lensmcp 1.16.28 → 1.16.30

package/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAqFD,wBAAsB,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA4ChE;AA0lBD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnE;;;;;;;;iFAQiF;AACjF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,CAItB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AA6FD,wBAAsB,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA4ChE;AAynBD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnE;;;;;;;;iFAQiF;AACjF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,CAItB"}

package/lib/cli.js

@@ -2,7 +2,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { request as httpRequest } from 'node:http';
 import { homedir, tmpdir } from 'node:os';
-import { basename, dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ensureLensConfig } from './workspace-scope.js';
 const HELP = `lensmcp — CLI for LensMCP (FrontMCP-based observability for coding agents)
@@ -12,10 +12,16 @@ Usage:
 
 Commands:
   setup [--cwd <dir>] [--skip-format] [--register-host-config <mode>]
-                       First-time bootstrap — runs \`install\` then \`trust\` in
+                       First-time bootstrap — \`install\` → \`trust\` → \`pods\` in
                        one idempotent pass: plugin + .mcp.json + nx config +
                        vite/nest wiring, then the dev CA (System keychain),
-                       /etc/hosts (both families) + DNS flush. sudo self-prompts
+                       /etc/hosts (both families) + DNS flush, then a recycle of
+                       THIS workspace's devserver pods (they would otherwise keep
+                       serving the wiring setup just replaced) plus a gateway
+                       reconcile — nx graph refresh, adopt an orphaned :443,
+                       register this workspace into a running daemon. A running
+                       gateway is NEVER restarted (the :443 door is shared) and
+                       other workspaces' pods are never touched. sudo self-prompts
                        only for the steps that need it — run in a real terminal.
                        Then \`lensmcp gateway start\`.
   mcp [--cwd <dir>] [--transport stdio|http] [--port <n>]
@@ -68,14 +74,16 @@ Commands:
                        promote, abort, add-rule, remove-rule, status. Validated +
                        atomic write; the prod gateway picks it up live. Run
                        \`lensmcp rollout\` (no args) for the op list.
-  logs [service] [--tail <n>] [--no-follow] [--plain] [--cwd <dir>]
+  logs [service] [--tail <n>] [--no-follow] [--plain] [--color] [--cwd <dir>]
                        Attach this terminal to a running service's live log
                        stream (docker-logs style — for humans and agents alike).
                        No <service> lists every attachable service across
                        workspaces. --tail <n> replays that many history lines
                        first (default 100); --no-follow prints them and exits
                        (the agent-friendly snapshot); --plain strips ANSI color
-                       (automatic when output is piped). Needs no ports — it
+                       (automatic when output is piped); --color FORCES color
+                       through a pipe — for consumers that RENDER ANSI, like
+                       the IDE plugin's Logs console. Needs no ports — it
                        finds the devserver's control socket under $TMPDIR.
   debug <service> [--port <base>] [--cwd <dir>]
                        Open every pod's Node inspector of a RUNNING service —
@@ -239,6 +247,15 @@ function daemonRequest(method, urlPath, body) {
     catch { /* non-JSON body */ }
     return Number.isFinite(status) ? { status, json } : null;
 }
+/** The workspace key that OWNS the running daemon (undefined when no daemon answers) — used to name the
+ *  workspace a guest must run privileged/workspace-scoped work (`trust`) in. */
+function daemonWsKey() {
+    const s = daemonRequest('GET', '/status');
+    if (s?.status !== 200 || !s.json || typeof s.json !== 'object')
+        return undefined;
+    const d = s.json.daemon;
+    return typeof d?.wsKey === 'string' && d.wsKey.length > 0 ? d.wsKey : undefined;
+}
 /** The nx projects map (name → workspace-relative root) for cluster discovery — built by scanning
  *  project.json files, the same walk `findGatewayTarget` uses. Sent to the daemon so it can `discoverRoutes`
  *  this workspace when it registers. */
@@ -336,8 +353,17 @@ function runGateway(ctx, args, out, err) {
         }
         const target = findGatewayTarget(cwd, stringFlag(opts.flags['--project']), stringFlag(opts.flags['--target']));
         if (!target) {
-            err('Could not find a gateway target (an executor `@lensmcp/cluster:gateway`) in this workspace.\n' +
-                'Pass --project <p> --target <t>, or add a gateway project (see @lensmcp/cluster).');
+            // This workspace hosts no gateway of its own. That is a NORMAL state for a guest workspace — it just
+            // means there is nothing on :443 to join right now. Say what to actually do, in order of likelihood,
+            // instead of only naming the two flags (the papercut the IDE plugin surfaced verbatim).
