@mesh-tech/mesh-cli 0.1.0

package/dist/src/commands/dev.js

@@ -0,0 +1,1248 @@
+/**
+ * mesh dev — Pulumi-output-driven local development orchestrator
+ *
+ * Reads `pulumi stack output dev --json` to discover services and tunnels,
+ * then launches each service's dev command in a tmux window.
+ *
+ * Usage:
+ *   mesh dev                  Start all services, attach tmux
+ *   mesh dev --headless       Start without attaching
+ *   mesh dev --kill           Stop everything
+ *   mesh dev --status         Show service health (--json for structured)
+ *   mesh dev logs <service>   Tail a service's output
+ *   mesh dev restart <svc>    Restart a single service
+ */
+import { execFileSync, spawnSync } from "child_process";
+import * as fs from "fs";
+import * as net from "net";
+import * as os from "os";
+import * as path from "path";
+import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
+import { logInfo, logSuccess, logError, logWarn } from "../utils/index.js";
+function getSessionStatePath(sessionName) {
+    const dir = path.join(os.tmpdir(), "mesh-dev-sessions");
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    return path.join(dir, `${sessionName}.json`);
+}
+function saveSessionState(sessionName, state) {
+    fs.writeFileSync(getSessionStatePath(sessionName), JSON.stringify(state, null, 2));
+}
+function loadSessionState(sessionName) {
+    const filePath = getSessionStatePath(sessionName);
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function removeSessionState(sessionName) {
+    try {
+        fs.unlinkSync(getSessionStatePath(sessionName));
+    }
+    catch { }
+}
+/**
+ * Check whether a TCP port is available on localhost.
+ */
+async function isPortFree(port) {
+    return new Promise((resolve) => {
+        const server = net.createServer();
+        server.once("error", () => resolve(false));
+        server.listen(port, "127.0.0.1", () => {
+            server.close(() => resolve(true));
+        });
+    });
+}
+/**
+ * Check if a port is being listened on (synchronous, for status display).
+ */
+function isPortListeningSync(port) {
+    try {
+        execFileSync("bash", ["-c", `echo >/dev/tcp/127.0.0.1/${port}`], {
+            timeout: 500,
+            stdio: "ignore",
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ask the OS for an ephemeral free port.
+ */
+async function findFreePort() {
+    return new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const { port } = server.address();
+            server.close(() => resolve(port));
+        });
+    });
+}
+/**
+ * Clone devOutput and replace any colliding ports with dynamically
+ * allocated free ports.  Preferred ports are kept when available.
+ */
+async function allocatePorts(devOutput) {
+    const allocated = JSON.parse(JSON.stringify(devOutput));
+    const usedPorts = new Set();
+    // Tunnels first (services may depend on them)
+    for (const [name, tunnel] of Object.entries(allocated.tunnels)) {
+        const preferred = tunnel.localPort;
+        if (preferred > 0 &&
+            !usedPorts.has(preferred) &&
+            (await isPortFree(preferred))) {
+            usedPorts.add(preferred);
+        }
+        else {
+            const newPort = await findFreePort();
+            if (preferred > 0)
+                logWarn(`Port ${preferred} busy for tunnel '${name}', using ${newPort}`);
+            tunnel.localPort = newPort;
+            usedPorts.add(newPort);
+        }
+    }
+    // Service ports — track remappings for cross-service URL rewriting
+    const portRemaps = new Map();
+    for (const [name, service] of Object.entries(allocated.services)) {
+        if (service.port <= 0)
+            continue;
+        // Skip port allocation for deployed services (no dev command).
+        // They run in K8s and are accessed via tunnels, not local ports.
+        if (!service.command || service.command.length === 0)
+            continue;
+        const preferred = service.port;
+        if (!usedPorts.has(preferred) &&
+            (await isPortFree(preferred))) {
+            usedPorts.add(preferred);
+        }
+        else {
+            const newPort = await findFreePort();
+            logWarn(`Port ${preferred} busy for service '${name}', using ${newPort}`);
+            // Update PORT env var to match
+            if (service.env?.PORT && service.env.PORT.value === String(preferred)) {
+                service.env.PORT.value = String(newPort);
+            }
+            portRemaps.set(preferred, newPort);
+            service.port = newPort;
+            usedPorts.add(newPort);
+        }
+    }
+    // Cross-service URL rewriting: when a service port is reassigned,
+    // update any env var in other services that references the old port
+    // (e.g., API_URL from a link() pointing to the API's original port).
+    if (portRemaps.size > 0) {
+        for (const service of Object.values(allocated.services)) {
+            if (!service.env)
+                continue;
+            for (const envVar of Object.values(service.env)) {
+                for (const [oldPort, newPort] of portRemaps) {
+                    if (envVar.value.includes(`localhost:${oldPort}`)) {
+                        envVar.value = envVar.value.replace(`localhost:${oldPort}`, `localhost:${newPort}`);
+                    }
+                }
+            }
+        }
+    }
+    return allocated;
+}
+// ============================================================================
+// Pulumi helpers
+// ============================================================================
+/**
+ * Find the monorepo root by walking up from cwd looking for the root
+ * package.json (has "workspaces" or the well-known repo markers).
+ */
+function findMonorepoRoot() {
+    let dir = process.cwd();
+    const root = path.parse(dir).root;
+    while (dir !== root) {
+        // Look for pnpm-workspace.yaml (pnpm monorepo) or .git (repo root)
+        if (fs.existsSync(path.join(dir, "pnpm-workspace.yaml")) ||
+            fs.existsSync(path.join(dir, "turbo.json"))) {
+            return dir;
+        }
+        // .git as fallback — but only if it's a directory (not a worktree file)
+        const gitPath = path.join(dir, ".git");
+        if (fs.existsSync(gitPath)) {
+            return dir;
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+/**
+ * Discover Pulumi apps in the monorepo.
