@lensmcp/cluster 1.16.5 → 1.16.8

package/executors/gateway/runtime/auth.d.ts

@@ -1,8 +1,9 @@
 import type { AuthVerdict, GatewayRuntime, GwTrace, Route } from './types';
 import type { Observability } from './observability';
+import type { JwtVerifier } from '../jwks-verify';
 export interface EdgeAuth {
     internal(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
     public(req: import('node:http').IncomingMessage, route: Route, trace: GwTrace | undefined): AuthVerdict;
 }
-export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability): EdgeAuth;
+export declare function createEdgeAuth(rt: GatewayRuntime, obs: Observability, verifier?: JwtVerifier): EdgeAuth;
 //# sourceMappingURL=auth.d.ts.map

package/executors/gateway/runtime/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,QAAQ,CA8C/E"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAC1G,MAAM,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;CACzG;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,QAAQ,CA8CvG"}

package/executors/gateway/runtime/auth.js

@@ -14,7 +14,7 @@ exports.createEdgeAuth = createEdgeAuth;
  */
 const manifest_1 = require("../manifest");
 const dev_auth_1 = require("./dev-auth");
-function createEdgeAuth(rt, obs) {
+function createEdgeAuth(rt, obs, verifier) {
     const { traceStep } = obs;
     const internal = (req, _route, trace) => {
         // service-to-service: validate the CALLER's api key at the boundary
@@ -37,7 +37,7 @@ function createEdgeAuth(rt, obs) {
             const method = (req.method ?? 'GET').toUpperCase();
             const resolved = (0, manifest_1.authRuleFor)(policy, url0, method);
             if (resolved.mode === 'jwt') {
-                const claims = (0, dev_auth_1.verifyDevJwt)(req);
+                const claims = (0, dev_auth_1.verifyDevJwt)(req, verifier);
                 if (!claims) {
                     traceStep(trace, 'auth', { mode: 'jwt', ok: false });
                     return { ok: false, status: 401, reason: 'unauthorized', detail: 'Unauthorized: invalid or missing token' };

package/executors/gateway/runtime/dev-auth.d.ts

@@ -1,7 +1,14 @@
 import type * as http from 'node:http';
 import type { Attrs } from './types';
-/** Verify the end-user JWT and return its claims, or undefined. */
-export declare function verifyDevJwt(req: http.IncomingMessage): Record<string, unknown> | undefined;
+import type { JwtVerifier } from '../jwks-verify';
+/**
+ * Verify the end-user JWT and return its claims, or undefined.
+ *
+ * @param verifier when provided (the RS256/JWKS verifier wired by the composition root), it is the ONLY
+ *   acceptor — the token is verified against the issuer's published keys by `kid`, so a rogue key / unknown
+ *   kid / bad signature / `alg:none` / HS256-confusion / expired token all return undefined (fail closed).
+ */
+export declare function verifyDevJwt(req: http.IncomingMessage, verifier?: JwtVerifier): Record<string, unknown> | undefined;
 /** Stamp verified identity onto the forwarded request — tenant from the `tid` CLAIM, never a client header. */
 export declare function stampIdentity(req: http.IncomingMessage, claims: Record<string, unknown>): void;
 /** Build the ABAC attribute bag from the verified claims + request envelope. */

package/executors/gateway/runtime/dev-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/dev-auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAiC3F;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AAED,gFAAgF;AAChF,eAAO,MAAM,QAAQ,GAAI,KAAK,IAAI,CAAC,eAAe,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAKpF,CAAC"}
+{"version":3,"file":"dev-auth.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/dev-auth.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AASlD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAyCnH;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAQ9F;AAED,gFAAgF;AAChF,eAAO,MAAM,QAAQ,GAAI,KAAK,IAAI,CAAC,eAAe,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAKpF,CAAC"}

