@lensmcp/cluster 1.16.26 → 1.16.28

package/create-webpack-dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-webpack-dev.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/create-webpack-dev.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAOtF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,qBAAqB,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA2CD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAoItF"}
+{"version":3,"file":"create-webpack-dev.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/create-webpack-dev.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQtF,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,qBAAqB,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA2CD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAgKtF"}

package/create-webpack-dev.js

@@ -7,6 +7,7 @@ const fs = tslib_1.__importStar(require("node:fs"));
 const path = tslib_1.__importStar(require("node:path"));
 const webpack_node_externals_1 = tslib_1.__importDefault(require("webpack-node-externals"));
 const build_scope_patterns_1 = require("./build-scope-patterns");
+const tsgo_check_plugin_1 = require("./tsgo-check-plugin");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const webpack = require('webpack');
 class DevServerReloadPlugin {
@@ -45,6 +46,17 @@ class DevServerReloadPlugin {
 function createDevWebpackConfig(options) {
     const { appRoot, outputDir, main, tsConfig, workspaceRoot, assets = [], port, memoryLimit = 8192, buildLibsFromSource = true, orgScopes = [], bundlePackages = [], additionalEntryPoints = [], nodeExternalsConfig: userNodeExternalsConfig, webpackConfigPath, } = options;
     const { allowlistPatterns, scopePrefixes, scopePatterns } = (0, build_scope_patterns_1.buildScopePatterns)(orgScopes);
+    // Type-checking mode (LENSMCP_TYPECHECK): default = the resident fork-ts-checker pair (async,
+    // feeds the lens `error TS` service-error signal); 'off' = none (fastest, quietest — the signal
+    // is traded away); 'tsgo' = zero-resident cold re-checks via @typescript/native-preview (same
+    // signal, no idle memory — see tsgo-check-plugin.ts). tsgo falls back to fork-ts-checker when
+    // the binary isn't installed in the workspace, so the flag can ship ahead of the devDep.
+    const typecheckMode = process.env.LENSMCP_TYPECHECK;
+    const tsgoBin = typecheckMode === 'tsgo' ? (0, tsgo_check_plugin_1.resolveTsgoBin)(workspaceRoot, process.env.LENSMCP_TSGO_BIN) : null;
+    if (typecheckMode === 'tsgo' && !tsgoBin) {
+        console.warn(`[serve] ${options.appName}: LENSMCP_TYPECHECK=tsgo but no tsgo binary (yarn add -D @typescript/native-preview) — falling back to fork-ts-checker`);
+    }
+    const useTsgo = !!tsgoBin;
     // Build combined allowlist: orgScopes + bundlePackages + user-provided
     const bundlePatterns = bundlePackages.map((pkg) => new RegExp(`^${pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(/|$)`));
     const combinedAllowlist = [
@@ -126,12 +138,25 @@ function createDevWebpackConfig(options) {
                 outputHashing: 'none',
                 generatePackageJson: false,
                 watchDependencies: true,
-                typeCheckOptions: {
-                    async: true,
-                },
+                // Type checking = the fork-ts-checker pair (2 worker processes, ~80MB per service) AND the
+                // source of the in-pod `error TS…` lines the gateway sniffs into the lens "service error"
+                // signal. Default ON. `LENSMCP_TYPECHECK=off` trades the signal for memory/CPU;
+                // `LENSMCP_TYPECHECK=tsgo` keeps the signal at zero resident cost (the TsgoCheckPlugin
+                // below replaces the resident pair with debounced cold native checks).
+                typeCheckOptions: process.env.LENSMCP_TYPECHECK === 'off' || useTsgo ? false : { async: true },
                 buildLibsFromSource,
             }),
             new DevServerReloadPlugin(port, options.httpsReload === true),
+            ...(useTsgo
+                ? [
+                    new tsgo_check_plugin_1.TsgoCheckPlugin({
+                        appName: options.appName,
+                        tsConfig,
+                        workspaceRoot,
+                        ...(process.env.LENSMCP_TSGO_BIN ? { binPath: process.env.LENSMCP_TSGO_BIN } : {}),
+                    }),
+                ]
+                : []),
         ],
         snapshot: { managedPaths: [/^(.+?[\\/])?node_modules[\\/]/] },
         watch: true,

package/executors/gateway/gateway.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.impl.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAElE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAA8B,eAAe,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAa/B"}
+{"version":3,"file":"gateway.impl.d.ts","sourceRoot":"","sources":["../../../../../libs/cluster/src/executors/gateway/gateway.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAGlE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAA8B,eAAe,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA0B/B"}

package/executors/gateway/gateway.impl.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = gatewayExecutor;
 const gateway_lib_1 = require("./gateway.lib");
+const server_1 = require("./runtime/server");
 /**
  * `gateway` executor — ONE https front door for the whole workspace,
  * assembled dynamically from every project's `cluster` declaration:
@@ -20,6 +21,19 @@ const gateway_lib_1 = require("./gateway.lib");
  * without signals; this wrapper only adds the executor contract.
  */
 async function gatewayExecutor(options, context) {
+    // LAST-RESORT netting for the long-running daemon (this executor runs for DAYS): a benign socket
+    // errno that escaped every layer's local handlers — e.g. a dependency emitting 'error' on a socket
+    // it forgot to guard — must cost the ONE connection, never the process. Scoped to exactly the
+    // read/write network errnos; anything else preserves crash semantics (print + exit 1, matching
+    // Node's default). Lives HERE, not in startGateway, so tests driving the lib keep real crashes loud.
+    process.on('uncaughtException', (err) => {
+        if ((err.syscall === 'read' || err.syscall === 'write') && server_1.BENIGN_SOCKET_ERRNOS.has(err.code ?? '')) {
+            console.warn(`[gateway] survived a stray socket ${err.syscall} error (${err.code}) — one connection dropped, the daemon lives`);
+            return;
+        }
+        console.error(err);
+        process.exit(1);
+    });
     let handle;
     try {
         handle = await (0, gateway_lib_1.startGateway)(options, context);