+ * Scans:
+ *   {tenants,tests/tenants}/<tenant>/apps/<app>/Pulumi.yaml
+ *   apps/<app>/Pulumi.yaml (flat layout, tenant from stack config)
+ */
+function discoverApps(monorepoRoot) {
+    const apps = [];
+    // Helper: extract stacks and add an app entry
+    function addApp(appDir, tenant) {
+        const projectName = getProjectName(appDir);
+        const stacks = fs
+            .readdirSync(appDir)
+            .filter((f) => f.startsWith("Pulumi.") &&
+            f.endsWith(".yaml") &&
+            f !== "Pulumi.yaml")
+            .map((f) => f.replace(/^Pulumi\./, "").replace(/\.yaml$/, ""));
+        apps.push({
+            name: projectName,
+            tenant,
+            appPath: appDir,
+            relativePath: path.relative(monorepoRoot, appDir),
+            stacks,
+        });
+    }
+    // 1. Tenant-scoped: {tenants,tests/tenants}/<tenant>/apps/<app>/
+    const searchDirs = ["tenants", "tests/tenants"];
+    for (const searchDir of searchDirs) {
+        const base = path.join(monorepoRoot, searchDir);
+        if (!fs.existsSync(base))
+            continue;
+        for (const tenant of fs.readdirSync(base)) {
+            const appsDir = path.join(base, tenant, "apps");
+            if (!fs.existsSync(appsDir) || !fs.statSync(appsDir).isDirectory())
+                continue;
+            for (const app of fs.readdirSync(appsDir)) {
+                const appDir = path.join(appsDir, app);
+                if (!fs.existsSync(path.join(appDir, "Pulumi.yaml")))
+                    continue;
+                addApp(appDir, tenant);
+            }
+        }
+    }
+    // 2. Flat layout: apps/<app>/ (tenant read from first stack config)
+    const flatAppsDir = path.join(monorepoRoot, "apps");
+    if (fs.existsSync(flatAppsDir) && fs.statSync(flatAppsDir).isDirectory()) {
+        for (const app of fs.readdirSync(flatAppsDir)) {
+            const appDir = path.join(flatAppsDir, app);
+            if (!fs.statSync(appDir).isDirectory())
+                continue;
+            if (!fs.existsSync(path.join(appDir, "Pulumi.yaml")))
+                continue;
+            // Read tenant from first stack config's mesh:tenant
+            let tenant = "unknown";
+            const stackConfigs = fs
+                .readdirSync(appDir)
+                .filter((f) => f.startsWith("Pulumi.") &&
+                f.endsWith(".yaml") &&
+                f !== "Pulumi.yaml");
+            if (stackConfigs.length > 0) {
+                try {
+                    const content = fs.readFileSync(path.join(appDir, stackConfigs[0]), "utf-8");
+                    const tenantMatch = content.match(/mesh:tenant:\s*(\S+)/);
+                    if (tenantMatch)
+                        tenant = tenantMatch[1];
+                }
+                catch { }
+            }
+            addApp(appDir, tenant);
+        }
+    }
+    return apps;
+}
+/**
+ * Find the Pulumi app root by walking up from cwd looking for Pulumi.yaml.
+ */
+function findAppRoot(appPath) {
+    if (appPath) {
+        // Resolve relative to cwd or monorepo root
+        const resolved = path.resolve(appPath);
+        if (fs.existsSync(path.join(resolved, "Pulumi.yaml")))
+            return resolved;
+        // Try relative to monorepo root
+        const mono = findMonorepoRoot();
+        if (mono) {
+            const fromMono = path.resolve(mono, appPath);
+            if (fs.existsSync(path.join(fromMono, "Pulumi.yaml")))
+                return fromMono;
+        }
+        logError(`No Pulumi.yaml found at: ${appPath}`);
+        process.exit(1);
+    }
+    let dir = process.cwd();
+    const root = path.parse(dir).root;
+    while (dir !== root) {
+        if (fs.existsSync(path.join(dir, "Pulumi.yaml"))) {
+            return dir;
+        }
+        dir = path.dirname(dir);
+    }
+    return process.cwd();
+}
+/**
+ * Read the Pulumi project name from Pulumi.yaml.
+ */
+function getProjectName(appRoot) {
+    const yamlPath = path.join(appRoot, "Pulumi.yaml");
+    if (!fs.existsSync(yamlPath))
+        return path.basename(appRoot);
+    const content = fs.readFileSync(yamlPath, "utf-8");
+    const match = content.match(/^name:\s*(.+)$/m);
+    return match?.[1]?.trim() ?? path.basename(appRoot);
+}
+/**
+ * Detect the current Pulumi stack from:
+ *   1. --stage flag
+ *   2. MESH_STAGE env var
+ *   3. `pulumi stack --show-name` (currently-selected stack)
+ *   4. Pulumi.<stack>.yaml files in the app root (if exactly one, use it)
+ */
+function detectStack(appRoot, stageArg) {
+    if (stageArg)
+        return stageArg;
+    if (process.env.MESH_STAGE)
+        return process.env.MESH_STAGE;
+    try {
+        const result = execFileSync("pulumi", ["stack", "--show-name"], {
+            cwd: appRoot,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        if (result)
+            return result;
+    }
+    catch {
+        // Fall through
+    }
+    // Infer from Pulumi.<stack>.yaml config files
+    try {
+        const files = fs.readdirSync(appRoot).filter((f) => f.startsWith("Pulumi.") && f.endsWith(".yaml") && f !== "Pulumi.yaml");
+        if (files.length === 1) {
+            const match = files[0].match(/^Pulumi\.(.+)\.yaml$/);
+            if (match?.[1]) {
+                logInfo(`Auto-detected stack from ${files[0]}`);
+                return match[1];
+            }
+        }
+    }
+    catch {
+        // Fall through
+    }
+    return "dev";
+}
+/**
+ * Read the dev output from Pulumi stack.
