lensmcp 1.16.29 → 1.16.31

package/bundled/bridge.js

@@ -3733,7 +3733,74 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 // libs/bridge/src/lib/env-sink.ts
 import { connect } from "node:net";
 import { createSocket } from "node:dgram";
-import { appendFileSync } from "node:fs";
+import { appendFileSync, renameSync, statSync, unlinkSync } from "node:fs";
+var MAX_EVENT_BYTES = (() => {
+  const n = Number(process.env["LENSMCP_EVENT_MAX_BYTES"]);
+  return Number.isFinite(n) && n > 0 ? n : 50 * 1024 * 1024;
+})();
+var MAX_EVENT_FILES = (() => {
+  const n = Number(process.env["LENSMCP_EVENT_MAX_FILES"]);
+  return Number.isFinite(n) && n >= 1 && n <= 20 ? Math.floor(n) : 5;
+})();
+var ROTATE_CHECK_BYTES = 1024 * 1024;
+var bytesSinceCheck = 0;
+function rotateIfLarge(file, addedBytes) {
+  bytesSinceCheck += addedBytes;
+  if (bytesSinceCheck < ROTATE_CHECK_BYTES) return;
+  bytesSinceCheck = 0;
+  try {
+    if (statSync(file).size <= MAX_EVENT_BYTES) return;
+  } catch {
+    return;
+  }
+  try {
+    unlinkSync(`${file}.${MAX_EVENT_FILES}`);
+  } catch {
+  }
+  for (let gen = MAX_EVENT_FILES - 1; gen >= 1; gen--) {
+    try {
+      renameSync(`${file}.${gen}`, `${file}.${gen + 1}`);
+    } catch {
+    }
+  }
+  try {
+    renameSync(file, `${file}.1`);
+  } catch {
+  }
+}
+var FLOOD_PER_SEC = (() => {
+  const raw = process.env["LENSMCP_EVENT_MAX_EPS"];
+  if (raw === "off") return Infinity;
+  const n = Number(raw);
+  if (raw !== void 0 && raw !== "" && Number.isFinite(n)) return n <= 0 ? Infinity : n;
+  return 5;
+})();
+var FLOOD_BURST = Math.max(30, FLOOD_PER_SEC === Infinity ? 0 : FLOOD_PER_SEC * 4);
+var floodBuckets = /* @__PURE__ */ new Map();
+function floodAdmit(fingerprint2) {
+  if (FLOOD_PER_SEC === Infinity) return 0;
+  const now = Date.now();
+  let b = floodBuckets.get(fingerprint2);
+  if (!b) {
+    if (floodBuckets.size >= 2048) {
+      for (const [k, v] of floodBuckets) if (now - v.lastSeenAt > 6e4) floodBuckets.delete(k);
+      if (floodBuckets.size >= 2048) floodBuckets.clear();
+    }
+    b = { tokens: FLOOD_BURST, lastRefillAt: now, suppressed: 0, lastSeenAt: now };
+    floodBuckets.set(fingerprint2, b);
+  }
+  b.lastSeenAt = now;
+  b.tokens = Math.min(FLOOD_BURST, b.tokens + (now - b.lastRefillAt) / 1e3 * FLOOD_PER_SEC);
+  b.lastRefillAt = now;
+  if (b.tokens >= 1) {
+    b.tokens -= 1;
+    const suppressed = b.suppressed;
+    b.suppressed = 0;
+    return suppressed;
+  }
+  b.suppressed += 1;
+  return -1;
+}
 var cachedEnvSink;
 function resolveEnvSink() {
   if (cachedEnvSink !== void 0) return cachedEnvSink;
@@ -3741,7 +3808,13 @@ function resolveEnvSink() {
   if (filePath) {
     cachedEnvSink = (event) => {
       try {
-        appendFileSync(filePath, JSON.stringify(event) + "\n");
+        const suppressed = floodAdmit(event.fingerprint);
+        if (suppressed < 0) return;
+        const line = JSON.stringify(
+          suppressed > 0 ? { ...event, raw: { ...event.raw ?? {}, floodSuppressed: suppressed } } : event
+        ) + "\n";
+        rotateIfLarge(filePath, line.length);
+        appendFileSync(filePath, line);
       } catch {
       }
     };

package/bundled/capture-runner.js

@@ -33558,7 +33558,7 @@ var require_chrome_remote_interface = __commonJS({
 });
 
 // libs/browser-capture/src/capture-runner.ts
-import { appendFileSync, readFileSync, renameSync, statSync } from "node:fs";
+import { appendFileSync, readFileSync, renameSync, statSync, unlinkSync } from "node:fs";
 
