@lensmcp/cluster 1.18.4 → 1.18.7

package/executors/gateway/runtime/proxy.js

@@ -1,457 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createProxy = createProxy;
-const tslib_1 = require("tslib");
-/**
- * The forwarding layer: one pooled `http-proxy` instance (keep-alive agents) and
- * the `forward` that drives it — pod round-robin with scale-from-zero/autoscale,
- * or a TCP upstream. Owns the edge-response branding (`x-lensmcp-pod`, stripping
- * `x-powered-by`, `server: LensMCP`).
- */
-const fs = tslib_1.__importStar(require("node:fs"));
-const http = tslib_1.__importStar(require("node:http"));
-const path = tslib_1.__importStar(require("node:path"));
-const discovery_1 = require("./discovery");
-const edge_1 = require("./edge");
-const types_1 = require("./types");
-/** A CONNECTION-class upstream error — the pod/dev-server is momentarily unreachable (restarting its
- * internal server on a config change, or warming up), NOT an application response. Only these are
- * retried by the self-heal; a real 5xx from the app has already streamed a response and never lands here. */
-function isConnError(err) {
-    const code = err.code ?? '';
-    return (code === 'ECONNREFUSED' ||
-        code === 'ECONNRESET' ||
-        code === 'ETIMEDOUT' ||
-        code === 'EPIPE' ||
-        code === 'EHOSTUNREACH' ||
-        code === 'ENOENT' ||
-        /ECONNREFUSED|ECONNRESET|socket hang up|EPIPE/i.test(err.message));
-}
-/** Hop-by-hop headers (RFC 7230 §6.1) — never forwarded upstream, never copied onto the edge
- * response. Doubles as the set of connection-specific headers that are ILLEGAL on an HTTP/2 stream
- * (Node's http2 layer throws on `connection`/`transfer-encoding`/… ), which is why the h2 native
- * forwarder below must strip them where node-http-proxy (H1-only) never had to. */
-const HOP_BY_HOP = new Set([
-    'connection', 'keep-alive', 'proxy-connection', 'proxy-authenticate', 'proxy-authorization',
-    'te', 'trailer', 'transfer-encoding', 'upgrade',
-]);
-// eslint-disable-next-line @typescript-eslint/no-require-imports
-const httpProxy = require('http-proxy');
-function createProxy(rt, obs, svcLayer) {
-    const { recordEdge, finishTrace, traceStep } = obs;
-    // Keep-alive to upstreams (pods over unix sockets AND TCP apps). Without an
-    // agent http-proxy opens a fresh connection per request — a connect per call
-    // that ~halves throughput and adds latency. One pooled agent reuses sockets
-    // (keyed by socketPath / host:port); https targets get the verify-skipping
-    // https agent. NB: this file uses `require('node:https')` to match the source
-    // file's pattern (the orchestrator shadows the module with a local TLS flag).
-    const agentOpts = { keepAlive: true, keepAliveMsecs: 30_000, maxSockets: 1024, maxFreeSockets: 256 };
-    const httpAgent = new http.Agent(agentOpts);
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const httpsAgent = new (require('node:https').Agent)(agentOpts);
-    const agentForTarget = (target) => typeof target === 'string' && target.startsWith('https:') ? httpsAgent : httpAgent;
-    // secure:false — upstreams may terminate TLS with the same local CA.
-    // proxyTimeout — a pod that accepts the socket but never responds would
-    // otherwise pin svc.inflight forever (blocking idle-kill, skewing autoscale)
-    // and leave the gateway-request trace open; the timeout fires the proxy
-    // error path → 502 → res 'close' → inflight decrements + trace finishes.
-    const proxy = httpProxy.createProxyServer({ xfwd: true, secure: false, proxyTimeout: 120_000, agent: httpAgent });
-    /**
-     * EDGE-CANCEL PROPAGATION for the H1 (node-http-proxy) path — the H1 twin of `pipeUpstream`'s
-     * `onEdgeClose`, and a real leak fix.
-     *
-     * node-http-proxy 1.18.1 propagates a client cancel through exactly ONE hook:
-     * `req.on('aborted', () => proxyReq.abort())` (web-incoming.js). `'aborted'` is the event Node
-     * DEPRECATED in v16 in favour of `'close'`, and it does not fire here — MEASURED on Node 24 with the
-     * real pooled-agent setup below: on an edge cancel mid-response the upstream request was never aborted
-     * (`aborted` 0 times), the upstream response never closed, the upstream kept STREAMING forever into a
-     * socket nobody reads, and the pooled socket stayed permanently CHECKED OUT of the agent
-     * (`in-use=1, free=0`) — leaked, never reused, never released. Every cancelled request (an unmounted
-     * SSE stream, an HMR reload, a navigated-away fetch) leaked one upstream socket AND pinned the pod
-     * generating events for a client that is gone; enough of them walk the agent to `maxSockets`, after
-     * which new requests queue behind sockets that can never come free.
-     *
-     * So the cancel is wired here instead, on both halves of the upstream exchange:
-     *  - `proxyReq` — cancel BEFORE the response arrives ⇒ destroy the outbound request.
-     *  - `proxyRes` — cancel MID-response ⇒ destroy the upstream response.