+ * Tries `app` output first (new env.register() format), falls back to `dev`.
+ */
+function getDevOutput(appRoot, stack) {
+    // Try new format: export const app = env.register() → { dev: { ... } }
+    try {
+        const result = execFileSync("pulumi", ["stack", "output", "app", "--json", "--show-secrets", "--stack", stack], {
+            cwd: appRoot,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const appOutput = JSON.parse(result);
+        if (appOutput.dev) {
+            return appOutput.dev;
+        }
+    }
+    catch {
+        // Fall through to legacy format
+    }
+    // Legacy format: export const dev = ...
+    try {
+        const result = execFileSync("pulumi", ["stack", "output", "dev", "--json", "--show-secrets", "--stack", stack], {
+            cwd: appRoot,
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return JSON.parse(result);
+    }
+    catch (err) {
+        logError(`Failed to read Pulumi stack output for stack '${stack}'.`);
+        logInfo("Make sure you've deployed with: pulumi up");
+        logInfo("And that the stack exports 'app' or 'dev' output.");
+        throw err;
+    }
+}
+// ============================================================================
+// tmux helpers
+// ============================================================================
+function hasTmux() {
+    try {
+        execFileSync("which", ["tmux"], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function sessionExists(name) {
+    try {
+        execFileSync("tmux", ["has-session", "-t", name], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function killSession(name) {
+    try {
+        execFileSync("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Collect AWS credentials from the current environment.
+ */
+function getAwsEnvVars() {
+    const result = {};
+    const vars = [
+        "AWS_PROFILE",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
+        "AWS_REGION",
+        "AWS_DEFAULT_REGION",
+    ];
+    for (const name of vars) {
+        const value = process.env[name];
+        if (value)
+            result[name] = value;
+    }
+    return result;
+}
+/**
+ * Resolve env vars for a service, rewriting tunnel references.
+ */
+function getServiceEnvVars(service, tunnels) {
+    const result = {};
+    if (service.env) {
+        for (const [key, spec] of Object.entries(service.env)) {
+            let value = spec.value;
+            if (spec.tunnel) {
+                const tunnel = tunnels[spec.tunnel];
+                if (tunnel) {
+                    try {
+                        // Try as a full URL first (e.g. postgres://host:5432/db)
+                        const url = new URL(value);
+                        if (url.hostname) {
+                            url.hostname = "localhost";
+                            url.port = String(tunnel.localPort);
+                            value = url.toString();
+                        }
+                        else {
+                            // URL parsed but hostname empty (e.g. host:port parsed as protocol)
+                            value = `localhost:${tunnel.localPort}`;
+                        }
+                    }
+                    catch {
+                        // Not a URL at all — bare host:port or just hostname
+                        value = `localhost:${tunnel.localPort}`;
+                    }
+                }
+            }
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Set env vars on a tmux session. New windows inherit them.
+ *
+ * Use for truly shared vars (AWS creds, secrets). For per-service
+ * vars like PORT, use envPrefix() instead to avoid cross-service leaks.
+ */
+function setTmuxEnv(sessionName, vars) {
+    for (const [key, value] of Object.entries(vars)) {
+        execFileSync("tmux", [
+            "set-environment", "-t", sessionName, key, value,
+        ], { stdio: "ignore" });
+    }
+}
+/**
+ * Build an `env K=V …` prefix string for per-service env vars.
+ *
+ * This scopes variables to the process instead of polluting the
+ * tmux session environment (where the last service's PORT would
+ * leak to every other service on restart).
+ */
+function envPrefix(vars) {
+    const entries = Object.entries(vars);
+    if (entries.length === 0)
+        return "";
+    const parts = entries.map(([k, v]) => `${k}=${shellEscape(v)}`);
+    return `env ${parts.join(" ")} `;
+}
+/** Escape a value for shell interpolation. */
+function shellEscape(s) {
+    // If the value is safe, return as-is
+    if (/^[a-zA-Z0-9_./:@=+,-]+$/.test(s))
+        return s;
+    // Otherwise single-quote it, escaping any embedded single quotes
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+// ============================================================================
+// Secret resolution
+// ============================================================================
+/**
+ * Resolve secrets from Secrets Manager and return env var key→value pairs.
+ * Applies tunnel rewrites to DATABASE_URL if a tunnel is active.
+ */
+async function resolveSecrets(secrets, tunnels) {
+    const client = new SecretsManagerClient({});
+    const resolved = {};
+    for (const [name, secret] of Object.entries(secrets)) {
+        try {
+            const response = await client.send(new GetSecretValueCommand({ SecretId: secret.secretName }));
+            if (!response.SecretString)
+                continue;
+            const values = JSON.parse(response.SecretString);
+            for (const [secretKey, envVar] of Object.entries(secret.envMapping)) {
+                const raw = values[secretKey];
+                if (raw === undefined)
+                    continue;
+                let value = raw;
+                // Rewrite DATABASE_URL host:port if there's a tunnel
+                if (envVar === "DATABASE_URL" || secretKey === "DATABASE_URL") {
+                    for (const tunnel of Object.values(tunnels)) {
+                        try {
+                            const parsed = new URL(value);
+                            parsed.hostname = "localhost";
+                            parsed.port = String(tunnel.localPort);
+                            value = parsed.toString();
+                            break;
+                        }
+                        catch {
+                            // Not a URL
+                        }
+                    }
+                }
+                resolved[envVar] = value;
+            }
+            logSuccess(`Secret resolved: ${name} (${secret.secretName})`);
+        }
+        catch (err) {
+            logWarn(`Could not resolve secret '${name}' (${secret.secretName}): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return resolved;
+}
+/**
+ * Update the DevBox host's Caddy reverse proxy config.
+ *
+ * Generates a Caddyfile so services are accessible at
+ * http://{service}.{stack}.{app}.{tenant}-{env}.mesh.local
+ * from the developer's Mac (via Tailscale + dnsmasq).
