@webjsdev/cli 0.10.57 → 0.10.59

package/lib/create.js

@@ -18,24 +18,10 @@ import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import { bunifyProse, bunifyDockerfile, bunifyCompose, bunifyCi } from './runtime-rewrite.js';
+import { postgresCompose, postgresCi } from './db-rewrite.js';
 import { assertValidAppName, toDatabaseName } from './app-name.js';
 import { isGalleryAppShellFile } from './gallery-shell-files.js';
-
-/**
- * Detect which package manager invoked us. Reads `npm_config_user_agent`,
- * which npm / pnpm / yarn / bun all set when running scripts or `npx`.
- * Falls back to `npm` when nothing is detected (matches what most users
- * actually have installed).
- *
- * @returns {'npm'|'pnpm'|'yarn'|'bun'}
- */
-function detectPackageManager() {
-  const ua = process.env.npm_config_user_agent || '';
-  if (ua.startsWith('pnpm/')) return 'pnpm';
-  if (ua.startsWith('yarn/')) return 'yarn';
-  if (ua.startsWith('bun/')) return 'bun';
-  return 'npm';
-}
+import { detectPackageManager } from './package-manager.js';
 
 /**
  * Run `<pm> install` inside the scaffolded app. Returns true on success.
@@ -292,6 +278,10 @@ export async function scaffoldApp(name, cwd, opts = {}) {
   // points (`webjs create` and `npx create-webjs-app`) explicitly set
   // `install: true` unless the user passes `--no-install`.
   const shouldInstall = opts.install === true;
+  // `--skip-ci` (#1471, `rails new --skip-ci` parity): omit the GitHub
+  // workflow. The local `webjs ci` list in package.json is always emitted, so
+  // the app still has its gate; only the cloud half is optional.
+  const skipCi = opts.skipCi === true;
   // Defence in depth. The CLI already validates this, but library
   // callers (tests, programmatic use) might pass anything.
   const VALID_TEMPLATES = ['full-stack', 'api'];
@@ -323,7 +313,10 @@ export async function scaffoldApp(name, cwd, opts = {}) {
   // with the explicit flag winning over detection. A bun-flavored app SERVES on
   // Bun (its dev/start scripts force `--bun`), commits `bun.lock`, sets
   // `trustedDependencies`, and ships a bun Dockerfile / CI / agent docs.
-  const runtime = opts.runtime || (detectPackageManager() === 'bun' ? 'bun' : 'node');
+  // Runtime detection reads ONLY the invoking tool (no lockfile walk): a
+  // global `webjs create` run inside someone else's Bun workspace should not
+  // silently flip the new app to serving on Bun.
+  const runtime = opts.runtime || (detectPackageManager({ cwd: null, prefer: 'agent' }) === 'bun' ? 'bun' : 'node');
   const VALID_RUNTIMES = ['node', 'bun'];
   if (!VALID_RUNTIMES.includes(runtime)) {
     throw new Error(`Unknown --runtime '${runtime}'. Only ${VALID_RUNTIMES.join(' / ')} are supported.`);
@@ -421,6 +414,10 @@ export async function scaffoldApp(name, cwd, opts = {}) {
       // the environment-shaped checks (env drift, pin freshness over the
       // network, the git hook) stay warns and cannot make CI flaky.
       doctor: 'webjs doctor',
+      // Local CI (#1471): every check above plus the test layers, one command,
+      // from the step list in the `webjs.ci` block below. Runtime-neutral like
+      // the other tooling scripts (it spawns `webjs ...` children).
+      ci: 'webjs ci',
       'db:generate': 'webjs db generate',
       'db:migrate': 'webjs db migrate',
       'db:push': 'webjs db push',
@@ -467,7 +464,12 @@ export async function scaffoldApp(name, cwd, opts = {}) {
       // The Tailwind v4 CLI that css:build runs to compile public/input.css into
       // the static public/tailwind.css the layout links. UI templates only (the
       // api template has no CSS). Build tooling, never shipped to the runtime.
-      ...(isApi ? {} : { '@tailwindcss/cli': '^4.1.0' }),
+      // `tailwindcss` itself is declared too (#1493): public/input.css starts
+      // with `@import "tailwindcss"`, so the app imports that package directly.
+      // Leaving it transitive (via @tailwindcss/cli) breaks under bun's isolated
+      // linker and pnpm, which link only declared packages into the app's
+      // node_modules, so the compile fails with `Can't resolve 'tailwindcss'`.
+      ...(isApi ? {} : { '@tailwindcss/cli': '^4.1.0', tailwindcss: '^4.1.0' }),
       // tsserver plugin, wired into tsconfig below. Gives the language
       // INTELLIGENCE (go-to-def, completions, diagnostics, hover inside html``
       // templates) in any tsserver editor with NO editor plugin installed,
@@ -515,8 +517,18 @@ export async function scaffoldApp(name, cwd, opts = {}) {
     // `npm audit fix --force` proposes: its @web/test-runner-chrome@1 still