-     * DESTROY, never release: a destroyed socket is dropped from the agent instead of returned to
-     * `freeSockets`, so a half-drained socket can never be picked up by a later request. Measured after the
-     * fix: upstream closed, `in-use=0, free=0`, and http-proxy's error callback NOT invoked (so this raises
-     * no spurious 502 and triggers no heal retry). Each listener is removed when its upstream half closes,
-     * so nothing accumulates on a retried request (see the leak note in `pipeUpstream`).
-     */
-    const propagateEdgeCancel = (upstream, res, completed) => {
-        const onEdgeClose = () => {
-            if (completed())
-                return; // the response finished normally — nothing to cancel
-            if (!upstream.destroyed)
-                upstream.destroy();
-        };
-        res.once('close', onEdgeClose);
-        upstream.once('close', () => res.removeListener('close', onEdgeClose));
-    };
-    proxy.on('proxyReq', (proxyReq, _req, res) => {
-        // `writableEnded` ⇒ we already flushed the whole edge response, so this 'close' is normal completion.
-        propagateEdgeCancel(proxyReq, res, () => res.writableEnded);
-    });
-    // Surface WHICH pod served the request (round-robin made visible).
-    proxy.on('proxyRes', (proxyRes, req, res) => {
-        const pod = req.__lensmcpPod;
-        if (pod)
-            proxyRes.headers['x-lensmcp-pod'] = pod;
-        // The gateway owns the edge response: drop the upstream framework leak
-        // (e.g. NestJS/Express `x-powered-by`) and brand the hop as the LensMCP gateway.
-        delete proxyRes.headers['x-powered-by'];
-        proxyRes.headers['server'] = 'LensMCP';
-        // A mid-response cancel must stop the upstream too: `proxyRes.pipe(res)` only UNPIPES when the edge
-        // dies (Node's `pipe` never destroys the source), which is what stranded the socket.
-        if (res)
-            propagateEdgeCancel(proxyRes, res, () => res.writableEnded);
-    });
-    // --- native HTTP/2 forwarder ------------------------------------------------
-    // node-http-proxy is HTTP/1.1-only: it copies connection-specific headers onto the
-    // response, which Node's http2 layer rejects. So an h2 EDGE request (a browser, once
-    // the front door speaks h2) is forwarded here with a raw http.request to the H1
-    // upstream (pod unix-socket or TCP dev-server) and the upstream response is piped back
-    // into the h2 stream. It mirrors the node-http-proxy path's branding (x-lensmcp-pod,
-    // drop x-powered-by, server:LensMCP), pod self-heal (evict + wedge timer) and TCP
-    // heal-retry — so h2 and h1 behave identically apart from the wire framing.
-    const pipeUpstream = (target, req, res, cbs) => {
-        const outHeaders = {};
-        for (const [k, v] of Object.entries(req.headers)) {
-            if (v === undefined || k.startsWith(':') || HOP_BY_HOP.has(k))
-                continue; // strip pseudo + hop-by-hop
-            outHeaders[k] = v;
-        }
-        // x-forwarded-* parity with node-http-proxy's xfwd:true.
-        const remote = req.socket?.remoteAddress ?? '';
-        const priorXff = req.headers['x-forwarded-for'];
-        outHeaders['x-forwarded-for'] = priorXff ? `${String(priorXff)}, ${remote}` : remote;
-        outHeaders['x-forwarded-proto'] = 'https';
-        if (!outHeaders['x-forwarded-host'])
-            outHeaders['x-forwarded-host'] = req.headers.host ?? '';
-        let mod = http;
-        let opts;
-        if (typeof target === 'object') {
-            // pod (unix socket): no changeOrigin — the pod ignores Host (matches the h1 path).
-            opts = { socketPath: target.socketPath, path: req.url, method: req.method, headers: outHeaders, agent: httpAgent };
-        }
-        else {
-            const u = new URL(target);
-            const isHttps = u.protocol === 'https:';
-            // eslint-disable-next-line @typescript-eslint/no-require-imports
-            mod = isHttps ? require('node:https') : http;
-            outHeaders['host'] = u.host; // changeOrigin:true parity — a Vite dev server matches on Host
-            opts = {
-                protocol: u.protocol,
-                hostname: u.hostname,
-                port: u.port || (isHttps ? 443 : 80),
-                path: req.url,
-                method: req.method,
-                headers: outHeaders,
-                agent: agentForTarget(target),
-            };
-        }
-        // An h2 ServerResponse whose stream faults (a RST from the client, a
-        // `res.destroy(err)` below) emits 'error'; UNHANDLED, that throws and can
-        // escalate to tear the whole h2 session down — the very "burst" symptom.
-        // A no-op listener keeps the fault local to THIS stream. (Harmless on h1.)
-        //
-        // ONCE PER REQUEST, not per attempt. `pipeUpstream` is re-entered for every TCP heal RETRY (see
-        // `tryTcp`), and containment is a property of the STREAM, not of one upstream attempt — so a plain
-        // `res.on('error')` here accumulated one listener per retry. With an 8s heal window at 300ms steps
-        // that is ~26 listeners on a single response, which Node reported as
-        // `MaxListenersExceededWarning: 11 error listeners added to [Http2ServerResponse]` (and the twin for
-        // [Http2ServerRequest] via the `req.on('error')` below). Each leaked closure also RETAINS the
-        // request/response objects — a memory bug, not just log noise. The marker makes re-entry idempotent.