+            err(`This workspace ('${cfg.key}') has no gateway target — no project declares the`);
+            err('`@lensmcp/cluster:gateway` executor, so there is nothing here to launch on :443.');
+            err('');
+            err('  • Joining a shared gateway? Start it in the workspace that OWNS it, then run');
+            err('    `lensmcp gateway start` here — this workspace registers into it (no local target needed).');
+            err('  • Should this workspace host its own gateway? Scaffold it: `lensmcp install`');
+            err('    (or `lensmcp setup` for the full install + trust bootstrap).');
+            err('  • Already have a differently-named target? `lensmcp gateway start --project <p> --target <t>`.');
             return { exitCode: 1 };
         }
         const nxBin = findNxBinary(cwd);
@@ -586,14 +612,34 @@ function findGatewayTarget(cwd, project, target) {
     // Sensible fallback used by most workspaces (tetros: tools/gateway → `gateway:serve`).
     return project || target ? { project: project ?? 'gateway', target: target ?? 'serve' } : undefined;
 }
-/** Find a project + target whose executor is `@lensmcp/cluster:trust`. Falls back
- *  unconditionally to `gateway:trust` — the conventional home the init generator
- *  scaffolds — since trust is idempotent and safe to attempt anywhere. */
+/**
+ * Find a project + target whose executor is `@lensmcp/cluster:trust`. Falls back to `gateway:trust` — the
+ * conventional home the init generator scaffolds — but ONLY when a project named `gateway` actually exists
+ * (an explicit `--project` is always taken at face value). The old unconditional fallback made `trust` in a
+ * workspace that never ran `lensmcp install` shell out to `nx run gateway:trust` and die on Nx's opaque
+ * "Cannot find project 'gateway'"; returning undefined lets the caller say what to do instead.
+ */
 function findTrustTarget(cwd, project, target) {
-    return (scanExecutorTarget(cwd, '@lensmcp/cluster:trust', project, target) ?? {
-        project: project ?? 'gateway',
-        target: target ?? 'trust',
-    });
+    const found = scanExecutorTarget(cwd, '@lensmcp/cluster:trust', project, target);
+    if (found)
+        return found;
+    if (project)
+        return { project, target: target ?? 'trust' };
+    return projectExists(cwd, 'gateway') ? { project: 'gateway', target: target ?? 'trust' } : undefined;
+}
+/** Does a project of this name exist in the workspace? (project.json-declared, like every other scan here.) */
+function projectExists(cwd, name) {
+    for (const file of walkProjectFiles(cwd, (n) => n === 'project.json')) {
+        try {
+            const parsed = JSON.parse(safeRead(file));
+            if ((parsed.name ?? basename(dirname(file))) === name)
+                return true;
+        }
+        catch {
+            /* unreadable project.json — not a match */
+        }
+    }
+    return false;
 }
 function readPid(pidFile) {
     try {
@@ -867,6 +913,26 @@ function runTrust(ctx, args, out, err) {
     // that unused CA file (the papercut). So run HOSTS-ONLY (/etc/hosts + DNS) and report the REAL served-cert
     // trust instead.
     const guestOfDaemon = daemonRequest('GET', '/list')?.status === 200 && gatewayOnPort443(cwd) === undefined;
+    // No trust target anywhere in this workspace (never ran `lensmcp install`). Trust is workspace-scoped work
+    // — minting the CA and writing /etc/hosts for THIS workspace's cluster hosts — so there is nothing to run
+    // here. Say which workspace owns the CA instead of failing inside Nx with "Cannot find project 'gateway'".