     // declares puppeteer-core ^24, so the same vulnerable chain resolves and
     // the audit stays red after a breaking major.
+    //
+    // basic-ftp (#1492) is the same kind of floor for the same runner: it is
+    // reached through puppeteer-core's proxy-agent chain and 6.2.2 is its fixed
+    // release (GHSA-c475-qrg2-pj4r), so an install that still resolves an older
+    // chain cannot land below it.
+    //
+    // Overrides are honoured ONLY at a workspace root. When this app is a
+    // member of an npm or bun workspace, move this block into the root
+    // package.json (`webjs doctor` warns with WORKSPACE_OVERRIDES until then).
     overrides: {
       'puppeteer-core': '^25.7.0',
+      'basic-ftp': '^6.2.2',
     },
     // Dev + start task orchestration (#550). `webjs dev` / `webjs start` read
     // `before` and run it in-process, so `npm run dev` / `start` (thin aliases
@@ -551,6 +563,12 @@ export async function scaffoldApp(name, cwd, opts = {}) {
         }),
       },
       start: { before: isApi ? ['webjs db migrate'] : ['webjs db migrate', cssBuildCmd] },
+      // No `db` block on purpose (#1468). `webjs db` defaults to drizzle-kit,
+      // and Drizzle is the scaffold default by OMISSION: an app that swaps the
+      // ORM adds `"db": { "migrate": "prisma migrate deploy", ... }` here and
+      // the `webjs db migrate` spelling in `before` (and the Dockerfile, and
+      // CI) keeps working. Emitting the Drizzle mapping would only duplicate
+      // the default into every app.
       // Which doctor findings are FATAL is the app's own call (#1257), declared
       // here rather than in the CI workflow so `npm run doctor` locally and the
       // workflow step agree about what fails. UNMARKED_ASSET_LINKS starts at
@@ -562,6 +580,56 @@ export async function scaffoldApp(name, cwd, opts = {}) {
       // everything else keeps its default warn. Add a code with "off" to
       // silence it, or "error" to make it fatal too.
       doctor: { gate: { UNMARKED_ASSET_LINKS: 'error' } },
+      // The dependency audit's allowlist (#1492), the ONE place an accepted
+      // advisory is listed, each with the reason it is safe. `webjs audit`
+      // (the CI step below) fails on every other advisory at `level` or above,
+      // and prints an entry as stale once the audit stops reporting it, so
+      // remove it then. Only accept an advisory with NO patched release that
+      // the app's users cannot reach; anything with a fix gets upgraded.
+      audit: {
+        level: 'high',
+        ignore: [
+          {
+            id: 'GHSA-vfj7-8cjw-p6xm',
+            reason: 'braces <=3.0.3 (no patched release) is reached only through dev tooling: the Tailwind '
+              + 'CLI file watcher and the test runner globber, on glob patterns this repo writes. Nothing '
+              + 'in the served app expands a pattern from request input.',
+          },
+        ],
+      },
+      // Local CI (#1471), the Rails `bin/ci` posture. `npm run ci` runs this
+      // list on a developer machine and the generated GitHub workflow runs the
+      // SAME list through the same command, so the two cannot drift. Bare
+      // `webjs ...` commands, like the before-steps above (a Bun app's image
+      // has no npm). The `Checks` group runs two steps at a time with each
+      // step's output replayed whole; `Tests` inside it stays SEQUENTIAL, one
+      // slot, because the server and e2e layers share one SQLite file.
+      ci: {
+        steps: [
+          { title: 'Setup', run: 'webjs db migrate' },
+          {
+            title: 'Checks',
+            parallel: 2,
+            steps: [
+              { title: 'Conventions', run: 'webjs check' },
+              { title: 'Health', run: 'webjs doctor' },
+              { title: 'Types', run: 'webjs typecheck' },
+              // `webjs audit` (#1492) runs `npm audit` or `bun audit` (by the
+              // nearest lockfile) and fails at webjs.audit.level, minus the
+              // advisories webjs.audit.ignore accepts below.
+              { title: 'Security: dependency audit', run: 'webjs audit' },
+              {
+                title: 'Tests',
+                steps: [
+                  { title: 'Tests: server', run: 'webjs test --server' },
+                  { title: 'Tests: browser', run: 'webjs test --browser' },
+                  { title: 'Tests: e2e', run: 'webjs test --server', env: { WEBJS_E2E: '1' } },
+                ],
+              },
+            ],
+          },
+        ],
+      },
     },
   }, null, 2) + '\n');
 