-        const guard = res;
-        if (!guard.__lensmcpErrContained) {
-            guard.__lensmcpErrContained = true;
-            res.on('error', () => { });
-        }
-        // Per-ATTEMPT listeners live on the SHARED per-request `req`/`res`, so each attempt must REMOVE its own
-        // on the way out — otherwise a heal retry (`tryTcp`) stacks one more of each per pass (the leak above).
-        // `upstream` is captured so the edge-close handler can be built (and detached) outside the response cb.
-        let upstream;
-        const onReqError = () => { upstreamReq.destroy(); };
-        // The client canceled: stop reading the upstream so its pooled keep-alive socket isn't left flowing
-        // (a half-drained socket is corrupt on the next reuse → would break a later request).
-        const onEdgeClose = () => { if (upstream && !upstream.destroyed)
-            upstream.destroy(); };
-        const detach = () => {
-            req.removeListener('error', onReqError);
-            res.removeListener('close', onEdgeClose);
-        };
-        const upstreamReq = mod.request(opts, (upstreamRes) => {
-            upstream = upstreamRes;
-            cbs.onResponse();
-            if (res.headersSent || res.writableEnded || res.destroyed) {
-                upstreamRes.destroy();
-                return;
-            }
-            const h = {};
-            for (const [k, v] of Object.entries(upstreamRes.headers)) {
-                if (v === undefined || HOP_BY_HOP.has(k))
-                    continue; // hop-by-hop headers are h2-illegal
-                h[k] = v;
-            }
-            delete h['x-powered-by']; // drop the upstream framework leak (parity with proxyRes)
-            h['server'] = 'LensMCP'; // brand the hop
-            const pod = req.__lensmcpPod;
-            if (pod)
-                h['x-lensmcp-pod'] = pod;
-            try {
-                res.writeHead(upstreamRes.statusCode ?? 502, h);
-            }
-            catch (e) {
-                // A header the upstream sent is illegal on an h2 stream (Node throws e.g.
-                // ERR_HTTP2_INVALID_HEADER_VALUE). RESET only THIS stream — left unhandled the throw escapes
-                // the request callback and can tear down the whole h2 SESSION, failing EVERY sibling stream on
-                // the connection at once with ERR_HTTP2_PROTOCOL_ERROR (the "burst of files failed" symptom).
-                console.error('[gateway] h2 relay: bad response header, resetting stream:', e.message);
-                upstreamRes.destroy();
-                if (!res.destroyed)
-                    res.destroy(e);
-                return;
-            }
-            upstreamRes.pipe(res);
-            // The upstream dies MID-BODY (a pod rolling-swap or a Vite restart resets the pooled socket): RST
-            // this h2 stream cleanly instead of leaving it half-written — a dangling h2 stream is what Chrome
-            // reports as ERR_HTTP2_PROTOCOL_ERROR. A premature close surfaces as 'error' OR just 'close'
-            // ('aborted') depending on the Node version, so handle BOTH; the `writableEnded` guard makes the
-            // normal-completion 'close' a no-op. (An unhandled 'error' on upstreamRes would also throw.)
-            const abortEdge = () => { if (!res.writableEnded && !res.destroyed)
-                res.destroy(); };
-            upstreamRes.once('error', abortEdge);
-            upstreamRes.once('close', abortEdge);
-            res.on('close', onEdgeClose);
-        });
-        upstreamReq.once('error', (err) => cbs.onError(err));
-        // ClientRequest 'close' fires exactly once however the attempt ended (completed, errored, destroyed), so
-        // it is the one place that can un-register this attempt's listeners — and drop the closures retaining
-        // `req`/`res`/`upstream`. For a long-lived stream it fires only when the stream ends, so `onEdgeClose`
-        // stays armed for the whole stream (a mid-stream client cancel MUST still destroy the upstream).
-        upstreamReq.once('close', detach);
-        req.on('error', onReqError);
-        // GET/HEAD/OPTIONS carry no body — end immediately; else stream the request body upstream.
-        if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS')
-            upstreamReq.end();
-        else
-            req.pipe(upstreamReq);
-    };
-    // The h2 twin of the pool/TCP branches in `forward` below — same pick / cold-start /
-    // evict / wedge / heal-retry, driving `pipeUpstream` instead of node-http-proxy.
-    const forwardNative = async (route, req, res) => {
-        const trace = req.__lensmcpTrace;
-        if (route.pool) {
-            const ctl = route.svc;
-            if (ctl) {
-                ctl.lastUsed = Date.now();
-                ctl.inflight += 1;
-                res.on('close', () => { ctl.inflight -= 1; ctl.lastUsed = Date.now(); });
-            }
-            let sock = (0, discovery_1.pickSock)(route.pool, rt.scanTtlMs);
-            if (!sock && ctl) {
-                traceStep(trace, 'cold-start', { project: route.project });
-                if (await svcLayer.ensureUp(ctl))
-                    sock = (0, discovery_1.pickSock)(route.pool, rt.scanTtlMs);
-            }
-            // A ROUTABLE pod is the recovery edge (see `markUp` in lifecycle.ts): `ensureUp` — which used
-            // to be the only announcer of a service going up — is SKIPPED whenever `pickSock` already
-            // found a socket, so a service that self-healed between requests was never announced and the
-            // lens fold latched on its last degradation. Idempotent ⇒ a property compare per request.
