hoisting the override without the patch installs the package unpatched,
+ * and `nuxt prepare` aborts the first `pnpm install` of every generated project.
+ * The value is a path relative to the workspace root, so the file moves with it —
+ * see `relocatePatches`.
  */
-const OBJECT_FIELDS = ['overrides', 'allowBuilds'];
+const OBJECT_FIELDS = ['overrides', 'allowBuilds', 'patchedDependencies'];
 const ARRAY_FIELDS = ['onlyBuiltDependencies', 'ignoredOptionalDependencies', 'minimumReleaseAgeExclude'];
 /** Objects whose inner arrays are unioned and inner maps merged, not replaced. */
 const NESTED_ARRAY_FIELDS = ['auditConfig', 'peerDependencyRules'];
@@ -333,6 +343,7 @@ function hoistWorkspacePnpmConfig(options) {
     const conflicts = [];
     const rootOverrides = [];
     const auditWidenedBy = new Set();
+    const relocatedPatches = new Map();
     // Sub-projects that are present and eligible but hand over nothing, because an
     // earlier run already hoisted their settings and deleted the source. They are
     // what turns a root-vs-sub override into a sub-vs-sub disagreement.
@@ -349,15 +360,31 @@ function hoistWorkspacePnpmConfig(options) {
         // across its own two config sources is the same silent-winner bug one scope
         // down, and a shared label hides it.
         const fromPkg = hoistFromSubPackageJson({
-            context: { auditWidenedBy, conflicts, provenance, rootOverrides, sourceLabel: `${subDir}/package.json#pnpm` },
+            context: {
+                auditWidenedBy,
+                conflicts,
+                provenance,
+                relocatedPatches,
+                rootOverrides,
+                sourceLabel: `${subDir}/package.json#pnpm`,
+            },
             filesystem,
+            projectDir,
             rootWs,
             subPath,
         });
         const fromYaml = hoistFromSubWorkspaceYaml({
             comments,
-            context: { auditWidenedBy, conflicts, provenance, rootOverrides, sourceLabel: `${subDir}/pnpm-workspace.yaml` },
+            context: {
+                auditWidenedBy,
+                conflicts,
+                provenance,
+                relocatedPatches,
+                rootOverrides,
+                sourceLabel: `${subDir}/pnpm-workspace.yaml`,
+            },
             filesystem,
+            projectDir,
             rootWs,
             subPath,
         });
@@ -547,13 +574,14 @@ function hoistFields(rootWs, source, context) {
 }
 /** Source 1: the sub-project's package.json `pnpm` block. */
 function hoistFromSubPackageJson(options) {
-    const { filesystem, rootWs, subPath } = options;
+    const { filesystem, projectDir, rootWs, subPath } = options;
     const subPkgPath = `${subPath}/package.json`;
     if (!filesystem.exists(subPkgPath))
         return false;
     const subPkg = filesystem.read(subPkgPath, 'json');
     if (!(subPkg === null || subPkg === void 0 ? void 0 : subPkg.pnpm))
         return false;
+    relocatePatches({ context: options.context, filesystem, projectDir, source: subPkg.pnpm, subPath });
     if (!hoistFields(rootWs, subPkg.pnpm, options.context))
         return false;
     // If the sub-project's pnpm section is now empty, drop it entirely.