 // libs/core/dist/lib/ulid.js
 var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -33826,6 +33826,7 @@ function planOrphanReap(psLines, isOwnerAlive, selfPid) {
 function reapOrphanCaptureChrome(log) {
   if (process.platform === "win32")
     return 0;
+  let reaped = 0;
   let out;
   try {
     out = execFileSync2("ps", ["ax", "-ww", "-o", "pid=,command="], {
@@ -33834,20 +33835,33 @@ function reapOrphanCaptureChrome(log) {
       maxBuffer: 64 * 1024 * 1024
     });
   } catch {
-    return 0;
   }
-  let reaped = 0;
-  for (const orphan of planOrphanReap(out.split("\n"), isAlive, process.pid)) {
-    try {
-      process.kill(orphan.pid, "SIGKILL");
-      reaped += 1;
-      log?.(`[browser-capture] reaped orphaned capture Chrome pid=${orphan.pid} (owner ${orphan.ownerPid} is gone)`);
-    } catch {
+  if (out !== void 0) {
+    for (const orphan of planOrphanReap(out.split("\n"), isAlive, process.pid)) {
+      try {
+        process.kill(orphan.pid, "SIGKILL");
+        reaped += 1;
+        log?.(`[browser-capture] reaped orphaned capture Chrome pid=${orphan.pid} (owner ${orphan.ownerPid} is gone)`);
+      } catch {
+      }
+      removeUserDataDir(orphan.userDataDir);
     }
-    removeUserDataDir(orphan.userDataDir);
   }
+  sweepStaleMarkerDirs();
   return reaped;
 }
+function sweepStaleMarkerDirs() {
+  const ownerRe = new RegExp(`^${CAPTURE_DIR_MARKER}(\\d+)-`);
+  try {
+    for (const entry of readdirSync(tmpdir())) {
+      const owner = Number(ownerRe.exec(entry)?.[1]);
+      if (!Number.isFinite(owner) || owner === process.pid || isAlive(owner))
+        continue;
+      removeUserDataDir(join2(tmpdir(), entry));
+    }
+  } catch {
+  }
+}
 function isAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -34883,7 +34897,11 @@ reapOrphanCaptureChrome((m) => console.error(m));
 setInterval(() => reapOrphanCaptureChrome((m) => console.error(m)), 6e4).unref();
 var MAX_EVENT_BYTES = (() => {
   const n = Number(process.env["LENSMCP_EVENT_MAX_BYTES"]);
-  return Number.isFinite(n) && n > 0 ? n : 256 * 1024 * 1024;
+  return Number.isFinite(n) && n > 0 ? n : 50 * 1024 * 1024;
+})();
+var MAX_EVENT_FILES = (() => {
+  const n = Number(process.env["LENSMCP_EVENT_MAX_FILES"]);
+  return Number.isFinite(n) && n >= 1 && n <= 20 ? Math.floor(n) : 5;
 })();
 var ROTATE_CHECK_BYTES = 1024 * 1024;
 var bytesSinceCheck = 0;
@@ -34892,7 +34910,22 @@ function rotateIfLarge(file, lineBytes) {
   if (bytesSinceCheck < ROTATE_CHECK_BYTES) return;
   bytesSinceCheck = 0;
   try {
-    if (statSync(file).size > MAX_EVENT_BYTES) renameSync(file, `${file}.1`);
+    if (statSync(file).size <= MAX_EVENT_BYTES) return;
+  } catch {
+    return;
+  }
+  try {
+    unlinkSync(`${file}.${MAX_EVENT_FILES}`);
+  } catch {
+  }
+  for (let gen = MAX_EVENT_FILES - 1; gen >= 1; gen--) {
+    try {
+      renameSync(`${file}.${gen}`, `${file}.${gen + 1}`);
+    } catch {
+    }
+  }
+  try {
+    renameSync(file, `${file}.1`);
   } catch {
   }
 }

package/bundled/dashboard.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // servers/lensmcp-mcp/dist/dashboard.js
 import "reflect-metadata";
-import { readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { closeSync as closeSync2, openSync as openSync2, readdirSync, readFileSync as readFileSync2, readSync as readSync2, statSync as statSync2 } from "node:fs";
 import { createServer as createServer2 } from "node:http";
 
