@lensmcp/cluster 1.16.26 → 1.16.27

package/create-webpack-dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-webpack-dev.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/create-webpack-dev.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAOtF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,qBAAqB,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA2CD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAoItF"}
+{"version":3,"file":"create-webpack-dev.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/create-webpack-dev.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQtF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,qBAAqB,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA2CD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgKtF"}

package/create-webpack-dev.js

@@ -7,6 +7,7 @@ const fs = tslib_1.__importStar(require("node:fs"));
 const path = tslib_1.__importStar(require("node:path"));
 const webpack_node_externals_1 = tslib_1.__importDefault(require("webpack-node-externals"));
 const build_scope_patterns_1 = require("./build-scope-patterns");
+const tsgo_check_plugin_1 = require("./tsgo-check-plugin");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const webpack = require('webpack');
 class DevServerReloadPlugin {
@@ -45,6 +46,17 @@ class DevServerReloadPlugin {
 function createDevWebpackConfig(options) {
     const { appRoot, outputDir, main, tsConfig, workspaceRoot, assets = [], port, memoryLimit = 8192, buildLibsFromSource = true, orgScopes = [], bundlePackages = [], additionalEntryPoints = [], nodeExternalsConfig: userNodeExternalsConfig, webpackConfigPath, } = options;
     const { allowlistPatterns, scopePrefixes, scopePatterns } = (0, build_scope_patterns_1.buildScopePatterns)(orgScopes);
+    // Type-checking mode (LENSMCP_TYPECHECK): default = the resident fork-ts-checker pair (async,
+    // feeds the lens `error TS` service-error signal); 'off' = none (fastest, quietest — the signal
+    // is traded away); 'tsgo' = zero-resident cold re-checks via @typescript/native-preview (same
+    // signal, no idle memory — see tsgo-check-plugin.ts). tsgo falls back to fork-ts-checker when
+    // the binary isn't installed in the workspace, so the flag can ship ahead of the devDep.
+    const typecheckMode = process.env.LENSMCP_TYPECHECK;
+    const tsgoBin = typecheckMode === 'tsgo' ? (0, tsgo_check_plugin_1.resolveTsgoBin)(workspaceRoot, process.env.LENSMCP_TSGO_BIN) : null;
+    if (typecheckMode === 'tsgo' && !tsgoBin) {
+        console.warn(`[serve] ${options.appName}: LENSMCP_TYPECHECK=tsgo but no tsgo binary (yarn add -D @typescript/native-preview) — falling back to fork-ts-checker`);
+    }
+    const useTsgo = !!tsgoBin;
     // Build combined allowlist: orgScopes + bundlePackages + user-provided
     const bundlePatterns = bundlePackages.map((pkg) => new RegExp(`^${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(/|$)`));
     const combinedAllowlist = [
@@ -126,12 +138,25 @@ function createDevWebpackConfig(options) {
                 outputHashing: 'none',
                 generatePackageJson: false,
                 watchDependencies: true,
-                typeCheckOptions: {
-                    async: true,
-                },
+                // Type checking = the fork-ts-checker pair (2 worker processes, ~80MB per service) AND the
+                // source of the in-pod `error TS…` lines the gateway sniffs into the lens "service error"
+                // signal. Default ON. `LENSMCP_TYPECHECK=off` trades the signal for memory/CPU;
+                // `LENSMCP_TYPECHECK=tsgo` keeps the signal at zero resident cost (the TsgoCheckPlugin
+                // below replaces the resident pair with debounced cold native checks).
+                typeCheckOptions: process.env.LENSMCP_TYPECHECK === 'off' || useTsgo ? false : { async: true },
                 buildLibsFromSource,
             }),
             new DevServerReloadPlugin(port, options.httpsReload === true),
+            ...(useTsgo
+                ? [
+                    new tsgo_check_plugin_1.TsgoCheckPlugin({
+                        appName: options.appName,
+                        tsConfig,
+                        workspaceRoot,
+                        ...(process.env.LENSMCP_TSGO_BIN ? { binPath: process.env.LENSMCP_TSGO_BIN } : {}),
+                    }),
+                ]
+                : []),
         ],
         snapshot: { managedPaths: [/^(.+?[\\/])?node_modules[\\/]/] },
         watch: true,