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AA8C/D;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAkRvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AA8C/D;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAwXvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -150,18 +150,87 @@ function createServiceLayer(rt, obs) {
     const serviceBus = (svc) => svc.wsKey === rt.wsKey ? undefined : path.join(svc.root, '.lensmcp', 'events.jsonl');
     const emitSvc = (svc, severity, title, fingerprint, raw) => emit(severity, title, fingerprint, { wsKey: svc.wsKey, ...raw }, undefined, serviceBus(svc));
     const scanNow = (pool) => { pool.scannedAt = 0; return (0, discovery_1.pickSock)(pool, rt.scanTtlMs) ? pool.socks.length : 0; };
+    /**
+     * FOREIGN-GENERATION REAPER (the respawn deadlock, foodguard 2026-07-26): nx records a
+     * running continuous task in its workspace-data DB, and a NEW `nx run <svc>:serve-hmr`
+     * invocation WAITS on that record ("Waiting for <task> in another nx process") — even with
+     * NX_DAEMON=false. When the record's holder is an ORPHANED runner (a replaced daemon's
+     * tree, a half-killed generation), every respawn parks forever and `ensureUp` hangs each
+     * request with no log. Before spawning, kill any nx runner for THIS target that this
+     * gateway does not own — the runner is the detached group leader, so `kill(-pgid)` reaps
+     * its whole devserver tree with it. One `ps` exec; a clean cold start is a no-op.
+     */
+    const reapForeignRunners = (svc, target) => {
+        let out = '';
+        try {
+            out = (0, node_child_process_1.execFileSync)('ps', ['ax', '-ww', '-o', 'pid=,pgid=,command='], { encoding: 'utf8', timeout: 5_000 });
+        }
+        catch {
+            return 0;
+        }
+        const ownPid = svc.proc?.pid;
+        let reaped = 0;
+        for (const line of out.split('\n')) {
+            const m = line.match(/^\s*(\d+)\s+(\d+)\s+(.*)$/);
+            if (!m)
+                continue;
+            const pid = Number(m[1]);
+            const pgid = Number(m[2]);
+            const cmd = m[3];
+            if (!cmd.includes(`run ${target}`))
+                continue; // only THIS service's runners
+            // Only nx runners (direct nx.js entry or the yarn/npx shim) — never a stray grep/editor.
+            if (!/\bnx(\.js)?\b/.test(cmd))
+                continue;
+            // A direct-entry runner carries its workspace's nx path — scope to OUR workspace root so a
+            // same-named project in another workspace is never touched. (The yarn-shim fallback has no
+            // path in argv; the target match alone bounds it.)
+            if (cmd.includes('/node_modules/nx/') && !cmd.includes(svc.root))
+                continue;
+            if (pid === process.pid || pid === ownPid)
+                continue;
+            if (ownPid !== undefined && pgid === ownPid)
+                continue; // our own detached tree
+            try {
+                process.kill(-pgid, 'SIGKILL');
+            }
+            catch {
+                try {
+                    process.kill(pid, 'SIGKILL');
+                }
+                catch { /* already gone */ }
+            }
+            reaped += 1;
+        }
+        if (reaped > 0) {
+            console.log(`[gateway] ${target}: reaped ${reaped} stale runner tree(s) — a foreign generation held the nx task lock`);
+            emitSvc(svc, 'warning', `stale-runner reap: ${svc.project} (${reaped} foreign tree(s))`, `cluster-service:${svc.project}`, { kind: 'stale-runner-reap', project: svc.project, reaped });
+        }
+        return reaped;
+    };
     const spawnService = (svc) => {
         if (rt.stopped())
             return; // never spawn a process after the gateway is told to stop
         const target = `${svc.project}:${svc.decl.serveTarget ?? 'serve-hmr'}`;
         const min = Math.max(1, svc.decl.minPods ?? 1);
+        reapForeignRunners(svc, target); // clear nx's running-tasks lock BEFORE the spawn can park on it
+        svc.lockBlockedAt = undefined;
         console.log(`[gateway] starting ${target} (pods=${min})…`);
         emitSvc(svc, 'info', `service starting: ${svc.project} (${min} pod${min > 1 ? 's' : ''})`, `cluster-service:${svc.project}`, { kind: 'service-starting', project: svc.project, pods: min });
         svc.state = 'starting';
         svc.spawnAt = Date.now();
         // childCount goes as a CLI option, NOT env: nx executes tasks via its
         // daemon, whose environment is not the gateway's — env vars get lost.
-        const proc = (0, node_child_process_1.spawn)('yarn', ['nx', 'run', target, `--childCount=${min}`], {
+        // Invoke the workspace's nx entry DIRECTLY (node + nx/dist/bin/nx.js) instead of through the
+        // `yarn nx` shim: the shim is a ~40MB node process that does nothing after the handoff yet
+        // lives for the service's whole life — ~600MB across a 15-service cluster. Resolved per
+        // svc.root so each hosted workspace runs its own nx; falls back to `yarn nx` when the entry
+        // isn't where node_modules linkers put it (pnp/odd layouts).
+        const nxEntry = path.join(svc.root, 'node_modules', 'nx', 'dist', 'bin', 'nx.js');
+        const [spawnCmd, spawnArgs] = fs.existsSync(nxEntry)
+            ? [process.execPath, [nxEntry, 'run', target, `--childCount=${min}`]]
+            : ['yarn', ['nx', 'run', target, `--childCount=${min}`]];