+ */
+async function updateDevboxProxy(devOutput, appRoot) {
+    const appName = devOutput.app ?? path.basename(appRoot);
+    const tenant = devOutput.platform?.tenant ?? "mesh";
+    const env = devOutput.platform?.env ?? "dev";
+    const stack = devOutput.stack ?? "dev";
+    const baseDomain = `${tenant}-${env}.mesh.local`;
+    // Build hostname → port map
+    const services = {};
+    for (const [name, service] of Object.entries(devOutput.services)) {
+        if (service.port) {
+            services[`${name}.${stack}.${appName}.${baseDomain}`] = service.port;
+        }
+    }
+    for (const [name, tunnel] of Object.entries(devOutput.tunnels)) {
+        if (tunnel.localPort) {
+            services[`${name}.${stack}.${appName}.${baseDomain}`] = tunnel.localPort;
+        }
+    }
+    if (Object.keys(services).length === 0)
+        return;
+    // Generate Caddyfile
+    const lines = [
+        "# Auto-generated by mesh dev — do not edit manually.",
+        "",
+        ":8080 {",
+        '  respond /health "OK" 200',
+        "}",
+        "",
+    ];
+    for (const [hostname, port] of Object.entries(services)) {
+        lines.push(`http://${hostname} {`);
+        lines.push(`  reverse_proxy localhost:${port}`);
+        lines.push("}");
+        lines.push("");
+    }
+    const caddyfile = lines.join("\n");
+    // Write to host's /etc/caddy via a throwaway container with a host volume mount.
+    // The Docker socket is the HOST's, so -v /etc/caddy mounts the HOST path.
+    execFileSync("docker", [
+        "run", "--rm",
+        "-v", "/etc/caddy:/etc/caddy",
+        "busybox", "sh", "-c",
+        `cat > /etc/caddy/Caddyfile << 'CADDYEOF'\n${caddyfile}\nCADDYEOF`,
+    ], { stdio: "pipe" });
+    // Reload Caddy on the host via nsenter into PID 1's mount namespace
+    execFileSync("docker", [
+        "run", "--rm", "--pid=host", "--privileged",
+        "busybox", "nsenter", "-t", "1", "-m", "--",
+        "caddy", "reload", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile",
+    ], { stdio: "pipe" });
+    logSuccess("DevBox proxy updated:");
+    for (const [hostname, port] of Object.entries(services)) {
+        logInfo(`  http://${hostname} → localhost:${port}`);
+    }
+}
+// ============================================================================
+// Core actions
+// ============================================================================
+/**
+ * Start all services in tmux windows.
+ */
+async function startServices(sessionName, appRoot, devOutput, headless) {
+    if (!hasTmux()) {
+        logError("tmux is required. Install with: brew install tmux");
+        process.exit(1);
+    }
+    // Kill existing session
+    if (sessionExists(sessionName)) {
+        logInfo(`Killing existing session: ${sessionName}`);
+        killSession(sessionName);
+    }
+    const serviceNames = Object.keys(devOutput.services);
+    if (serviceNames.length === 0) {
+        logWarn("No services defined in dev output.");
+        return;
+    }
+    const tunnelNames = Object.keys(devOutput.tunnels);
+    // Create session with a status window
+    logInfo(`Creating tmux session: ${sessionName}`);
+    execFileSync("tmux", [
+        "new-session", "-d", "-s", sessionName, "-n", "status", "-c", appRoot,
+    ]);
+    // Start tunnels via tunnel manager in the status window (before services)
+    if (tunnelNames.length > 0) {
+        const bastionTunnels = Object.entries(devOutput.tunnels).filter(([, t]) => (t.type ?? "bastion") === "bastion");
+        // Validate bastion tunnels have a bastion instance
+        if (bastionTunnels.length > 0 && !devOutput.bastion?.instanceId) {
+            logError("Bastion tunnels defined but no bastion.instanceId in dev output.");
+            logInfo("Add bastion: { instanceId: '...' } to your dev stack output.");
+            process.exit(1);
+        }
+        // Set AWS creds on session so tunnel windows inherit them
+        setTmuxEnv(sessionName, getAwsEnvVars());
+        // Write tunnel config for the tunnel manager
+        const stateDir = path.join(os.tmpdir(), "mesh-dev-sessions");
+        if (!fs.existsSync(stateDir))
+            fs.mkdirSync(stateDir, { recursive: true });
+        const tunnelConfigPath = path.join(stateDir, `${sessionName}-tunnels.json`);
+        fs.writeFileSync(tunnelConfigPath, JSON.stringify({
+            tunnels: devOutput.tunnels,
+            bastionId: devOutput.bastion?.instanceId,
+        }));
+        // Run tunnel manager in the status window (combines tunnel management + status display)
+        // Use process.argv to self-reference (npx mesh may not work in all setups)
+        const meshBin = process.argv.slice(0, 2).join(" ");
+        const managerCmd = `${meshBin} dev __tunnel-manager --config '${tunnelConfigPath}' --tmux-session '${sessionName}'`;
+        execFileSync("tmux", [
+            "send-keys", "-t", `${sessionName}:status`, managerCmd, "Enter",
+        ]);
+        for (const [tName, tunnel] of Object.entries(devOutput.tunnels)) {
+            const target = tunnel.type === "kubectl"
+                ? `${tunnel.namespace ?? "default"}/${tunnel.resource ?? tName}:${tunnel.port}`
+                : `${tunnel.host}:${tunnel.port}`;
+            logSuccess(`Tunnel: ${tName} → localhost:${tunnel.localPort} → ${target}`);
+        }
+        // Give tunnels a moment to establish before starting services
+        logInfo("Waiting for tunnels to establish...");
+        spawnSync("sleep", ["3"]);
+    }
+    // Resolve secrets from Secrets Manager
+    let secretEnvVars = {};
+    if (devOutput.secrets && Object.keys(devOutput.secrets).length > 0) {
+        secretEnvVars = await resolveSecrets(devOutput.secrets, devOutput.tunnels);
+    }
+    // Set shared env vars (AWS creds + secrets) on the tmux session.