-            if (ctl && sock)
-                svcLayer.markUp(ctl, 'observed');
-            if (ctl)
-                svcLayer.scaleUp(ctl);
-            if (!sock) {
-                const errs = ctl?.lastErrors?.length ? ` Service errors: ${ctl.lastErrors.join('; ')}` : '';
-                (0, edge_1.sendError)(res, req, 503, 'unavailable', `Service ${route.project} is not reachable (no pods in ${route.pool.dir}).${errs} The watcher recovers and the next request retries automatically.`);
-                return;
-            }
-            const podName = path.basename(sock, '.sock');
-            req.__lensmcpPod = podName;
-            traceStep(trace, 'pod-select', { pod: podName, pods: route.pool.socks.length, strategy: 'round-robin' });
-            let settled = false;
-            const evictPod = (reason) => {
-                route.pool.socks = route.pool.socks.filter((s) => s !== sock);
-                route.pool.idx = -1;
-                try {
-                    fs.unlinkSync(sock);
-                }
-                catch { /* already gone */ }
-                console.error(`[gateway] pod ${podName} of ${route.project}: ${reason}`);
-            };
-            const wedgeTimer = setTimeout(() => {
-                if (settled || res.headersSent || res.writableEnded)
-                    return;
-                settled = true;
-                evictPod(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) — evicted + respawning`);
-                (0, edge_1.sendError)(res, req, 502, 'unavailable', `Pod ${podName} of ${route.project} was unresponsive — evicted, retry.`);
-            }, types_1.POD_RESPONSE_TIMEOUT_MS);
-            wedgeTimer.unref?.();
-            res.on('close', () => clearTimeout(wedgeTimer));
-            pipeUpstream({ socketPath: sock }, req, res, {
-                onResponse: () => { clearTimeout(wedgeTimer); settled = true; },
-                onError: (err) => {
-                    clearTimeout(wedgeTimer);
-                    if (settled)
-                        return;
-                    settled = true;
-                    evictPod(err.message);
-                    (0, edge_1.sendError)(res, req, 502, 'unavailable', `Pod ${podName} of ${route.project} unavailable — retry.`);
-                },
-            });
-            return;
-        }
-        const tcpTarget = route.target;
-        const tcpDeadline = Date.now() + types_1.UPSTREAM_HEAL_WINDOW_MS;
-        const tryTcp = () => {
-            pipeUpstream(tcpTarget, req, res, {
-                onResponse: () => { },
-                onError: (err) => {
-                    // `!res.destroyed`: once the CLIENT is gone there is nobody to heal for — retrying would hammer a
-                    // recovering upstream for the rest of the window and then write an error into a dead stream.
-                    if (isConnError(err) && Date.now() < tcpDeadline && !res.headersSent && !res.writableEnded && !res.destroyed) {
-                        const t = setTimeout(tryTcp, types_1.UPSTREAM_HEAL_STEP_MS);
-                        t.unref?.(); // a pending heal retry must never keep the gateway process alive
-                        return;
-                    }
-                    // Past the response headers there's nothing to send an error body into — reset the stream.
-                    if (res.headersSent || res.writableEnded || res.destroyed) {
-                        if (!res.destroyed)
-                            res.destroy();
-                        return;
-                    }
-                    console.error(`[gateway] upstream ${route.project} (${String(tcpTarget)}):`, err.message);
-                    (0, edge_1.sendError)(res, req, 502, 'unavailable', `Upstream ${route.project} unavailable.`);
-                },
-            });
-        };
-        tryTcp();
-    };
-    const forward = async (route, req, res) => {
-        const startedAt = Date.now();
-        const trace = req.__lensmcpTrace;
-        res.on('close', () => {
-            recordEdge(route, Date.now() - startedAt, res.statusCode ?? 0, req.__lensmcpCaller);
-            finishTrace(trace, route.project, res.statusCode ?? 0, {
-                ...(req.__lensmcpPod ? { pod: req.__lensmcpPod } : {}),
-                ...(req.__lensmcpCaller ? { caller: req.__lensmcpCaller } : {}),
-            });
-        });
-        if (route.prependPrefix && !req.url?.startsWith(route.prependPrefix)) {
-            req.url = route.prependPrefix + (req.url ?? '/');
-        }
-        // HTTP/2 edge requests (browsers, once the front door speaks h2) can't ride node-http-proxy
-        // — forward them natively. H1 requests (curl, tools, the HMR WebSocket's sibling fetches)
-        // keep the proven path below unchanged.
-        if ((req.httpVersionMajor ?? 1) >= 2) {
-            await forwardNative(route, req, res);
-            return;
-        }
-        if (route.pool) {
-            const ctl = route.svc;
-            if (ctl) {
-                ctl.lastUsed = Date.now();
-                ctl.inflight += 1;
-                res.on('close', () => { ctl.inflight -= 1; ctl.lastUsed = Date.now(); });
-            }
-            let sock = (0, discovery_1.pickSock)(route.pool, rt.scanTtlMs);
-            if (!sock && ctl) {
-                // scale from zero: start the service, buffer this request until pods are up
-                traceStep(trace, 'cold-start', { project: route.project });
-                if (await svcLayer.ensureUp(ctl))
-                    sock = (0, discovery_1.pickSock)(route.pool, rt.scanTtlMs);
-            }
-            // The recovery edge — see the twin comment in `forwardNative` above.