+        const proc = (0, node_child_process_1.spawn)(spawnCmd, spawnArgs, {
             // The service's OWN workspace root — `rt.root` for the daemon's own workspace, the registered
             // workspace's root for a second one (so ONE daemon hosts several workspaces' devservers — model (A)).
             cwd: svc.root,
@@ -181,6 +250,15 @@ function createServiceLayer(rt, obs) {
             env: {
                 ...process.env,
                 NX_DAEMON: 'false',
+                // NX_ISOLATE_PLUGINS=false: with the daemon off (above), EVERY serve client builds the
+                // project graph itself — and with plugin isolation on (nx's default) each client spawns
+                // 8 plugin-worker processes (~50MB each) that stay ALIVE for the life of the service:
+                // ~400MB of nx machinery per ~50MB service pod, ~4-5GB across a 13-service cluster
+                // (measured tetros 2026-07-25). Isolation-off loads plugins in-process: the graph is
+                // identical and zero workers spawn (nx itself runs isolation-off in sandboxes/WASM —
+                // a supported mode). NOTE this is authoritative for spawned clients: nx's dotenv load
+                // never overrides an already-set env var, so a workspace .env cannot flip it back on.
+                NX_ISOLATE_PLUGINS: 'false',
                 ...(svc.wsKey ? { LENSMCP_WS_KEY: svc.wsKey } : {}),
                 LENSMCP_EVENT_FILE: svc.wsKey === rt.wsKey ? rt.eventFile : path.join(svc.root, '.lensmcp', 'events.jsonl'),
                 ...eastWestEnv(rt, svc.project),
@@ -211,6 +289,25 @@ function createServiceLayer(rt, obs) {
                 }
                 if (/No typescript errors found|webpack compiled successfully|Child#\d+ ready/.test(line))
                     svc.buildFailed = false;
+                // LOCK-BREAK: nx prints exactly this when a FOREIGN runner holds the running-tasks
+                // record for our target — this spawn will park forever and every request would hang
+                // through ensureUp with no further log. Cure it once per spawn: kill our parked
+                // waiter, reap the foreign tree, and respawn clean.
+                if (!svc.lockBlockedAt && /Waiting for .+ in another nx process/.test(line)) {
+                    svc.lockBlockedAt = Date.now();
+                    console.log(`[gateway] ${target}: spawn blocked by a stale nx runner — breaking the lock + respawning`);
+                    emitSvc(svc, 'warning', `nx task lock: ${svc.project} blocked by a stale runner — auto-breaking`, `cluster-service:${svc.project}`, { kind: 'nx-lock-break', project: svc.project });
+                    setTimeout(() => {
+                        if (rt.stopped() || !svc.lockBlockedAt)
+                            return;
+                        killSpawned(svc, 'parked on a foreign nx task lock — recycling');
+                        reapForeignRunners(svc, target);
+                        setTimeout(() => {
+                            if (!rt.stopped() && !svc.proc && svc.state === 'down')
+                                spawnService(svc);
+                        }, 1_500).unref?.();
+                    }, 250).unref?.();
+                }
             }
         };
         proc.stdout?.on('data', (d) => { if (rt.stopped())
@@ -327,16 +424,39 @@ function createServiceLayer(rt, obs) {
         }
         svc.proc = undefined;
         svc.state = 'down';
-        // children die with the tree but their sock FILES survive — remove them
-        // so the canvas and the proxy never see ghost pods.
+        // children die with the tree but their sock FILES survive — remove them so the canvas
+        // and the proxy never see ghost pods. OWNER-AWARE: a sock whose `.owner` pidfile names a
+        // LIVE process belongs to a NEWER generation binding concurrently — leave it (the
+        // devserver's bind-steal owns the path now; unlinking it here recreates the vanished-sock
+        // wedge this sweep exists to prevent).
         setTimeout(() => {
             try {
                 for (const f of fs.readdirSync(svc.pool.dir)) {
-                    if (f.endsWith('.sock'))
-                        fs.unlinkSync(path.join(svc.pool.dir, f));
+                    if (!f.endsWith('.sock'))
+                        continue;
+                    const sockPath = path.join(svc.pool.dir, f);
+                    try {
+                        const owner = Number(fs.readFileSync(`${sockPath}.owner`, 'utf8').trim());
+                        if (Number.isFinite(owner) && owner > 0) {
+                            try {
+                                process.kill(owner, 0); // throws when the owner is dead
+                                continue; // a LIVE foreign owner — a newer generation's pod; keep it
+                            }
+                            catch { /* dead owner → sweep */ }
+                        }
+                    }
+                    catch { /* no owner file (legacy) → sweep */ }
+                    try {
+                        fs.unlinkSync(sockPath);
+                    }
+                    catch { /* gone */ }
+                    try {
+                        fs.unlinkSync(`${sockPath}.owner`);
+                    }
+                    catch { /* gone */ }
                 }
             }
-            catch { /* gone */ }
+            catch { /* dir gone */ }
             svc.pool.socks = [];
             svc.pool.scannedAt = 0;
         }, 1200).unref?.();