package/executors/gateway/gateway.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.impl.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAA8B,eAAe,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAa/B"}
+{"version":3,"file":"gateway.impl.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAGlE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAA8B,eAAe,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B/B"}

package/executors/gateway/gateway.impl.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = gatewayExecutor;
 const gateway_lib_1 = require("./gateway.lib");
+const server_1 = require("./runtime/server");
 /**
  * `gateway` executor — ONE https front door for the whole workspace,
  * assembled dynamically from every project's `cluster` declaration:
@@ -20,6 +21,19 @@ const gateway_lib_1 = require("./gateway.lib");
  * without signals; this wrapper only adds the executor contract.
  */
 async function gatewayExecutor(options, context) {
+    // LAST-RESORT netting for the long-running daemon (this executor runs for DAYS): a benign socket
+    // errno that escaped every layer's local handlers — e.g. a dependency emitting 'error' on a socket
+    // it forgot to guard — must cost the ONE connection, never the process. Scoped to exactly the
+    // read/write network errnos; anything else preserves crash semantics (print + exit 1, matching
+    // Node's default). Lives HERE, not in startGateway, so tests driving the lib keep real crashes loud.
+    process.on('uncaughtException', (err) => {
+        if ((err.syscall === 'read' || err.syscall === 'write') && server_1.BENIGN_SOCKET_ERRNOS.has(err.code ?? '')) {
+            console.warn(`[gateway] survived a stray socket ${err.syscall} error (${err.code}) — one connection dropped, the daemon lives`);
+            return;
+        }
+        console.error(err);
+        process.exit(1);
+    });
     let handle;
     try {
         handle = await (0, gateway_lib_1.startGateway)(options, context);

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AA8C/D;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAkRvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AA8C/D;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAoSvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -161,7 +161,16 @@ function createServiceLayer(rt, obs) {
         svc.spawnAt = Date.now();
         // childCount goes as a CLI option, NOT env: nx executes tasks via its
         // daemon, whose environment is not the gateway's — env vars get lost.
-        const proc = (0, node_child_process_1.spawn)('yarn', ['nx', 'run', target, `--childCount=${min}`], {
+        // Invoke the workspace's nx entry DIRECTLY (node + nx/dist/bin/nx.js) instead of through the
+        // `yarn nx` shim: the shim is a ~40MB node process that does nothing after the handoff yet
+        // lives for the service's whole life — ~600MB across a 15-service cluster. Resolved per
+        // svc.root so each hosted workspace runs its own nx; falls back to `yarn nx` when the entry
+        // isn't where node_modules linkers put it (pnp/odd layouts).
+        const nxEntry = path.join(svc.root, 'node_modules', 'nx', 'dist', 'bin', 'nx.js');
+        const [spawnCmd, spawnArgs] = fs.existsSync(nxEntry)
+            ? [process.execPath, [nxEntry, 'run', target, `--childCount=${min}`]]
+            : ['yarn', ['nx', 'run', target, `--childCount=${min}`]];
+        const proc = (0, node_child_process_1.spawn)(spawnCmd, spawnArgs, {
             // The service's OWN workspace root — `rt.root` for the daemon's own workspace, the registered
             // workspace's root for a second one (so ONE daemon hosts several workspaces' devservers — model (A)).
             cwd: svc.root,
@@ -181,6 +190,15 @@ function createServiceLayer(rt, obs) {
             env: {
                 ...process.env,
                 NX_DAEMON: 'false',
+                // NX_ISOLATE_PLUGINS=false: with the daemon off (above), EVERY serve client builds the
+                // project graph itself — and with plugin isolation on (nx's default) each client spawns
+                // 8 plugin-worker processes (~50MB each) that stay ALIVE for the life of the service:
+                // ~400MB of nx machinery per ~50MB service pod, ~4-5GB across a 13-service cluster
+                // (measured tetros 2026-07-25). Isolation-off loads plugins in-process: the graph is
+                // identical and zero workers spawn (nx itself runs isolation-off in sandboxes/WASM —
+                // a supported mode). NOTE this is authoritative for spawned clients: nx's dotenv load
+                // never overrides an already-set env var, so a workspace .env cannot flip it back on.
+                NX_ISOLATE_PLUGINS: 'false',
                 ...(svc.wsKey ? { LENSMCP_WS_KEY: svc.wsKey } : {}),
                 LENSMCP_EVENT_FILE: svc.wsKey === rt.wsKey ? rt.eventFile : path.join(svc.root, '.lensmcp', 'events.jsonl'),
                 ...eastWestEnv(rt, svc.project),