+    if (!target) {
+        err(`This workspace has no trust target — no project declares the \`@lensmcp/cluster:trust\` executor.`);
+        err('');
+        if (guestOfDaemon) {
+            const owner = daemonWsKey();
+            err(`  A shared gateway daemon${owner ? ` (owned by '${owner}')` : ''} already serves this workspace, and`);
+            err('  TLS rides ITS certificate authority. Run `lensmcp trust` in THAT workspace — it owns the CA —');
+            err('  and this workspace is trusted too (restart the browser once if it cached a cert error).');
+        }
+        else {
+            err('  • Should this workspace own its gateway (and its CA)? Scaffold it first: `lensmcp install`,');
+            err('    then re-run `lensmcp trust`.');
+            err('  • Joining a shared gateway? Run `lensmcp trust` in the workspace that owns the daemon.');
+        }
+        err('  • Already have a differently-named target? `lensmcp trust --project <p> --target <t>`.');
+        return { exitCode: 1 };
+    }
     if (!isInteractive()) {
         out('  note: trust runs `sudo` for the CA + /etc/hosts — run it in a real terminal if a step is needed.');
     }
@@ -920,8 +986,10 @@ function writeSetupState(cwd) {
 }
 /**
  * `lensmcp setup` — first-time bootstrap. Runs `install` (plugin + .mcp.json +
- * nx config + vite/nest wiring, no sudo) then `trust` (dev CA → keychain,
- * /etc/hosts, DNS flush, sudo). Both steps are idempotent, so re-running is safe.
+ * nx config + vite/nest wiring, no sudo), then `trust` (dev CA → keychain,
+ * /etc/hosts, DNS flush, sudo), then `pods` — which recycles this workspace's
+ * devservers and reconciles the gateway, so nothing keeps serving the wiring
+ * that setup just replaced. Every step is idempotent, so re-running is safe.
  * Flags are forwarded to whichever sub-command understands them (`--skip-format`,
  * `--register-host-config` → install; `--project`/`--target` → trust).
  */
@@ -929,9 +997,9 @@ function runSetup(ctx, args, out, err) {
     const opts = parseFlags(args, { string: ['--cwd'] });
     const cwd = resolve(stringFlag(opts.flags['--cwd']) ?? ctx.cwd);
     const subCtx = { ...ctx, cwd };
-    out('lensmcp setup — first-time bootstrap (install → trust)');
+    out('lensmcp setup — first-time bootstrap (install → trust → pods)');
     out('');
-    out('[1/2] install — plugin, .mcp.json, nx config, vite/nest wiring');
+    out('[1/3] install — plugin, .mcp.json, nx config, vite/nest wiring');
     const installRes = runInstall(subCtx, args, out, err);
     if (installRes.exitCode !== 0) {
         err('');
@@ -939,17 +1007,31 @@ function runSetup(ctx, args, out, err) {
         return installRes;
     }
     out('');
-    out('[2/2] trust — dev CA → System keychain, /etc/hosts, DNS flush (sudo)');
+    out('[2/3] trust — dev CA → System keychain, /etc/hosts, DNS flush (sudo)');
     const trustRes = runTrust(subCtx, args, out, err);
     if (trustRes.exitCode !== 0) {
         err('');
         err('setup: the trust step failed — run `lensmcp setup` directly in a terminal so sudo can prompt.');
         return trustRes;
     }
-    // Both steps succeeded → mark the workspace set up for this version (opens the MCP gate).
+    // Install + trust rewrote this workspace's wiring, but a devserver that has been up since before it
+    // changed goes on serving the OLD bundle from its pooled pods — the "setup said ✓ but the app is
+    // unchanged" trap. Recycle them, then put the gateway back in line with reality WITHOUT restarting it
+    // (the :443 door is shared: bouncing it would take every other workspace down with this one).