package/executors/gateway/runtime/dev-auth.js

@@ -4,25 +4,45 @@ exports.devAttrs = void 0;
 exports.verifyDevJwt = verifyDevJwt;
 exports.stampIdentity = stampIdentity;
 /**
- * Dev edge auth (HS256), mirroring the prod gateway: verify the end-user token, then stamp the
- * trusted identity headers the services read (via GatewayTrustGuard). RS256/JWKS is prod's job;
- * dev shares the `AUTH_JWT_SECRET` the auth host signs with. Pure functions.
+ * Dev edge auth: verify the end-user token, then stamp the trusted identity headers the services read
+ * (via GatewayTrustGuard). It MIRRORS the prod gateway's posture — a real JWKS/RS256 verifier when one is
+ * wired (see `../jwks-verify` + the composition in `server.ts`), an HS256 shared-secret path as the legacy
+ * fallback. Pure functions (the verifier is injected, so unit tests supply their own JWKS).
+ *
+ * SECURITY (the invariant this file must hold): a `jwt` route MUST NOT accept a token whose signature the
+ * edge cannot verify. When a JWKS verifier is wired it is the SOLE acceptor — every alg goes through it, so
+ * an unknown `kid`, a bad signature, `alg:none`, an HS256-confusion token, and an expired token ALL fail
+ * closed (rejected). Without a verifier, an asymmetric (RS256/ES*) token cannot be checked (we don't hold
+ * the issuer's public keys), so it also fails closed — unless an operator EXPLICITLY opts into the old
+ * insecure decode-only path (`LENSMCP_GW_DEV_JWT_INSECURE_DECODE=1`) for local bring-up. The HS256
+ * shared-secret path stays for services using that convention (and is itself bypassed once JWKS is wired).
  */
 const node_crypto_1 = require("node:crypto");
-/** Verify the end-user JWT and return its claims, or undefined. */
-function verifyDevJwt(req) {
-    const secret = process.env['AUTH_JWT_SECRET'] ?? 'tetros-dev-secret';
-    const auth = String((Array.isArray(req.headers['authorization']) ? req.headers['authorization'][0] : req.headers['authorization']) ?? '');
-    if (!auth.startsWith('Bearer '))
+/** The compact JWS from the `Authorization: Bearer …` header, or undefined. */
+function bearerToken(req) {
+    const raw = Array.isArray(req.headers['authorization']) ? req.headers['authorization'][0] : req.headers['authorization'];
+    const auth = String(raw ?? '');
+    return auth.startsWith('Bearer ') ? auth.slice(7) : undefined;
+}
+/**
+ * Verify the end-user JWT and return its claims, or undefined.
+ *
+ * @param verifier when provided (the RS256/JWKS verifier wired by the composition root), it is the ONLY
+ *   acceptor — the token is verified against the issuer's published keys by `kid`, so a rogue key / unknown
+ *   kid / bad signature / `alg:none` / HS256-confusion / expired token all return undefined (fail closed).
+ */
+function verifyDevJwt(req, verifier) {
+    const token = bearerToken(req);
+    if (!token)
         return undefined;
-    const [h, p, s] = auth.slice(7).split('.');
+    const [h, p, s] = token.split('.');
     if (!h || !p || !s)
         return undefined;
-    // An IdP that signs ASYMMETRIC (RS256 + JWKS — e.g. tetros's auth host) does NOT use the HS256 dev
-    // shared-secret this dev edge assumed. The PROD gateway verifies RS256 via jwks-verify; in dev we
-    // DECODE + exp-check the claims (no signature check) — the gateway is the only local ingress, the token
-    // came from the trusted local IdP, and a dev IdP's ephemeral per-pod keys make in-cluster JWKS
-    // verification unreliable. (The HS256 path below stays for services using the shared-secret convention.)
+    // Preferred: a real JWKS/RS256 verifier (mirrors the prod gateway's `jwks ? jwks.verify(tok) : hs256`).
+    // When wired it is the SOLE acceptor, so every forgery vector below is closed at once.
+    if (verifier)
+        return verifier.verify(token);
+    // ── No verifier wired (legacy dev) ──────────────────────────────────────────────────────────────────
     let alg;
     try {
         alg = JSON.parse(Buffer.from(h, 'base64url').toString())['alg'];
@@ -31,6 +51,13 @@ function verifyDevJwt(req) {
         return undefined;
     }
     if (typeof alg === 'string' && alg !== 'HS256') {
+        // An asymmetric IdP (RS256 + JWKS) does NOT use the HS256 dev shared secret. Without the issuer's public
+        // keys we CANNOT verify the signature, so — unlike the old code, which decode-accepted any RS256 token
+        // (a full edge auth bypass: a rogue key or a forged `alg:none` sailed through) — we FAIL CLOSED. Wire a
+        // JWKS verifier (LENSMCP_GW_JWKS_URL, or the auto-derived auth-host JWKS) to accept RS256 tokens.
+        if (process.env['LENSMCP_GW_DEV_JWT_INSECURE_DECODE'] !== '1')
+            return undefined; // fail closed
+        // Explicit, dev-only opt-in to the legacy decode + exp-check (NO signature check) — bring-up escape hatch.
         try {
             const rsClaims = JSON.parse(Buffer.from(p, 'base64url').toString());
             if (typeof rsClaims['exp'] === 'number' && Date.now() / 1000 > rsClaims['exp'])
@@ -41,6 +68,8 @@ function verifyDevJwt(req) {
             return undefined;
         }
     }
+    // HS256 shared-secret convention (only reachable when NO JWKS verifier is wired).
+    const secret = process.env['AUTH_JWT_SECRET'] ?? 'tetros-dev-secret';
     const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(`${h}.${p}`).digest('base64url');
     const a = Buffer.from(s);
     const b = Buffer.from(expected);

package/executors/gateway/runtime/lens-children.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AACnF,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B,wDAAwD;IACxD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CA0HvH"}
+{"version":3,"file":"lens-children.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lens-children.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAgB,MAAM,SAAS,CAAC;AAQnF,OAAO,EAA0B,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAM7E,MAAM,WAAW,YAAY;IAC3B,iBAAiB,EAAE,UAAU,CAAC;IAC9B;iFAC6E;IAC7E,qBAAqB,IAAI,IAAI,CAAC;IAC9B,wDAAwD;IACxD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,GAAG,YAAY,CAiKvH"}