package/executors/gateway/runtime/server.d.ts

@@ -12,5 +12,8 @@ import type { GatewayContext, GatewayHandle, GatewayRuntimeOptions, Route } from
  * unless the insecure opt-in is set).
  */
 export declare function buildEdgeVerifierPool(getRoutes: () => Route[]): EdgeVerifierPool;
+/** Client-abort errnos that are NORMAL front-door traffic (a closed tab, a sleeping laptop, a canceled
+ *  HMR socket) — dropped quietly. Anything else on an inbound socket is logged before the drop. */
+export declare const BENIGN_SOCKET_ERRNOS: ReadonlySet<string>;
 export declare function startGateway(options: GatewayRuntimeOptions, context: GatewayContext): Promise<GatewayHandle>;
 //# sourceMappingURL=server.d.ts.map

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AA0BxH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,KAAK,EAAE,GAAG,gBAAgB,CA4ChF;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAmRxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAkB,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAK/D,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,KAAK,EAAE,MAAM,SAAS,CAAC;AA0BxH;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,KAAK,EAAE,GAAG,gBAAgB,CA4ChF;AAED;mGACmG;AACnG,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAA8E,CAAC;AAkBpI,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA8RxB"}

package/executors/gateway/runtime/server.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BENIGN_SOCKET_ERRNOS = void 0;
 exports.buildEdgeVerifierPool = buildEdgeVerifierPool;
 exports.startGateway = startGateway;
 const tslib_1 = require("tslib");
@@ -112,6 +113,24 @@ function buildEdgeVerifierPool(getRoutes) {
         },
     };
 }
+/** Client-abort errnos that are NORMAL front-door traffic (a closed tab, a sleeping laptop, a canceled
+ *  HMR socket) — dropped quietly. Anything else on an inbound socket is logged before the drop. */
+exports.BENIGN_SOCKET_ERRNOS = new Set(['ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'ECONNABORTED', 'ECANCELED']);
+/** Attach the inbound-socket error guard. EVERY socket the front door accepts gets an 'error' listener
+ *  the moment it exists — both the raw TCP socket ('connection') and the post-handshake TLSSocket
+ *  ('secureConnection', a DIFFERENT emitter). A client abort is routine, but with NO listener Node turns
+ *  it into an UNHANDLED 'error' event that kills the whole daemon (observed: a days-old gateway died on
+ *  `read ECONNRESET` at TLSWrap.onStreamRead — the exposed window is a socket the http layer has handed
+ *  off, e.g. right after an 'upgrade', where no internal handler is attached any more). Handling =
+ *  destroy the ONE socket; never the process. */
+function guardInboundSocket(socket) {
+    socket.on('error', (err) => {
+        if (!exports.BENIGN_SOCKET_ERRNOS.has(err.code ?? '')) {
+            console.warn(`[gateway] inbound socket error (${err.code ?? err.message}) — dropping this connection only`);
+        }
+        socket.destroy();
+    });
+}
 async function startGateway(options, context) {
     // NB: this local `https` (TLS-on flag) deliberately SHADOWS the `node:https`
     // module — which is why TLS/agents are reached via `require('node:https')`.
@@ -303,6 +322,18 @@ async function startGateway(options, context) {
             : http.createServer(handler);
         server.on('upgrade', upgrade);
         server.on('error', (err) => console.error(`[gateway] port ${port}: ${err.code}`));
+        // Inbound-socket resilience (the ECONNRESET-crash fix): guard every accepted socket, and end
+        // handshake-phase ('tlsClientError') / H1 parse-phase ('clientError') faults on the ONE connection.
+        // Registering 'clientError' replaces Node's default 400-writer, so keep its semantics: a best-effort
+        // 400 on a still-writable socket, then destroy.
+        server.on('connection', guardInboundSocket);
+        server.on('secureConnection', guardInboundSocket); // never fires on a plain-http server — harmless
+        server.on('tlsClientError', (_err, tlsSocket) => tlsSocket.destroy());
+        server.on('clientError', (err, socket) => {
+            if (err.code !== 'ECONNRESET' && socket.writable)
+                socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+            socket.destroy();
+        });
         // h2 SESSION resilience: without a `sessionError` handler ANY session-level
         // fault (a client GOAWAY mid-burst, a flood-protection trip, a decode error)
         // is unhandled → Node tears the session down, failing EVERY sibling stream at

package/executors/gateway/runtime/types.d.ts

@@ -147,6 +147,11 @@ export interface ServiceCtl {
      * stops a rapid source-churn (e.g. a codegen run) from thrash-recycling the same pod. NOT counted against
      * the crash-loop cap ({@link restarts}) — staleness is not a crash. */
     lastStaleRecycleAt?: number;
+    /** Self-heal: set when THIS spawn printed nx's "Waiting for <task> in another nx process" — a FOREIGN
+     * (orphaned) runner holds nx's running-tasks lock and the spawn will never produce a pod. The sniffer
+     * fires the lock-break once per spawn (kill our waiter → reap the foreign tree → respawn); cleared on
+     * the next spawn. */
+    lockBlockedAt?: number;
 }
 /** Min interval (ms) between repeat 'service error' emits for the SAME service + same error line. */
 export declare const SERVICE_ERROR_THROTTLE_MS = 5000;