+    // Per-service vars are set before each window is created.
+    setTmuxEnv(sessionName, getAwsEnvVars());
+    setTmuxEnv(sessionName, secretEnvVars);
+    for (const [name, service] of Object.entries(devOutput.services)) {
+        const cmd = service.command.join(" ");
+        // Skip services with no dev command (e.g., deployed-only like ApiDocs)
+        if (!cmd) {
+            logInfo(`Skipped: ${name} (no dev command, deployed to K8s)`);
+            continue;
+        }
+        const serviceDir = path.resolve(appRoot, service.src);
+        // Per-service env vars are inlined into the command via `env K=V`
+        // to avoid cross-service leaks through the tmux session environment.
+        const serviceVars = getServiceEnvVars(service, devOutput.tunnels);
+        const prefixedCmd = `${envPrefix(serviceVars)}${cmd}`;
+        execFileSync("tmux", [
+            "new-window", "-t", sessionName, "-n", name, "-c", serviceDir,
+        ]);
+        // Keep window alive on exit so errors are visible
+        execFileSync("tmux", [
+            "set-option", "-t", `${sessionName}:${name}`, "remain-on-exit", "on",
+        ], { stdio: "ignore" });
+        execFileSync("tmux", [
+            "send-keys", "-t", `${sessionName}:${name}`, prefixedCmd, "Enter",
+        ]);
+        logSuccess(`Started: ${name} (${service.src}, port ${service.port})`);
+    }
+    // Generate reverse proxy config for DevBox hostname-based routing.
+    // When running inside a devbox (DEVCONTAINER=1 on EC2), update the host's
+    // Caddy config so services are accessible via {service}.mesh.local.
+    if (process.env.DEVCONTAINER === "1") {
+        try {
+            await updateDevboxProxy(devOutput, appRoot);
+        }
+        catch (e) {
+            logWarn(`Could not update devbox proxy: ${e.message}`);
+        }
+    }
+    // Status window: if no tunnels, run watch for live status updates.
+    // (When tunnels exist, the tunnel manager already runs in the status window.)
+    if (tunnelNames.length === 0) {
+        const statusCmd = `watch -n2 -t npx mesh dev --status --session '${sessionName}'`;
+        execFileSync("tmux", [
+            "send-keys", "-t", `${sessionName}:status`, statusCmd, "Enter",
+        ]);
+    }
+    console.log("");
+    logSuccess(`Dev session started: ${sessionName}`);
+    console.log("");
+    if (tunnelNames.length > 0) {
+        console.log("Tunnels:");
+        for (const tName of tunnelNames) {
+            const t = devOutput.tunnels[tName];
+            const target = t.type === "kubectl"
+                ? `${t.namespace ?? "default"}/${t.resource ?? tName}:${t.port}`
+                : `${t.host}:${t.port}`;
+            const label = t.type === "kubectl" ? " (kubectl)" : "";
+            console.log(`  ${tName.padEnd(20)} localhost:${t.localPort} → ${target}${label}`);
+        }
+        console.log("");
+    }
+    console.log("Services:");
+    for (const name of serviceNames) {
+        const s = devOutput.services[name];
+        const hasCmd = s.command && s.command.length > 0;
+        if (hasCmd) {
+            const addr = s.port ? `http://localhost:${s.port}` : "(no port)";
+            console.log(`  ${name.padEnd(20)} ${addr}`);
+        }
+        else {
+            console.log(`  ${name.padEnd(20)} (deployed)`);
+        }
+    }
+    console.log("");
+    if (!headless) {
+        logInfo("Attaching to tmux session...");
+        spawnSync("tmux", ["attach", "-t", sessionName], { stdio: "inherit" });
+    }
+    else {
+        console.log(`Attach with:  tmux attach -t ${sessionName}`);
+        console.log(`Stop with:    mesh dev --kill`);
+        console.log("");
+    }
+}
+/**
+ * Show status of running services.