+    out('');
+    out("[3/3] pods — recycle this workspace's devservers, reconcile the gateway");
+    const key = ensureLensConfig(cwd).key;
+    const reaped = reapWorkspacePods(cwd, key, out);
+    reconcileGatewayAfterSetup(subCtx, cwd, key, out);
+    // All steps succeeded → mark the workspace set up for this version (opens the MCP gate).
     writeSetupState(cwd);
     out('');
     out('✓ setup complete.');
+    if (reaped.killed > 0 || reaped.stale > 0) {
+        out(`  recycled ${reaped.killed} pod${reaped.killed === 1 ? '' : 's'}` +
+            (reaped.stale > 0 ? ` (+${reaped.stale} stale socket${reaped.stale === 1 ? '' : 's'} cleared)` : '') +
+            ' — they come back on the new wiring.');
+    }
     out('  next:   lensmcp gateway start      (the :443 front door — needs sudo)');
     out('  verify: lensmcp doctor');
     return { exitCode: 0 };
@@ -1309,6 +1391,179 @@ function discoverDevserverSocks() {
     return found.sort((a, b) => `${a.wsKey}/${a.service}`.localeCompare(`${b.wsKey}/${b.service}`));
 }
 const fullServiceName = (d) => (d.wsKey ? `${d.wsKey}/${d.service}` : d.service);
+/* ───────── pod recycling (the `setup` reap) ─────────
+ * A devserver is a PARENT process holding `parent.sock` plus N forked child pods. Killing the parent is
+ * enough for the pods — they exit on the IPC `disconnect` (main.devserver.ts's ORPHAN GUARD) and unlink
+ * their own sockets. But the gateway spawns each service `detached: true` with `NX_DAEMON=false`, so the
+ * whole service — the `nx run` shim, the devserver, the pods — sits in ONE process group of its own; group-
+ * killing that reaps the shim too, which a lone parent kill would leave behind (the documented "nx wrapper
+ * outlives its child" leak). Hence: kill the group when we can prove it's the service's own, else the pid. */
+/** The pid holding a unix socket (best-effort via lsof; undefined = the socket is stale litter). */
+function pidOnSocket(sock) {
+    try {
+        const r = spawnSync('lsof', ['-t', sock], { encoding: 'utf8' });
+        const pid = Number((r.stdout ?? '').split('\n')[0]?.trim());
+        return Number.isInteger(pid) && pid > 0 ? pid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A process's group id (undefined when it's gone or `ps` is unavailable). */
+function pgidOf(pid) {
+    try {
+        const r = spawnSync('ps', ['-o', 'pgid=', '-p', String(pid)], { encoding: 'utf8' });
+        const pgid = Number((r.stdout ?? '').trim());
+        return Number.isInteger(pgid) && pgid > 1 ? pgid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A process's working directory — how an UN-NAMESPACED devserver (a plain `nx serve`, no LENSMCP_WS_KEY)
+ *  gets attributed to a workspace. Undefined when it can't be read, and an unattributable pod is left
+ *  alone: it belongs to somebody else until proven otherwise. */
+function cwdOfPid(pid) {
+    try {
+        const r = spawnSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], { encoding: 'utf8' });
+        const line = (r.stdout ?? '').split('\n').find((l) => l.startsWith('n'));
+        return line ? line.slice(1).trim() || undefined : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `child` the same path as, or inside, `parent`? */
+function isInside(parent, child) {
+    const rel = relative(resolve(parent), resolve(child));
+    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+/** Every devserver under $TMPDIR that belongs to the workspace rooted at `cwd`. A namespaced sock dir
+ *  (`$TMPDIR/<wsKey>/…`) is attributed by its key; a legacy un-namespaced one by its owner's cwd. */
+function workspaceDevservers(cwd, key) {
+    return discoverDevserverSocks().filter((d) => {
+        if (d.wsKey)
+            return d.wsKey === key;
+        const pid = pidOnSocket(d.sock);
+        const owner = pid !== undefined ? cwdOfPid(pid) : undefined;
+        return owner !== undefined && isInside(cwd, owner);
+    });
+}
+/**
+ * Stop every devserver of THIS workspace and clear its socket dir, so the next boot comes up on the
+ * freshly installed wiring instead of a pod that has been running since before it changed.