 // libs/core/dist/lib/ulid.js
@@ -352,6 +352,10 @@ function compileStory(events, options = {}) {
   if (pool.length === 0)
     return void 0;
   pool.sort((a, b) => a.timestamp - b.timestamp);
+  const MAX_STORY_EVENTS = 1e3;
+  if (pool.length > MAX_STORY_EVENTS) {
+    pool = [pool[0], ...pool.slice(pool.length - (MAX_STORY_EVENTS - 1))];
+  }
   const origin = pool[0];
   const phases = [];
   let finalRender;
@@ -16428,6 +16432,7 @@ var URI_CURRENT = "flow://current";
 var URI_ORIGINS = "flow://origins/recent";
 var MAX_FLOWS = 50;
 var MAX_ORIGINS = 50;
+var MAX_EVENTS_PER_FLOW = 2e3;
 function installFlowReducer(args) {
   const state2 = {
     flows: /* @__PURE__ */ new Map(),
@@ -16470,6 +16475,9 @@ function installFlowReducer(args) {
       void args.resources.markDirty(URI_ORIGINS);
     }
     entry.events.push(event);
+    if (entry.events.length > MAX_EVENTS_PER_FLOW) {
+      entry.events.splice(0, entry.events.length - MAX_EVENTS_PER_FLOW);
+    }
     entry.summary.eventCount += 1;
     entry.summary.lastSeenAt = event.timestamp;
     const idx = state2.recentOrder.indexOf(flowId);
@@ -17677,6 +17685,7 @@ NestApp = __decorate([
 var URI_PROVIDERS = "nest://providers";
 var URI_REQUESTS = "nest://requests/recent";
 var MAX_RECENT2 = 50;
+var MAX_PROVIDERS = 500;
 function installNestReducer(args) {
   const state2 = { providers: /* @__PURE__ */ new Map(), recentRequests: [] };
   const handler = (event) => {
@@ -17685,7 +17694,15 @@ function installNestReducer(args) {
     const raw = event.raw ?? null;
     if (raw?.kind === "singleton-instance" && raw.provider) {
       const p = raw.provider;
+      state2.providers.delete(p.instanceId);
       state2.providers.set(p.instanceId, { ...p });
+      if (state2.providers.size > MAX_PROVIDERS) {
+        for (const k of state2.providers.keys()) {
+          state2.providers.delete(k);
+          if (state2.providers.size <= MAX_PROVIDERS)
+            break;
+        }
+      }
       void args.resources.markDirty(URI_PROVIDERS);
       return;
     }
@@ -18582,6 +18599,7 @@ var URI_MEMOS_RECOMPUTED = "react://memos/recomputed";
 var URI_HOOKS_RECENT = "react://hooks/recent";
 var MAX_RECENT4 = 100;
 var MAX_SLOW2 = 50;
+var MAX_INSTANCES = 500;
 function installReactReducer(args) {
   const slowRenderMs = resolveThresholds(args.thresholds).slowRenderMs;
   const state2 = {
@@ -18605,7 +18623,15 @@ function installReactReducer(args) {
         if (!r)
           return;
         pushBounded3(state2.rendersRecent, r, MAX_RECENT4);
+        state2.rendersByInstance.delete(r.componentInstanceId);
         state2.rendersByInstance.set(r.componentInstanceId, r);
+        if (state2.rendersByInstance.size > MAX_INSTANCES) {
+          for (const k of state2.rendersByInstance.keys()) {
+            state2.rendersByInstance.delete(k);
+            if (state2.rendersByInstance.size <= MAX_INSTANCES)
+              break;
+          }
+        }
         if (r.actualDurationMs >= slowRenderMs) {
           pushBounded3(state2.rendersSlow, r, MAX_SLOW2);
           state2.rendersSlow.sort((a, b) => b.actualDurationMs - a.actualDurationMs);
@@ -18836,6 +18862,7 @@ var URI_UPDATES = "valtio://updates/recent";
 var URI_STORES = "valtio://stores";
 var URI_SUBSCRIBERS = "valtio://subscribers";
 var MAX_UPDATES = 100;
+var MAX_PATHS = 1e3;
 function installValtioReducer(args) {
   const state2 = {
     updates: [],
@@ -18859,7 +18886,16 @@ function installValtioReducer(args) {
         if (state2.updates.length > MAX_UPDATES) {
           state2.updates.splice(0, state2.updates.length - MAX_UPDATES);
         }
-        state2.latestUpdateByPath.set(`${u.storeId}::${u.path}`, rec);
+        const pathKey = `${u.storeId}::${u.path}`;
+        state2.latestUpdateByPath.delete(pathKey);
+        state2.latestUpdateByPath.set(pathKey, rec);
+        if (state2.latestUpdateByPath.size > MAX_PATHS) {
+          for (const k of state2.latestUpdateByPath.keys()) {
+            state2.latestUpdateByPath.delete(k);
+            if (state2.latestUpdateByPath.size <= MAX_PATHS)
+              break;
+          }
+        }
         void args.resources.markDirty(URI_UPDATES);
         return;
       }
@@ -19547,8 +19583,25 @@ var URI_CURRENT7 = "memory://current";
 var URI_OWNERS = "memory://owners";
 var URI_GROWING = "memory://owners/growing";
 var URI_LEAKS = "memory://leaks/suspected";
+var MAX_LEAKS = 200;
+var MAX_FLOWIDS_PER_OWNER = 50;
 function installMemoryReducer(args) {
   const state2 = { owners: /* @__PURE__ */ new Map(), leaks: [] };
+  const pushLeak = (leak) => {
+    state2.leaks.push(leak);
+    if (state2.leaks.length > MAX_LEAKS)
+      state2.leaks.splice(0, state2.leaks.length - MAX_LEAKS);
+  };
+  const noteFlow = (o, flowId) => {
+    o.flowIds.add(flowId);
+    if (o.flowIds.size > MAX_FLOWIDS_PER_OWNER) {
+      for (const id of o.flowIds) {
+        o.flowIds.delete(id);
+        if (o.flowIds.size <= MAX_FLOWIDS_PER_OWNER)
+          break;
+      }
+    }
+  };
   const ensure = (ownerId) => {
     let o = state2.owners.get(ownerId);
     if (!o) {
@@ -19579,7 +19632,7 @@ function installMemoryReducer(args) {
         o.estimatedBytes = raw.mutation.afterCount * 64;
         o.mutations += 1;
         if (event.context.flowId)
-          o.flowIds.add(event.context.flowId);
+          noteFlow(o, event.context.flowId);
         void args.resources.markDirty(URI_OWNERS);
         void args.resources.markDirty(URI_GROWING);
         return;
@@ -19587,7 +19640,7 @@ function installMemoryReducer(args) {
       case "memory-retention": {
         if (!raw.retention)
           return;
-        state2.leaks.push({
+        pushLeak({
           kind: "retention",
           ownerId: raw.retention.ownerId,
           flowId: raw.retention.flowId,
@@ -19600,7 +19653,7 @@ function installMemoryReducer(args) {
       case "singleton-stale-generation": {
         if (!raw.staleGeneration)
           return;
-        state2.leaks.push({
+        pushLeak({
           kind: "stale-generation",
           logicalId: raw.staleGeneration.logicalId,
           detail: { ...raw.staleGeneration },
@@ -20358,7 +20411,19 @@ session.bus.subscribe(appendLog);
 (() => {
   try {
     const file2 = process.env["LENSMCP_EVENT_FILE"] ?? `${process.cwd()}/.lensmcp/events.jsonl`;
-    const lines = readFileSync2(file2, "utf8").trim().split("\n").slice(-25e3);
+    const REPLAY_BYTES = 8 * 1024 * 1024;
+    const size = statSync2(file2).size;
+    const start = Math.max(0, size - REPLAY_BYTES);
+    const buf = Buffer.alloc(size - start);
+    const fd = openSync2(file2, "r");
+    try {
+      readSync2(fd, buf, 0, buf.length, start);
+    } finally {
+      closeSync2(fd);
+    }
+    const lines = buf.toString("utf8").trim().split("\n").slice(-25e3);
+    if (start > 0)
+      lines.shift();
     for (const line of lines) {
       try {
         const e = JSON.parse(line);