package/executors/gateway/runtime/server.d.ts

@@ -12,5 +12,8 @@ import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions, Route } from
  * unless the insecure opt-in is set).
  */
 export declare function buildEdgeVerifierPool(getRoutes: () => Route[]): EdgeVerifierPool;
+/** Client-abort errnos that are NORMAL front-door traffic (a closed tab, a sleeping laptop, a canceled
+ *  HMR socket) — dropped quietly. Anything else on an inbound socket is logged before the drop. */
+export declare const BENIGN_SOCKET_ERRNOS: ReadonlySet<string>;
 export declare function startGateway(options: GatewayRuntimeOptions, context: GatewayContext): Promise<GatewayHandle>;
 //# sourceMappingURL=server.d.ts.map

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AA0BxH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,KAAK,EAAE,GAAG,gBAAgB,CA4ChF;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAmRxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AA0BxH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,KAAK,EAAE,GAAG,gBAAgB,CA4ChF;AAED;mGACmG;AACnG,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAA8E,CAAC;AAkBpI,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA8RxB"}

package/executors/gateway/runtime/server.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BENIGN_SOCKET_ERRNOS = void 0;
 exports.buildEdgeVerifierPool = buildEdgeVerifierPool;
 exports.startGateway = startGateway;
 const tslib_1 = require("tslib");
@@ -112,6 +113,24 @@ function buildEdgeVerifierPool(getRoutes) {
         },
     };
 }
+/** Client-abort errnos that are NORMAL front-door traffic (a closed tab, a sleeping laptop, a canceled
+ *  HMR socket) — dropped quietly. Anything else on an inbound socket is logged before the drop. */
+exports.BENIGN_SOCKET_ERRNOS = new Set(['ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'ECONNABORTED', 'ECANCELED']);
+/** Attach the inbound-socket error guard. EVERY socket the front door accepts gets an 'error' listener
+ *  the moment it exists — both the raw TCP socket ('connection') and the post-handshake TLSSocket
+ *  ('secureConnection', a DIFFERENT emitter). A client abort is routine, but with NO listener Node turns
+ *  it into an UNHANDLED 'error' event that kills the whole daemon (observed: a days-old gateway died on
+ *  `read ECONNRESET` at TLSWrap.onStreamRead — the exposed window is a socket the http layer has handed
+ *  off, e.g. right after an 'upgrade', where no internal handler is attached any more). Handling =
+ *  destroy the ONE socket; never the process. */
+function guardInboundSocket(socket) {
+    socket.on('error', (err) => {
+        if (!exports.BENIGN_SOCKET_ERRNOS.has(err.code ?? '')) {
+            console.warn(`[gateway] inbound socket error (${err.code ?? err.message}) — dropping this connection only`);
+        }
+        socket.destroy();
+    });
+}
 async function startGateway(options, context) {
     // NB: this local `https` (TLS-on flag) deliberately SHADOWS the `node:https`
     // module — which is why TLS/agents are reached via `require('node:https')`.
@@ -303,6 +322,18 @@ async function startGateway(options, context) {
             : http.createServer(handler);
         server.on('upgrade', upgrade);
         server.on('error', (err) => console.error(`[gateway] port ${port}: ${err.code}`));
+        // Inbound-socket resilience (the ECONNRESET-crash fix): guard every accepted socket, and end
+        // handshake-phase ('tlsClientError') / H1 parse-phase ('clientError') faults on the ONE connection.
+        // Registering 'clientError' replaces Node's default 400-writer, so keep its semantics: a best-effort
+        // 400 on a still-writable socket, then destroy.
+        server.on('connection', guardInboundSocket);
+        server.on('secureConnection', guardInboundSocket); // never fires on a plain-http server — harmless
+        server.on('tlsClientError', (_err, tlsSocket) => tlsSocket.destroy());
+        server.on('clientError', (err, socket) => {
+            if (err.code !== 'ECONNRESET' && socket.writable)
+                socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+            socket.destroy();
+        });
         // h2 SESSION resilience: without a `sessionError` handler ANY session-level
         // fault (a client GOAWAY mid-burst, a flood-protection trip, a decode error)
         // is unhandled → Node tears the session down, failing EVERY sibling stream at

