lensmcp 1.16.18 → 1.16.20

package/lib/cli.js

@@ -236,6 +236,7 @@ function buildProjectsMap(cwd) {
 function runGateway(ctx, args, out, err) {
     const opts = parseFlags(args, { string: ['--cwd', '--project', '--target'] });
     const sub = (opts.positional[0] ?? 'status').toLowerCase();
+    const asJson = args.includes('--json'); // `gateway status --json` → machine-readable (the IDE plugin/scripts)
     const cwd = resolve(stringFlag(opts.flags['--cwd']) ?? ctx.cwd);
     const cfg = ensureLensConfig(cwd);
     const pidFile = join(cwd, '.lensmcp', 'gateway.pid');
@@ -330,26 +331,99 @@ function runGateway(ctx, args, out, err) {
         }
         if (healed)
             out(`healed: found an orphaned gateway (pid ${pid}) the pid file had lost — stopping it.`);
-        // Detached child is its own process-group leader → negative pid kills the whole tree.
+        // GRACEFUL first: SIGTERM the whole process group (the daemon's handler reaps its children — pods +
+        // lens vites/dashboard/mcp — and exits, so `nx run` deregisters and the next `start` won't hang on the
+        // nx run-lock). Then WAIT for the port to actually free.
         killGatewayTree(pid);
-        rmFile(pidFile);
-        // Escalate: if a lens gateway STILL holds :443 (a differently-parented tree), kill that too, so
-        // `stop` genuinely frees the port instead of leaving a wedged listener behind.
+        let hardKilled = false;
+        if (!waitForPortFree(6000)) {
+            // A child wedged (vite ignores SIGTERM) and is still holding :443. Escalate to a GROUP SIGKILL — that
+            // reaps the wedged vite AND its forks — then SIGKILL any straggler still on the port.
+            hardKilled = true;
+            killGatewayTree(pid, 'SIGKILL');
+            for (const p of pidsOnPort443()) {
+                try {
+                    process.kill(p, 'SIGKILL');
+                }
+                catch { /* already gone */ }
+            }
+            waitForPortFree(3000);
+        }
+        // A differently-parented lens gateway may still hold :443 (a desync tree) — force it too.
         const still = gatewayOnPort443(cwd);
-        if (still !== undefined && still !== pid)
-            killGatewayTree(still);
-        out(`gateway stopped (pid ${pid}).`);
+        if (still !== undefined && still !== pid) {
+            killGatewayTree(still, 'SIGKILL');
+            hardKilled = true;
+        }
+        rmFile(pidFile);
+        // A hard SIGKILL means the `nx run gateway:serve` process died WITHOUT deregistering from the nx daemon,
+        // so the next `start` would block on "Waiting for gateway:serve in another nx process". Clear the stale
+        // nx daemon state (best-effort) so a subsequent start is clean. The graceful path skips this (fast).
+        if (hardKilled)
+            refreshNxGraph(cwd, ctx.env, () => { });
+        out(`gateway stopped (pid ${pid})${hardKilled ? ' — forced (a child ignored SIGTERM)' : ''}.`);
         return { exitCode: 0 };
     };
     const status = () => {
         const { pid, healed } = reconcileGateway(pidFile, cwd);
         const alive = pid !== undefined && isAlive(pid);
-        out(`gateway: ${alive ? `running (pid ${pid})${healed ? ' — recovered a stale pid file' : ''}` : 'stopped'}`);
+        // Machine-readable status for the IDE plugin / scripts: the daemon's rich /status (identity + workspaces
+        // + per-service live state) plus THIS workspace's role + the dashboard URL. Degrades to a minimal object
+        // when no daemon is reachable, so a consumer always gets valid JSON.
+        if (asJson) {
+            const s = daemonRequest('GET', '/status');
+            const daemonStatus = s?.status === 200 && s.json && typeof s.json === 'object' ? s.json : null;
+            const registered = existsSync(registeredMarker);
+            const role = alive ? 'daemon' : daemonStatus && registered ? 'guest' : daemonStatus ? 'other' : 'stopped';
+            out(JSON.stringify({
+                thisWorkspace: cfg.key,
+                role,
+                dashboardUrl: dashUrl,
+                chooserUrl: 'https://lensmcp.local/',
+                logFile,
+                daemon: daemonStatus?.['daemon'] ?? null,
+                workspaces: daemonStatus?.['workspaces'] ?? [],
+                services: daemonStatus?.['services'] ?? [],
+            }));
+            return { exitCode: alive || (daemonStatus && registered) ? 0 : 1 };
+        }
+        // If a shared daemon is up, GET /list shows the FULL multi-workspace picture (this one may be a guest).