package/bundled/main.js

@@ -362,6 +362,10 @@ function compileStory(events, options = {}) {
   if (pool.length === 0)
     return void 0;
   pool.sort((a, b) => a.timestamp - b.timestamp);
+  const MAX_STORY_EVENTS = 1e3;
+  if (pool.length > MAX_STORY_EVENTS) {
+    pool = [pool[0], ...pool.slice(pool.length - (MAX_STORY_EVENTS - 1))];
+  }
   const origin = pool[0];
   const phases = [];
   let finalRender;
@@ -16430,6 +16434,7 @@ var URI_CURRENT = "flow://current";
 var URI_ORIGINS = "flow://origins/recent";
 var MAX_FLOWS = 50;
 var MAX_ORIGINS = 50;
+var MAX_EVENTS_PER_FLOW = 2e3;
 function installFlowReducer(args) {
   const state2 = {
     flows: /* @__PURE__ */ new Map(),
@@ -16472,6 +16477,9 @@ function installFlowReducer(args) {
       void args.resources.markDirty(URI_ORIGINS);
     }
     entry.events.push(event);
+    if (entry.events.length > MAX_EVENTS_PER_FLOW) {
+      entry.events.splice(0, entry.events.length - MAX_EVENTS_PER_FLOW);
+    }
     entry.summary.eventCount += 1;
     entry.summary.lastSeenAt = event.timestamp;
     const idx = state2.recentOrder.indexOf(flowId);
@@ -17679,6 +17687,7 @@ NestApp = __decorate([
 var URI_PROVIDERS = "nest://providers";
 var URI_REQUESTS = "nest://requests/recent";
 var MAX_RECENT2 = 50;
+var MAX_PROVIDERS = 500;
 function installNestReducer(args) {
   const state2 = { providers: /* @__PURE__ */ new Map(), recentRequests: [] };
   const handler = (event) => {
@@ -17687,7 +17696,15 @@ function installNestReducer(args) {
     const raw = event.raw ?? null;
     if (raw?.kind === "singleton-instance" && raw.provider) {
       const p = raw.provider;
+      state2.providers.delete(p.instanceId);
       state2.providers.set(p.instanceId, { ...p });
+      if (state2.providers.size > MAX_PROVIDERS) {
+        for (const k of state2.providers.keys()) {
+          state2.providers.delete(k);
+          if (state2.providers.size <= MAX_PROVIDERS)
+            break;
+        }
+      }
       void args.resources.markDirty(URI_PROVIDERS);
       return;
     }
@@ -18584,6 +18601,7 @@ var URI_MEMOS_RECOMPUTED = "react://memos/recomputed";
 var URI_HOOKS_RECENT = "react://hooks/recent";
 var MAX_RECENT4 = 100;
 var MAX_SLOW2 = 50;
+var MAX_INSTANCES = 500;
 function installReactReducer(args) {
   const slowRenderMs = resolveThresholds(args.thresholds).slowRenderMs;
   const state2 = {
@@ -18607,7 +18625,15 @@ function installReactReducer(args) {
         if (!r)
           return;
         pushBounded3(state2.rendersRecent, r, MAX_RECENT4);
+        state2.rendersByInstance.delete(r.componentInstanceId);
         state2.rendersByInstance.set(r.componentInstanceId, r);
+        if (state2.rendersByInstance.size > MAX_INSTANCES) {
+          for (const k of state2.rendersByInstance.keys()) {
+            state2.rendersByInstance.delete(k);
+            if (state2.rendersByInstance.size <= MAX_INSTANCES)
+              break;
+          }
+        }
         if (r.actualDurationMs >= slowRenderMs) {
           pushBounded3(state2.rendersSlow, r, MAX_SLOW2);
           state2.rendersSlow.sort((a, b) => b.actualDurationMs - a.actualDurationMs);
@@ -18838,6 +18864,7 @@ var URI_UPDATES = "valtio://updates/recent";
 var URI_STORES = "valtio://stores";
 var URI_SUBSCRIBERS = "valtio://subscribers";
 var MAX_UPDATES = 100;
+var MAX_PATHS = 1e3;
 function installValtioReducer(args) {
   const state2 = {
     updates: [],
@@ -18861,7 +18888,16 @@ function installValtioReducer(args) {
         if (state2.updates.length > MAX_UPDATES) {
           state2.updates.splice(0, state2.updates.length - MAX_UPDATES);
         }
-        state2.latestUpdateByPath.set(`${u.storeId}::${u.path}`, rec);
+        const pathKey = `${u.storeId}::${u.path}`;
+        state2.latestUpdateByPath.delete(pathKey);
+        state2.latestUpdateByPath.set(pathKey, rec);
+        if (state2.latestUpdateByPath.size > MAX_PATHS) {
+          for (const k of state2.latestUpdateByPath.keys()) {
+            state2.latestUpdateByPath.delete(k);
+            if (state2.latestUpdateByPath.size <= MAX_PATHS)
+              break;
+          }
+        }
         void args.resources.markDirty(URI_UPDATES);
         return;
       }
@@ -19549,8 +19585,25 @@ var URI_CURRENT7 = "memory://current";
 var URI_OWNERS = "memory://owners";
 var URI_GROWING = "memory://owners/growing";
 var URI_LEAKS = "memory://leaks/suspected";
+var MAX_LEAKS = 200;
+var MAX_FLOWIDS_PER_OWNER = 50;
 function installMemoryReducer(args) {
   const state2 = { owners: /* @__PURE__ */ new Map(), leaks: [] };
+  const pushLeak = (leak) => {
+    state2.leaks.push(leak);
+    if (state2.leaks.length > MAX_LEAKS)
+      state2.leaks.splice(0, state2.leaks.length - MAX_LEAKS);
+  };
+  const noteFlow = (o, flowId) => {
+    o.flowIds.add(flowId);
+    if (o.flowIds.size > MAX_FLOWIDS_PER_OWNER) {
+      for (const id of o.flowIds) {
+        o.flowIds.delete(id);
+        if (o.flowIds.size <= MAX_FLOWIDS_PER_OWNER)
+          break;
+      }
+    }
+  };
   const ensure = (ownerId) => {
     let o = state2.owners.get(ownerId);
     if (!o) {
@@ -19581,7 +19634,7 @@ function installMemoryReducer(args) {
         o.estimatedBytes = raw.mutation.afterCount * 64;
         o.mutations += 1;
         if (event.context.flowId)
-          o.flowIds.add(event.context.flowId);
+          noteFlow(o, event.context.flowId);
         void args.resources.markDirty(URI_OWNERS);
         void args.resources.markDirty(URI_GROWING);
         return;
@@ -19589,7 +19642,7 @@ function installMemoryReducer(args) {
       case "memory-retention": {
         if (!raw.retention)
           return;
-        state2.leaks.push({
+        pushLeak({
           kind: "retention",
           ownerId: raw.retention.ownerId,
           flowId: raw.retention.flowId,
@@ -19602,7 +19655,7 @@ function installMemoryReducer(args) {
       case "singleton-stale-generation": {
         if (!raw.staleGeneration)
           return;
-        state2.leaks.push({
+        pushLeak({
           kind: "stale-generation",
           logicalId: raw.staleGeneration.logicalId,
           detail: { ...raw.staleGeneration },