package/executors/gateway/runtime/lens-children.js

@@ -11,6 +11,8 @@ const node_child_process_1 = require("node:child_process");
 const manifest_1 = require("../manifest");
 const lens_frontend_1 = require("@lensmcp/nx-plugin/lens-frontend");
 const scope_1 = require("./scope");
+const lifecycle_1 = require("./lifecycle");
+const types_1 = require("./types");
 const observability_1 = require("./observability");
 const HEAL_BASE_MS = 1_500; // first restart delay
 const HEAL_MAX_MS = 30_000; // backoff cap — a true boot-loop settles here, never hot-loops
@@ -21,6 +23,13 @@ function createLensChildren(rt, obs, options) {
     // Auto-heal bookkeeping per child label: consecutive restart attempts (drives the exponential
     // backoff) so a boot-loop settles instead of hammering, reset once a child has run healthily.
     const lensHeal = new Map();
+    // Zombie recycle: the live `lens:true` app VITE children (label 'vite') + when each spawned, so the lens
+    // sweeper can restart one whose fs-watcher missed a post-spawn file add (the reported dashboard zombie).
+    // The capture sidecar + the dashboard/MCP singletons are NOT tracked (they don't serve app source).
+    const viteChildren = new Map();
+    // Per-project last-recycle time — the cooldown survives the kill→auto-heal→respawn (a new child handle).
+    const viteRecycleAt = new Map();
+    let lensSweeper;
     // A `SpawnChild` over the gateway's managed-children array — the SAME shape `agent-dev` passes to
     // `spawnLensFrontend`. EVERY gateway-managed child AUTO-HEALS: the dashboard + MCP singletons AND each
     // `lens:true` vite app are restarted when they exit while the gateway is up, with exponential backoff.
@@ -34,10 +43,15 @@ function createLensChildren(rt, obs, options) {
         const spawnedAt = Date.now();
         const child = (0, node_child_process_1.spawn)(bin, args, { cwd: rt.root, env: { ...process.env, ...(env ?? {}) }, stdio: 'inherit' });
         lensChildren.push(child);
+        // Track a `lens:true` app's vite dev server (label 'vite') for the zombie recycle. Its `LENSMCP_PROJECT`
+        // (set by lens-children when it spawns the frontend) names the app; a fresh respawn re-adds via this path.
+        if (label === 'vite')
+            viteChildren.set(child, { project: env?.['LENSMCP_PROJECT'] ?? 'app', spawnedAt });
         child.on('exit', (code, sig) => {
             const idx = lensChildren.indexOf(child);
             if (idx >= 0)
                 lensChildren.splice(idx, 1); // drop the dead handle so stop() won't signal it
+            viteChildren.delete(child); // the auto-heal respawn re-registers a fresh handle with a new spawnedAt
             if (rt.stopped())
                 return; // the gateway is shutting down — do NOT resurrect
             const heal = lensHeal.get(label) ?? { attempts: 0 };
@@ -53,6 +67,38 @@ function createLensChildren(rt, obs, options) {
         });
         return child;
     };
+    // ZOMBIE recycle for lens frontends: restart a `lens:true` app's vite whose fs-watcher went stale — it is
+    // ALIVE + reachable yet MISSED files created after it spawned (500 `Failed to resolve import` for a file
+    // that exists; the reported 17.7h dashboard pod). The shared `rt.sourceSetChangedAt` (stamped by the
+    // lifecycle sweeper's source-set scan) drives it: a vite that spawned before a settled set change is
+    // killed → this manager's own `on('exit')` auto-heal respawns a fresh vite that re-scans the FS. Only on a
+    // set CHANGE (add/remove), never a content save, and never a blind max-age (no idle signal for a frontend).
+    const startLensSweeper = () => {
+        if (!types_1.POD_RECYCLE_ENABLED || lensSweeper)
+            return;
+        const cfg = { graceMs: types_1.POD_STALE_GRACE_MS, settleMs: types_1.POD_RECYCLE_SETTLE_MS, cooldownMs: types_1.POD_STALE_RECYCLE_COOLDOWN_MS };
+        lensSweeper = setInterval(() => {
+            if (rt.stopped())
+                return;
+            const changedAt = rt.sourceSetChangedAt ?? 0;
+            if (changedAt <= 0 || viteChildren.size === 0)
+                return;
+            const now = Date.now();
+            for (const [child, meta] of viteChildren) {
+                const last = viteRecycleAt.get(meta.project) ?? 0;
+                if (!(0, lifecycle_1.lensFrontendStale)(meta.spawnedAt, last, changedAt, now, cfg))
+                    continue;
+                viteRecycleAt.set(meta.project, now);
+                console.log(`[gateway] zombie recycle: lens app ${meta.project} (stale-source-set) — vite missed a file add; restarting it`);
+                emit('warning', `zombie recycle: ${meta.project} (stale-source-set)`, `cluster-lens-app:${meta.project}`, { kind: 'pod-recycle', project: meta.project, reason: 'stale-source-set' });
+                try {
+                    child.kill('SIGTERM');
+                }
+                catch { /* already gone — the exit auto-heal will respawn */ }
+            }
+        }, Math.min(types_1.POD_STALE_SCAN_MS, 15_000));
+        lensSweeper.unref?.();
+    };
     const bootSingletonsAndApps = () => {
         const lensApps = [...new Map(rt.routes.filter((r) => r.lens).map((r) => [r.project, r.lens])).values()];
         const wantDashboard = options.dashboard !== false;
@@ -124,8 +170,13 @@ function createLensChildren(rt, obs, options) {
                 console.error(`[gateway] lens app ${app.project}: ${e.message}`);
             }
         }
+        startLensSweeper(); // watch the just-spawned lens vites for a stale-source-set zombie
     };
     const reapAll = () => {
+        if (lensSweeper) {
+            clearInterval(lensSweeper);
+            lensSweeper = undefined;
+        }
         for (const c of lensChildren) {
             try {
                 c.kill('SIGTERM');

package/executors/gateway/runtime/lifecycle.d.ts

@@ -1,5 +1,36 @@
 import type { GatewayRuntime, ServiceCtl, SockPool } from './types';
 import type { Observability } from './observability';
+/** Bounded, async, non-blocking walk of the workspace source tree → a signature of the file SET
+ *  (`<count>:<xor-of-path-hashes>`). Skips node_modules/dist/build/dotdirs + `*-devserver` sock dirs, and
+ *  only counts source-extension files. Order-independent (readdir order irrelevant) and null-safe. */
+export declare function sourceSetSignature(root: string): Promise<string>;
+export interface PodRecycleConfig {
+    maxAgeMs: number;
+    graceMs: number;
+    settleMs: number;
+    cooldownMs: number;
+}
+/**
+ * PURE decision: should this pod be recycled as a stale-view zombie, and why? A pod qualifies only when it
+ * is a live, UP, gateway-spawned pod that is currently QUIET (0 in-flight AND idle for `settleMs`, so a busy
+ * pod is never interrupted) and past its per-service cooldown. Then it recycles if the source file SET
+ * changed after it spawned (`stale-source-set`) or as a plain age backstop (`max-age`). Returns `null` when
+ * it must be left alone. Kept pure (no `ServiceCtl` mutation, no fs) so the sweeper's logic is unit-tested
+ * without spawning a process. `sourceSetChangedAt` is 0 until the gateway first observes a set change.
+ */
+export declare function podRecycleReason(svc: Pick<ServiceCtl, 'proc' | 'state' | 'spawnAt' | 'inflight' | 'lastUsed' | 'lastStaleRecycleAt'>, now: number, sourceSetChangedAt: number, cfg: PodRecycleConfig): 'stale-source-set' | 'max-age' | null;
+/**
+ * PURE decision for a LENS-FRONTEND vite child (a `lens:true` app's dev server — the reported zombie). It
+ * has no in-flight/idle signal like a pod, so it recycles ONLY on a settled source-file-SET change that
+ * POST-dates its spawn (the precise "watcher missed a new file" trigger) — never a blind max-age (which
+ * could interrupt active work). `killing` it lets the manager's `on('exit')` auto-heal respawn a fresh vite
+ * that re-scans the FS. Kept pure + exported so the recycle logic is unit-tested without a process.
+ */
+export declare function lensFrontendStale(spawnedAt: number, lastRecycleAt: number, sourceSetChangedAt: number, now: number, cfg: {
+    graceMs: number;
+    settleMs: number;
+    cooldownMs: number;
+}): boolean;
 export interface ServiceLayer {
     scanNow(pool: SockPool): number;
     spawnService(svc: ServiceCtl): void;