+        const listRes = daemonRequest('GET', '/list');
+        const workspaces = listRes?.status === 200 && listRes.json && typeof listRes.json === 'object'
+            ? (listRes.json.workspaces ?? [])
+            : [];
+        const printWorkspaces = () => {
+            if (workspaces.length === 0)
+                return;
+            out(`  workspaces (${workspaces.length} registered):`);
+            for (const w of workspaces) {
+                out(`    • ${w.key}  (${w.routes ?? 0} routes, ${w.services ?? 0} services)${w.key === cfg.key ? '   ← this workspace' : ''}`);
+            }
+        };
+        if (alive) {
+            // This workspace's own pid owns :443 → it IS the daemon (it may be hosting other workspaces too).
+            out(`gateway: running (pid ${pid}) — DAEMON on :443${healed ? ' — recovered a stale pid file' : ''}`);
+            out(`  workspace → ${cfg.key}`);
+            out(`  dashboard → ${dashUrl}`);
+            out(`  chooser   → https://lensmcp.local/`);
+            out(`  logs      → ${logFile}`);
+            printWorkspaces();
+            return { exitCode: 0 };
+        }
+        // Not our own gateway — but are we a GUEST registered into a shared daemon someone else owns?
+        if (existsSync(registeredMarker) && listRes?.status === 200) {
+            const host = pidsOnPort443()[0];
+            out(`gateway: registered into a shared daemon${host !== undefined ? ` (pid ${host})` : ''} — this workspace is a guest`);
+            out(`  workspace → ${cfg.key}`);
+            out(`  dashboard → ${dashUrl}`);
+            out('  stop      → `lensmcp gateway stop` (unregisters; the daemon keeps running)');
+            printWorkspaces();
+            return { exitCode: 0 };
+        }
+        out('gateway: stopped');
         out(`  workspace → ${cfg.key}`);
         out(`  dashboard → ${dashUrl}`);
-        if (alive)
-            out(`  logs      → ${logFile}`);
-        return { exitCode: alive ? 0 : 1 };
+        return { exitCode: 1 };
     };
     switch (sub) {
         case 'start':
@@ -519,20 +593,64 @@ function reconcileGateway(pidFile, cwd) {
     }
     return { healed: false };
 }
-/** Best-effort kill of a detached gateway process GROUP (the leader is its own group via `detached`). */
-function killGatewayTree(pid) {
+/** Best-effort kill of a detached gateway process GROUP (the leader is its own group via `detached`).
+ *  `signal` defaults to SIGTERM (graceful — the daemon's handler reaps its children + exits, so `nx run`
+ *  deregisters cleanly); a caller escalates to SIGKILL when a wedged child (vite ignores SIGTERM) keeps the
+ *  port held. Killing the GROUP (`-pid`) reaps the daemon + `nx run` + every child + their forks at once. */
+function killGatewayTree(pid, signal = 'SIGTERM') {
     try {
-        process.kill(-pid, 'SIGTERM');
+        process.kill(-pid, signal);
     }
     catch {
         try {
-            process.kill(pid, 'SIGTERM');
+            process.kill(pid, signal);
         }
         catch {
             /* already gone */
         }
     }
 }
+/** Poll (via lsof) until :443 is free or the timeout elapses. Returns true once free. Unix-only; on a
+ *  platform without lsof `pidsOnPort443()` returns [] so this resolves free immediately (unchanged path). */
+function waitForPortFree(timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (pidsOnPort443().length === 0)
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        // Busy-wait in ~150ms slices (a stop/restart command, not a hot path) — spawnSync('sleep') keeps it
+        // synchronous so the CLI result reflects the real port state before returning.