@@ -657,7 +725,8 @@ export async function scaffoldApp(name, cwd, opts = {}) {
     // Shipped without a dot (npm strips a published .gitignore) and renamed on copy.
     'gitignore',
     '.github/pull_request_template.md',
-    // CI runs webjs check + the test layers on every PR and push to main.
+    // The cloud half of CI: one job that runs `npm run ci`, the same step list
+    // the app declares under `webjs.ci` (#1471). Omitted by `--skip-ci`.
     '.github/workflows/ci.yml',
     '.editorconfig',
     '.vscode/settings.json',
@@ -685,7 +754,17 @@ export async function scaffoldApp(name, cwd, opts = {}) {
     'compose.yaml': bunifyCompose,
     '.github/workflows/ci.yml': bunifyCi,
   };
+  // Database axis (#1490): the compose + CI templates are the SQLite shape, so
+  // a --db postgres app derives its variant (a Postgres service, DATABASE_URL
+  // pointed at it) by a pure transform, like the Bun rewrite above. Applied
+  // FIRST; the two touch disjoint lines, so they compose. SQLite copies as is.
+  const DB_REWRITE = dialect === 'postgres' ? {
+    'compose.yaml': (c) => postgresCompose(c, toDatabaseName(name)),
+    '.github/workflows/ci.yml': (c) => postgresCi(c, toDatabaseName(name)),
+  } : {};
   for (const f of templateFiles) {
+    // `--skip-ci` drops only the workflow; the PR template still ships.
+    if (skipCi && f === '.github/workflows/ci.yml') continue;
     const src = join(TEMPLATES, f);
     if (existsSync(src)) {
       // `gitignore` ships without a dot (npm strips a published `.gitignore`)
@@ -704,6 +783,7 @@ export async function scaffoldApp(name, cwd, opts = {}) {
         const playbook = await readFile(join(TEMPLATES, 'partials', playbookFile), 'utf8');
         content = content.replace('{{PLAYBOOK}}', () => playbook.trimEnd());
       }
+      if (DB_REWRITE[f]) content = DB_REWRITE[f](content);
       if (isBun) {
         if (PROSE_REWRITE.has(f)) content = bunifyProse(content);
         else if (FILE_REWRITE[f]) content = FILE_REWRITE[f](content);
@@ -1613,8 +1693,11 @@ ThemeToggle.register('theme-toggle');
   // that exercise the scaffold without paying the install cost.
   // In bun mode, install with bun regardless of the invoking PM, so the app
   // commits `bun.lock` (text JSONC, git-diffable) instead of `package-lock.json`
-  // (#541). Otherwise honour the invoking PM (npm / pnpm / yarn / bun).
-  const pm = isBun ? 'bun' : detectPackageManager();
+  // (#541). Otherwise honour the invoking PM (npm / pnpm / yarn / bun), and when
+  // nothing invoked us through a package manager (a global `webjs` bin), the
+  // lockfile of the enclosing project or workspace (#1494), so an app created
+  // inside a bun workspace does not get a stray package-lock.json.
+  const pm = isBun ? 'bun' : detectPackageManager({ cwd: dirname(appDir), prefer: 'agent' });
   let installed = false;
   let generatedMigration = false;
   if (shouldInstall) {

