lensmcp 1.16.19 → 1.16.20

package/lib/cli.js

@@ -236,6 +236,7 @@ function buildProjectsMap(cwd) {
 function runGateway(ctx, args, out, err) {
     const opts = parseFlags(args, { string: ['--cwd', '--project', '--target'] });
     const sub = (opts.positional[0] ?? 'status').toLowerCase();
+    const asJson = args.includes('--json'); // `gateway status --json` → machine-readable (the IDE plugin/scripts)
     const cwd = resolve(stringFlag(opts.flags['--cwd']) ?? ctx.cwd);
     const cfg = ensureLensConfig(cwd);
     const pidFile = join(cwd, '.lensmcp', 'gateway.pid');
@@ -366,12 +367,63 @@ function runGateway(ctx, args, out, err) {
     const status = () => {
         const { pid, healed } = reconcileGateway(pidFile, cwd);
         const alive = pid !== undefined && isAlive(pid);
-        out(`gateway: ${alive ? `running (pid ${pid})${healed ? ' — recovered a stale pid file' : ''}` : 'stopped'}`);
+        // Machine-readable status for the IDE plugin / scripts: the daemon's rich /status (identity + workspaces
+        // + per-service live state) plus THIS workspace's role + the dashboard URL. Degrades to a minimal object
+        // when no daemon is reachable, so a consumer always gets valid JSON.
+        if (asJson) {
+            const s = daemonRequest('GET', '/status');
+            const daemonStatus = s?.status === 200 && s.json && typeof s.json === 'object' ? s.json : null;
+            const registered = existsSync(registeredMarker);
+            const role = alive ? 'daemon' : daemonStatus && registered ? 'guest' : daemonStatus ? 'other' : 'stopped';
+            out(JSON.stringify({
+                thisWorkspace: cfg.key,
+                role,
+                dashboardUrl: dashUrl,
+                chooserUrl: 'https://lensmcp.local/',
+                logFile,
+                daemon: daemonStatus?.['daemon'] ?? null,
+                workspaces: daemonStatus?.['workspaces'] ?? [],
+                services: daemonStatus?.['services'] ?? [],
+            }));
+            return { exitCode: alive || (daemonStatus && registered) ? 0 : 1 };
+        }
+        // If a shared daemon is up, GET /list shows the FULL multi-workspace picture (this one may be a guest).
+        const listRes = daemonRequest('GET', '/list');
+        const workspaces = listRes?.status === 200 && listRes.json && typeof listRes.json === 'object'
+            ? (listRes.json.workspaces ?? [])
+            : [];
+        const printWorkspaces = () => {
+            if (workspaces.length === 0)
+                return;
+            out(`  workspaces (${workspaces.length} registered):`);
+            for (const w of workspaces) {
+                out(`    • ${w.key}  (${w.routes ?? 0} routes, ${w.services ?? 0} services)${w.key === cfg.key ? '   ← this workspace' : ''}`);
+            }
+        };
+        if (alive) {
+            // This workspace's own pid owns :443 → it IS the daemon (it may be hosting other workspaces too).
+            out(`gateway: running (pid ${pid}) — DAEMON on :443${healed ? ' — recovered a stale pid file' : ''}`);
+            out(`  workspace → ${cfg.key}`);
+            out(`  dashboard → ${dashUrl}`);
+            out(`  chooser   → https://lensmcp.local/`);
+            out(`  logs      → ${logFile}`);
+            printWorkspaces();
+            return { exitCode: 0 };
+        }
+        // Not our own gateway — but are we a GUEST registered into a shared daemon someone else owns?
+        if (existsSync(registeredMarker) && listRes?.status === 200) {
+            const host = pidsOnPort443()[0];
+            out(`gateway: registered into a shared daemon${host !== undefined ? ` (pid ${host})` : ''} — this workspace is a guest`);
+            out(`  workspace → ${cfg.key}`);
+            out(`  dashboard → ${dashUrl}`);
+            out('  stop      → `lensmcp gateway stop` (unregisters; the daemon keeps running)');
+            printWorkspaces();
+            return { exitCode: 0 };
+        }
+        out('gateway: stopped');
         out(`  workspace → ${cfg.key}`);
         out(`  dashboard → ${dashUrl}`);
-        if (alive)
-            out(`  logs      → ${logFile}`);
-        return { exitCode: alive ? 0 : 1 };
+        return { exitCode: 1 };
     };
     switch (sub) {
         case 'start':
@@ -572,6 +624,33 @@ function waitForPortFree(timeoutMs) {
         spawnSync('sleep', ['0.15']);
     }
 }
+/** Probe whether the cert served for `host` is trusted by the SYSTEM store — the ACCURATE check for a
+ *  daemon-served workspace (whose OWN local CA is unused, so `trust`'s file-based verify falsely says "NOT
+ *  TRUSTED"). Sync via curl: `ssl_verify_result` 0 + a completed handshake = trusted; a non-0 verify = the
+ *  cert was rejected; otherwise the host was unreachable. */
