@lensmcp/cluster 1.16.28 → 1.16.29

package/executors/gateway/runtime/lens-children.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,SAAS,CAAC;AAQ1F,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E;;;;8CAI8C;AAC9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO5D;AAED,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;;gFAE4E;IAC5E,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC;;6GAEyG;IACzG,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;IACvF;;yGAEqG;IACrG,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACpE;gHAC4G;IAC5G,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,qBAAqB,EAE9B,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,GACzD,YAAY,CAgWd"}
+{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAuB,MAAM,SAAS,CAAC;AAQ1F,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E;;;;8CAI8C;AAC9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO5D;AAED,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;;gFAE4E;IAC5E,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC;;6GAEyG;IACzG,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;IACvF;;yGAEqG;IACrG,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACpE;gHAC4G;IAC5G,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,qBAAqB,EAE9B,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,GACzD,YAAY,CAmWd"}

package/executors/gateway/runtime/lens-children.js

@@ -13,6 +13,7 @@ const net = tslib_1.__importStar(require("node:net"));
 const path = tslib_1.__importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
 const lens_frontend_1 = require("@lensmcp/nx-plugin/lens-frontend");
+const pod_env_1 = require("./pod-env");
 const scope_1 = require("./scope");
 const workspace_registry_1 = require("./workspace-registry");
 const lifecycle_1 = require("./lifecycle");
@@ -91,7 +92,10 @@ deps) {
         // their ports for the next gateway to route into.
         const child = (0, node_child_process_1.spawn)(bin, args, {
             cwd: cwd ?? rt.root,
-            env: { ...process.env, ...(env ?? {}), LENSMCP_PARENT_PID: String(process.pid) },
+            // FOREIGN-POD ENV SCRUB (pod-env.ts): a registered workspace's vite/child runs in ITS root and must
+            // not inherit the daemon host's dotenv-loaded env (vite, like nx, keeps an already-set var over the
+            // workspace's own .env) — the caller's explicit `env` overlay still applies on top.
+            env: { ...(0, pod_env_1.podBaseEnv)(process.env, rt.root, cwd ?? rt.root), ...(env ?? {}), LENSMCP_PARENT_PID: String(process.pid) },
             stdio: 'inherit',
         });
         lensChildren.push(child);

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AA8C/D;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CAwXvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AA8C/D;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CA4XvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -15,6 +15,7 @@ const fs = tslib_1.__importStar(require("node:fs"));
 const http = tslib_1.__importStar(require("node:http"));
 const path = tslib_1.__importStar(require("node:path"));
 const discovery_1 = require("./discovery");
+const pod_env_1 = require("./pod-env");
 const types_1 = require("./types");
 /**
  * The east-west env a pod needs to call ANOTHER service's `internal.<host>` route (memberships, settings,
@@ -248,7 +249,11 @@ function createServiceLayer(rt, obs) {
             // so its dashboard shows its live traces, not the daemon's. The daemon's own services keep rt.eventFile
             // exactly (svc.root === rt.root), so single-workspace behavior is unchanged.
             env: {
-                ...process.env,
+                // FOREIGN-POD ENV SCRUB (pod-env.ts): a registered workspace's pod must NOT inherit the daemon
+                // host's dotenv-loaded env (nx never overrides an already-set var, so foodguard's PG_URL/REDIS_URL
+                // riding the daemon once pointed tetros's auth+iam at foodguard's stores). The daemon's own
+                // workspace keeps the full inherit — its pods reload the same files anyway.
+                ...(0, pod_env_1.podBaseEnv)(process.env, rt.root, svc.root),
                 NX_DAEMON: 'false',
                 // NX_ISOLATE_PLUGINS=false: with the daemon off (above), EVERY serve client builds the
                 // project graph itself — and with plugin isolation on (nx's default) each client spawns

package/executors/gateway/runtime/pod-env.d.ts

@@ -0,0 +1,24 @@
+/** The root-level dotenv files nx (and vite) auto-load for any invocation at a workspace root. */
+export declare const WORKSPACE_DOTENV_FILES: readonly [".env", ".env.local", ".local.env"];
+/**
+ * Data-store pointers that must never cross a workspace boundary, even when they arrived in the daemon's
+ * env some way other than the host's dotenv (an exported shell var at gateway start). Belt-and-suspenders
+ * under the dotenv-derived scrub — kept to the class that caused the incident.
+ */
+export declare const FOREIGN_POD_ENV_DENYLIST: readonly ["PG_URL", "REDIS_URL", "DATABASE_URL", "POSTGRES_URL"];
+/**
+ * The keys a dotenv file DECLARES — assignment lines only (`KEY=…`, optional `export ` prefix), comments
+ * and malformed lines ignored. We only need the key names (what to scrub), never the values.
+ */
+export declare function parseDotenvKeys(content: string): Set<string>;
+/** Every key declared across a workspace root's dotenv files (missing/unreadable files contribute nothing). */
+export declare function workspaceDotenvKeys(root: string): Set<string>;
+/** PURE scrub: a copy of `base` without the given keys nor the store-pointer denylist. Never mutates `base`. */
+export declare function scrubEnv(base: NodeJS.ProcessEnv, hostKeys: ReadonlySet<string>): NodeJS.ProcessEnv;
+/**
+ * The spawn-base env for a child of `childRoot` under a daemon hosted at `hostRoot`: the daemon's own
+ * workspace inherits untouched; a foreign workspace gets the scrubbed copy (the child's own nx/vite dotenv
+ * load then supplies THAT workspace's values, which is the whole point).
+ */
+export declare function podBaseEnv(base: NodeJS.ProcessEnv, hostRoot: string, childRoot: string): NodeJS.ProcessEnv;
+//# sourceMappingURL=pod-env.d.ts.map