@@ -566,7 +594,7 @@ function hoistFromSubPackageJson(options) {
 /** Source 2: the sub-project's pnpm-workspace.yaml. */
 function hoistFromSubWorkspaceYaml(options) {
     var _a;
-    const { comments, filesystem, rootWs, subPath } = options;
+    const { comments, filesystem, projectDir, rootWs, subPath } = options;
     const subWsPath = `${subPath}/pnpm-workspace.yaml`;
     if (!filesystem.exists(subWsPath))
         return false;
@@ -581,6 +609,7 @@ function hoistFromSubWorkspaceYaml(options) {
         if (!comments.has(key))
             comments.set(key, block);
     }
+    relocatePatches({ context: options.context, filesystem, projectDir, source: ws, subPath });
     if (!hoistFields(rootWs, ws, options.context))
         return false;
     // A settings-only file (no `packages:`) exists solely to carry these
@@ -658,6 +687,21 @@ function pmVersion(pin) {
     const afterAt = pin.slice(pin.lastIndexOf('@') + 1);
     return afterAt.split('+')[0];
 }
+/** Remove `dir` and every parent it empties, stopping below `stopAt`, which is never removed. */
+function pruneEmptyDirs(filesystem, dir, stopAt) {
+    var _a;
+    const stop = (0, path_1.resolve)(stopAt);
+    let current = (0, path_1.resolve)(dir);
+    for (;;) {
+        const rel = (0, path_1.relative)(stop, current);
+        if (!rel || rel.startsWith('..') || (0, path_1.isAbsolute)(rel))
+            return;
+        if (((_a = filesystem.list(current)) !== null && _a !== void 0 ? _a : ['?']).length > 0)
+            return;
+        filesystem.remove(current);
+        current = (0, path_1.dirname)(current);
+    }
+}
 /** Parse a YAML file into a plain object, or null on missing/malformed/non-object. */
 function readYaml(filesystem, path) {
     if (!filesystem.exists(path))
@@ -746,6 +790,90 @@ function recordRootOverrides(field, rootValue, subValue, context) {
         });
     }
 }
+/**
+ * Make every `patchedDependencies` path in a sub-project's pnpm config valid at the
+ * workspace root, by moving the patch file to `<root>/patches/`.
+ *
+ * Why the file moves instead of the path just being rewritten to
+ * `projects/app/patches/…`: pnpm would find either, but the Dockerfiles copy only the
+ * build-context-root `patches/` into their deps stage, and in a monorepo the context IS
+ * the root. A path into `projects/app/` installs locally and breaks the image build.
+ *
+ * Never overwrites, never writes through a symlink, never deletes a patch it could not
+ * place. Where the move is impossible the entry points at the file where it is (a local
+ * install keeps working) and the reason is reported. A clash with ANOTHER sub-project's
+ * entry for the same key is left to `recordObjectFieldProvenance`, which names both
+ * sources; reporting it here as well would say the same thing twice.
+ */
+function relocatePatches(options) {
+    var _a, _b;
+    const { context, filesystem, projectDir, source, subPath } = options;
+    const entries = source.patchedDependencies;
+    if (!entries || typeof entries !== 'object' || Array.isArray(entries))
+        return;
+    const rootPatchesDir = (0, path_1.resolve)(projectDir, 'patches');
+    const toRootPath = (abs) => (0, path_1.relative)((0, path_1.resolve)(projectDir), abs).split(path_1.sep).join('/');
+    const isInside = (dir, path) => {
+        const rel = (0, path_1.relative)(dir, path);
+        return !!rel && !rel.startsWith('..') && !(0, path_1.isAbsolute)(rel);
+    };
+    const relocated = {};
+    const moved = (_a = context === null || context === void 0 ? void 0 : context.relocatedPatches) !== null && _a !== void 0 ? _a : new Map();
+    for (const [key, value] of Object.entries(entries)) {
+        relocated[key] = value;
+        if (typeof value !== 'string')
+            continue;
+        const from = (0, path_1.resolve)(subPath, value);
+        const fromPath = toRootPath(from);
+        relocated[key] = (_b = moved.get(from)) !== null && _b !== void 0 ? _b : fromPath;
+        if (moved.has(from))