+function probeHostTrust(host) {
+    const r = spawnSync('curl', ['-s', '-o', '/dev/null', '-m', '8', '-w', '%{ssl_verify_result}', `https://${host}/`], { encoding: 'utf8' });
+    const verify = (r.stdout ?? '').trim();
+    if (r.status === 0 && verify === '0')
+        return 'trusted';
+    if (verify && verify !== '0')
+        return 'untrusted';
+    return 'unknown';
+}
+/** The first non-wildcard `cluster.host` declared in the workspace — a workspace-specific host to
+ *  trust-probe (better than the shared `lensmcp.local`, which both workspaces route). */
+function firstClusterHost(cwd) {
+    for (const file of walkProjectFiles(cwd, (n) => n === 'project.json')) {
+        try {
+            const raw = JSON.parse(readFileSync(file, 'utf8'));
+            const h = (raw.cluster ?? raw.davnx)?.host;
+            if (h && !h.includes('*'))
+                return h;
+        }
+        catch { /* skip unreadable project.json */ }
+    }
+    return undefined;
+}
 function rmFile(path) {
     try {
         if (existsSync(path))
@@ -674,15 +753,40 @@ function runTrust(ctx, args, out, err) {
         return { exitCode: 1 };
     }
     const target = findTrustTarget(cwd, stringFlag(opts.flags['--project']), stringFlag(opts.flags['--target']));
+    // Daemon-awareness: if a shared daemon owns :443 and this workspace is a GUEST (its gateway isn't the one
+    // on :443), the daemon serves every host with ITS (already-trusted) CA — this workspace's own CA is unused.
+    // The full trust here would mint a pointless second CA and, worse, report "NOT TRUSTED YET" from verifying
+    // that unused CA file (the papercut). So run HOSTS-ONLY (/etc/hosts + DNS) and report the REAL served-cert
+    // trust instead.
+    const guestOfDaemon = daemonRequest('GET', '/list')?.status === 200 && gatewayOnPort443(cwd) === undefined;
     if (!isInteractive()) {
         out('  note: trust runs `sudo` for the CA + /etc/hosts — run it in a real terminal if a step is needed.');
     }
-    out(`> ${nxBin} run ${target.project}:${target.target}   (sudo prompts inline for the CA + /etc/hosts)`);
+    if (guestOfDaemon) {
+        out('  a shared gateway daemon serves this workspace — TLS rides ITS (already-trusted) CA, not a separate');
+        out("  one here. Setting up /etc/hosts only (trusting the CA is the DAEMON workspace's job).");
+    }
+    out(`> ${nxBin} run ${target.project}:${target.target}   (sudo prompts inline for ${guestOfDaemon ? '/etc/hosts' : 'the CA + /etc/hosts'})`);
     const result = spawnSync(nxBin, ['run', `${target.project}:${target.target}`], {
         cwd,
         stdio: 'inherit',
-        env: { ...process.env, ...(ctx.env ?? {}) },
+        env: { ...process.env, ...(ctx.env ?? {}), ...(guestOfDaemon ? { LENSMCP_TRUST_HOSTS_ONLY: '1' } : {}) },
     });
+    // For a guest the executor's own (file-based, misleading) CA check is suppressed — report the ACCURATE
+    // trust of the daemon's SERVED cert via a real system-store TLS probe, so the verdict is truthful.
+    if (guestOfDaemon && result.status === 0) {
+        const host = firstClusterHost(cwd);
+        if (host) {
+            const verdict = probeHostTrust(host);
+            out('');
+            if (verdict === 'trusted')
+                out(`  ✓ ${host} → served by the daemon with a TRUSTED cert — you're set (restart the browser once if it cached an error).`);
+            else if (verdict === 'untrusted')
+                out(`  ✗ ${host} → the daemon's cert is NOT trusted yet. Run \`lensmcp trust\` in the DAEMON workspace (it owns the CA), then restart your browser.`);
+            else
+                out(`  ? ${host} → couldn't reach it to verify (is the daemon running?). /etc/hosts is set; TLS rides the daemon's CA.`);
+        }
+    }
     return { exitCode: result.status ?? 1 };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lensmcp",
-  "version": "1.16.19",
+  "version": "1.16.20",
   "type": "module",
   "main": "./index.js",
   "module": "./index.js",
@@ -17,7 +17,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "^1.4.1",
+    "@frontmcp/sdk": "^1.5.4",
     "reflect-metadata": "^0.2.2",
     "tslib": "^2.3.0",
     "vectoriadb": "^2.2.0"

package/plugin/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "lensmcp",
   "displayName": "LensMCP",
   "description": "The observability lens for coding agents. One command brings up the dev cluster gateway (every project.json `cluster` decl → its host on :443), the per-project lens dashboard at https://lensmcp.local/<project>/, and the MCP server your agent connects to — scoped automatically to whatever project you opened Claude Code in.",
-  "version": "1.16.19",
+  "version": "1.16.20",
   "author": {
     "name": "David Antoon",
     "email": "davidmantoon@gmail.com"