-            if (ctl && sock)
-                svcLayer.markUp(ctl, 'observed');
-            if (ctl)
-                svcLayer.scaleUp(ctl);
-            if (!sock) {
-                const errs = ctl?.lastErrors?.length ? ` Service errors: ${ctl.lastErrors.join('; ')}` : '';
-                (0, edge_1.sendError)(res, req, 503, 'unavailable', `Service ${route.project} is not reachable (no pods in ${route.pool.dir}).${errs} The watcher recovers and the next request retries automatically.`);
-                return;
-            }
-            const podName = path.basename(sock, '.sock');
-            req.__lensmcpPod = podName;
-            traceStep(trace, 'pod-select', { pod: podName, pods: route.pool.socks.length, strategy: 'round-robin' });
-            // EVICT a dead/wedged pod: drop its socket from the pool + reset the round-robin index + unlink the
-            // ghost socket file, so rescans stay truthful and the next request re-scans / scale-from-zero
-            // respawns. Shared by the connection-error cb AND the wedge timer below (same proven recovery).
-            let settled = false;
-            const evictPod = (reason) => {
-                route.pool.socks = route.pool.socks.filter((s) => s !== sock); // drop dead pod until rescan
-                route.pool.idx = -1; // removing an element shifts indices — reset so the next pick walks cleanly from 0
-                try {
-                    fs.unlinkSync(sock);
-                }
-                catch {
-                    /* already gone */
-                }
-                console.error(`[gateway] pod ${podName} of ${route.project}: ${reason}`);
-            };
-            // WEDGE GUARD (self-heal the "request pending 2+ minutes" hang): a pod that ACCEPTS the socket but
-            // never sends response headers — a stale socket left by an HMR hot-swap — is NOT a connection error,
-            // so http-proxy's error cb never fires and the request would pin until `proxyTimeout` (120s). Fire on
-            // POD_RESPONSE_TIMEOUT_MS instead: evict the pod (→ respawn on the next request) and 502 fast. Only
-            // acts BEFORE the first response byte, so a legit long request (streaming after headers) is untouched.
-            const wedgeTimer = setTimeout(() => {
-                if (settled || res.headersSent || res.writableEnded)
-                    return;
-                settled = true;
-                evictPod(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) — evicted + respawning`);
-                (0, edge_1.sendError)(res, req, 502, 'unavailable', `Pod ${podName} of ${route.project} was unresponsive — evicted, retry.`);
-            }, types_1.POD_RESPONSE_TIMEOUT_MS);
-            wedgeTimer.unref?.(); // never keep the gateway process alive for this timer
-            res.on('close', () => clearTimeout(wedgeTimer));
-            // NO autoRewrite for a socketPath target: it's an OBJECT, and http-proxy's setRedirectHostRewrite
-            // does url.parse(options.target) on ANY 3xx response — which throws ("url must be a string, received
-            // Object") and CRASHES the gateway the instant a pod returns a redirect (e.g. the auth IdP's
-            // /authorize → login). A socket target has no host to rewrite anyway, and pods emit ABSOLUTE
-            // external redirect URLs, so no rewrite is needed.
-            proxy.web(req, res, { target: { socketPath: sock }, agent: httpAgent }, (err) => {
-                clearTimeout(wedgeTimer);
-                if (settled)
-                    return; // the wedge timer already evicted + responded
-                settled = true;
-                evictPod(err.message); // a refused sock is a GHOST file — the evict removes it so rescans stay truthful
-                (0, edge_1.sendError)(res, req, 502, 'unavailable', `Pod ${podName} of ${route.project} unavailable — retry.`);
-            });
-            return;
-        }
-        // autoRewrite ONLY for a string (external URL) target — a non-string target crashes
-        // setRedirectHostRewrite's url.parse(options.target) on a 3xx (see the socketPath case above).
-        // SELF-HEAL (a TCP app upstream, e.g. a Vite dev server): on a config change Vite RESTARTS its
-        // internal server — the process stays alive, so the port refuses for ~1-3s. Rather than an instant
-        // 502 ("Upstream login unavailable"), retry the CONNECTION error with a short backoff until the
-        // restart/warmup finishes (the heal window), then finally 502. Retried only BEFORE any byte is
-        // written (the err cb fires pre-proxyRes) + only for a connection error (a real app 5xx streams
-        // through untouched).
-        const tcpTarget = route.target;
-        const tcpOpts = { target: tcpTarget, autoRewrite: typeof tcpTarget === 'string', changeOrigin: true, agent: agentForTarget(tcpTarget) };
-        const tcpDeadline = Date.now() + types_1.UPSTREAM_HEAL_WINDOW_MS;
-        const tryTcp = () => {
-            proxy.web(req, res, tcpOpts, (err) => {
-                // `!res.destroyed` — see the h2 twin above: with the client gone there is nothing to heal for.