+ *
+ * Safe next to a live gateway: it marks a vanished service `down` and either self-heals it or scales it
+ * from zero on the next request, so the front door keeps serving while the pods come back new. NEVER
+ * group-kills a group it can't prove is the service's own — a mis-derived group would take down the
+ * gateway (or this CLI) with it.
+ */
+function reapWorkspacePods(cwd, key, out) {
+    const mine = workspaceDevservers(cwd, key);
+    if (mine.length === 0) {
+        out('  no devserver pods running for this workspace — nothing to recycle.');
+        return { killed: 0, stale: 0 };
+    }
+    // Groups we must never signal: our own, and whatever holds :443 (the gateway must survive this).
+    const forbidden = new Set();
+    for (const p of [process.pid, ...pidsOnPort443()]) {
+        const g = pgidOf(p);
+        if (g !== undefined)
+            forbidden.add(g);
+    }
+    let killed = 0;
+    let stale = 0;
+    for (const d of mine) {
+        const name = fullServiceName(d);
+        const pid = pidOnSocket(d.sock);
+        if (pid === undefined) {
+            rmFile(d.sock);
+            out(`  ✓ ${name} — stale socket removed (no process held it)`);
+            stale++;
+            continue;
+        }
+        const group = pgidOf(pid);
+        const groupKillable = group !== undefined && !forbidden.has(group);
+        const signal = (sig) => {
+            try {
+                if (groupKillable)
+                    process.kill(-group, sig);
+                else
+                    process.kill(pid, sig); // pods follow the parent out via the IPC disconnect guard
+            }
+            catch {
+                /* already gone */
+            }
+        };
+        signal('SIGTERM');
+        // Give the tree a moment to unwind gracefully (the devserver closes its pods' IPC, they unlink their
+        // own sockets), then escalate — a wedged child must not survive the recycle.
+        if (!waitForPidGone(pid, 5000)) {
+            signal('SIGKILL');
+            waitForPidGone(pid, 2000);
+        }
+        rmFile(d.sock);
+        out(`  ✓ ${name} — stopped (pid ${pid}${groupKillable ? `, group ${group}` : ', parent only'})`);
+        killed++;
+    }
+    return { killed, stale };
+}
+/** Poll until `pid` is gone or the timeout elapses. Synchronous — a setup step, not a hot path. */
+function waitForPidGone(pid, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (!isAlive(pid))
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        spawnSync('sleep', ['0.15']);
+    }
+}
+/**
+ * Bring the gateway back in line with reality WITHOUT restarting a running one — a `setup` must never take
+ * the shared `:443` front door (and every other workspace on it) down. It:
+ *   • adopts an orphaned gateway the pid file lost track of (the desync self-heal);
+ *   • busts the nx project graph, so the projects `install` just wired resolve instead of 404ing out of a
+ *     daemon whose graph predates them;
+ *   • registers this workspace into a daemon someone else owns, when it isn't in there yet.
+ * An already-registered workspace is left alone: re-registering makes the daemon tear down and respawn its
+ * services and dashboard for nothing.