+            continue;
+        const leftInPlace = (reason) => {
+            context === null || context === void 0 ? void 0 : context.conflicts.push(`patchedDependencies: ${JSON.stringify(key)} — ${reason}, so ${fromPath} was left in place. ` +
+                `A local install still finds it, but the Dockerfiles copy only the root patches/ and the image build will not.`);
+        };
+        if (isInside(rootPatchesDir, from))
+            continue;
+        if (filesystem.exists(from) !== 'file') {
+            context === null || context === void 0 ? void 0 : context.conflicts.push(`patchedDependencies: ${JSON.stringify(key)} points at ${fromPath}, which does not exist. ` +
+                `pnpm install fails until the patch file is there.`);
+            continue;
+        }
+        if (!isInside((0, path_1.resolve)(subPath), from)) {
+            leftInPlace('the patch lives outside its sub-project');
+            continue;
+        }
+        if ((0, fs_utils_1.isSymlink)(from)) {
+            leftInPlace('the patch file is a symlink');
+            continue;
+        }
+        const dirState = filesystem.exists(rootPatchesDir);
+        if ((0, fs_utils_1.isSymlink)(rootPatchesDir) || (dirState && dirState !== 'dir')) {
+            leftInPlace('patches/ at the workspace root is a symlink or not a directory');
+            continue;
+        }
+        const to = (0, path_1.join)(rootPatchesDir, (0, path_1.basename)(from));
+        if (filesystem.exists(to)) {
+            const identical = filesystem.exists(to) === 'file' && !(0, fs_utils_1.isSymlink)(to) && (0, fs_1.readFileSync)(to).equals((0, fs_1.readFileSync)(from));
+            if (identical) {
+                filesystem.remove(from);
+                pruneEmptyDirs(filesystem, (0, path_1.dirname)(from), subPath);
+                relocated[key] = toRootPath(to);
+                moved.set(from, toRootPath(to));
+            }
+            else if (!(context === null || context === void 0 ? void 0 : context.provenance.has(`patchedDependencies.${key}`))) {
+                leftInPlace(`${toRootPath(to)} already exists with different content`);
+            }
+            continue;
+        }
+        filesystem.dir(rootPatchesDir);
+        filesystem.move(from, to);
+        pruneEmptyDirs(filesystem, (0, path_1.dirname)(from), subPath);
+        relocated[key] = toRootPath(to);
+        moved.set(from, toRootPath(to));
+    }
+    source.patchedDependencies = relocated;
+}
 /**
  * One line, not one per advisory: say that hoisting widened the audit
  * suppressions to the whole workspace, and name who brought them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/cli",
-  "version": "1.50.2",
+  "version": "1.50.4",
   "description": "lenne.Tech CLI: lt",
   "keywords": [
     "lenne.Tech",
@@ -113,6 +113,7 @@
     "//minimatch-note": "Why the minimatch raises exist: when they were added, brace-expansion 1.x and 2.x were END OF LINE for GHSA-mh99-v99m-4gvg (advisory range <=5.0.7 across ALL majors, patched only 5.0.8+), so the only fix was to raise each CONSUMER off minimatch 3.x/5.x/9.x. That premise no longer holds: upstream has since backported every fix (GHSA-mh99 now reads <1.1.17 / >=2.0.0 <2.1.3, and 1.1.21 / 2.1.7 patch all five current advisories). Verified 2026-10-03 with fresh lockfile resolves: without `minimatch@>=4 <10` and `fs-jetpack > minimatch@<10` npm audit is still clean, the tree only gains minimatch 3.1.5 + 5.1.9 and brace-expansion 1.1.21 + 2.1.7 (7 packages). So both are now a DEDUPE measure (one minimatch 10.2.6, one brace-expansion 5.0.12), not a security fix - dropping them is a judgment call, it reopens no advisory. Forcing brace-expansion 5.x globally is still NOT an option: 5.x is ESM/tshy and exports an object ({ expand, ... }) while 1.x/2.x export the function itself, so minimatch 3.x/5.x would die on `expand is not a function`. Each scoped entry was verified against the consumer's actual call site before being added. The eslint / @eslint/eslintrc / @eslint/config-array entries were REMOVED in 1.42.0: eslint 10 requests minimatch ^10.2.5 itself, config-array ^10.2.4, and eslintrc is no longer in the tree at all.",