package/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAqFD,wBAAsB,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA4ChE;AA0lBD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnE;;;;;;;;iFAQiF;AACjF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,CAItB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AA6FD,wBAAsB,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA4ChE;AA0nBD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnE;;;;;;;;iFAQiF;AACjF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,CAItB"}

package/lib/cli.js

@@ -2,9 +2,10 @@ import { spawn, spawnSync } from 'node:child_process';
 import { existsSync, mkdirSync, openSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { request as httpRequest } from 'node:http';
 import { homedir, tmpdir } from 'node:os';
-import { basename, dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ensureLensConfig } from './workspace-scope.js';
+import { sweepLensRuntimeFiles } from './sweep.js';
 const HELP = `lensmcp — CLI for LensMCP (FrontMCP-based observability for coding agents)
 
 Usage:
@@ -12,10 +13,16 @@ Usage:
 
 Commands:
   setup [--cwd <dir>] [--skip-format] [--register-host-config <mode>]
-                       First-time bootstrap — runs \`install\` then \`trust\` in
+                       First-time bootstrap — \`install\` → \`trust\` → \`pods\` in
                        one idempotent pass: plugin + .mcp.json + nx config +
                        vite/nest wiring, then the dev CA (System keychain),
-                       /etc/hosts (both families) + DNS flush. sudo self-prompts
+                       /etc/hosts (both families) + DNS flush, then a recycle of
+                       THIS workspace's devserver pods (they would otherwise keep
+                       serving the wiring setup just replaced) plus a gateway
+                       reconcile — nx graph refresh, adopt an orphaned :443,
+                       register this workspace into a running daemon. A running
+                       gateway is NEVER restarted (the :443 door is shared) and
+                       other workspaces' pods are never touched. sudo self-prompts
                        only for the steps that need it — run in a real terminal.
                        Then \`lensmcp gateway start\`.
   mcp [--cwd <dir>] [--transport stdio|http] [--port <n>]
@@ -68,14 +75,16 @@ Commands:
                        promote, abort, add-rule, remove-rule, status. Validated +
                        atomic write; the prod gateway picks it up live. Run
                        \`lensmcp rollout\` (no args) for the op list.
-  logs [service] [--tail <n>] [--no-follow] [--plain] [--cwd <dir>]
+  logs [service] [--tail <n>] [--no-follow] [--plain] [--color] [--cwd <dir>]
                        Attach this terminal to a running service's live log
                        stream (docker-logs style — for humans and agents alike).
                        No <service> lists every attachable service across
                        workspaces. --tail <n> replays that many history lines
                        first (default 100); --no-follow prints them and exits
                        (the agent-friendly snapshot); --plain strips ANSI color
-                       (automatic when output is piped). Needs no ports — it
+                       (automatic when output is piped); --color FORCES color
+                       through a pipe — for consumers that RENDER ANSI, like
+                       the IDE plugin's Logs console. Needs no ports — it
                        finds the devserver's control socket under $TMPDIR.
   debug <service> [--port <base>] [--cwd <dir>]
                        Open every pod's Node inspector of a RUNNING service —
@@ -239,6 +248,15 @@ function daemonRequest(method, urlPath, body) {
     catch { /* non-JSON body */ }
     return Number.isFinite(status) ? { status, json } : null;
 }
+/** The workspace key that OWNS the running daemon (undefined when no daemon answers) — used to name the
+ *  workspace a guest must run privileged/workspace-scoped work (`trust`) in. */
+function daemonWsKey() {
+    const s = daemonRequest('GET', '/status');
+    if (s?.status !== 200 || !s.json || typeof s.json !== 'object')
+        return undefined;
+    const d = s.json.daemon;
+    return typeof d?.wsKey === 'string' && d.wsKey.length > 0 ? d.wsKey : undefined;
+}
 /** The nx projects map (name → workspace-relative root) for cluster discovery — built by scanning
  *  project.json files, the same walk `findGatewayTarget` uses. Sent to the daemon so it can `discoverRoutes`
  *  this workspace when it registers. */
@@ -336,8 +354,17 @@ function runGateway(ctx, args, out, err) {
         }
         const target = findGatewayTarget(cwd, stringFlag(opts.flags['--project']), stringFlag(opts.flags['--target']));
         if (!target) {
-            err('Could not find a gateway target (an executor `@lensmcp/cluster:gateway`) in this workspace.\n' +
-                'Pass --project <p> --target <t>, or add a gateway project (see @lensmcp/cluster).');
+            // This workspace hosts no gateway of its own. That is a NORMAL state for a guest workspace — it just
+            // means there is nothing on :443 to join right now. Say what to actually do, in order of likelihood,
+            // instead of only naming the two flags (the papercut the IDE plugin surfaced verbatim).
+            err(`This workspace ('${cfg.key}') has no gateway target — no project declares the`);
+            err('`@lensmcp/cluster:gateway` executor, so there is nothing here to launch on :443.');
+            err('');
+            err('  • Joining a shared gateway? Start it in the workspace that OWNS it, then run');
+            err('    `lensmcp gateway start` here — this workspace registers into it (no local target needed).');