package/executors/gateway/runtime/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA0BrD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CA4MvF"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/lifecycle.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAapE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4CrD;;sGAEsG;AACtG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,oBAAoB,CAAC,EACpG,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,gBAAgB,GACpB,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAQvC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IAChC,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC;CAChC;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,GAAG,YAAY,CA2PvF"}

package/executors/gateway/runtime/lifecycle.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sourceSetSignature = sourceSetSignature;
+exports.podRecycleReason = podRecycleReason;
+exports.lensFrontendStale = lensFrontendStale;
 exports.createServiceLayer = createServiceLayer;
 const tslib_1 = require("tslib");
 /**
@@ -38,6 +41,103 @@ function eastWestEnv(rt, project) {
     return env;
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+// --- zombie-pod recycle: source-file-SET signature -------------------------------------------------------
+// A pod goes "stale" when the set of source files CHANGES (a file added/removed) after it spawned and its
+// degraded watcher missed it. We detect a set change — NOT a content change — by a cheap order-independent
+// signature over source file PATHS (count + xor of per-path hashes): adding/removing a path flips the
+// signature; editing a file's CONTENTS does not, so ordinary saves never trigger a recycle.
+const SRC_EXCLUDE = new Set(['node_modules', 'dist', 'tmp', 'coverage', 'build', 'out', 'target']);
+const SRC_EXT = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.css', '.scss', '.sass', '.less',
+    '.json', '.html', '.htm', '.vue', '.svelte', '.mdx',
+]);
+const SCAN_FILE_CAP = 100_000;
+function fnv1a(s) {
+    let h = 2166136261;
+    for (let i = 0; i < s.length; i += 1) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 16777619);
+    }
+    return h >>> 0;
+}
+/** Bounded, async, non-blocking walk of the workspace source tree → a signature of the file SET
+ *  (`<count>:<xor-of-path-hashes>`). Skips node_modules/dist/build/dotdirs + `*-devserver` sock dirs, and
+ *  only counts source-extension files. Order-independent (readdir order irrelevant) and null-safe. */
+async function sourceSetSignature(root) {
+    let count = 0;
+    let xor = 0;
+    const walk = async (dir) => {
+        if (count > SCAN_FILE_CAP)
+            return;
+        let entries;
+        try {
+            entries = await fs.promises.readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (count > SCAN_FILE_CAP)
+                return;
+            const name = e.name;
+            if (e.isDirectory()) {
+                if (name.startsWith('.') || SRC_EXCLUDE.has(name) || name.endsWith('-devserver'))
+                    continue;
+                await walk(path.join(dir, name));
+            }
+            else if (e.isFile()) {
+                const dot = name.lastIndexOf('.');
+                if (dot <= 0 || !SRC_EXT.has(name.slice(dot)))
+                    continue;
+                count += 1;
+                xor ^= fnv1a(path.join(dir, name));
+            }
+        }
+    };
+    await walk(root);
+    return `${count}:${(xor >>> 0).toString(36)}`;
+}
+/**
+ * PURE decision: should this pod be recycled as a stale-view zombie, and why? A pod qualifies only when it
+ * is a live, UP, gateway-spawned pod that is currently QUIET (0 in-flight AND idle for `settleMs`, so a busy
+ * pod is never interrupted) and past its per-service cooldown. Then it recycles if the source file SET
+ * changed after it spawned (`stale-source-set`) or as a plain age backstop (`max-age`). Returns `null` when
+ * it must be left alone. Kept pure (no `ServiceCtl` mutation, no fs) so the sweeper's logic is unit-tested
+ * without spawning a process. `sourceSetChangedAt` is 0 until the gateway first observes a set change.
+ */
+function podRecycleReason(svc, now, sourceSetChangedAt, cfg) {
+    if (!svc.proc || svc.state !== 'up' || svc.spawnAt == null)
+        return null; // only a live, up, spawned pod
+    if (svc.inflight > 0)
+        return null; // never mid-request
+    if (now - svc.lastUsed < cfg.settleMs)
+        return null; // wait for an inter-request lull
+    if (svc.lastStaleRecycleAt != null && now - svc.lastStaleRecycleAt < cfg.cooldownMs)
+        return null; // anti-thrash
+    if (sourceSetChangedAt > 0 && sourceSetChangedAt - svc.spawnAt > cfg.graceMs)
+        return 'stale-source-set';
+    if (cfg.maxAgeMs > 0 && now - svc.spawnAt > cfg.maxAgeMs)
+        return 'max-age';
+    return null;
+}
+/**
+ * PURE decision for a LENS-FRONTEND vite child (a `lens:true` app's dev server — the reported zombie). It
+ * has no in-flight/idle signal like a pod, so it recycles ONLY on a settled source-file-SET change that