package/executors/gateway/runtime/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;oGACgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB;;iHAE6G;IAC7G,IAAI,EAAE,MAAM,CAAC;IACb;yGACqG;IACrG,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;iGAE6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;6GAGyG;IACzG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;mCAE+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2EAGuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAWD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;wDAEwD;AACxD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;sGAEsG;AACtG,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;;sDAOsD;AACtD,eAAO,MAAM,uBAAuB,QAGhC,CAAC;AAEL;;;;;;;iHAOiH;AACjH,eAAO,MAAM,sBAAsB,QAG/B,CAAC;AAEL;;;;;;;;;GASG;AACH,8GAA8G;AAC9G,eAAO,MAAM,mBAAmB,SAA6C,CAAC;AAC9E;;4CAE4C;AAC5C,eAAO,MAAM,cAAc,QAA0D,CAAC;AACtF;;0FAE0F;AAC1F,eAAO,MAAM,kBAAkB,QAA+C,CAAC;AAC/E;;mDAEmD;AACnD,eAAO,MAAM,qBAAqB,QAAiD,CAAC;AACpF;gEACgE;AAChE,eAAO,MAAM,iBAAiB,QAA8C,CAAC;AAC7E;mFACmF;AACnF,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAGD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;sDAEkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;+GAC2G;IAC3G,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACzB;8GAC0G;IAC1G,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;mHAG+G;IAC/G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;wFACoF;IACpF,OAAO,IAAI,OAAO,CAAC;CACpB;AAGD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;IAChC,gEAAgE;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,gGAAgG;IAChG,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;oGACgG;IAChG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB;;iHAE6G;IAC7G,IAAI,EAAE,MAAM,CAAC;IACb;yGACqG;IACrG,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;iGAE6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;6GAGyG;IACzG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;mCAE+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2EAGuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;yBAGqB;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAWD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;wDAEwD;AACxD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;sGAEsG;AACtG,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;;sDAOsD;AACtD,eAAO,MAAM,uBAAuB,QAGhC,CAAC;AAEL;;;;;;;iHAOiH;AACjH,eAAO,MAAM,sBAAsB,QAG/B,CAAC;AAEL;;;;;;;;;GASG;AACH,8GAA8G;AAC9G,eAAO,MAAM,mBAAmB,SAA6C,CAAC;AAC9E;;4CAE4C;AAC5C,eAAO,MAAM,cAAc,QAA0D,CAAC;AACtF;;0FAE0F;AAC1F,eAAO,MAAM,kBAAkB,QAA+C,CAAC;AAC/E;;mDAEmD;AACnD,eAAO,MAAM,qBAAqB,QAAiD,CAAC;AACpF;gEACgE;AAChE,eAAO,MAAM,iBAAiB,QAA8C,CAAC;AAC7E;mFACmF;AACnF,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAGD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;sDAEkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;+GAC2G;IAC3G,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACzB;8GAC0G;IAC1G,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,sGAAsG;IACtG,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;mHAG+G;IAC/G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;wFACoF;IACpF,OAAO,IAAI,OAAO,CAAC;CACpB;AAGD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;IAChC,gEAAgE;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,gGAAgG;IAChG,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/executors/gateway/runtime/upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,cAAc,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CAqChE"}
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/upgrade.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,cAAc,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAEvG,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CA6ChE"}

package/executors/gateway/runtime/upgrade.js

@@ -59,5 +59,13 @@ function createUpgrade(deps) {
         }
         proxy.proxy.ws(req, socket, head, { target, changeOrigin: !route.pool, agent: proxy.agentForTarget(target) }, () => socket.destroy());
     };
-    return (req, socket, head) => { void run(req, socket, head); };
+    return (req, socket, head) => {
+        // Guard the handed-off socket IMMEDIATELY: on 'upgrade' the http layer removes its OWN listeners,
+        // so until proxy.ws attaches handlers (an `await` away in `run`) a client abort (ECONNRESET — an
+        // HMR socket torn mid-upgrade) would be an unhandled 'error' event → the whole daemon dies. And a
+        // rejection out of `run` (a throwing auth/hook) must likewise cost the ONE socket, never the
+        // process — a floating promise rejection is fatal by default.
+        socket.on('error', () => socket.destroy());
+        run(req, socket, head).catch(() => socket.destroy());
+    };
 }