package/lib/db-rewrite.js

@@ -0,0 +1,137 @@
+/**
+ * Database-dialect rewrites for the deploy files (#1490).
+ *
+ * The canonical `compose.yaml` and `.github/workflows/ci.yml` templates are the
+ * SQLite shape (a `file:` DATABASE_URL, a named volume for the db file). A
+ * `--db postgres` app needs a real Postgres in both places, so these pure
+ * transforms DERIVE the Postgres variant from the canonical template, the same
+ * way `runtime-rewrite.js` derives the Bun variant. There is no parallel
+ * Postgres template to drift, and SQLite output stays byte-identical because
+ * nothing here runs for it.
+ *
+ * Order: create.js applies these BEFORE the Bun rewrites. They only touch the
+ * DATABASE_URL lines, the volume, and add a database service, none of which
+ * the Bun rewrites match (those swap `node -e` healthchecks, `npm` commands and
+ * the setup-node block), so the two axes compose in either order. Every anchor
+ * is asserted, so a template edit that moves one fails loudly in the scaffold
+ * tests instead of shipping a half-rewritten file.
+ *
+ * The credentials are local-only (a throwaway compose volume, an ephemeral CI
+ * service container), never a production value; production points
+ * DATABASE_URL at its own managed Postgres.
+ *
+ * @module db-rewrite
+ */
+
+/** Local Postgres user + password for compose and CI (never production). */
+export const LOCAL_PG_USER = 'webjs';
+export const LOCAL_PG_PASSWORD = 'webjs';
+/** The Postgres image both files run. */
+export const PG_IMAGE = 'postgres:17-alpine';
+
+/**
+ * @param {string} s
+ * @param {string} from
+ * @param {string} to
+ * @param {string} file
+ */
+function replaceOnce(s, from, to, file) {
+  if (!s.includes(from)) {
+    throw new Error(`db-rewrite: ${file} template no longer contains the anchor ${JSON.stringify(from.slice(0, 60))}`);
+  }
+  return s.replace(from, () => to);
+}
+
+/**
+ * Rewrite compose.yaml for a Postgres app: a sibling `db` service with a
+ * `pg_isready` healthcheck and its own named volume, the app's DATABASE_URL
+ * pointed at it, and `depends_on` with `service_healthy` so the app's boot-time
+ * `webjs db migrate` never races the database's startup.
+ *
+ * @param {string} s
+ * @param {string} dbName fold-stable database name (toDatabaseName(appName))
+ * @returns {string}
+ */
+export function postgresCompose(s, dbName) {
+  const url = `postgres://${LOCAL_PG_USER}:${LOCAL_PG_PASSWORD}@db:5432/${dbName}`;
+  let out = s;
+  out = replaceOnce(out, 'using the same Dockerfile, one service.',
+    'using the same Dockerfile, plus a Postgres service.', 'compose.yaml');
+  out = replaceOnce(out,
+    "# In production your host provides DATABASE_URL + AUTH_SECRET. Locally this\n" +
+    "# uses the scaffold's SQLite file on a named volume so data survives\n" +
+    '# `compose down`.',
+    '# In production your host provides DATABASE_URL + AUTH_SECRET. Locally this\n' +