+            err('  • Should this workspace host its own gateway? Scaffold it: `lensmcp install`');
+            err('    (or `lensmcp setup` for the full install + trust bootstrap).');
+            err('  • Already have a differently-named target? `lensmcp gateway start --project <p> --target <t>`.');
             return { exitCode: 1 };
         }
         const nxBin = findNxBinary(cwd);
@@ -345,6 +372,7 @@ function runGateway(ctx, args, out, err) {
             err('Could not find the `nx` binary in the workspace. Install Nx first: `yarn add -D nx`.');
             return { exitCode: 1 };
         }
+        sweepLensRuntimeFiles(cwd, logFile);
         const fd = openSync(logFile, 'a');
         const child = spawn(nxBin, ['run', `${target.project}:${target.target}`], {
             cwd,
@@ -586,14 +614,34 @@ function findGatewayTarget(cwd, project, target) {
     // Sensible fallback used by most workspaces (tetros: tools/gateway → `gateway:serve`).
     return project || target ? { project: project ?? 'gateway', target: target ?? 'serve' } : undefined;
 }
-/** Find a project + target whose executor is `@lensmcp/cluster:trust`. Falls back
- *  unconditionally to `gateway:trust` — the conventional home the init generator
- *  scaffolds — since trust is idempotent and safe to attempt anywhere. */
+/**
+ * Find a project + target whose executor is `@lensmcp/cluster:trust`. Falls back to `gateway:trust` — the
+ * conventional home the init generator scaffolds — but ONLY when a project named `gateway` actually exists
+ * (an explicit `--project` is always taken at face value). The old unconditional fallback made `trust` in a
+ * workspace that never ran `lensmcp install` shell out to `nx run gateway:trust` and die on Nx's opaque
+ * "Cannot find project 'gateway'"; returning undefined lets the caller say what to do instead.
+ */
 function findTrustTarget(cwd, project, target) {
-    return (scanExecutorTarget(cwd, '@lensmcp/cluster:trust', project, target) ?? {
-        project: project ?? 'gateway',
-        target: target ?? 'trust',
-    });
+    const found = scanExecutorTarget(cwd, '@lensmcp/cluster:trust', project, target);
+    if (found)
+        return found;
+    if (project)
+        return { project, target: target ?? 'trust' };
+    return projectExists(cwd, 'gateway') ? { project: 'gateway', target: target ?? 'trust' } : undefined;
+}
+/** Does a project of this name exist in the workspace? (project.json-declared, like every other scan here.) */
+function projectExists(cwd, name) {
+    for (const file of walkProjectFiles(cwd, (n) => n === 'project.json')) {
+        try {
+            const parsed = JSON.parse(safeRead(file));
+            if ((parsed.name ?? basename(dirname(file))) === name)
+                return true;
+        }
+        catch {
+            /* unreadable project.json — not a match */
+        }
+    }
+    return false;
 }
 function readPid(pidFile) {
     try {
@@ -867,6 +915,26 @@ function runTrust(ctx, args, out, err) {
     // that unused CA file (the papercut). So run HOSTS-ONLY (/etc/hosts + DNS) and report the REAL served-cert
     // trust instead.
     const guestOfDaemon = daemonRequest('GET', '/list')?.status === 200 && gatewayOnPort443(cwd) === undefined;
+    // No trust target anywhere in this workspace (never ran `lensmcp install`). Trust is workspace-scoped work
+    // — minting the CA and writing /etc/hosts for THIS workspace's cluster hosts — so there is nothing to run
+    // here. Say which workspace owns the CA instead of failing inside Nx with "Cannot find project 'gateway'".
+    if (!target) {
+        err(`This workspace has no trust target — no project declares the \`@lensmcp/cluster:trust\` executor.`);
+        err('');
+        if (guestOfDaemon) {
+            const owner = daemonWsKey();
+            err(`  A shared gateway daemon${owner ? ` (owned by '${owner}')` : ''} already serves this workspace, and`);
+            err('  TLS rides ITS certificate authority. Run `lensmcp trust` in THAT workspace — it owns the CA —');
+            err('  and this workspace is trusted too (restart the browser once if it cached a cert error).');
+        }
+        else {
+            err('  • Should this workspace own its gateway (and its CA)? Scaffold it first: `lensmcp install`,');
+            err('    then re-run `lensmcp trust`.');
+            err('  • Joining a shared gateway? Run `lensmcp trust` in the workspace that owns the daemon.');
+        }
+        err('  • Already have a differently-named target? `lensmcp trust --project <p> --target <t>`.');
+        return { exitCode: 1 };
+    }
     if (!isInteractive()) {
         out('  note: trust runs `sudo` for the CA + /etc/hosts — run it in a real terminal if a step is needed.');
     }
@@ -920,8 +988,10 @@ function writeSetupState(cwd) {
 }
 /**
  * `lensmcp setup` — first-time bootstrap. Runs `install` (plugin + .mcp.json +
- * nx config + vite/nest wiring, no sudo) then `trust` (dev CA → keychain,
- * /etc/hosts, DNS flush, sudo). Both steps are idempotent, so re-running is safe.
+ * nx config + vite/nest wiring, no sudo), then `trust` (dev CA → keychain,
+ * /etc/hosts, DNS flush, sudo), then `pods` — which recycles this workspace's
+ * devservers and reconciles the gateway, so nothing keeps serving the wiring
+ * that setup just replaced. Every step is idempotent, so re-running is safe.
  * Flags are forwarded to whichever sub-command understands them (`--skip-format`,
  * `--register-host-config` → install; `--project`/`--target` → trust).
  */
@@ -929,9 +999,9 @@ function runSetup(ctx, args, out, err) {
     const opts = parseFlags(args, { string: ['--cwd'] });
     const cwd = resolve(stringFlag(opts.flags['--cwd']) ?? ctx.cwd);
     const subCtx = { ...ctx, cwd };
-    out('lensmcp setup — first-time bootstrap (install → trust)');
+    out('lensmcp setup — first-time bootstrap (install → trust → pods)');