+ * POST-dates its spawn (the precise "watcher missed a new file" trigger) — never a blind max-age (which
+ * could interrupt active work). `killing` it lets the manager's `on('exit')` auto-heal respawn a fresh vite
+ * that re-scans the FS. Kept pure + exported so the recycle logic is unit-tested without a process.
+ */
+function lensFrontendStale(spawnedAt, lastRecycleAt, sourceSetChangedAt, now, cfg) {
+    if (now - lastRecycleAt < cfg.cooldownMs)
+        return false; // anti-thrash on a source-churn burst
+    if (sourceSetChangedAt <= 0)
+        return false; // no set change observed yet
+    if (sourceSetChangedAt - spawnedAt <= cfg.graceMs)
+        return false; // this vite already postdates the change
+    if (now - sourceSetChangedAt < cfg.settleMs)
+        return false; // let an add/remove burst settle → one recycle
+    return true;
+}
 function createServiceLayer(rt, obs) {
     const { emit } = obs;
     const scanNow = (pool) => { pool.scannedAt = 0; return (0, discovery_1.pickSock)(pool, rt.scanTtlMs) ? pool.socks.length : 0; };
@@ -243,8 +343,51 @@ function createServiceLayer(rt, obs) {
                 spawnService(svc);
         }, 1500).unref?.();
     };
+    // --- zombie-pod recycle: source-set-change tracking + a fresh-pod recycle for a live-but-stale pod ------
+    const recycleCfg = {
+        maxAgeMs: types_1.POD_MAX_AGE_MS, graceMs: types_1.POD_STALE_GRACE_MS,
+        settleMs: types_1.POD_RECYCLE_SETTLE_MS, cooldownMs: types_1.POD_STALE_RECYCLE_COOLDOWN_MS,
+    };
+    let prevSig;
+    let scanInFlight = false;
+    let lastScanAt = 0;
+    // Kick a bounded, async source-set scan when due; on a SET change (file added/removed) stamp the shared
+    // clock so pods that predate it recycle. Non-blocking — the sweeper never awaits it.
+    const maybeScanSourceSet = () => {
+        if (scanInFlight || Date.now() - lastScanAt < types_1.POD_STALE_SCAN_MS)
+            return;
+        scanInFlight = true;
+        lastScanAt = Date.now();
+        void sourceSetSignature(rt.root)
+            .then((sig) => {
+            if (prevSig !== undefined && sig !== prevSig) {
+                rt.sourceSetChangedAt = Date.now();
+                emit('info', 'source file set changed — stale pods recycle when idle', 'cluster-gateway', { kind: 'source-set-changed' });
+            }
+            prevSig = sig;
+        })
+            .catch(() => undefined)
+            .finally(() => { scanInFlight = false; });
+    };
+    // Recycle a live-but-STALE-VIEW pod (alive + reachable, yet its watcher missed post-spawn file adds).
+    // Kill it → scale-from-zero (or eager respawn) → a fresh pod re-scans the FS. NOT counted against the
+    // crash-loop cap (staleness ≠ crash); the per-service cooldown ({@link podRecycleReason}) stops thrash.
+    const recyclePod = (svc, reason) => {
+        svc.lastStaleRecycleAt = Date.now();
+        console.log(`[gateway] zombie recycle: ${svc.project} (${reason}) — stale fs view; fresh pod incoming`);
+        emit('warning', `zombie recycle: ${svc.project} (${reason})`, `cluster-service:${svc.project}`, { kind: 'pod-recycle', project: svc.project, reason });
+        const eager = !!svc.decl.eager;
+        killSpawned(svc, `${reason} — recycling stale pod`); // clears proc, state='down', unlinks socks (+1200ms)
+        if (eager)
+            setTimeout(() => { if (!rt.stopped() && !svc.proc && svc.state === 'down')
+                spawnService(svc); }, 1500).unref?.();
+    };
     const startSweeper = () => {
         const sweeper = setInterval(() => {
+            if (rt.stopped())
+                return;
+            if (types_1.POD_RECYCLE_ENABLED)
+                maybeScanSourceSet();
             for (const svc of rt.services) {
                 if (rt.stopped() || !svc.proc) {
                     svc.wedgedSince = undefined;
@@ -259,8 +402,17 @@ function createServiceLayer(rt, obs) {
                 }
                 // WEDGE detection: a live parent with 0 live pods that is NOT legitimately cold-starting is wedged.
                 const coldStarting = svc.state === 'starting' && svc.spawnAt !== undefined && Date.now() - svc.spawnAt < rt.startupTimeoutMs;
-                if (scanNow(svc.pool) > 0 || coldStarting) {
+                const live = scanNow(svc.pool) > 0;
+                if (live || coldStarting) {
                     svc.wedgedSince = undefined;
+                    // ZOMBIE recycle: a live pod (live parent + live socket, answers requests) whose fs view went
+                    // stale — neither exit-respawn nor wedge-recycle sees it. Idle-gated in podRecycleReason so a busy
+                    // pod is never interrupted.
+                    if (live && !coldStarting && types_1.POD_RECYCLE_ENABLED) {
+                        const reason = podRecycleReason(svc, Date.now(), rt.sourceSetChangedAt ?? 0, recycleCfg);
+                        if (reason)
+                            recyclePod(svc, reason);
+                    }
                     continue;
                 }
                 svc.wedgedSince ??= Date.now();