+ */
+function reconcileGatewayAfterSetup(ctx, cwd, key, out) {
+    const pidFile = join(cwd, '.lensmcp', 'gateway.pid');
+    const registeredMarker = join(cwd, '.lensmcp', 'registered.json');
+    const { pid, healed } = reconcileGateway(pidFile, cwd);
+    if (healed)
+        out(`  healed: adopted a running gateway (pid ${pid}) the pid file had lost.`);
+    refreshNxGraph(cwd, ctx.env, (l) => out(` ${l}`));
+    const owned = gatewayOnPort443(cwd) !== undefined;
+    if (owned) {
+        out(`  gateway: this workspace owns the :443 daemon (pid ${pid ?? '?'}) — left running, pods respawn fresh.`);
+        return;
+    }
+    const list = daemonRequest('GET', '/list');
+    if (list?.status !== 200) {
+        out('  gateway: not running. Start it when you are ready:  lensmcp gateway start');
+        return;
+    }
+    const registered = list.json && typeof list.json === 'object'
+        ? (list.json.workspaces ?? []).some((w) => w.key === key)
+        : false;
+    if (registered) {
+        mkdirSync(dirname(registeredMarker), { recursive: true });
+        writeFileSync(registeredMarker, JSON.stringify({ wsKey: key }));
+        out(`  gateway: '${key}' is already registered into the shared daemon — left serving.`);
+        return;
+    }
+    const res = daemonRequest('POST', '/register', { wsKey: key, root: cwd, projects: buildProjectsMap(cwd) });
+    if (res && res.status === 200) {
+        mkdirSync(dirname(registeredMarker), { recursive: true });
+        writeFileSync(registeredMarker, JSON.stringify({ wsKey: key }));
+        out(`  gateway: registered '${key}' into the shared daemon — it now hosts this workspace.`);
+        return;
+    }
+    out('  gateway: a shared daemon is up but registering this workspace failed — run `lensmcp gateway start`.');
+}
 /** Resolve a service argument (`name` or `wsKey/name`) to ONE control socket. A bare
  *  name running in several workspaces is disambiguated by the current workspace's key.
  *  Prints the helpful error itself and returns null when nothing (or too much) matches. */
@@ -1340,7 +1595,7 @@ function resolveServiceSock(service, all, cwd, err) {
 async function runLogs(ctx, args, out, err) {
     const opts = parseFlags(args, {
         string: ['--tail', '--cwd'],
-        boolean: ['--no-follow', '--plain'],
+        boolean: ['--no-follow', '--plain', '--color'],
     });
     const service = opts.positional[0];
     const all = discoverDevserverSocks();
@@ -1362,7 +1617,11 @@ async function runLogs(ctx, args, out, err) {
     const follow = opts.flags['--no-follow'] !== true;
     const tailRaw = Number(stringFlag(opts.flags['--tail']) ?? NaN);
     const tail = Number.isInteger(tailRaw) && tailRaw >= 0 ? tailRaw : 100; // 0 = live-only, no history
-    const plain = opts.flags['--plain'] === true || !process.stdout.isTTY;
+    // ANSI is stripped when the output is piped — EXCEPT for a consumer that renders it and says so with
+    // `--color` (the IDE plugin's Logs console runs through a pipe, and plain-stripped output is exactly the
+    // unreadable wall of text the colored stream avoids). Explicit `--plain` still wins.
+    const plain = opts.flags['--plain'] === true ||
+        (opts.flags['--color'] !== true && !process.stdout.isTTY);
     const reqPath = `/webpack/logs?tail=${tail}&follow=${follow ? 1 : 0}${plain ? '&plain=1' : ''}`;
     return new Promise((done) => {
         const req = httpRequest({ socketPath: target.sock, path: reqPath, method: 'GET' }, (res) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lensmcp",
-  "version": "1.16.28",
+  "version": "1.16.30",
   "type": "module",
   "main": "./index.js",
   "module": "./index.js",

package/plugin/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "lensmcp",
   "displayName": "LensMCP",
   "description": "The observability lens for coding agents. One command brings up the dev cluster gateway (every project.json `cluster` decl → its host on :443), the per-project lens dashboard at https://lensmcp.local/<project>/, and the MCP server your agent connects to — scoped automatically to whatever project you opened Claude Code in.",
-  "version": "1.16.28",
+  "version": "1.16.30",
   "author": {
     "name": "David Antoon",
     "email": "davidmantoon@gmail.com"