-                if (isConnError(err) && Date.now() < tcpDeadline && !res.headersSent && !res.writableEnded && !res.destroyed) {
-                    const t = setTimeout(tryTcp, types_1.UPSTREAM_HEAL_STEP_MS);
-                    t.unref?.();
-                    return;
-                }
-                if (res.destroyed)
-                    return; // the client left — no stream to write an error into
-                console.error(`[gateway] upstream ${route.project} (${String(tcpTarget)}):`, err.message);
-                (0, edge_1.sendError)(res, req, 502, 'unavailable', `Upstream ${route.project} unavailable.`);
-            });
-        };
-        tryTcp();
-    };
-    const destroyAgents = () => { httpAgent.destroy(); httpsAgent.destroy(); };
-    const closeProxy = () => { try {
-        proxy.close?.();
-    }
-    catch { /* ignore */ } };
-    return { proxy, forward, agentForTarget, destroyAgents, closeProxy };
-}
+"use strict";var q=Object.defineProperty;var b=(E,u)=>q(E,"name",{value:u,configurable:!0});var C=Object.defineProperty,s=b((E,u)=>C(E,"name",{value:u,configurable:!0}),"s");Object.defineProperty(exports,"__esModule",{value:!0}),exports.createProxy=createProxy;const tslib_1=require("tslib"),fs=tslib_1.__importStar(require("node:fs")),http=tslib_1.__importStar(require("node:http")),path=tslib_1.__importStar(require("node:path")),discovery_1=require("./discovery"),edge_1=require("./edge"),types_1=require("./types");function isConnError(E){const u=E.code??"";return u==="ECONNREFUSED"||u==="ECONNRESET"||u==="ETIMEDOUT"||u==="EPIPE"||u==="EHOSTUNREACH"||u==="ENOENT"||/ECONNREFUSED|ECONNRESET|socket hang up|EPIPE/i.test(E.message)}b(isConnError,"isConnError"),s(isConnError,"isConnError");const HOP_BY_HOP=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]),httpProxy=require("http-proxy");function createProxy(E,u,S){const{recordEdge:D,finishTrace:N,traceStep:T}=u,k={keepAlive:!0,keepAliveMsecs:3e4,maxSockets:1024,maxFreeSockets:256},w=new http.Agent(k),$=new(require("node:https")).Agent(k),x=s(r=>typeof r=="string"&&r.startsWith("https:")?$:w,"agentForTarget"),P=httpProxy.createProxyServer({xfwd:!0,secure:!1,proxyTimeout:12e4,agent:w}),O=s((r,o,e)=>{const i=s(()=>{e()||r.destroyed||r.destroy()},"onEdgeClose");o.once("close",i),r.once("close",()=>o.removeListener("close",i))},"propagateEdgeCancel");P.on("proxyReq",(r,o,e)=>{O(r,e,()=>e.writableEnded)}),P.on("proxyRes",(r,o,e)=>{const i=o.__lensmcpPod;i&&(r.headers["x-lensmcp-pod"]=i),delete r.headers["x-powered-by"],r.headers.server="LensMCP",e&&O(r,e,()=>e.writableEnded)});const M=s((r,o,e,i)=>{const d={};for(const[t,p]of Object.entries(o.headers))p===void 0||t.startsWith(":")||HOP_BY_HOP.has(t)||(d[t]=p);const m=o.socket?.remoteAddress??"",f=o.headers["x-forwarded-for"];d["x-forwarded-for"]=f?`${String(f)}, ${m}`:m,d["x-forwarded-proto"]="https",d["x-forwarded-host"]||(d["x-forwarded-host"]=o.headers.host??"");let a=http,l;if(typeof r=="object")l={socketPath:r.socketPath,path:o.url,method:o.method,headers:d,agent:w};else{const t=new URL(r),p=t.protocol==="https:";a=p?require("node:https"):http,d.host=t.host,l={protocol:t.protocol,hostname:t.hostname,port:t.port||(p?443:80),path:o.url,method:o.method,headers:d,agent:x(r)}}const n=e;n.__lensmcpErrContained||(n.__lensmcpErrContained=!0,e.on("error",()=>{}));let c;const y=s(()=>{g.destroy()},"onReqError"),h=s(()=>{c&&!c.destroyed&&c.destroy()},"onEdgeClose"),_=s(()=>{o.removeListener("error",y),e.removeListener("close",h)},"detach"),g=a.request(l,t=>{if(c=t,i.onResponse(),e.headersSent||e.writableEnded||e.destroyed){t.destroy();return}const p={};for(const[v,R]of Object.entries(t.headers))R===void 0||HOP_BY_HOP.has(v)||(p[v]=R);delete p["x-powered-by"],p.server="LensMCP";const U=o.__lensmcpPod;U&&(p["x-lensmcp-pod"]=U);try{e.writeHead(t.statusCode??502,p)}catch(v){console.error("[gateway] h2 relay: bad response header, resetting stream:",v.message),t.destroy(),e.destroyed||e.destroy(v);return}t.pipe(e);const j=s(()=>{!e.writableEnded&&!e.destroyed&&e.destroy()},"abortEdge");t.once("error",j),t.once("close",j),e.on("close",h)});g.once("error",t=>i.onError(t)),g.once("close",_),o.on("error",y),o.method==="GET"||o.method==="HEAD"||o.method==="OPTIONS"?g.end():o.pipe(g)},"pipeUpstream"),A=s(async(r,o,e)=>{const i=o.__lensmcpTrace;if(r.pool){const a=r.svc;a&&(a.lastUsed=Date.now(),a.inflight+=1,e.on("close",()=>{a.inflight-=1,a.lastUsed=Date.now()}));let l=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs);if(!l&&a&&(T(i,"cold-start",{project:r.project}),await S.ensureUp(a)&&(l=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs))),a&&l&&S.markUp(a,"observed"),a&&S.scaleUp(a),!l){const _=a?.lastErrors?.length?` Service errors: ${a.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(e,o,503,"unavailable",`Service ${r.project} is not reachable (no pods in ${r.pool.dir}).