package/executors/gateway/runtime/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAe,MAAM,SAAS,CAAC;AAEjH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CAkKxB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/server.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,qBAAqB,EAAsB,MAAM,SAAS,CAAC;AAkDxH,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA0KxB"}

package/executors/gateway/runtime/server.js

@@ -24,6 +24,57 @@ const auth_1 = require("./auth");
 const hooks_1 = require("./hooks");
 const handler_1 = require("./handler");
 const upgrade_1 = require("./upgrade");
+const jwks_verify_1 = require("../jwks-verify");
+/**
+ * A `fetch`-shaped shim for the JWKS pull that accepts the dev gateway's OWN self-signed cert. The dev
+ * IdP's JWKS is served behind the same local HTTPS front door (e.g. `https://auth.tetros.ai.local`), whose
+ * cert chains to the local basic-ssl CA — global `fetch` would reject it. Read-only GET of a public,
+ * gateway-served JWKS document; the SIGNATURE trust comes from verifying tokens against those keys, not
+ * from the transport. Falls back to plain `http` for an http URL. Dev-only (only the dev executor uses it).
+ */
+function insecureLocalFetch(url, init) {
+    return new Promise((resolve, reject) => {
+        const mod = url.startsWith('https:') ? require('node:https') : require('node:http');
+        const req = mod.request(url, { method: 'GET', headers: init?.headers, rejectUnauthorized: false }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                const status = res.statusCode ?? 0;
+                const text = Buffer.concat(chunks).toString('utf8');
+                resolve({ ok: status >= 200 && status < 300, status, json: async () => JSON.parse(text) });
+            });
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+/**
+ * The dev edge's JWT verifier — matches the prod gateway's RS256/JWKS posture so the LOCAL edge rejects
+ * forged tokens instead of decode-accepting them. The JWKS URL is `LENSMCP_GW_JWKS_URL` (explicit, same
+ * env as prod) or, absent that, is AUTO-DERIVED from the trusted `auth.*` host in the gateway's own route
+ * table (`https://<auth-host>/jwks.json`) — so a standard `auth.<apex>` IdP needs zero config. The host is
+ * taken from project.json (trusted), never from a token, so there's no SSRF/attacker-chosen JWKS. Returns
+ * undefined when no source is found (→ non-HS256 tokens fail closed unless the insecure opt-in is set).
+ */
+function buildEdgeJwtVerifier(routes) {
+    const explicit = process.env['LENSMCP_GW_JWKS_URL'];
+    let jwksUrl = explicit;
+    let derived = false;
+    if (!jwksUrl) {
+        const authHost = routes
+            .map((r) => r.host)
+            .find((h) => typeof h === 'string' && /^auth\./.test(h) && !h.startsWith('internal.'));
+        if (authHost) {
+            jwksUrl = `https://${authHost}/jwks.json`;
+            derived = true;
+        }
+    }
+    if (!jwksUrl)
+        return undefined;
+    const issuer = process.env['LENSMCP_GW_JWT_ISS'];
+    console.log(`[gateway] edge JWT: verifying via JWKS ${jwksUrl}${derived ? ' (auto-derived from the auth route)' : ''}`);
+    return (0, jwks_verify_1.createJwksVerifier)({ jwksUrl, ...(issuer ? { issuer } : {}), fetchImpl: insecureLocalFetch });
+}
 async function startGateway(options, context) {
     // NB: this local `https` (TLS-on flag) deliberately SHADOWS the `node:https`
     // module — which is why TLS/agents are reached via `require('node:https')`.
@@ -65,7 +116,15 @@ async function startGateway(options, context) {
     const svcLayer = (0, lifecycle_1.createServiceLayer)(rt, obs);
     const lens = (0, lens_children_1.createLensChildren)(rt, obs, options);
     const proxyLayer = (0, proxy_1.createProxy)(rt, obs, svcLayer);
-    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs);
+    // Edge JWT verification (mirrors the prod gateway): when a JWKS source is configured/derivable, the dev
+    // edge verifies RS256 tokens by `kid` against the IdP's published keys and REJECTS anything it can't
+    // verify (rogue kid / bad sig / alg:none / HS256-confusion / expired) — closing the dev decode-only bypass.
+    const jwtVerifier = buildEdgeJwtVerifier(routes);
+    const edgeAuth = (0, auth_1.createEdgeAuth)(rt, obs, jwtVerifier);
+    // Warm the key cache (non-fatal, non-blocking): the IdP pod may still be booting, so a failure here just
+    // means the first tokens fail closed until the on-miss/periodic refresh lands the keys (matches prod).
+    if (jwtVerifier)
+        void jwtVerifier.refresh().catch((e) => console.warn('[gateway] edge JWKS warm failed (will retry):', e.message));
     // Custom user middleware (the JWT seam; internal.* routes skip it) is wired as
     // the BUILT-IN FIRST `afterAuth` hook — so "custom middleware runs AFTER core
     // auth" and the `{ mode:'middleware' }` trace step are preserved.
@@ -167,6 +226,7 @@ async function startGateway(options, context) {
         clearInterval(edgeFlusher);
         clearInterval(sweeper);
         obs.emit('info', 'gateway down', 'cluster-gateway', { kind: 'gateway-down' });
+        jwtVerifier?.stop(); // clear the JWKS periodic-refresh timer
         for (const svc of services)
             svcLayer.killSpawned(svc, 'gateway shutdown');
         // Reap the lens-mode managed children (dashboard + MCP singletons + each

