@lensmcp/cluster 1.16.13 → 1.16.15

package/basic-ssl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"basic-ssl.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/basic-ssl.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAKnD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAgB,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM,CAoCzG;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMrD"}
+{"version":3,"file":"basic-ssl.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/basic-ssl.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAKnD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAgB,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,MAAM,CA0CzG;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMrD"}

package/basic-ssl.js

@@ -35,6 +35,15 @@ exports.CA_CERT_FILE = 'lensmcp-local-ca.crt';
 const LEGACY_CA_CERT_FILE = 'davnx-local-ca.crt';
 const CA_KEY_FILE = '_ca-key.pem';
 function getCertificateSync(cacheDir, name = 'lensmcp.dev', domains = []) {
+    // Resolve the CA FIRST: loadOrCreateCa mints a fresh CA (and sweeps every OLD-CA leaf) whenever the CA
+    // cert is missing/expired — e.g. after a rebrand renamed the CA file. Doing this BEFORE the leaf-cache read
+    // is what makes a CA change actually take effect: otherwise a stale, old-CA-signed leaf short-circuits the
+    // mint and the rebrand never applies (the bug that needed a manual cache clear). On a normal run the CA is
+    // unchanged, nothing is swept, and the SAN-keyed leaf cache below still fast-paths.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const forge = require('node-forge');
+    fs.mkdirSync(cacheDir, { recursive: true });
+    const ca = loadOrCreateCa(cacheDir, forge);
     // The SAN set is part of the cache key: adding a gateway hostname must
     // mint a fresh leaf, not serve a cached one that lacks the new SAN.
     const sanKey = crypto
@@ -46,16 +55,12 @@ function getCertificateSync(cacheDir, name = 'lensmcp.dev', domains = []) {
     try {
         const stat = fs.statSync(leafPath);
         if (Date.now() - stat.ctimeMs < LEAF_MAX_AGE_MS) {
-            return fs.readFileSync(leafPath, 'utf8');
+            return fs.readFileSync(leafPath, 'utf8'); // reached only when the CA was NOT just re-minted (a mint sweeps leaves)
         }
     }
     catch {
         /* no cache yet */
     }
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const forge = require('node-forge');
-    fs.mkdirSync(cacheDir, { recursive: true });
-    const ca = loadOrCreateCa(cacheDir, forge);
     const pem = createLeafCertificate(forge, ca, name, domains);
     fs.writeFileSync(leafPath, pem);
     // Stale leaves and the pre-1.3.4 self-signed cache just rot here — sweep

package/executors/gateway/runtime/lens-children.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAQnF,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B;;6GAEyG;IACzG,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9E,wDAAwD;IACxD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CA8MvH"}
+{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAQnF,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B;;6GAEyG;IACzG,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9E,wDAAwD;IACxD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CAkNvH"}

package/executors/gateway/runtime/lens-children.js

@@ -206,6 +206,9 @@ function createLensChildren(rt, obs, options) {
         const eventFile = path.join(fragment.root, '.lensmcp', 'events.jsonl'); // the registered workspace's OWN bus
         removedLabels.delete(label); // a fresh registration after a prior unregister → allow auto-heal again
         rt.registry.appendRoutes(fragment.wsKey, [{ host: lensHost, prefix: lensBase, project: observability_1.LENS_DASHBOARD_PROJECT, target: `http://localhost:${port}` }]);
+        // Publish the hosted workspace to the GLOBAL chooser registry (keyed on the DAEMON's pid — the daemon is
+        // what keeps it live), so `lensmcp.local/` lists it. Reaped on unregister below.
+        (0, workspace_registry_1.registerWorkspace)({ key: fragment.wsKey, root: fragment.root, base: lensBase, pid: process.pid, updatedAt: new Date().toISOString() });
         console.log(`[gateway] hosting dashboard for workspace '${fragment.wsKey}' → http://localhost:${port} (routed at https://${lensHost}${lensBase}/)`);
         emit('info', `lens dashboard up: ${lensHost}${lensBase} → :${port}`, 'cluster-lens-dashboard', { kind: 'lens-dashboard-up', host: lensHost, port, base: lensBase });
         spawnManagedChild(label, process.execPath, [bundle], {
@@ -216,6 +219,7 @@ function createLensChildren(rt, obs, options) {
         return () => {
             removedLabels.add(label); // stop auto-heal from resurrecting it
             usedDashboardPorts.delete(port);
+            (0, workspace_registry_1.unregisterWorkspace)(fragment.wsKey); // drop it from the chooser registry
             try {
                 labeledChildren.get(label)?.kill('SIGTERM');
             }