     out('');
-    out('[1/2] install — plugin, .mcp.json, nx config, vite/nest wiring');
+    out('[1/3] install — plugin, .mcp.json, nx config, vite/nest wiring');
     const installRes = runInstall(subCtx, args, out, err);
     if (installRes.exitCode !== 0) {
         err('');
@@ -939,17 +1009,31 @@ function runSetup(ctx, args, out, err) {
         return installRes;
     }
     out('');
-    out('[2/2] trust — dev CA → System keychain, /etc/hosts, DNS flush (sudo)');
+    out('[2/3] trust — dev CA → System keychain, /etc/hosts, DNS flush (sudo)');
     const trustRes = runTrust(subCtx, args, out, err);
     if (trustRes.exitCode !== 0) {
         err('');
         err('setup: the trust step failed — run `lensmcp setup` directly in a terminal so sudo can prompt.');
         return trustRes;
     }
-    // Both steps succeeded → mark the workspace set up for this version (opens the MCP gate).
+    // Install + trust rewrote this workspace's wiring, but a devserver that has been up since before it
+    // changed goes on serving the OLD bundle from its pooled pods — the "setup said ✓ but the app is
+    // unchanged" trap. Recycle them, then put the gateway back in line with reality WITHOUT restarting it
+    // (the :443 door is shared: bouncing it would take every other workspace down with this one).
+    out('');
+    out("[3/3] pods — recycle this workspace's devservers, reconcile the gateway");
+    const key = ensureLensConfig(cwd).key;
+    const reaped = reapWorkspacePods(cwd, key, out);
+    reconcileGatewayAfterSetup(subCtx, cwd, key, out);
+    // All steps succeeded → mark the workspace set up for this version (opens the MCP gate).
     writeSetupState(cwd);
     out('');
     out('✓ setup complete.');
+    if (reaped.killed > 0 || reaped.stale > 0) {
+        out(`  recycled ${reaped.killed} pod${reaped.killed === 1 ? '' : 's'}` +
+            (reaped.stale > 0 ? ` (+${reaped.stale} stale socket${reaped.stale === 1 ? '' : 's'} cleared)` : '') +
+            ' — they come back on the new wiring.');
+    }
     out('  next:   lensmcp gateway start      (the :443 front door — needs sudo)');
     out('  verify: lensmcp doctor');
     return { exitCode: 0 };
@@ -1309,6 +1393,179 @@ function discoverDevserverSocks() {
     return found.sort((a, b) => `${a.wsKey}/${a.service}`.localeCompare(`${b.wsKey}/${b.service}`));
 }
 const fullServiceName = (d) => (d.wsKey ? `${d.wsKey}/${d.service}` : d.service);
+/* ───────── pod recycling (the `setup` reap) ─────────
+ * A devserver is a PARENT process holding `parent.sock` plus N forked child pods. Killing the parent is
+ * enough for the pods — they exit on the IPC `disconnect` (main.devserver.ts's ORPHAN GUARD) and unlink
+ * their own sockets. But the gateway spawns each service `detached: true` with `NX_DAEMON=false`, so the
+ * whole service — the `nx run` shim, the devserver, the pods — sits in ONE process group of its own; group-
+ * killing that reaps the shim too, which a lone parent kill would leave behind (the documented "nx wrapper
+ * outlives its child" leak). Hence: kill the group when we can prove it's the service's own, else the pid. */
+/** The pid holding a unix socket (best-effort via lsof; undefined = the socket is stale litter). */
+function pidOnSocket(sock) {
+    try {
+        const r = spawnSync('lsof', ['-t', sock], { encoding: 'utf8' });
+        const pid = Number((r.stdout ?? '').split('\n')[0]?.trim());
+        return Number.isInteger(pid) && pid > 0 ? pid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A process's group id (undefined when it's gone or `ps` is unavailable). */
+function pgidOf(pid) {
+    try {
+        const r = spawnSync('ps', ['-o', 'pgid=', '-p', String(pid)], { encoding: 'utf8' });
+        const pgid = Number((r.stdout ?? '').trim());
+        return Number.isInteger(pgid) && pgid > 1 ? pgid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A process's working directory — how an UN-NAMESPACED devserver (a plain `nx serve`, no LENSMCP_WS_KEY)
+ *  gets attributed to a workspace. Undefined when it can't be read, and an unattributable pod is left
+ *  alone: it belongs to somebody else until proven otherwise. */
+function cwdOfPid(pid) {
+    try {
+        const r = spawnSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], { encoding: 'utf8' });
+        const line = (r.stdout ?? '').split('\n').find((l) => l.startsWith('n'));
+        return line ? line.slice(1).trim() || undefined : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `child` the same path as, or inside, `parent`? */
+function isInside(parent, child) {
+    const rel = relative(resolve(parent), resolve(child));
+    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+/** Every devserver under $TMPDIR that belongs to the workspace rooted at `cwd`. A namespaced sock dir
+ *  (`$TMPDIR/<wsKey>/…`) is attributed by its key; a legacy un-namespaced one by its owner's cwd. */
+function workspaceDevservers(cwd, key) {
+    return discoverDevserverSocks().filter((d) => {
+        if (d.wsKey)
+            return d.wsKey === key;
+        const pid = pidOnSocket(d.sock);
+        const owner = pid !== undefined ? cwdOfPid(pid) : undefined;
+        return owner !== undefined && isInside(cwd, owner);
+    });
+}
+/**
+ * Stop every devserver of THIS workspace and clear its socket dir, so the next boot comes up on the
+ * freshly installed wiring instead of a pod that has been running since before it changed.
+ *
+ * Safe next to a live gateway: it marks a vanished service `down` and either self-heals it or scales it
+ * from zero on the next request, so the front door keeps serving while the pods come back new. NEVER
+ * group-kills a group it can't prove is the service's own — a mis-derived group would take down the
+ * gateway (or this CLI) with it.
+ */
+function reapWorkspacePods(cwd, key, out) {
+    const mine = workspaceDevservers(cwd, key);