package/executors/gateway/runtime/types.d.ts

@@ -131,6 +131,11 @@ export interface ServiceCtl {
      * cold-starting). Cleared once a pod appears; once it exceeds {@link WEDGE_RECYCLE_GRACE_MS} the sweeper
      * recycles the wedged tree. */
     wedgedSince?: number;
+    /** Zombie recycle: when this pod was last recycled for STALENESS/age (a live-but-stale-view pod, distinct
+     * from a crash or a wedge). A per-service cooldown ({@link POD_STALE_RECYCLE_COOLDOWN_MS}) keyed off this
+     * stops a rapid source-churn (e.g. a codegen run) from thrash-recycling the same pod. NOT counted against
+     * the crash-loop cap ({@link restarts}) — staleness is not a crash. */
+    lastStaleRecycleAt?: number;
 }
 /** Min interval (ms) between repeat 'service error' emits for the SAME service + same error line. */
 export declare const SERVICE_ERROR_THROTTLE_MS = 5000;
@@ -162,6 +167,36 @@ export declare const POD_RESPONSE_TIMEOUT_MS: number;
  * legit in-process hot-swap (the socket is briefly gone, then re-bound). A code (build) error is left to
  * the user's fix but still recycled under the crash-loop cap. Override with `LENSMCP_WEDGE_RECYCLE_GRACE_MS`. */
 export declare const WEDGE_RECYCLE_GRACE_MS: number;
+/**
+ * ZOMBIE-POD RECYCLE (dev only). The exit-respawn (crashed pod) and wedge-recycle (live parent, 0 live
+ * pods) self-heals both assume a DEAD or SOCKET-LESS pod. This one catches the third kind: a pod that is
+ * ALIVE and reachable (a live socket, answers requests) yet serves a STALE FILESYSTEM VIEW — its dev-server
+ * file-watcher degraded (macOS fsevents after long uptime / a sleep-wake) and MISSED files created AFTER it
+ * spawned, so it 500s `Failed to resolve import "./x"` for a file that EXISTS on disk (the reported
+ * incident: a 17.7h-old vite pod that predated new files by ~6h). The sweeper detects it two ways and
+ * recycles the pod (kill → scale-from-zero → a fresh pod re-scans the FS) — but ONLY when the pod is idle
+ * (no in-flight request + a brief lull), so an active pod is never interrupted.
+ */
+/** Master switch — set `LENSMCP_POD_RECYCLE=0` to disable zombie-pod recycling entirely. Default ON (dev). */
+export declare const POD_RECYCLE_ENABLED: boolean;
+/** Backstop: recycle a gateway-spawned pod once it is older than this, even with no detected source change
+ *  (a long-lived pod is the one whose watcher degrades). `0` disables the age backstop. Override
+ *  `LENSMCP_POD_MAX_AGE_MS`. Default 4h. */
+export declare const POD_MAX_AGE_MS: number;
+/** A pod is "stale" when the source file SET changed (a file added/removed — NOT a content change, so
+ *  ordinary saves never recycle) more than this AFTER the pod spawned. The grace absorbs clock skew + the
+ *  pod's own first-compile writes. Override `LENSMCP_POD_STALE_GRACE_MS`. Default 10s. */
+export declare const POD_STALE_GRACE_MS: number;
+/** Recycle only after the pod has been quiet this long (0 in-flight AND lastUsed older than this) — a busy
+ *  pod is never interrupted; the recycle lands in an inter-request lull. Override
+ *  `LENSMCP_POD_RECYCLE_SETTLE_MS`. Default 8s. */
+export declare const POD_RECYCLE_SETTLE_MS: number;
+/** How often the sweeper rescans the workspace source file SET signature (a bounded, async, non-blocking
+ *  walk). Override `LENSMCP_POD_STALE_SCAN_MS`. Default 30s. */
+export declare const POD_STALE_SCAN_MS: number;
+/** Per-service cooldown between staleness recycles — stops a source-churn burst (codegen) thrash-recycling
+ *  the same pod. Override `LENSMCP_POD_STALE_RECYCLE_COOLDOWN_MS`. Default 60s. */
+export declare const POD_STALE_RECYCLE_COOLDOWN_MS: number;
 /** Test-tunable knobs on top of the user-facing schema. */
 export interface GatewayRuntimeOptions extends GatewayExecutorSchema {
     /** Traffic-edge flush period (ms). Default 5000. */
@@ -212,6 +247,11 @@ export interface GatewayRuntime {
     readonly sweepMs: number;
     readonly trafficFlushMs: number;
     readonly https: boolean;
+    /** Zombie-pod recycle: the last time the workspace source FILE SET changed (a file added/removed), stamped
+     *  by the lifecycle sweeper's periodic scan. SHARED so both managers — the pod sweeper (lifecycle) and the
+     *  lens-frontend sweeper (lens-children) — recycle any child that spawned before it. `0`/undefined until
+     *  the first change is observed. Mutable (the one non-readonly runtime field, written only by the scanner). */
+    sourceSetChangedAt?: number;
     /** Teardown flag — a GETTER, never a captured boolean, so every layer reads
      *  the LIVE value (an in-flight cold start / auto-heal must not act after stop). */
     stopped(): boolean;

package/executors/gateway/runtime/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;iGAE6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;6GAGyG;IACzG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;mCAE+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;wDAEwD;AACxD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;sGAEsG;AACtG,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;;sDAOsD;AACtD,eAAO,MAAM,uBAAuB,QAGhC,CAAC;AAEL;;;;;;;iHAOiH;AACjH,eAAO,MAAM,sBAAsB,QAG/B,CAAC;AAEL,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAGD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;wFACoF;IACpF,OAAO,IAAI,OAAO,CAAC;CACpB;AAGD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;IAChC,gEAAgE;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,gGAAgG;IAChG,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../libs/cluster/src/executors/gateway/runtime/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,KAAK,IAAI,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,YAAY,EAAE,KAAK,EAAE,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACzE;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC9B;;iGAE6F;IAC7F,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE1F,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;gEAC4D;IAC5D,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;;yBAGyB;AACzB,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;iGAE6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;6GAGyG;IACzG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;mCAE+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2EAGuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAWD,qGAAqG;AACrG,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAE9C;;wDAEwD;AACxD,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;sGAEsG;AACtG,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;;sDAOsD;AACtD,eAAO,MAAM,uBAAuB,QAGhC,CAAC;AAEL;;;;;;;iHAOiH;AACjH,eAAO,MAAM,sBAAsB,QAG/B,CAAC;AAEL;;;;;;;;;GASG;AACH,8GAA8G;AAC9G,eAAO,MAAM,mBAAmB,SAA6C,CAAC;AAC9E;;4CAE4C;AAC5C,eAAO,MAAM,cAAc,QAA0D,CAAC;AACtF;;0FAE0F;AAC1F,eAAO,MAAM,kBAAkB,QAA+C,CAAC;AAC/E;;mDAEmD;AACnD,eAAO,MAAM,qBAAqB,QAAiD,CAAC;AACpF;gEACgE;AAChE,eAAO,MAAM,iBAAiB,QAA8C,CAAC;AAC7E;mFACmF;AACnF,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG,2DAA2D;AAC3D,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAGD,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;mHAG+G;IAC/G,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;wFACoF;IACpF,OAAO,IAAI,OAAO,CAAC;CACpB;AAGD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,YAAY,GACZ,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE;6EAC6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;IAChC,gEAAgE;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,gGAAgG;IAChG,SAAS,IAAI,OAAO,CAAC;CACtB;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/executors/gateway/runtime/types.js