+    '# runs Postgres in the `db` service on a named volume so data survives\n' +
+    '# `compose down`.',
+    'compose.yaml');
+  out = replaceOnce(out,
+    '      # SQLite on a volume for local dev. For production, scaffold with\n' +
+    '      # --db postgres (or swap db/columns.server.ts + db/connection.server.ts\n' +
+    '      # for the pg variant) and point DATABASE_URL at your managed Postgres.\n' +
+    '      DATABASE_URL: file:/data/dev.db\n',
+    '      # The `db` service below. In production, point DATABASE_URL at your\n' +
+    '      # managed Postgres instead.\n' +
+    `      DATABASE_URL: ${url}\n`,
+    'compose.yaml');
+  // The app no longer owns a db file, so it needs no volume; it waits for a
+  // healthy database instead, because `webjs start` migrates before serving.
+  out = replaceOnce(out,
+    '    volumes:\n      - app-data:/data\n',
+    '    depends_on:\n      db:\n        condition: service_healthy\n',
+    'compose.yaml');
+  out = replaceOnce(out,
+    '\nvolumes:\n  app-data:\n',
+    '\n' +
+    '  db:\n' +
+    `    image: ${PG_IMAGE}\n` +
+    '    environment:\n' +
+    `      POSTGRES_USER: ${LOCAL_PG_USER}\n` +
+    `      POSTGRES_PASSWORD: ${LOCAL_PG_PASSWORD}\n` +
+    `      POSTGRES_DB: ${dbName}\n` +
+    '    volumes:\n' +
+    '      - db-data:/var/lib/postgresql/data\n' +
+    '    healthcheck:\n' +
+    `      test: ["CMD-SHELL", "pg_isready -U ${LOCAL_PG_USER} -d ${dbName}"]\n` +
+    '      interval: 5s\n' +
+    '      timeout: 3s\n' +
+    '      retries: 10\n' +
+    '\n' +
+    'volumes:\n' +
+    '  db-data:\n',
+    'compose.yaml');
+  return out;
+}
+
+/**
+ * Rewrite the GitHub Actions CI workflow for a Postgres app: a `postgres`
+ * service container with a health check (the job waits until it is healthy
+ * before the first step) and DATABASE_URL pointed at it on localhost.
+ *
+ * @param {string} s
+ * @param {string} dbName
+ * @returns {string}
+ */
+export function postgresCi(s, dbName) {
+  return replaceOnce(s,
+    '    env:\n      DATABASE_URL: file:./ci.db\n',
+    '    env:\n' +
+    `      DATABASE_URL: postgres://${LOCAL_PG_USER}:${LOCAL_PG_PASSWORD}@localhost:5432/${dbName}\n` +
+    '    # The app is scaffolded with --db postgres, so CI runs against a real\n' +
+    '    # Postgres. The job waits for the health check before the first step.\n' +
+    '    services:\n' +
+    '      postgres:\n' +
+    `        image: ${PG_IMAGE}\n` +
+    '        env:\n' +
+    `          POSTGRES_USER: ${LOCAL_PG_USER}\n` +
+    `          POSTGRES_PASSWORD: ${LOCAL_PG_PASSWORD}\n` +
+    `          POSTGRES_DB: ${dbName}\n` +
+    '        ports:\n' +
+    '          - 5432:5432\n' +
+    '        options: >-\n' +
+    `          --health-cmd "pg_isready -U ${LOCAL_PG_USER} -d ${dbName}"\n` +
+    '          --health-interval 5s\n' +
+    '          --health-timeout 5s\n' +
+    '          --health-retries 10\n',
+    '.github/workflows/ci.yml');
+}