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4CrD;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CA+PvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4CrD;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAwQvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -166,7 +166,16 @@ function createServiceLayer(rt, obs) {
             // means env vars DO reach the pod, so the east-west key + CA propagate.
             // LENSMCP_WS_KEY (the SERVICE's owning workspace) namespaces its pod sock dir
             // ($TMPDIR/<wsKey>/<service>-devserver) — the namespaced pool the daemon scans for this fragment.
-            env: { ...process.env, NX_DAEMON: 'false', ...(svc.wsKey ? { LENSMCP_WS_KEY: svc.wsKey } : {}), ...eastWestEnv(rt, svc.project) },
+            // LENSMCP_EVENT_FILE points a REGISTERED workspace's pods at ITS OWN bus (<root>/.lensmcp/events.jsonl),
+            // so its dashboard shows its live traces, not the daemon's. The daemon's own services keep rt.eventFile
+            // exactly (svc.root === rt.root), so single-workspace behavior is unchanged.
+            env: {
+                ...process.env,
+                NX_DAEMON: 'false',
+                ...(svc.wsKey ? { LENSMCP_WS_KEY: svc.wsKey } : {}),
+                LENSMCP_EVENT_FILE: svc.wsKey === rt.wsKey ? rt.eventFile : path.join(svc.root, '.lensmcp', 'events.jsonl'),
+                ...eastWestEnv(rt, svc.project),
+            },
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         svc.lastErrors = [];

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAqNxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA0OxB"}

package/executors/gateway/runtime/server.js

@@ -140,6 +140,10 @@ async function startGateway(options, context) {
     // REGISTERS its fragment here instead of fighting for :443, and the daemon HOSTS its services (spawns
     // them, model A) + its dashboard (planning/multi-workspace-gateway.md P3). Harmless for a lone gateway.
     const dashboardReapers = new Map();
+    // Assigned after the TLS servers are built (below) — re-mints the gateway cert with the CURRENT route
+    // hosts and hot-swaps it, so a workspace that registers AFTER boot gets its hostnames into the cert SANs
+    // (otherwise the browser sees ERR_CERT_COMMON_NAME_INVALID for the new workspace's hosts).
+    let refreshCert = () => { };
     let controlServer;
     try {
         controlServer = (0, control_1.startControlServer)({
@@ -151,10 +155,12 @@ async function startGateway(options, context) {
                 const reap = lens.hostWorkspaceDashboard(fragment);
                 if (reap)
                     dashboardReapers.set(fragment.wsKey, reap);
+                refreshCert(); // the new workspace's hosts must join the gateway cert SANs
             },
             onUnregister: (fragment) => {
                 dashboardReapers.get(fragment.wsKey)?.();
                 dashboardReapers.delete(fragment.wsKey);
+                refreshCert();
             },
         });
     }
@@ -214,12 +220,15 @@ async function startGateway(options, context) {
     // --- TLS + listeners --------------------------------------------------------
     let pem;
     let caPath;
+    let mintCert;
     if (https) {
         // eslint-disable-next-line @typescript-eslint/no-require-imports
         const basicSsl = require('../../../basic-ssl');
         const cacheDir = (0, service_keys_1.gatewayCacheDir)(context.root);
-        const hosts = routes.map((r) => r.host).filter((h) => !!h);
-        pem = basicSsl.getCertificateSync(cacheDir, 'gateway', hosts);
+        // SANs = the CURRENT route hosts. `rt.routes` is rebuilt live on register, so a re-mint (refreshCert
+        // below) automatically includes a newly-registered workspace's hostnames.
+        mintCert = () => basicSsl.getCertificateSync(cacheDir, 'gateway', rt.routes.map((r) => r.host).filter((h) => !!h));
+        pem = mintCert();
         caPath = basicSsl.caCertPath(cacheDir);
     }
     const servers = [];
@@ -253,6 +262,18 @@ async function startGateway(options, context) {
         });
         servers.push(server);
     }
+    // Now that the TLS servers exist, wire the live cert refresh: on a workspace register/unregister the
+    // control endpoint calls this to re-mint the gateway cert with the CURRENT route hosts and hot-swap it
+    // into every HTTP/2 secure server (setSecureContext), so a dynamically-registered workspace's hostnames
+    // are covered (no ERR_CERT_COMMON_NAME_INVALID).
+    if (mintCert) {
+        refreshCert = () => {
+            const fresh = mintCert();
+            for (const s of servers) {
+                s.setSecureContext?.({ key: fresh, cert: fresh });
+            }
+        };
+    }
     console.log('[gateway] Routes:');
     for (const r of routes) {
         const dest = r.pool ? `pods@${r.pool.dir}` : r.target;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.13",
+  "version": "1.16.15",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.13",
-    "@lensmcp/nx-plugin": "1.16.13",
+    "@lensmcp/node-instrumentation": "1.16.15",
+    "@lensmcp/nx-plugin": "1.16.15",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",