+ */
+function showStatus(sessionName, devOutput, asJson) {
+    if (!sessionExists(sessionName)) {
+        if (asJson) {
+            console.log(JSON.stringify({ running: false, session: sessionName }));
+        }
+        else {
+            logInfo(`No active session: ${sessionName}`);
+        }
+        return;
+    }
+    // Get tmux window list
+    let windows = [];
+    try {
+        const raw = execFileSync("tmux", [
+            "list-windows", "-t", sessionName, "-F", "#{window_name} #{pane_dead}",
+        ], { encoding: "utf-8" });
+        windows = raw.trim().split("\n");
+    }
+    catch {
+        // Session might have disappeared
+    }
+    const windowStatus = {};
+    for (const line of windows) {
+        const [name, dead] = line.split(" ");
+        if (name)
+            windowStatus[name] = dead === "1" ? "exited" : "running";
+    }
+    const tunnelNames = Object.keys(devOutput.tunnels);
+    if (asJson) {
+        const services = {};
+        for (const [name, svc] of Object.entries(devOutput.services)) {
+            services[name] = {
+                status: windowStatus[name] ?? "unknown",
+                port: svc.port,
+                src: svc.src,
+            };
+        }
+        const tunnels = {};
+        for (const [name, tun] of Object.entries(devOutput.tunnels)) {
+            const target = tun.type === "kubectl"
+                ? `${tun.namespace ?? "default"}/${tun.resource ?? name}:${tun.port}`
+                : `${tun.host}:${tun.port}`;
+            const listening = isPortListeningSync(tun.localPort);
+            tunnels[name] = {
+                status: listening ? "running" : "down",
+                localPort: tun.localPort,
+                remote: target,
+                type: tun.type ?? "bastion",
+            };
+        }
+        console.log(JSON.stringify({ running: true, session: sessionName, services, tunnels }, null, 2));
+    }
+    else {
+        console.log("── mesh dev ──");
+        console.log("");
+        console.log(`Session: ${sessionName}`);
+        if (tunnelNames.length > 0) {
+            // Tunnel manager runs in a single window; check health by probing local ports
+            const managerStatus = windowStatus["tunnels"] ?? "unknown";
+            const managerIcon = managerStatus === "running" ? "●" : "✗";
+            console.log("");
+            console.log(`Tunnels: ${managerIcon} manager ${managerStatus}`);
+            for (const [name, tun] of Object.entries(devOutput.tunnels)) {
+                const listening = isPortListeningSync(tun.localPort);
+                const icon = listening ? "●" : "✗";
+                const status = listening ? "up" : "down";
+                const target = tun.type === "kubectl"
+                    ? `${tun.namespace ?? "default"}/${tun.resource ?? name}:${tun.port}`
+                    : `${tun.host}:${tun.port}`;
+                const label = tun.type === "kubectl" ? " kubectl" : "";
+                console.log(`  ${icon} ${name.padEnd(16)} ${status.padEnd(10)} :${tun.localPort} → ${target}${label}`);
+            }
+        }
+        console.log("");
+        console.log("Services:");
+        for (const [name, svc] of Object.entries(devOutput.services)) {
+            const hasCmd = svc.command && svc.command.length > 0;
+            if (!hasCmd) {
+                console.log(`  ☁ ${name.padEnd(16)} deployed                ${svc.src}`);
+                continue;
+            }
+            const status = windowStatus[name] ?? "unknown";
+            const icon = status === "running" ? "●" : status === "exited" ? "✗" : "?";
+            const addr = svc.port ? `:${svc.port}` : "";
+            console.log(`  ${icon} ${name.padEnd(16)} ${status.padEnd(10)} ${addr.padEnd(8)} ${svc.src}`);
+        }
+        console.log("");
+        console.log("Commands:");
+        console.log("  mesh dev restart <s>   Restart a service");
+        console.log("  mesh dev logs <s>      Tail service logs");
+        console.log("  mesh dev --kill        Stop everything");
+        console.log("");
+        console.log("tmux: Ctrl+b n/p switch windows, d detach");
+    }
+}
+/**
+ * Restart a single service window.
+ */
+function restartService(sessionName, serviceName, _appRoot, devOutput) {
+    const service = devOutput.services[serviceName];
+    if (!service) {
+        logError(`Unknown service: ${serviceName}`);
+        logInfo(`Available: ${Object.keys(devOutput.services).join(", ")}`);
+        process.exit(1);
+    }
+    if (!sessionExists(sessionName)) {
+        logError(`No active session: ${sessionName}. Run 'mesh dev' first.`);
+        process.exit(1);
+    }
+    const target = `${sessionName}:${serviceName}`;
+    // Kill the current pane process and respawn
+    try {
+        execFileSync("tmux", ["respawn-pane", "-k", "-t", target], { stdio: "ignore" });
+    }
+    catch {
+        // Window might not exist yet
+        logError(`Window '${serviceName}' not found in session.`);
+        process.exit(1);
+    }
+    // Refresh shared env (AWS creds may have rotated) on the session.
+    // Per-service vars are inlined into the command to avoid cross-service leaks.
+    setTmuxEnv(sessionName, getAwsEnvVars());
+    const serviceVars = getServiceEnvVars(service, devOutput.tunnels);
+    const cmd = service.command.join(" ");
+    const prefixedCmd = `${envPrefix(serviceVars)}${cmd}`;
+    execFileSync("tmux", ["send-keys", "-t", target, prefixedCmd, "Enter"]);
+    logSuccess(`Restarted: ${serviceName}`);
+}
+/**
+ * Capture and display logs from a service window.
+ */
+function showLogs(sessionName, serviceName, tail) {
+    if (!sessionExists(sessionName)) {
+        logError(`No active session: ${sessionName}. Run 'mesh dev' first.`);
+        process.exit(1);
+    }
+    const target = `${sessionName}:${serviceName}`;
+    try {
+        const result = execFileSync("tmux", [
+            "capture-pane", "-t", target, "-p", "-S", `-${tail}`,
+        ], { encoding: "utf-8" });
+        process.stdout.write(result);
+    }
+    catch {
+        logError(`Could not capture logs for '${serviceName}'.`);
+        logInfo("Is the service name correct? Check with: mesh dev --status");
+        process.exit(1);
+    }
+}
+// ============================================================================
+// Tunnel Manager
+// ============================================================================
+import { spawn } from "child_process";
+/**
+ * Tunnel manager — spawns all tunnels as child processes, monitors health,
+ * auto-restarts on failure, and prints a live status table.
+ *
+ * Runs in a single tmux window instead of one window per tunnel.