package/lib/doctor/codes.js

@@ -49,6 +49,7 @@ export const DOCTOR_CODES = {
   'Component elision (what the browser drops)': 'ELISION_COMPONENTS',
   'Static build outputs (dev.regenerate freshness)': 'STATIC_ASSET_FRESHNESS',
   'Asset urls (unmarked stylesheet links)': 'UNMARKED_ASSET_LINKS',
+  'workspace-overrides': 'WORKSPACE_OVERRIDES',
 };
 
 /**

package/lib/doctor/probes/workspace-overrides.js

@@ -0,0 +1,79 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, relative, sep, matchesGlob } from 'node:path';
+
+/**
+ * @typedef {import('../codes.js').DoctorResult} DoctorResult
+ */
+
+/** @param {string} p */
+function readJson(p) {
+  try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+/**
+ * The workspace globs a root package.json declares (npm / bun / yarn), in
+ * either the array form or yarn's `{ packages: [...] }` form, else null.
+ * @param {any} pkg
+ * @returns {string[] | null}
+ */
+function workspaceGlobs(pkg) {
+  const ws = pkg?.workspaces;
+  if (Array.isArray(ws)) return ws;
+  if (ws && Array.isArray(ws.packages)) return ws.packages;
+  return null;
+}
+
+/**
+ * Find the workspace root that `appDir` is a MEMBER of: the nearest ancestor
+ * whose package.json `workspaces` globs match the app's relative path. A plain
+ * parent with a package.json but no matching glob is not a workspace for this
+ * app, so it does not count.
+ * @param {string} appDir
+ * @returns {string | null}
+ */
+export function findWorkspaceRoot(appDir) {
+  let dir = dirname(appDir);
+  for (;;) {
+    const pkg = existsSync(join(dir, 'package.json')) ? readJson(join(dir, 'package.json')) : null;
+    const globs = workspaceGlobs(pkg);
+    if (globs) {
+      const rel = relative(dir, appDir).split(sep).join('/');
+      const included = globs.filter((g) => !g.startsWith('!')).some((g) => matchesGlob(rel, g.replace(/^\.\//, '').replace(/\/$/, '')));
+      const excluded = globs.filter((g) => g.startsWith('!')).some((g) => matchesGlob(rel, g.slice(1).replace(/^\.\//, '')));
+      if (included && !excluded) return dir;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+/**
+ * CHECK (#1492), dependency overrides declared in a workspace MEMBER. npm and
+ * bun honour `overrides` (and yarn / bun `resolutions`) only in the workspace
+ * ROOT package.json, so the same block in a member is silently ignored and the
+ * security floor it encodes (the scaffold's puppeteer-core and basic-ftp
+ * floors) never applies. WARN naming the root to move it to; PASS otherwise.
+ * @param {string} appDir
+ * @returns {DoctorResult}
+ */
+export function checkWorkspaceOverrides(appDir) {
+  const name = 'workspace-overrides';
+  const pkg = readJson(join(appDir, 'package.json'));
+  const keys = ['overrides', 'resolutions'].filter((k) => pkg && pkg[k] && typeof pkg[k] === 'object' && Object.keys(pkg[k]).length);
+  if (keys.length === 0) {
+    return { name, status: 'pass', message: 'No dependency overrides in this package.json.' };
+  }
+  const root = findWorkspaceRoot(appDir);
+  if (!root) {
+    return { name, status: 'pass', message: `\`${keys.join('` / `')}\` apply: this app is not a workspace member.` };
+  }
+  const rel = relative(appDir, join(root, 'package.json')) || 'package.json';
+  return {
+    name,
+    status: 'warn',
+    message: `package.json declares \`${keys.join('` / `')}\`, but this app is a member of the workspace at ${rel}, `
+      + 'and package managers honour overrides only at the workspace root, so these are ignored.',
+    fix: `Move the \`${keys.join('` / `')}\` block into ${rel} (merge it with any the root already has).`,
+  };
+}

package/lib/doctor/runner.js

@@ -11,6 +11,7 @@ import { checkElisionCarriers, checkElisionComponents } from './probes/elision.j
 import { checkStaticAssetFreshness } from './probes/static-asset-freshness.js';
 import { checkUnmarkedAssetLinks } from './probes/unmarked-asset-links.js';
 import { checkFrameworkResolves, checkFrameworkLinks } from './probes/framework-resolves.js';
+import { checkWorkspaceOverrides } from './probes/workspace-overrides.js';
 
 /**
  * @typedef {import('./codes.js').DoctorResult} DoctorResult
@@ -64,6 +65,7 @@ export async function runDoctorChecks(appDir, opts = {}) {
     checkElisionComponents(elision),
     checkStaticAssetFreshness(appDir),
     checkUnmarkedAssetLinks(appDir),
+    Promise.resolve(checkWorkspaceOverrides(appDir)),
   ]);
   // Attach the stable machine code to every result (#975). Centralized here so
   // each check function stays free of the code-contract concern.