${_} The watcher recovers and the next request retries automatically.`);return}const n=path.basename(l,".sock");o.__lensmcpPod=n,T(i,"pod-select",{pod:n,pods:r.pool.socks.length,strategy:"round-robin"});let c=!1;const y=s(_=>{r.pool.socks=r.pool.socks.filter(g=>g!==l),r.pool.idx=-1;try{fs.unlinkSync(l)}catch{}console.error(`[gateway] pod ${n} of ${r.project}: ${_}`)},"evictPod"),h=setTimeout(()=>{c||e.headersSent||e.writableEnded||(c=!0,y(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) \u2014 evicted + respawning`),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${n} of ${r.project} was unresponsive \u2014 evicted, retry.`))},types_1.POD_RESPONSE_TIMEOUT_MS);h.unref?.(),e.on("close",()=>clearTimeout(h)),M({socketPath:l},o,e,{onResponse:s(()=>{clearTimeout(h),c=!0},"onResponse"),onError:s(_=>{clearTimeout(h),!c&&(c=!0,y(_.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${n} of ${r.project} unavailable \u2014 retry.`))},"onError")});return}const d=r.target,m=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS,f=s(()=>{M(d,o,e,{onResponse:s(()=>{},"onResponse"),onError:s(a=>{if(isConnError(a)&&Date.now()<m&&!e.headersSent&&!e.writableEnded&&!e.destroyed){setTimeout(f,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}if(e.headersSent||e.writableEnded||e.destroyed){e.destroyed||e.destroy();return}console.error(`[gateway] upstream ${r.project} (${String(d)}):`,a.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Upstream ${r.project} unavailable.`)},"onError")})},"tryTcp");f()},"forwardNative");return{proxy:P,forward:s(async(r,o,e)=>{const i=Date.now(),d=o.__lensmcpTrace;if(e.on("close",()=>{D(r,Date.now()-i,e.statusCode??0,o.__lensmcpCaller),N(d,r.project,e.statusCode??0,{...o.__lensmcpPod?{pod:o.__lensmcpPod}:{},...o.__lensmcpCaller?{caller:o.__lensmcpCaller}:{}})}),r.prependPrefix&&!o.url?.startsWith(r.prependPrefix)&&(o.url=r.prependPrefix+(o.url??"/")),(o.httpVersionMajor??1)>=2){await A(r,o,e);return}if(r.pool){const n=r.svc;n&&(n.lastUsed=Date.now(),n.inflight+=1,e.on("close",()=>{n.inflight-=1,n.lastUsed=Date.now()}));let c=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs);if(!c&&n&&(T(d,"cold-start",{project:r.project}),await S.ensureUp(n)&&(c=(0,discovery_1.pickSock)(r.pool,E.scanTtlMs))),n&&c&&S.markUp(n,"observed"),n&&S.scaleUp(n),!c){const t=n?.lastErrors?.length?` Service errors: ${n.lastErrors.join("; ")}`:"";(0,edge_1.sendError)(e,o,503,"unavailable",`Service ${r.project} is not reachable (no pods in ${r.pool.dir}).${t} The watcher recovers and the next request retries automatically.`);return}const y=path.basename(c,".sock");o.__lensmcpPod=y,T(d,"pod-select",{pod:y,pods:r.pool.socks.length,strategy:"round-robin"});let h=!1;const _=s(t=>{r.pool.socks=r.pool.socks.filter(p=>p!==c),r.pool.idx=-1;try{fs.unlinkSync(c)}catch{}console.error(`[gateway] pod ${y} of ${r.project}: ${t}`)},"evictPod"),g=setTimeout(()=>{h||e.headersSent||e.writableEnded||(h=!0,_(`no response within ${types_1.POD_RESPONSE_TIMEOUT_MS}ms (wedged socket) \u2014 evicted + respawning`),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${y} of ${r.project} was unresponsive \u2014 evicted, retry.`))},types_1.POD_RESPONSE_TIMEOUT_MS);g.unref?.(),e.on("close",()=>clearTimeout(g)),P.web(o,e,{target:{socketPath:c},agent:w},t=>{clearTimeout(g),!h&&(h=!0,_(t.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Pod ${y} of ${r.project} unavailable \u2014 retry.`))});return}const m=r.target,f={target:m,autoRewrite:typeof m=="string",changeOrigin:!0,agent:x(m)},a=Date.now()+types_1.UPSTREAM_HEAL_WINDOW_MS,l=s(()=>{P.web(o,e,f,n=>{if(isConnError(n)&&Date.now()<a&&!e.headersSent&&!e.writableEnded&&!e.destroyed){setTimeout(l,types_1.UPSTREAM_HEAL_STEP_MS).unref?.();return}e.destroyed||(console.error(`[gateway] upstream ${r.project} (${String(m)}):`,n.message),(0,edge_1.sendError)(e,o,502,"unavailable",`Upstream ${r.project} unavailable.`))})},"tryTcp");l()},"forward"),agentForTarget:x,destroyAgents:s(()=>{w.destroy(),$.destroy()},"destroyAgents"),closeProxy:s(()=>{try{P.close?.()}catch{}},"closeProxy")}}b(createProxy,"createProxy"),s(createProxy,"createProxy");

package/executors/gateway/runtime/route-registry.js

@@ -1,72 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RouteRegistry = void 0;
-exports.rebuildRoutesInPlace = rebuildRoutesInPlace;
-/**
- * The live, multi-workspace ROUTE-FRAGMENT registry — the core of the shared daemon
- * (planning/multi-workspace-gateway.md P3). ONE `:443` gateway holds a fragment per registered workspace
- * (its routes + its pod-service controllers) and merges them into the single flat, specificity-sorted route
- * table the request pipeline reads. A second workspace's `gateway start` REGISTERS its fragment; a stop
- * UNREGISTERS it — the daemon rebuilds live, never restarts.