package/main.devserver.js

@@ -124,13 +124,57 @@ const SOCK_DIR = LENSMCP_WS_KEY
 function childSockPath(id) {
     return path.join(SOCK_DIR, `child-${id}.sock`);
 }
-function cleanupSock(sockPath) {
+/**
+ * SOCKET OWNERSHIP (the generation race, foodguard 2026-07-26): when devserver generations
+ * overlap — a killed nx runner's orphaned tree dying while the daemon's fresh spawn binds —
+ * the DYING generation's cleanup used to unlink `child-1.sock` that the NEW generation had
+ * just bound. The file vanished from disk while the live child held the (now anonymous)
+ * inode: every gateway connect hit ENOENT/ghost, with no log and no evictable pod.
+ *
+ * The rule that closes it: **BIND steals, DEATH is guarded.** A binder writes a sidecar
+ * `<sock>.owner` pidfile FIRST (so any concurrently-dying process already sees the new
+ * owner), then unlinks the stale path and binds. Every death/cleanup path unlinks ONLY if
+ * the owner file still names the pid it is cleaning up for — a foreign live owner means a
+ * newer generation took the path, and the dying one must leave it alone.
+ */
+function sockOwnerPath(sockPath) { return `${sockPath}.owner`; }
+/** Bind-time steal: claim ownership (pidfile first), then clear the stale path. */
+function claimSock(sockPath, ownerPid = process.pid) {
+    try {
+        fs.mkdirSync(path.dirname(sockPath), { recursive: true });
+    }
+    catch { /* exists */ }
+    try {
+        fs.writeFileSync(sockOwnerPath(sockPath), String(ownerPid));
+    }
+    catch { /* best-effort */ }
+    try {
+        fs.unlinkSync(sockPath);
+    }
+    catch { /* no stale socket */ }
+}
+/**
+ * Death-path cleanup: unlink the socket ONLY when `expectedOwnerPid` (default: this
+ * process) still owns it. A missing/unreadable owner file falls back to unlinking
+ * (legacy sockets from a pre-ownership build).
+ */
+function cleanupSock(sockPath, expectedOwnerPid = process.pid) {
     if (!sockPath)
         return;
+    try {
+        const owner = fs.readFileSync(sockOwnerPath(sockPath), 'utf8').trim();
+        if (owner && owner !== String(expectedOwnerPid))
+            return; // a newer generation owns the path
+    }
+    catch { /* no owner file → legacy behavior */ }
     try {
         fs.unlinkSync(sockPath);
     }
     catch { /* best-effort: socket already gone */ }
+    try {
+        fs.unlinkSync(sockOwnerPath(sockPath));
+    }
+    catch { /* best-effort */ }
 }
 // delete from CJS cache + require fresh
 async function importFresh(spec) {
@@ -270,10 +314,7 @@ if (process.env.APP_RUNNER === '1') {
         // SIGTERM that missed us), the IPC channel closes — exit immediately and
         // remove our socket so no ghost pod (live process + stale sock) survives.
         process.on('disconnect', () => {
-            try {
-                fs.unlinkSync(sockPath);
-            }
-            catch { /* already gone */ }
+            cleanupSock(sockPath); // owner-guarded: never unlink a newer generation's socket
             process.exit(0);
         });
         // boot once, then listen on Unix socket
@@ -281,7 +322,7 @@ if (process.env.APP_RUNNER === '1') {
             await swapNow();
             const resolvedBundle = path.isAbsolute(BUNDLE_PATH) ? BUNDLE_PATH : path.join(__dirname, BUNDLE_PATH);
             console.log(`[child] Using bundle: ${resolvedBundle}`);
-            cleanupSock(sockPath); // remove stale socket from previous run
+            claimSock(sockPath); // bind steals: claim ownership, then clear the stale path
             server.listen(sockPath, () => {
                 console.log(`[child] Listening on ${sockPath}`);
                 if (process.send)
@@ -570,7 +611,7 @@ else {
                         info.lastError = `Child exited abnormally (code=${code}, signal=${signal ?? 'none'})`;
                 }
                 info.healthy = false;
-                cleanupSock(info.socketPath);
+                cleanupSock(info.socketPath, info.proc.pid); // guarded by the DEAD child's claim
                 info.socketPath = undefined;
                 // Supervise the pool: a CRASHED pod (not a clean shutdown, not a
                 // reload/idle-kill) must be replaced or the pool silently shrinks to
@@ -619,7 +660,7 @@ else {
                 }
                 catch { /* ignore */
                 }
-                cleanupSock(c.socketPath);
+                cleanupSock(c.socketPath, c.proc.pid); // guarded by the replaced child's claim
                 c.socketPath = undefined;
                 // Remove from array
                 const idx = children.indexOf(c);
@@ -1008,7 +1049,7 @@ else {
         // derivation the gateway uses for the pod pool dir. Plain HTTP: it's a
         // per-user unix socket, TLS adds nothing.
         const controlSockPath = path.join(SOCK_DIR, 'parent.sock');
-        cleanupSock(controlSockPath); // stale socket from a crashed previous parent
+        claimSock(controlSockPath); // bind steals: claim + clear a crashed previous parent's leftover
         const controlServer = http.createServer(requestHandler);
         controlServer.on('error', (err) => {
             console.warn(`[parent] control socket unavailable (${err.code}) — lensmcp logs/debug attach disabled.`);
@@ -1039,7 +1080,7 @@ else {
                 catch { /* ignore */
                 }
                 if (c.socketPath)
-                    cleanupSock(c.socketPath);
+                    cleanupSock(c.socketPath, c.proc.pid);
             }
             // Clean up socket directory
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.26",
+  "version": "1.16.28",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.26",
-    "@lensmcp/nx-plugin": "1.16.26",
+    "@lensmcp/node-instrumentation": "1.16.28",
+    "@lensmcp/nx-plugin": "1.16.28",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",