@@ -1,6 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WEDGE_RECYCLE_GRACE_MS = exports.POD_RESPONSE_TIMEOUT_MS = exports.UPSTREAM_HEAL_STEP_MS = exports.UPSTREAM_HEAL_WINDOW_MS = exports.SERVICE_RESTART_WINDOW_MS = exports.SERVICE_MAX_RESTARTS = exports.SERVICE_ERROR_THROTTLE_MS = void 0;
+exports.POD_STALE_RECYCLE_COOLDOWN_MS = exports.POD_STALE_SCAN_MS = exports.POD_RECYCLE_SETTLE_MS = exports.POD_STALE_GRACE_MS = exports.POD_MAX_AGE_MS = exports.POD_RECYCLE_ENABLED = exports.WEDGE_RECYCLE_GRACE_MS = exports.POD_RESPONSE_TIMEOUT_MS = exports.UPSTREAM_HEAL_STEP_MS = exports.UPSTREAM_HEAL_WINDOW_MS = exports.SERVICE_RESTART_WINDOW_MS = exports.SERVICE_MAX_RESTARTS = exports.SERVICE_ERROR_THROTTLE_MS = void 0;
+/** Parse a positive-integer env override; fall back to `def` on missing/NaN/negative. `allowZero` lets a
+ *  `0` through (used as a "disable" sentinel, e.g. {@link POD_MAX_AGE_MS}); otherwise `0` also falls back. */
+function envInt(name, def, allowZero = false) {
+    const n = Number(process.env[name]);
+    if (!Number.isFinite(n) || n < 0)
+        return def;
+    if (n === 0)
+        return allowZero ? 0 : def;
+    return n;
+}
 /** Min interval (ms) between repeat 'service error' emits for the SAME service + same error line. */
 exports.SERVICE_ERROR_THROTTLE_MS = 5000;
 /** Self-heal: an unexpectedly-exited pod (crash, not a clean exit or a build error) is auto-respawned
@@ -37,3 +47,33 @@ exports.WEDGE_RECYCLE_GRACE_MS = (() => {
     const n = Number(process.env['LENSMCP_WEDGE_RECYCLE_GRACE_MS']);
     return Number.isFinite(n) && n > 0 ? n : 15_000;
 })();
+/**
+ * ZOMBIE-POD RECYCLE (dev only). The exit-respawn (crashed pod) and wedge-recycle (live parent, 0 live
+ * pods) self-heals both assume a DEAD or SOCKET-LESS pod. This one catches the third kind: a pod that is
+ * ALIVE and reachable (a live socket, answers requests) yet serves a STALE FILESYSTEM VIEW — its dev-server
+ * file-watcher degraded (macOS fsevents after long uptime / a sleep-wake) and MISSED files created AFTER it
+ * spawned, so it 500s `Failed to resolve import "./x"` for a file that EXISTS on disk (the reported
+ * incident: a 17.7h-old vite pod that predated new files by ~6h). The sweeper detects it two ways and
+ * recycles the pod (kill → scale-from-zero → a fresh pod re-scans the FS) — but ONLY when the pod is idle
+ * (no in-flight request + a brief lull), so an active pod is never interrupted.
+ */
+/** Master switch — set `LENSMCP_POD_RECYCLE=0` to disable zombie-pod recycling entirely. Default ON (dev). */
+exports.POD_RECYCLE_ENABLED = process.env['LENSMCP_POD_RECYCLE'] !== '0';
+/** Backstop: recycle a gateway-spawned pod once it is older than this, even with no detected source change
+ *  (a long-lived pod is the one whose watcher degrades). `0` disables the age backstop. Override
+ *  `LENSMCP_POD_MAX_AGE_MS`. Default 4h. */
+exports.POD_MAX_AGE_MS = envInt('LENSMCP_POD_MAX_AGE_MS', 4 * 60 * 60_000, true);
+/** A pod is "stale" when the source file SET changed (a file added/removed — NOT a content change, so
+ *  ordinary saves never recycle) more than this AFTER the pod spawned. The grace absorbs clock skew + the
+ *  pod's own first-compile writes. Override `LENSMCP_POD_STALE_GRACE_MS`. Default 10s. */
+exports.POD_STALE_GRACE_MS = envInt('LENSMCP_POD_STALE_GRACE_MS', 10_000);
+/** Recycle only after the pod has been quiet this long (0 in-flight AND lastUsed older than this) — a busy
+ *  pod is never interrupted; the recycle lands in an inter-request lull. Override
+ *  `LENSMCP_POD_RECYCLE_SETTLE_MS`. Default 8s. */
+exports.POD_RECYCLE_SETTLE_MS = envInt('LENSMCP_POD_RECYCLE_SETTLE_MS', 8_000);
+/** How often the sweeper rescans the workspace source file SET signature (a bounded, async, non-blocking
+ *  walk). Override `LENSMCP_POD_STALE_SCAN_MS`. Default 30s. */
+exports.POD_STALE_SCAN_MS = envInt('LENSMCP_POD_STALE_SCAN_MS', 30_000);
+/** Per-service cooldown between staleness recycles — stops a source-churn burst (codegen) thrash-recycling
+ *  the same pod. Override `LENSMCP_POD_STALE_RECYCLE_COOLDOWN_MS`. Default 60s. */
+exports.POD_STALE_RECYCLE_COOLDOWN_MS = envInt('LENSMCP_POD_STALE_RECYCLE_COOLDOWN_MS', 60_000);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/cluster",
-  "version": "1.16.5",
+  "version": "1.16.8",
   "description": "Run your Nx workspace as a local production cluster: pods on unix sockets with true HMR, one https gateway with per-project domains, scale-from-zero, autoscale, idle-kill, local-CA TLS — observed by the LensMCP lens.",
   "main": "./index.js",
   "types": "./index.d.ts",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@lensmcp/node-instrumentation": "1.16.5",
-    "@lensmcp/nx-plugin": "1.16.5",
+    "@lensmcp/node-instrumentation": "1.16.8",
+    "@lensmcp/nx-plugin": "1.16.8",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "glob": "^11.0.0",
     "http-proxy": "^1.18.0",