package/executors/gateway/runtime/pod-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pod-env.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/pod-env.ts"],"names":[],"mappings":"AAoBA,kGAAkG;AAClG,eAAO,MAAM,sBAAsB,+CAAgD,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,kEAAmE,CAAC;AAEzG;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAS5D;AAED,+GAA+G;AAC/G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAY7D;AAED,gHAAgH;AAChH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAQlG;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAG1G"}

package/executors/gateway/runtime/pod-env.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FOREIGN_POD_ENV_DENYLIST = exports.WORKSPACE_DOTENV_FILES = void 0;
+exports.parseDotenvKeys = parseDotenvKeys;
+exports.workspaceDotenvKeys = workspaceDotenvKeys;
+exports.scrubEnv = scrubEnv;
+exports.podBaseEnv = podBaseEnv;
+const tslib_1 = require("tslib");
+/**
+ * FOREIGN-POD ENV SCRUB (the cross-workspace store bleed, foodguard↔tetros 2026-07-26).
+ *
+ * `nx run gateway:serve` auto-loads the DAEMON workspace's root dotenv (`.env`, `.env.local`) into the
+ * daemon's own process env, and the spawn sites' `...process.env` handed that to EVERY child — including a
+ * REGISTERED (foreign) workspace's pods. nx's dotenv load in the child never overrides an already-set var,
+ * so the daemon host's values beat the foreign workspace's own `.env.local`: with the daemon hosted from
+ * foodguard (whose root `.env.local` declares `PG_URL`/`REDIS_URL`), tetros's auth+iam pods booted onto
+ * foodguard's Postgres/Valkey — foodguard tenants rendered inside the tetros app, and tetros's boot seed
+ * wrote rows into foodguard's database.
+ *
+ * The rule: a FOREIGN workspace's pod gets the inherited env MINUS (every key the daemon workspace's root
+ * dotenv files declare ∪ a hard denylist of data-store pointers). The daemon's OWN workspace pods keep the
+ * full inherit — their nx/vite reload the exact same files at spawn (so the scrub would change nothing),
+ * and a deliberate shell override (`PG_URL=… lensmcp gateway start`) staying live for one's own pods is
+ * ordinary env semantics. Hosting order must never matter for anyone else's pods.
+ */
+const fs = tslib_1.__importStar(require("node:fs"));
+const path = tslib_1.__importStar(require("node:path"));
+/** The root-level dotenv files nx (and vite) auto-load for any invocation at a workspace root. */
+exports.WORKSPACE_DOTENV_FILES = ['.env', '.env.local', '.local.env'];
+/**
+ * Data-store pointers that must never cross a workspace boundary, even when they arrived in the daemon's
+ * env some way other than the host's dotenv (an exported shell var at gateway start). Belt-and-suspenders
+ * under the dotenv-derived scrub — kept to the class that caused the incident.
+ */
+exports.FOREIGN_POD_ENV_DENYLIST = ['PG_URL', 'REDIS_URL', 'DATABASE_URL', 'POSTGRES_URL'];
+/**
+ * The keys a dotenv file DECLARES — assignment lines only (`KEY=…`, optional `export ` prefix), comments
+ * and malformed lines ignored. We only need the key names (what to scrub), never the values.
+ */
+function parseDotenvKeys(content) {
+    const keys = new Set();
+    for (const raw of content.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const m = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (m)
+            keys.add(m[1]);
+    }
+    return keys;
+}
+/** Every key declared across a workspace root's dotenv files (missing/unreadable files contribute nothing). */
+function workspaceDotenvKeys(root) {
+    const keys = new Set();
+    for (const file of exports.WORKSPACE_DOTENV_FILES) {
+        let content;
+        try {
+            content = fs.readFileSync(path.join(root, file), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const k of parseDotenvKeys(content))
+            keys.add(k);
+    }
+    return keys;
+}
+/** PURE scrub: a copy of `base` without the given keys nor the store-pointer denylist. Never mutates `base`. */
+function scrubEnv(base, hostKeys) {
+    const out = {};
+    for (const [k, v] of Object.entries(base)) {
+        if (hostKeys.has(k))
+            continue;
+        if (exports.FOREIGN_POD_ENV_DENYLIST.includes(k))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/**
+ * The spawn-base env for a child of `childRoot` under a daemon hosted at `hostRoot`: the daemon's own
+ * workspace inherits untouched; a foreign workspace gets the scrubbed copy (the child's own nx/vite dotenv
+ * load then supplies THAT workspace's values, which is the whole point).
+ */
+function podBaseEnv(base, hostRoot, childRoot) {
+    if (path.resolve(childRoot) === path.resolve(hostRoot))
+        return base;
+    return scrubEnv(base, workspaceDotenvKeys(hostRoot));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.28",
+  "version": "1.16.29",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.28",
-    "@lensmcp/nx-plugin": "1.16.28",
+    "@lensmcp/node-instrumentation": "1.16.29",
+    "@lensmcp/nx-plugin": "1.16.29",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",