package/tsgo-check-plugin.d.ts

@@ -0,0 +1,61 @@
+/**
+ * TsgoCheckPlugin — dev type checking with ZERO resident memory (`LENSMCP_TYPECHECK=tsgo`).
+ *
+ * The default fork-ts-checker keeps an incremental tsc PROGRAM resident between saves — a
+ * 2-worker pair (~80MB+) per service, ~1GB across a 13-service cluster, alive even when nobody
+ * saves. tsgo (@typescript/native-preview, the native TS compiler) full-checks one of these
+ * services cold in ~1-3s, so instead of holding a program we re-check COLD after each successful
+ * rebuild (debounced, killing any in-flight check): idle cost is exactly zero.
+ *
+ * The output CONTRACT is the point: `--pretty false` prints classic `file.ts(1,2): error TS1234:`
+ * lines to the executor's console, which the gateway sniffs (`error TS\d+`) into the lens
+ * "service error" signal — the same wire the fork-ts-checker fed. Advisory like
+ * `typeCheckOptions.async: true`: a type error never fails or blocks the webpack build.
+ *
+ * SHIM tsconfig: tsgo is TS7 — `moduleResolution: node10` (what node-app tsconfigs often pin) is
+ * REMOVED there, so the check runs against a generated shim extending the app tsconfig with
+ * `{ module: 'preserve', moduleResolution: 'bundler', isolatedModules: false }`. `extends` is an
+ * ABSOLUTE path and tsconfig path-options resolve relative to the file they ORIGINATE in, so the
+ * shim lives in the workspace's git-ignored `tmp/` (in-tree, so @types resolution still walks up to
+ * the workspace node_modules — see writeShimTsconfig). `isolatedModules: false` because
+ * `module: preserve` + `emitDecoratorMetadata` otherwise flags TS1272 on decorated signatures —
+ * an emit-safety rule that doesn't apply here (this checker never emits; webpack owns emit).
+ * Parity was verified per adopting workspace (0-error parity with tsc on all spot-checked apps);
+ * tsgo is a PREVIEW compiler, which is why this mode is opt-in and falls back to fork-ts-checker
+ * when the binary is absent.
+ */
+import { spawn } from 'node:child_process';
+export interface TsgoCheckPluginOptions {
+    appName: string;
+    /** Absolute path to the app tsconfig the check covers. */
+    tsConfig: string;
+    workspaceRoot: string;
+    debounceMs?: number;
+    /** Binary override (LENSMCP_TSGO_BIN); default: <workspaceRoot>/node_modules/.bin/tsgo. */
+    binPath?: string;
+    /** Injectable for tests. */
+    spawnImpl?: typeof spawn;
+}
+/** The workspace's tsgo binary, or null when not installed (caller falls back to fork-ts-checker). */
+export declare function resolveTsgoBin(workspaceRoot: string, override?: string): string | null;
+/**
+ * Write the shim tsconfig (absolute `extends`; see the header) and return its path. It lives under
+ * the WORKSPACE's git-ignored `tmp/` — NOT os.tmpdir(): `types: ['node']` (and every other @types
+ * lookup) resolves typeRoots by walking node_modules UP FROM THE CONFIG FILE's directory, so a shim
+ * outside the tree fails every service with `TS2688: Cannot find type definition file for 'node'`.
+ */
+export declare function writeShimTsconfig(appName: string, tsConfig: string, workspaceRoot: string): string;
+export declare class TsgoCheckPlugin {
+    private readonly opts;
+    private readonly spawnImpl;
+    private timer;
+    private inflight;
+    private shimPath;
+    private disabled;
+    constructor(opts: TsgoCheckPluginOptions);
+    apply(compiler: any): void;
+    /** Debounced: rapid successive rebuilds collapse into one check; an in-flight check is superseded. */
+    schedule(): void;
+    private run;
+}
+//# sourceMappingURL=tsgo-check-plugin.d.ts.map

package/tsgo-check-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tsgo-check-plugin.d.ts","sourceRoot":"","sources":["../../../libs/cluster/src/tsgo-check-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAI9D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGtF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA0BlG;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAS;gBAEb,IAAI,EAAE,sBAAsB;IAMxC,KAAK,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI;IAO1B,sGAAsG;IACtG,QAAQ,IAAI,IAAI;IAOhB,OAAO,CAAC,GAAG;CA0CZ"}