package/lib/package-manager.js

@@ -0,0 +1,93 @@
+/**
+ * Package-manager detection for `webjs create` (#1494).
+ *
+ * KEEP IN SYNC with `packages/ui/src/utils/package-manager.js`, the copy
+ * `webjs ui add` uses. The two published
+ * packages carry the same small module rather than one importing the other,
+ * so a `@webjsdev/cli` release can never fail at import time against an older
+ * `@webjsdev/ui` that lacks the export. `packages/cli/test/package-manager.test.mjs`
+ * asserts both copies agree on every fixture.
+ *
+ * Detection order (with `prefer: 'lockfile'`, the default):
+ *   1. A lockfile in `cwd` or any ancestor. The walk stops at the first
+ *      workspace root (a package.json declaring `workspaces`, or a
+ *      `pnpm-workspace.yaml`) or at the filesystem root, so an app nested in a
+ *      workspace finds the root's lockfile. Within one directory the order is
+ *      pnpm, yarn, bun (`bun.lock`, the text lockfile Bun writes since 1.2,
+ *      and the older binary `bun.lockb`), then npm.
+ *   2. `npm_config_user_agent`, which npm, pnpm, yarn and bun set when they
+ *      run a script or a `dlx` / `bunx` / `npx` binary.
+ *   3. `npm`.
+ * With `prefer: 'agent'` steps 1 and 2 swap, which suits `webjs create`: the
+ * tool that invoked it is the strongest signal for a directory that has no
+ * lockfile yet.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+/** @typedef {'npm'|'pnpm'|'yarn'|'bun'} PackageManager */
+
+/** Lockfile name to manager, in per-directory precedence order. */
+const LOCKFILES = /** @type {const} */ ([
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['yarn.lock', 'yarn'],
+  ['bun.lock', 'bun'],
+  ['bun.lockb', 'bun'],
+  ['package-lock.json', 'npm'],
+  ['npm-shrinkwrap.json', 'npm'],
+]);
+
+/**
+ * Whether `dir` is a workspace root, where the lockfile walk stops.
+ * @param {string} dir
+ * @returns {boolean}
+ */
+function isWorkspaceRoot(dir) {
+  if (existsSync(join(dir, 'pnpm-workspace.yaml'))) return true;
+  const pkgPath = join(dir, 'package.json');
+  if (!existsSync(pkgPath)) return false;
+  try {
+    return Boolean(JSON.parse(readFileSync(pkgPath, 'utf8')).workspaces);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Walk up from `cwd` looking for a lockfile.
+ * @param {string} cwd
+ * @returns {PackageManager | null}
+ */
+export function managerFromLockfile(cwd) {
+  let dir = resolve(cwd);
+  for (;;) {
+    for (const [file, manager] of LOCKFILES) {
+      if (existsSync(join(dir, file))) return manager;
+    }
+    if (isWorkspaceRoot(dir)) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+/**
+ * Read the manager from an `npm_config_user_agent` value such as
+ * `bun/1.3.14 npm/? node/v24.0.0 linux x64`.
+ * @param {string | undefined} ua
+ * @returns {PackageManager | null}
+ */
+export function managerFromUserAgent(ua) {
+  const name = String(ua || '').split('/')[0];
+  return name === 'pnpm' || name === 'yarn' || name === 'bun' || name === 'npm' ? name : null;
+}
+
+/**
+ * @param {{ cwd?: string | null, env?: Record<string, string | undefined>, prefer?: 'lockfile' | 'agent' }} [opts]
+ * @returns {PackageManager}
+ */
+export function detectPackageManager({ cwd = null, env = process.env, prefer = 'lockfile' } = {}) {
+  const fromLock = () => (cwd ? managerFromLockfile(cwd) : null);
+  const fromAgent = () => managerFromUserAgent(env.npm_config_user_agent);
+  return (prefer === 'agent' ? fromAgent() ?? fromLock() : fromLock() ?? fromAgent()) ?? 'npm';
+}

package/lib/run-tasks.js

@@ -12,7 +12,7 @@ import { delimiter, dirname, join } from 'node:path';
  * @param {string} cwd
  * @param {NodeJS.ProcessEnv} [env]
  */
-function envWithLocalBin(cwd, env = process.env) {
+export function envWithLocalBin(cwd, env = process.env) {
   const bins = [];
   let dir = cwd;
   // Walk up to the filesystem root, collecting each node_modules/.bin.
@@ -44,7 +44,10 @@ export async function runBeforeSteps(steps, cwd, opts = {}) {
     if (opts.onStep) opts.onStep(step);
     const code = await new Promise((res) => {
       const c = spawn(step, { shell: true, stdio: 'inherit', cwd, env });
-      c.on('exit', (code) => res(code ?? 0));
+      // A child killed by a signal exits with `code` null and `signal` set.
+      // That is a failure (an OOM-killed `db migrate` must not boot the
+      // server over a half-applied schema), so it maps to 1, never 0.
+      c.on('exit', (code, signal) => res(code ?? (signal ? 1 : 0)));
       c.on('error', () => res(1));
     });
     if (code !== 0) return { ok: false, step, code };
@@ -52,6 +55,23 @@ export async function runBeforeSteps(steps, cwd, opts = {}) {
   return { ok: true };
 }
 