+ */
+function runTunnelManager(configPath, sessionName) {
+    const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const tunnelEntries = Object.entries(config.tunnels);
+    if (tunnelEntries.length === 0) {
+        console.log("No tunnels to manage.");
+        return;
+    }
+    const states = tunnelEntries.map(([name, tunnel]) => {
+        let argv;
+        if ((tunnel.type ?? "bastion") === "bastion") {
+            argv = [
+                "aws", "ssm", "start-session",
+                "--target", config.bastionId,
+                "--document-name", "AWS-StartPortForwardingSessionToRemoteHost",
+                "--parameters", JSON.stringify({
+                    host: [tunnel.host],
+                    portNumber: [String(tunnel.port)],
+                    localPortNumber: [String(tunnel.localPort)],
+                }),
+            ];
+        }
+        else {
+            const ns = tunnel.namespace ?? "default";
+            const resource = tunnel.resource ?? `svc/${name}`;
+            argv = ["kubectl", "port-forward", "-n", ns, resource, `${tunnel.localPort}:${tunnel.port}`];
+        }
+        return {
+            name,
+            tunnel,
+            process: null,
+            status: "starting",
+            restarts: 0,
+            lastStart: 0,
+            argv,
+        };
+    });
+    function startTunnel(state) {
+        state.status = "starting";
+        state.lastStart = Date.now();
+        const [cmd, ...args] = state.argv;
+        const child = spawn(cmd, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        child.stdout?.on("data", () => {
+            // SSM/kubectl output — tunnel is establishing
+            if (state.status === "starting") {
+                state.status = "up";
+            }
+        });
+        child.stderr?.on("data", (data) => {
+            const msg = data.toString().trim();
+            if (msg && !msg.includes("Starting session") && !msg.includes("Forwarding from")) {
+                console.log(`  [${state.name}] ${msg}`);
+            }
+        });
+        child.on("exit", (code) => {
+            state.process = null;
+            if (shuttingDown)
+                return;
+            state.status = "down";
+            state.restarts++;
+            // Back off: wait longer between restarts (1s, 2s, 4s, 8s, max 30s)
+            const delay = Math.min(1000 * Math.pow(2, Math.min(state.restarts - 1, 4)), 30000);
+            console.log(`  [${state.name}] exited (code ${code}), restarting in ${delay / 1000}s...`);
+            state.status = "restarting";
+            setTimeout(() => {
+                if (!shuttingDown)
+                    startTunnel(state);
+            }, delay);
+        });
+        state.process = child;
+        // Mark as "up" after a short delay if still running
+        setTimeout(() => {
+            if (state.process && state.status === "starting") {
+                state.status = "up";
+            }
+        }, 2000);
+    }
+    let shuttingDown = false;
+    function shutdown() {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        console.log("\nShutting down tunnels...");
+        for (const state of states) {
+            if (state.process) {
+                state.process.kill("SIGTERM");
+            }
+        }
+        setTimeout(() => process.exit(0), 1000);
+    }
+    process.on("SIGTERM", shutdown);
+    process.on("SIGINT", shutdown);
+    // Print header
+    console.log("mesh dev — tunnel manager");
+    console.log("─".repeat(60));
+    for (const state of states) {
+        const target = state.tunnel.type === "kubectl"
+            ? `${state.tunnel.namespace ?? "default"}/${state.tunnel.resource ?? state.name}:${state.tunnel.port}`
+            : `${state.tunnel.host}:${state.tunnel.port}`;
+        const label = state.tunnel.type === "kubectl" ? "kubectl" : "bastion";
+        console.log(`  ${state.name.padEnd(16)} :${state.tunnel.localPort} → ${target} (${label})`);
+    }
+    console.log("─".repeat(60));
+    console.log("");
+    // Start all tunnels
+    for (const state of states) {
+        startTunnel(state);
+    }
+    // Periodically print full status (tunnels + services)
+    function printStatus() {
+        if (shuttingDown)
+            return;
+        // Clear screen and move cursor to top
+        process.stdout.write("\x1b[2J\x1b[H");
+        console.log("── mesh dev ──");
+        console.log("");
+        // Tunnels
+        console.log("Tunnels:");
+        for (const s of states) {
+            const icon = s.status === "up" ? "●" : s.status === "restarting" ? "↻" : s.status === "starting" ? "…" : "✗";
+            const statusLabel = s.status === "up" ? "up" : s.status === "restarting" ? `restart(${s.restarts})` : s.status;
+            const target = s.tunnel.type === "kubectl"
+                ? `${s.tunnel.namespace ?? "default"}/${s.tunnel.resource ?? s.name}:${s.tunnel.port}`
+                : `${s.tunnel.host}:${s.tunnel.port}`;
+            const label = s.tunnel.type === "kubectl" ? " kubectl" : "";
+            console.log(`  ${icon} ${s.name.padEnd(16)} ${statusLabel.padEnd(14)} :${s.tunnel.localPort} → ${target}${label}`);
+        }
+        // Services (check tmux window status if session name provided)
+        if (sessionName) {
+            let windows = [];
+            try {
+                const raw = execFileSync("tmux", [
+                    "list-windows", "-t", sessionName, "-F", "#{window_name} #{pane_dead}",
+                ], { encoding: "utf-8" });
+                windows = raw.trim().split("\n");
+            }
+            catch { }
+            const windowStatus = {};
+            for (const line of windows) {
+                const [name, dead] = line.split(" ");
+                if (name)
+                    windowStatus[name] = dead === "1" ? "exited" : "running";
+            }
+            // Get service names from session state
+            const state = loadSessionState(sessionName);
+            if (state?.devOutput?.services) {
+                console.log("");
+                console.log("Services:");
+                for (const [name, svc] of Object.entries(state.devOutput.services)) {
+                    const hasCmd = svc.command && svc.command.length > 0;
+                    if (!hasCmd) {
+                        console.log(`  ☁ ${name.padEnd(16)} deployed                ${svc.src}`);
+                        continue;
+                    }
+                    const status = windowStatus[name] ?? "unknown";
+                    const icon = status === "running" ? "●" : status === "exited" ? "✗" : "?";
+                    const addr = svc.port ? `:${svc.port}` : "";
+                    console.log(`  ${icon} ${name.padEnd(16)} ${status.padEnd(14)} ${addr.padEnd(8)} ${svc.src}`);
+                }
+            }
+        }
+        console.log("");
+        console.log("mesh dev --status / --kill   |   Ctrl+b n/p switch windows");
+    }
+    // Print initial status after tunnels start, then refresh every 2s
+    setTimeout(printStatus, 3000);
+    setInterval(printStatus, 2000);