package/executors/gateway/runtime/upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,cAAc,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CAqChE"}
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,cAAc,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CA6ChE"}

package/executors/gateway/runtime/upgrade.js

@@ -59,5 +59,13 @@ function createUpgrade(deps) {
         }
         proxy.proxy.ws(req, socket, head, { target, changeOrigin: !route.pool, agent: proxy.agentForTarget(target) }, () => socket.destroy());
     };
-    return (req, socket, head) => { void run(req, socket, head); };
+    return (req, socket, head) => {
+        // Guard the handed-off socket IMMEDIATELY: on 'upgrade' the http layer removes its OWN listeners,
+        // so until proxy.ws attaches handlers (an `await` away in `run`) a client abort (ECONNRESET — an
+        // HMR socket torn mid-upgrade) would be an unhandled 'error' event → the whole daemon dies. And a
+        // rejection out of `run` (a throwing auth/hook) must likewise cost the ONE socket, never the
+        // process — a floating promise rejection is fatal by default.
+        socket.on('error', () => socket.destroy());
+        run(req, socket, head).catch(() => socket.destroy());
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.26",
+  "version": "1.16.27",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.26",
-    "@lensmcp/nx-plugin": "1.16.26",
+    "@lensmcp/node-instrumentation": "1.16.27",
+    "@lensmcp/nx-plugin": "1.16.27",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",

package/tsgo-check-plugin.d.ts

@@ -0,0 +1,61 @@
+/**
+ * TsgoCheckPlugin — dev type checking with ZERO resident memory (`LENSMCP_TYPECHECK=tsgo`).
+ *
+ * The default fork-ts-checker keeps an incremental tsc PROGRAM resident between saves — a
+ * 2-worker pair (~80MB+) per service, ~1GB across a 13-service cluster, alive even when nobody
+ * saves. tsgo (@typescript/native-preview, the native TS compiler) full-checks one of these
+ * services cold in ~1-3s, so instead of holding a program we re-check COLD after each successful
+ * rebuild (debounced, killing any in-flight check): idle cost is exactly zero.
+ *
+ * The output CONTRACT is the point: `--pretty false` prints classic `file.ts(1,2): error TS1234:`
+ * lines to the executor's console, which the gateway sniffs (`error TS\d+`) into the lens
+ * "service error" signal — the same wire the fork-ts-checker fed. Advisory like
+ * `typeCheckOptions.async: true`: a type error never fails or blocks the webpack build.
+ *
+ * SHIM tsconfig: tsgo is TS7 — `moduleResolution: node10` (what node-app tsconfigs often pin) is
+ * REMOVED there, so the check runs against a generated shim extending the app tsconfig with
+ * `{ module: 'preserve', moduleResolution: 'bundler', isolatedModules: false }`. `extends` is an
+ * ABSOLUTE path and tsconfig path-options resolve relative to the file they ORIGINATE in, so the
+ * shim lives in the workspace's git-ignored `tmp/` (in-tree, so @types resolution still walks up to
+ * the workspace node_modules — see writeShimTsconfig). `isolatedModules: false` because
+ * `module: preserve` + `emitDecoratorMetadata` otherwise flags TS1272 on decorated signatures —
+ * an emit-safety rule that doesn't apply here (this checker never emits; webpack owns emit).
+ * Parity was verified per adopting workspace (0-error parity with tsc on all spot-checked apps);
+ * tsgo is a PREVIEW compiler, which is why this mode is opt-in and falls back to fork-ts-checker
+ * when the binary is absent.
+ */
+import { spawn } from 'node:child_process';
+export interface TsgoCheckPluginOptions {
+    appName: string;
+    /** Absolute path to the app tsconfig the check covers. */
+    tsConfig: string;
+    workspaceRoot: string;
+    debounceMs?: number;
+    /** Binary override (LENSMCP_TSGO_BIN); default: <workspaceRoot>/node_modules/.bin/tsgo. */
+    binPath?: string;
+    /** Injectable for tests. */
+    spawnImpl?: typeof spawn;
+}
+/** The workspace's tsgo binary, or null when not installed (caller falls back to fork-ts-checker). */
+export declare function resolveTsgoBin(workspaceRoot: string, override?: string): string | null;
+/**
+ * Write the shim tsconfig (absolute `extends`; see the header) and return its path. It lives under
+ * the WORKSPACE's git-ignored `tmp/` — NOT os.tmpdir(): `types: ['node']` (and every other @types
+ * lookup) resolves typeRoots by walking node_modules UP FROM THE CONFIG FILE's directory, so a shim
+ * outside the tree fails every service with `TS2688: Cannot find type definition file for 'node'`.
+ */
+export declare function writeShimTsconfig(appName: string, tsConfig: string, workspaceRoot: string): string;
+export declare class TsgoCheckPlugin {
+    private readonly opts;
+    private readonly spawnImpl;
+    private timer;
+    private inflight;
+    private shimPath;
+    private disabled;
+    constructor(opts: TsgoCheckPluginOptions);
+    apply(compiler: any): void;
+    /** Debounced: rapid successive rebuilds collapse into one check; an in-flight check is superseded. */
+    schedule(): void;
+    private run;
+}
+//# sourceMappingURL=tsgo-check-plugin.d.ts.map