+/**
+ * Quote one argv entry for a POSIX shell so it survives `shell: true` as ONE
+ * word with no expansion. A plain word passes through untouched; anything
+ * else is single-quoted, with an embedded single quote spliced as `'\''`.
+ * Used by `webjs db <verb> [args]` (#1468) to append the CLI's args to a
+ * mapped command string, so `--name "add users"` reaches the ORM as one arg
+ * and a `$` / `;` / glob is never expanded, matching what the drizzle-kit
+ * default (a real argv, no shell) already guarantees.
+ *
+ * @param {string} arg
+ * @returns {string}
+ */
+export function shellQuote(arg) {
+  if (/^[A-Za-z0-9_\-.\/=:@,+%]+$/.test(arg)) return arg;
+  return `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+
 /**
  * Spawn the configured dev `parallel` tasks (#550) as long-lived children and
  * return a killer that tears them ALL down (idempotent), so a watcher cannot
@@ -90,7 +110,7 @@ export function startParallelTasks(commands, cwd, opts = {}) {
  *
  * @param {import('node:child_process').ChildProcess} child
  */
-function killChildTree(child) {
+export function killChildTree(child) {
   try {
     if (typeof child.pid === 'number') process.kill(-child.pid, 'SIGTERM');
     else child.kill();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.10.57",
+  "version": "0.10.59",
   "type": "module",
   "description": "The CLI for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Runs the dev and production servers, scaffolds apps, validates conventions, and drives the database. Node 24+ or Bun.",
   "bin": {
@@ -18,8 +18,8 @@
   ],
   "dependencies": {
     "@webjsdev/mcp": "^0.1.0",
-    "@webjsdev/server": "^0.8.0",
-    "@webjsdev/ui": "^0.3.1"
+    "@webjsdev/server": "^0.8.68",
+    "@webjsdev/ui": "^0.3.15"
   },
   "publishConfig": {
     "access": "public"

package/templates/.agents/rules/workflow.md

@@ -50,15 +50,21 @@ Read `AGENTS.md` first. Full hosted docs are at https://webjs.dev/docs.
 2. Browser tests in `test/<feature>/browser/*.test.js` for hydration, DOM, slots,
    and the client router.
 3. Documentation stays in sync on the SAME PR as the code, never a follow-up.
-4. `npm run check` must pass (correctness), and so must `npm run doctor`
-   (project health). CI runs both. Doctor fails on whatever your `package.json`
-   `webjs.doctor.gate` marks `error`, which starts as the un-versioned
-   stylesheet link check, plus the two hard toolchain checks that default to
-   `error` with no gate entry at all: `NODE_VERSION` (the Node floor) and
-   `TSCONFIG_ERASABLE` (`erasableSyntaxOnly` missing from an existing
-   tsconfig), either of which would 500 the app at runtime. Everything else it
-   reports is a warning that cannot fail the build. Widen or narrow the gate in
-   `package.json` rather than in the workflow.
+4. `npm run ci` must pass before you push. It runs the step list declared in
+   `package.json` under `webjs.ci`, one result line per step: `webjs check`
+   (correctness), `webjs doctor` (project health), `webjs typecheck`, a
+   dependency audit, then the server, browser, and e2e test layers. The GitHub
+   workflow runs the same list on every PR and push, so the two cannot drift;
+   `npm run ci -- --only Tests` runs one layer while you iterate, and
+   `npm run ci -- --signoff` posts a green commit status (basecamp/gh-signoff)
+   a branch-protection rule can require. Doctor fails on whatever your
+   `package.json` `webjs.doctor.gate` marks `error`, which starts as the
+   un-versioned stylesheet link check, plus the two hard toolchain checks that
+   default to `error` with no gate entry at all: `NODE_VERSION` (the Node
+   floor) and `TSCONFIG_ERASABLE` (`erasableSyntaxOnly` missing from an
+   existing tsconfig), either of which would 500 the app at runtime. Everything
+   else it reports is a warning that cannot fail the build. Widen or narrow the
+   gate, and the step list, in `package.json` rather than in the workflow.
 
 How a PR gets REVIEWED is deliberately not specified here. Use whatever your
 team already does. WebJs has opinions about the code (the conventions above,