+}
+// ============================================================================
+// Command registration
+// ============================================================================
+export function registerDevCommand(program) {
+    const dev = program
+        .command("dev")
+        .description("Start local dev environment (reads Pulumi stack outputs)")
+        .option("--app <path>", "Path to a Pulumi app (relative to monorepo root or cwd)")
+        .option("--stage <stage>", "Pulumi stack name (default: auto-detect)")
+        .option("--headless", "Start without attaching to tmux")
+        .option("--kill", "Kill existing dev session")
+        .option("--status", "Show service status")
+        .option("--json", "Output status as JSON (with --status)")
+        .option("--session <name>", "Custom tmux session name");
+    // Default action: start or show status
+    dev.action(async (options) => {
+        // Fast-path: --status/--kill with explicit --session can skip app root resolution
+        if (options.session && (options.status || options.kill)) {
+            const sessionName = options.session;
+            if (options.kill) {
+                if (sessionExists(sessionName)) {
+                    killSession(sessionName);
+                    logSuccess(`Killed session: ${sessionName}`);
+                }
+                else {
+                    logInfo(`No active session: ${sessionName}`);
+                }
+                removeSessionState(sessionName);
+                return;
+            }
+            // --status with --session: use state file, no Pulumi needed
+            const state = loadSessionState(sessionName);
+            if (state) {
+                showStatus(sessionName, state.devOutput, !!options.json);
+                return;
+            }
+            // No state — fall through to normal flow
+        }
+        const appRoot = findAppRoot(options.app);
+        const projectName = getProjectName(appRoot);
+        const sessionName = options.session ?? `${projectName}-dev`;
+        // --kill
+        if (options.kill) {
+            if (sessionExists(sessionName)) {
+                killSession(sessionName);
+                logSuccess(`Killed session: ${sessionName}`);
+            }
+            else {
+                logInfo(`No active session: ${sessionName}`);
+            }
+            removeSessionState(sessionName);
+            return;
+        }
+        const stack = detectStack(appRoot, options.stage);
+        logInfo(`Project: ${projectName}, Stack: ${stack}`);
+        const rawDevOutput = getDevOutput(appRoot, stack);
+        // --status — use persisted state (has allocated ports), fall back to raw
+        if (options.status) {
+            const state = loadSessionState(sessionName);
+            showStatus(sessionName, state?.devOutput ?? rawDevOutput, !!options.json);
+            return;
+        }
+        // Allocate dynamic ports (avoid collisions with other running apps)
+        const devOutput = await allocatePorts(rawDevOutput);
+        // Persist session state so --status and restart see allocated ports
+        saveSessionState(sessionName, {
+            appRoot,
+            stack,
+            devOutput,
+            startedAt: new Date().toISOString(),
+        });
+        // Start services
+        await startServices(sessionName, appRoot, devOutput, !!options.headless);
+    });
+    // Subcommand: logs
+    dev
+        .command("logs <service>")
+        .description("Show logs for a service")
+        .option("--tail <lines>", "Number of lines", "100")
+        .action((service, opts) => {
+        // --session is on the parent dev command
+        const sessionName = dev.opts().session;
+        if (sessionName) {
+            showLogs(sessionName, service, parseInt(opts.tail, 10));
+        }
+        else {
+            const appRoot = findAppRoot();
+            const projectName = getProjectName(appRoot);
+            showLogs(`${projectName}-dev`, service, parseInt(opts.tail, 10));
+        }
+    });
+    // Subcommand: restart
+    dev
+        .command("restart <service>")
+        .description("Restart a service")
+        .option("--stage <stage>", "Pulumi stack name")
+        .action((service, opts) => {
+        // --session is on the parent dev command
+        const parentSession = dev.opts().session;
+        const appRoot = findAppRoot();
+        const projectName = getProjectName(appRoot);
+        const sessionName = parentSession ?? `${projectName}-dev`;
+        // Use persisted state (has allocated ports), fall back to raw Pulumi output
+        const state = loadSessionState(sessionName);
+        const devOutput = state?.devOutput ??
+            getDevOutput(appRoot, detectStack(appRoot, opts.stage));
+        restartService(sessionName, service, appRoot, devOutput);
+    });
+    // Subcommand: list — discover apps in the monorepo
+    dev
+        .command("list")
+        .description("List Pulumi apps in the monorepo")
+        .action(() => {
+        // --json is on the parent dev command
+        const asJson = dev.opts().json;
+        const mono = findMonorepoRoot();
+        if (!mono) {
+            logError("Could not find monorepo root (pnpm-workspace.yaml or .git)");
+            process.exit(1);
+        }
+        const apps = discoverApps(mono);
+        if (asJson) {
+            // Include running state for each app
+            const result = apps.map((app) => {
+                const sessionName = `${app.name}-dev`;
+                return {
+                    ...app,
+                    running: sessionExists(sessionName),
+                    session: sessionName,
+                };
+            });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        else {
+            if (apps.length === 0) {
+                logInfo("No Pulumi apps found.");
+                return;
+            }
+            console.log("Apps in monorepo:");
+            console.log("");
+            for (const app of apps) {
+                const sessionName = `${app.name}-dev`;
+                const running = sessionExists(sessionName);
+                const icon = running ? "●" : "○";
+                const stacks = app.stacks.length > 0
+                    ? ` (${app.stacks.join(", ")})`
+                    : "";
+                console.log(`  ${icon} ${app.name.padEnd(24)} ${app.tenant.padEnd(12)} ${app.relativePath}${stacks}`);
+            }
+            console.log("");
+        }
+    });
+    // Hidden subcommand: tunnel manager (started internally by mesh dev)
+    dev
+        .command("__tunnel-manager")
+        .description("Internal: manage all tunnels in a single process")
+        .option("--config <path>", "Path to tunnel config JSON")
+        .option("--tmux-session <name>", "tmux session name for status display")
+        .action((opts) => {
+        if (!opts.config) {
+            logError("--config is required");
+            process.exit(1);
+        }
+        runTunnelManager(opts.config, opts.tmuxSession);
+    });
+}
+//# sourceMappingURL=dev.js.map