package/tsgo-check-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsgo-check-plugin.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/tsgo-check-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAI9D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGtF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAgBlG;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAS;gBAEb,IAAI,EAAE,sBAAsB;IAMxC,KAAK,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI;IAO1B,sGAAsG;IACtG,QAAQ,IAAI,IAAI;IAOhB,OAAO,CAAC,GAAG;CA0CZ"}

package/tsgo-check-plugin.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TsgoCheckPlugin = void 0;
+exports.resolveTsgoBin = resolveTsgoBin;
+exports.writeShimTsconfig = writeShimTsconfig;
+const tslib_1 = require("tslib");
+/**
+ * TsgoCheckPlugin — dev type checking with ZERO resident memory (`LENSMCP_TYPECHECK=tsgo`).
+ *
+ * The default fork-ts-checker keeps an incremental tsc PROGRAM resident between saves — a
+ * 2-worker pair (~80MB+) per service, ~1GB across a 13-service cluster, alive even when nobody
+ * saves. tsgo (@typescript/native-preview, the native TS compiler) full-checks one of these
+ * services cold in ~1-3s, so instead of holding a program we re-check COLD after each successful
+ * rebuild (debounced, killing any in-flight check): idle cost is exactly zero.
+ *
+ * The output CONTRACT is the point: `--pretty false` prints classic `file.ts(1,2): error TS1234:`
+ * lines to the executor's console, which the gateway sniffs (`error TS\d+`) into the lens
+ * "service error" signal — the same wire the fork-ts-checker fed. Advisory like
+ * `typeCheckOptions.async: true`: a type error never fails or blocks the webpack build.
+ *
+ * SHIM tsconfig: tsgo is TS7 — `moduleResolution: node10` (what node-app tsconfigs often pin) is
+ * REMOVED there, so the check runs against a generated shim extending the app tsconfig with
+ * `{ module: 'preserve', moduleResolution: 'bundler', isolatedModules: false }`. `extends` is an
+ * ABSOLUTE path and tsconfig path-options resolve relative to the file they ORIGINATE in, so the
+ * shim lives in the workspace's git-ignored `tmp/` (in-tree, so @types resolution still walks up to
+ * the workspace node_modules — see writeShimTsconfig). `isolatedModules: false` because
+ * `module: preserve` + `emitDecoratorMetadata` otherwise flags TS1272 on decorated signatures —
+ * an emit-safety rule that doesn't apply here (this checker never emits; webpack owns emit).
+ * Parity was verified per adopting workspace (0-error parity with tsc on all spot-checked apps);
+ * tsgo is a PREVIEW compiler, which is why this mode is opt-in and falls back to fork-ts-checker
+ * when the binary is absent.
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = tslib_1.__importStar(require("node:fs"));
+const path = tslib_1.__importStar(require("node:path"));
+/** The workspace's tsgo binary, or null when not installed (caller falls back to fork-ts-checker). */
+function resolveTsgoBin(workspaceRoot, override) {
+    const candidate = override || path.join(workspaceRoot, 'node_modules', '.bin', 'tsgo');
+    return fs.existsSync(candidate) ? candidate : null;
+}
+/**
+ * Write the shim tsconfig (absolute `extends`; see the header) and return its path. It lives under
+ * the WORKSPACE's git-ignored `tmp/` — NOT os.tmpdir(): `types: ['node']` (and every other @types
+ * lookup) resolves typeRoots by walking node_modules UP FROM THE CONFIG FILE's directory, so a shim
+ * outside the tree fails every service with `TS2688: Cannot find type definition file for 'node'`.
+ */
+function writeShimTsconfig(appName, tsConfig, workspaceRoot) {