+        spawnSync('sleep', ['0.15']);
+    }
+}
+/** Probe whether the cert served for `host` is trusted by the SYSTEM store — the ACCURATE check for a
+ *  daemon-served workspace (whose OWN local CA is unused, so `trust`'s file-based verify falsely says "NOT
+ *  TRUSTED"). Sync via curl: `ssl_verify_result` 0 + a completed handshake = trusted; a non-0 verify = the
+ *  cert was rejected; otherwise the host was unreachable. */
+function probeHostTrust(host) {
+    const r = spawnSync('curl', ['-s', '-o', '/dev/null', '-m', '8', '-w', '%{ssl_verify_result}', `https://${host}/`], { encoding: 'utf8' });
+    const verify = (r.stdout ?? '').trim();
+    if (r.status === 0 && verify === '0')
+        return 'trusted';
+    if (verify && verify !== '0')
+        return 'untrusted';
+    return 'unknown';
+}
+/** The first non-wildcard `cluster.host` declared in the workspace — a workspace-specific host to
+ *  trust-probe (better than the shared `lensmcp.local`, which both workspaces route). */
+function firstClusterHost(cwd) {
+    for (const file of walkProjectFiles(cwd, (n) => n === 'project.json')) {
+        try {
+            const raw = JSON.parse(readFileSync(file, 'utf8'));
+            const h = (raw.cluster ?? raw.davnx)?.host;
+            if (h && !h.includes('*'))
+                return h;
+        }
+        catch { /* skip unreadable project.json */ }
+    }
+    return undefined;
+}
 function rmFile(path) {
     try {
         if (existsSync(path))
@@ -635,15 +753,40 @@ function runTrust(ctx, args, out, err) {
         return { exitCode: 1 };
     }
     const target = findTrustTarget(cwd, stringFlag(opts.flags['--project']), stringFlag(opts.flags['--target']));
+    // Daemon-awareness: if a shared daemon owns :443 and this workspace is a GUEST (its gateway isn't the one
+    // on :443), the daemon serves every host with ITS (already-trusted) CA — this workspace's own CA is unused.
+    // The full trust here would mint a pointless second CA and, worse, report "NOT TRUSTED YET" from verifying
+    // that unused CA file (the papercut). So run HOSTS-ONLY (/etc/hosts + DNS) and report the REAL served-cert
+    // trust instead.
+    const guestOfDaemon = daemonRequest('GET', '/list')?.status === 200 && gatewayOnPort443(cwd) === undefined;
     if (!isInteractive()) {
         out('  note: trust runs `sudo` for the CA + /etc/hosts — run it in a real terminal if a step is needed.');
     }
-    out(`> ${nxBin} run ${target.project}:${target.target}   (sudo prompts inline for the CA + /etc/hosts)`);
+    if (guestOfDaemon) {
+        out('  a shared gateway daemon serves this workspace — TLS rides ITS (already-trusted) CA, not a separate');
+        out("  one here. Setting up /etc/hosts only (trusting the CA is the DAEMON workspace's job).");
+    }
+    out(`> ${nxBin} run ${target.project}:${target.target}   (sudo prompts inline for ${guestOfDaemon ? '/etc/hosts' : 'the CA + /etc/hosts'})`);
     const result = spawnSync(nxBin, ['run', `${target.project}:${target.target}`], {
         cwd,
         stdio: 'inherit',
-        env: { ...process.env, ...(ctx.env ?? {}) },
+        env: { ...process.env, ...(ctx.env ?? {}), ...(guestOfDaemon ? { LENSMCP_TRUST_HOSTS_ONLY: '1' } : {}) },
     });
+    // For a guest the executor's own (file-based, misleading) CA check is suppressed — report the ACCURATE
+    // trust of the daemon's SERVED cert via a real system-store TLS probe, so the verdict is truthful.
+    if (guestOfDaemon && result.status === 0) {
+        const host = firstClusterHost(cwd);
+        if (host) {
+            const verdict = probeHostTrust(host);
+            out('');
+            if (verdict === 'trusted')
+                out(`  ✓ ${host} → served by the daemon with a TRUSTED cert — you're set (restart the browser once if it cached an error).`);
+            else if (verdict === 'untrusted')
+                out(`  ✗ ${host} → the daemon's cert is NOT trusted yet. Run \`lensmcp trust\` in the DAEMON workspace (it owns the CA), then restart your browser.`);
+            else
+                out(`  ? ${host} → couldn't reach it to verify (is the daemon running?). /etc/hosts is set; TLS rides the daemon's CA.`);
+        }
+    }
     return { exitCode: result.status ?? 1 };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lensmcp",
-  "version": "1.16.18",
+  "version": "1.16.20",
   "type": "module",
   "main": "./index.js",
   "module": "./index.js",
@@ -17,7 +17,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "^1.4.1",
+    "@frontmcp/sdk": "^1.5.4",
     "reflect-metadata": "^0.2.2",
     "tslib": "^2.3.0",
     "vectoriadb": "^2.2.0"

package/plugin/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "lensmcp",
   "displayName": "LensMCP",
   "description": "The observability lens for coding agents. One command brings up the dev cluster gateway (every project.json `cluster` decl → its host on :443), the per-project lens dashboard at https://lensmcp.local/<project>/, and the MCP server your agent connects to — scoped automatically to whatever project you opened Claude Code in.",
-  "version": "1.16.18",
+  "version": "1.16.20",
   "author": {
     "name": "David Antoon",
     "email": "davidmantoon@gmail.com"