     "minimatch@>=4 <10": "Bounded raise of every minimatch 4.x-9.x install to 10.2.6, whose brace-expansion ^5.0.8 is patched. As of 2026-10-03 the only consumer it still raises is filelist (gluegun > ejs 3.1.10 > jake > filelist, PRODUCTION-reachable, minimatch ^5.0.1): @typescript-eslint/typescript-estree 8.65 requests ^10.2.2 itself and the jest 30.5 packages no longer depend on minimatch. Verified safe: filelist calls only the static helper `minimatch.match(files, pat, opts)`. Floored at >=4 so the 3.x line is NOT swept in: minimatch 3.x is callable while 9.x/10.x export an object with __esModule but no `default` key, so sweeping it would break any consumer that calls the default export. Dedupe, not security (see //minimatch-note). Drop once filelist requests minimatch >=10.",
     "babel-plugin-istanbul > test-exclude@<8": "Dedupe override, no longer a security fix. Added when babel-plugin-istanbul requested test-exclude ^6.0.0, whose 6.0.0 pins minimatch ^3.0.4 and glob ^7. Since jest 30.5 (babel-plugin-istanbul 8.0.0) the request is ^7.0.1, and test-exclude 7.0.2 already uses minimatch ^10.2.2: a fresh resolve without this entry audits clean (2026-10-03) but adds 23 packages (glob 10.5.0 and its subtree). 8.0.0 uses glob ^13, the major this project already ships, and is still CJS with the same `module.exports = TestExclude` class shape, so babel-plugin-istanbul 8's _interopRequireDefault + `new _testExclude.default(opts)` keeps working. Drop once babel-plugin-istanbul requests test-exclude ^8.",
+    "@istanbuljs/load-nyc-config > js-yaml": "Security fix for GHSA-hp3w-g68c-fv3c (sprintf-js, DoS via unbounded precision specifiers, moderate). Advisory range is ALL versions, so there is no patched sprintf-js to raise to. Dev-only path: ts-jest > @jest/transform > babel-plugin-istanbul 8.0.0 > @istanbuljs/load-nyc-config 1.1.0 (js-yaml ^3.13.1) > js-yaml 3.15.2 > argparse 1.0.10 > sprintf-js. Every link is already at its latest release (2026-10-06), and only js-yaml 4.x leaves the chain: it depends on argparse ^2, which has no sprintf-js. `$js-yaml` pins it to this project's own direct js-yaml, so the two never drift. Verified safe: load-nyc-config only calls `require('js-yaml').load(...)` (index.js:80), which 4.x has; 4.x `load` behaves like 3.x `safeLoad`. Drop once load-nyc-config requests js-yaml >=4 or argparse 1.x drops sprintf-js.",
     "fs-jetpack > minimatch@<10": "Same chain, PRODUCTION-reachable (gluegun > fs-jetpack). Safe: lib/utils/matcher.js does `require('minimatch').Minimatch` and uses only `new Minimatch(pattern, { matchBase, nocomment, nocase, dot })`, `.negate` and `.match()` - all verified against 10.x. Not fixable by upgrading fs-jetpack: gluegun@5.2.2 is the latest release and fs-jetpack@5.1.0 still requests minimatch ^5.1.0 (brace-expansion ^2.0.1, also unpatched)."
   },
   "overrides": {
@@ -126,6 +127,9 @@
     "babel-plugin-istanbul": {
       "test-exclude@<8": "8.0.0"
     },
+    "@istanbuljs/load-nyc-config": {
+      "js-yaml": "$js-yaml"
+    },
     "minimatch@>=4 <10": "10.2.6"
   },
   "//jest.workerIdleMemoryLimit": "Recycle a ts-jest worker once its heap passes this. Guards against an intermittent `A jest worker process was terminated by another process: signal=SIGSEGV` that kills ONE suite while every other test passes (seen twice in marketplace*, both under `npm run check`, never reproducible on demand - 0 in 9 targeted runs incl. --maxWorkers=16). It is a worker crash, NOT an assertion failure: the signature is `Test suite failed to run` with the remaining count still green. All versions are current and in-range (node 24 / jest 30 / ts-jest 29 / ts 6), so this is a resilience measure against unbounded worker heap growth, not a proven root-cause fix - if it recurs, capture the suite name and re-open.",