+    const dir = path.join(workspaceRoot, 'tmp', 'lensmcp-tsgo');
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, `${appName}.tsconfig.json`);
+    fs.writeFileSync(file, JSON.stringify({
+        extends: tsConfig,
+        compilerOptions: { module: 'preserve', moduleResolution: 'bundler', isolatedModules: false },
+    }, null, 2));
+    return file;
+}
+class TsgoCheckPlugin {
+    constructor(opts) {
+        this.timer = null;
+        this.inflight = null;
+        this.shimPath = null;
+        this.disabled = false;
+        this.opts = opts;
+        this.spawnImpl = opts.spawnImpl ?? node_child_process_1.spawn;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- webpack Compiler (untyped here like DevServerReloadPlugin)
+    apply(compiler) {
+        compiler.hooks.done.tap('TsgoCheckPlugin', (stats) => {
+            if (stats.hasErrors())
+                return; // webpack already printed build errors — don't pile on
+            this.schedule();
+        });
+    }
+    /** Debounced: rapid successive rebuilds collapse into one check; an in-flight check is superseded. */
+    schedule() {
+        if (this.disabled)
+            return;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = setTimeout(() => this.run(), this.opts.debounceMs ?? 500);
+        this.timer.unref?.();
+    }
+    run() {
+        const bin = resolveTsgoBin(this.opts.workspaceRoot, this.opts.binPath);
+        if (!bin) {
+            // The binary vanished after config time (e.g. a reinstall mid-serve) — warn once, go quiet.
+            this.disabled = true;
+            console.warn(`[tsgo] ${this.opts.appName}: tsgo binary not found — type checking disabled for this session`);
+            return;
+        }
+        if (this.inflight) {
+            this.inflight.kill('SIGTERM'); // superseded by a newer build
+            this.inflight = null;
+        }
+        if (!this.shimPath)
+            this.shimPath = writeShimTsconfig(this.opts.appName, this.opts.tsConfig, this.opts.workspaceRoot);
+        const startedAt = Date.now();
+        const child = this.spawnImpl(bin, ['--noEmit', '--pretty', 'false', '-p', this.shimPath], {
+            cwd: this.opts.workspaceRoot,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        this.inflight = child;
+        let out = '';
+        child.stdout?.on('data', (d) => { out += d.toString(); });
+        child.stderr?.on('data', (d) => { out += d.toString(); });
+        child.on('error', () => {
+            if (this.inflight === child)
+                this.inflight = null;
+            console.warn(`[tsgo] ${this.opts.appName}: failed to spawn ${bin}`);
+        });
+        child.on('close', (code, signal) => {
+            if (this.inflight === child)
+                this.inflight = null;
+            if (signal)
+                return; // superseded — a newer check owns the verdict
+            const secs = ((Date.now() - startedAt) / 1000).toFixed(1);
+            if (code === 0) {
+                console.log(`[tsgo] ${this.opts.appName}: types clean (${secs}s)`);
+                return;
+            }
+            // Print the raw `file.ts(1,2): error TSxxxx:` lines — the gateway's `error TS\d+` sniff
+            // turns these into the lens service-error signal, exactly like fork-ts-checker output did.
+            if (out.trim())
+                process.stdout.write(out.endsWith('\n') ? out : `${out}\n`);
+            const count = (out.match(/error TS\d+/g) ?? []).length;
+            console.log(`[tsgo] ${this.opts.appName}: ${count} type error${count === 1 ? '' : 's'} (${secs}s)`);
+        });
+    }
+}
+exports.TsgoCheckPlugin = TsgoCheckPlugin;