- *
- * For a SINGLE workspace the merged table is byte-identical to `discoverRoutes` + the dashboard route, so
- * this is a no-op refactor until a second workspace registers. The per-apex `default` (see `matchRoute`)
- * is what keeps two workspaces' catch-alls from shadowing each other.
- */
-const manifest_1 = require("../manifest");
-/** A live map of `wsKey → fragment`; `merged()` is the flat table the pipeline matches against. */
-class RouteRegistry {
-    constructor() {
-        this.fragments = new Map();
-    }
-    /** Register (or REPLACE) a workspace's fragment. Idempotent by `wsKey`. */
-    register(fragment) {
-        this.fragments.set(fragment.wsKey, fragment);
-    }
-    /** Drop a workspace's fragment; returns it (so the caller can reap its services/dashboard). */
-    unregister(wsKey) {
-        const f = this.fragments.get(wsKey);
-        this.fragments.delete(wsKey);
-        return f;
-    }
-    has(wsKey) {
-        return this.fragments.has(wsKey);
-    }
-    get(wsKey) {
-        return this.fragments.get(wsKey);
-    }
-    keys() {
-        return [...this.fragments.keys()];
-    }
-    size() {
-        return this.fragments.size;
-    }
-    /** APPEND routes to an already-registered workspace's fragment (e.g. its dashboard route, added after
-     *  discovery). No-op if the workspace isn't registered. */
-    appendRoutes(wsKey, routes) {
-        const f = this.fragments.get(wsKey);
-        if (f)
-            f.routes.push(...routes);
-    }
-    /** Every registered workspace's pod-service controllers, flattened (the daemon's full lifecycle set). */
-    allServices() {
-        return [...this.fragments.values()].flatMap((f) => f.services);
-    }
-    /** The merged, specificity-sorted route table (host+path ▸ host ▸ per-apex catch-all). A NEW array each
-     *  call — the caller rebuilds `rt.routes` in place from it so the pipeline (which reads `rt.routes` fresh
-     *  per request) picks the change up atomically. */
-    merged() {
-        const all = [...this.fragments.values()].flatMap((f) => f.routes);
-        (0, manifest_1.sortBySpecificity)(all);
-        return all;
-    }
-}
-exports.RouteRegistry = RouteRegistry;
-/** Rebuild `routes` IN PLACE from the registry (mutate the SAME array the request pipeline holds, so a
- *  live register/unregister is picked up with no restart and no torn read — JS is single-threaded, so the
- *  splice+push is atomic w.r.t. request handling). */
-function rebuildRoutesInPlace(routes, registry) {
-    const merged = registry.merged();
-    routes.length = 0;
-    routes.push(...merged);
-}
+"use strict";var u=Object.defineProperty;var n=(t,e)=>u(t,"name",{value:e,configurable:!0});var i=Object.defineProperty,r=n((t,e)=>i(t,"name",{value:e,configurable:!0}),"r");Object.defineProperty(exports,"__esModule",{value:!0}),exports.RouteRegistry=void 0,exports.rebuildRoutesInPlace=rebuildRoutesInPlace;const manifest_1=require("../manifest");class RouteRegistry{static{n(this,"RouteRegistry")}static{r(this,"RouteRegistry")}constructor(){this.fragments=new Map}register(e){this.fragments.set(e.wsKey,e)}unregister(e){const s=this.fragments.get(e);return this.fragments.delete(e),s}has(e){return this.fragments.has(e)}get(e){return this.fragments.get(e)}keys(){return[...this.fragments.keys()]}size(){return this.fragments.size}appendRoutes(e,s){const a=this.fragments.get(e);a&&a.routes.push(...s)}allServices(){return[...this.fragments.values()].flatMap(e=>e.services)}merged(){const e=[...this.fragments.values()].flatMap(s=>s.routes);return(0,manifest_1.sortBySpecificity)(e),e}}exports.RouteRegistry=RouteRegistry;function rebuildRoutesInPlace(t,e){const s=e.merged();t.length=0,t.push(...s)}n(rebuildRoutesInPlace,"rebuildRoutesInPlace"),r(rebuildRoutesInPlace,"rebuildRoutesInPlace");