package/tsgo-check-plugin.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TsgoCheckPlugin = void 0;
+exports.resolveTsgoBin = resolveTsgoBin;
+exports.writeShimTsconfig = writeShimTsconfig;
+const tslib_1 = require("tslib");
+/**
+ * TsgoCheckPlugin — dev type checking with ZERO resident memory (`LENSMCP_TYPECHECK=tsgo`).
+ *
+ * The default fork-ts-checker keeps an incremental tsc PROGRAM resident between saves — a
+ * 2-worker pair (~80MB+) per service, ~1GB across a 13-service cluster, alive even when nobody
+ * saves. tsgo (@typescript/native-preview, the native TS compiler) full-checks one of these
+ * services cold in ~1-3s, so instead of holding a program we re-check COLD after each successful
+ * rebuild (debounced, killing any in-flight check): idle cost is exactly zero.
+ *
+ * The output CONTRACT is the point: `--pretty false` prints classic `file.ts(1,2): error TS1234:`
+ * lines to the executor's console, which the gateway sniffs (`error TS\d+`) into the lens
+ * "service error" signal — the same wire the fork-ts-checker fed. Advisory like
+ * `typeCheckOptions.async: true`: a type error never fails or blocks the webpack build.
+ *
+ * SHIM tsconfig: tsgo is TS7 — `moduleResolution: node10` (what node-app tsconfigs often pin) is
+ * REMOVED there, so the check runs against a generated shim extending the app tsconfig with
+ * `{ module: 'preserve', moduleResolution: 'bundler', isolatedModules: false }`. `extends` is an
+ * ABSOLUTE path and tsconfig path-options resolve relative to the file they ORIGINATE in, so the
+ * shim lives in the workspace's git-ignored `tmp/` (in-tree, so @types resolution still walks up to
+ * the workspace node_modules — see writeShimTsconfig). `isolatedModules: false` because
+ * `module: preserve` + `emitDecoratorMetadata` otherwise flags TS1272 on decorated signatures —
+ * an emit-safety rule that doesn't apply here (this checker never emits; webpack owns emit).
+ * Parity was verified per adopting workspace (0-error parity with tsc on all spot-checked apps);
+ * tsgo is a PREVIEW compiler, which is why this mode is opt-in and falls back to fork-ts-checker
+ * when the binary is absent.
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = tslib_1.__importStar(require("node:fs"));
+const path = tslib_1.__importStar(require("node:path"));
+/** The workspace's tsgo binary, or null when not installed (caller falls back to fork-ts-checker). */
+function resolveTsgoBin(workspaceRoot, override) {
+    const candidate = override || path.join(workspaceRoot, 'node_modules', '.bin', 'tsgo');
+    return fs.existsSync(candidate) ? candidate : null;
+}
+/**
+ * Write the shim tsconfig (absolute `extends`; see the header) and return its path. It lives under
+ * the WORKSPACE's git-ignored `tmp/` — NOT os.tmpdir(): `types: ['node']` (and every other @types
+ * lookup) resolves typeRoots by walking node_modules UP FROM THE CONFIG FILE's directory, so a shim
+ * outside the tree fails every service with `TS2688: Cannot find type definition file for 'node'`.
+ */
+function writeShimTsconfig(appName, tsConfig, workspaceRoot) {
+    const dir = path.join(workspaceRoot, 'tmp', 'lensmcp-tsgo');
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, `${appName}.tsconfig.json`);
+    fs.writeFileSync(file, JSON.stringify({
+        extends: tsConfig,
+        // baseUrl: null UNSETS an inherited baseUrl — TS7 removed the option outright (TS5102), and
+        // a workspace that anchors its inherited `paths` with baseUrl still resolves them fine
+        // without it: TS7 anchors non-relative `paths` at the config file that DECLARES them (the
+        // workspace-root base tsconfig — the same directory baseUrl pointed at). A no-op where
+        // baseUrl was never set.
+        compilerOptions: {
+            module: 'preserve',
+            moduleResolution: 'bundler',
+            isolatedModules: false,
+            baseUrl: null,
+        },
+    }, null, 2));
+    return file;
+}
+class TsgoCheckPlugin {
+    constructor(opts) {
+        this.timer = null;
+        this.inflight = null;
+        this.shimPath = null;
+        this.disabled = false;
+        this.opts = opts;
+        this.spawnImpl = opts.spawnImpl ?? node_child_process_1.spawn;
+    }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- webpack Compiler (untyped here like DevServerReloadPlugin)
+    apply(compiler) {
+        compiler.hooks.done.tap('TsgoCheckPlugin', (stats) => {
+            if (stats.hasErrors())
+                return; // webpack already printed build errors — don't pile on
+            this.schedule();
+        });
+    }
+    /** Debounced: rapid successive rebuilds collapse into one check; an in-flight check is superseded. */
+    schedule() {
+        if (this.disabled)
+            return;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = setTimeout(() => this.run(), this.opts.debounceMs ?? 500);
+        this.timer.unref?.();
+    }
+    run() {
+        const bin = resolveTsgoBin(this.opts.workspaceRoot, this.opts.binPath);
+        if (!bin) {
+            // The binary vanished after config time (e.g. a reinstall mid-serve) — warn once, go quiet.
+            this.disabled = true;
+            console.warn(`[tsgo] ${this.opts.appName}: tsgo binary not found — type checking disabled for this session`);
+            return;
+        }
+        if (this.inflight) {
+            this.inflight.kill('SIGTERM'); // superseded by a newer build
+            this.inflight = null;
+        }
+        if (!this.shimPath)
+            this.shimPath = writeShimTsconfig(this.opts.appName, this.opts.tsConfig, this.opts.workspaceRoot);
+        const startedAt = Date.now();
+        const child = this.spawnImpl(bin, ['--noEmit', '--pretty', 'false', '-p', this.shimPath], {
+            cwd: this.opts.workspaceRoot,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        this.inflight = child;
+        let out = '';
+        child.stdout?.on('data', (d) => { out += d.toString(); });
+        child.stderr?.on('data', (d) => { out += d.toString(); });
+        child.on('error', () => {
+            if (this.inflight === child)
+                this.inflight = null;
+            console.warn(`[tsgo] ${this.opts.appName}: failed to spawn ${bin}`);
+        });
+        child.on('close', (code, signal) => {
+            if (this.inflight === child)
+                this.inflight = null;
+            if (signal)
+                return; // superseded — a newer check owns the verdict
+            const secs = ((Date.now() - startedAt) / 1000).toFixed(1);
+            if (code === 0) {
+                console.log(`[tsgo] ${this.opts.appName}: types clean (${secs}s)`);
+                return;
+            }
+            // Print the raw `file.ts(1,2): error TSxxxx:` lines — the gateway's `error TS\d+` sniff
+            // turns these into the lens service-error signal, exactly like fork-ts-checker output did.
+            if (out.trim())
+                process.stdout.write(out.endsWith('\n') ? out : `${out}\n`);
+            const count = (out.match(/error TS\d+/g) ?? []).length;
+            console.log(`[tsgo] ${this.opts.appName}: ${count} type error${count === 1 ? '' : 's'} (${secs}s)`);
+        });
+    }
+}
+exports.TsgoCheckPlugin = TsgoCheckPlugin;