+    if (mine.length === 0) {
+        out('  no devserver pods running for this workspace — nothing to recycle.');
+        return { killed: 0, stale: 0 };
+    }
+    // Groups we must never signal: our own, and whatever holds :443 (the gateway must survive this).
+    const forbidden = new Set();
+    for (const p of [process.pid, ...pidsOnPort443()]) {
+        const g = pgidOf(p);
+        if (g !== undefined)
+            forbidden.add(g);
+    }
+    let killed = 0;
+    let stale = 0;
+    for (const d of mine) {
+        const name = fullServiceName(d);
+        const pid = pidOnSocket(d.sock);
+        if (pid === undefined) {
+            rmFile(d.sock);
+            out(`  ✓ ${name} — stale socket removed (no process held it)`);
+            stale++;
+            continue;
+        }
+        const group = pgidOf(pid);
+        const groupKillable = group !== undefined && !forbidden.has(group);
+        const signal = (sig) => {
+            try {
+                if (groupKillable)
+                    process.kill(-group, sig);
+                else
+                    process.kill(pid, sig); // pods follow the parent out via the IPC disconnect guard
+            }
+            catch {
+                /* already gone */
+            }
+        };
+        signal('SIGTERM');
+        // Give the tree a moment to unwind gracefully (the devserver closes its pods' IPC, they unlink their
+        // own sockets), then escalate — a wedged child must not survive the recycle.
+        if (!waitForPidGone(pid, 5000)) {
+            signal('SIGKILL');
+            waitForPidGone(pid, 2000);
+        }
+        rmFile(d.sock);
+        out(`  ✓ ${name} — stopped (pid ${pid}${groupKillable ? `, group ${group}` : ', parent only'})`);
+        killed++;
+    }
+    return { killed, stale };
+}
+/** Poll until `pid` is gone or the timeout elapses. Synchronous — a setup step, not a hot path. */
+function waitForPidGone(pid, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (!isAlive(pid))
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        spawnSync('sleep', ['0.15']);
+    }
+}
+/**
+ * Bring the gateway back in line with reality WITHOUT restarting a running one — a `setup` must never take
+ * the shared `:443` front door (and every other workspace on it) down. It:
+ *   • adopts an orphaned gateway the pid file lost track of (the desync self-heal);
+ *   • busts the nx project graph, so the projects `install` just wired resolve instead of 404ing out of a
+ *     daemon whose graph predates them;
+ *   • registers this workspace into a daemon someone else owns, when it isn't in there yet.
+ * An already-registered workspace is left alone: re-registering makes the daemon tear down and respawn its
+ * services and dashboard for nothing.
+ */
+function reconcileGatewayAfterSetup(ctx, cwd, key, out) {
+    const pidFile = join(cwd, '.lensmcp', 'gateway.pid');
+    const registeredMarker = join(cwd, '.lensmcp', 'registered.json');
+    const { pid, healed } = reconcileGateway(pidFile, cwd);
+    if (healed)
+        out(`  healed: adopted a running gateway (pid ${pid}) the pid file had lost.`);
+    refreshNxGraph(cwd, ctx.env, (l) => out(` ${l}`));
+    const owned = gatewayOnPort443(cwd) !== undefined;
+    if (owned) {
+        out(`  gateway: this workspace owns the :443 daemon (pid ${pid ?? '?'}) — left running, pods respawn fresh.`);
+        return;
+    }
+    const list = daemonRequest('GET', '/list');
+    if (list?.status !== 200) {
+        out('  gateway: not running. Start it when you are ready:  lensmcp gateway start');
+        return;
+    }
+    const registered = list.json && typeof list.json === 'object'
+        ? (list.json.workspaces ?? []).some((w) => w.key === key)
+        : false;
+    if (registered) {
+        mkdirSync(dirname(registeredMarker), { recursive: true });
+        writeFileSync(registeredMarker, JSON.stringify({ wsKey: key }));
+        out(`  gateway: '${key}' is already registered into the shared daemon — left serving.`);
+        return;
+    }
+    const res = daemonRequest('POST', '/register', { wsKey: key, root: cwd, projects: buildProjectsMap(cwd) });
+    if (res && res.status === 200) {
+        mkdirSync(dirname(registeredMarker), { recursive: true });
+        writeFileSync(registeredMarker, JSON.stringify({ wsKey: key }));
+        out(`  gateway: registered '${key}' into the shared daemon — it now hosts this workspace.`);
+        return;
+    }
+    out('  gateway: a shared daemon is up but registering this workspace failed — run `lensmcp gateway start`.');
+}
 /** Resolve a service argument (`name` or `wsKey/name`) to ONE control socket. A bare
  *  name running in several workspaces is disambiguated by the current workspace's key.
  *  Prints the helpful error itself and returns null when nothing (or too much) matches. */
@@ -1340,7 +1597,7 @@ function resolveServiceSock(service, all, cwd, err) {
 async function runLogs(ctx, args, out, err) {
     const opts = parseFlags(args, {
         string: ['--tail', '--cwd'],
-        boolean: ['--no-follow', '--plain'],
+        boolean: ['--no-follow', '--plain', '--color'],
     });
     const service = opts.positional[0];
     const all = discoverDevserverSocks();
@@ -1362,7 +1619,11 @@ async function runLogs(ctx, args, out, err) {
     const follow = opts.flags['--no-follow'] !== true;
     const tailRaw = Number(stringFlag(opts.flags['--tail']) ?? NaN);
     const tail = Number.isInteger(tailRaw) && tailRaw >= 0 ? tailRaw : 100; // 0 = live-only, no history
-    const plain = opts.flags['--plain'] === true || !process.stdout.isTTY;
+    // ANSI is stripped when the output is piped — EXCEPT for a consumer that renders it and says so with
+    // `--color` (the IDE plugin's Logs console runs through a pipe, and plain-stripped output is exactly the
+    // unreadable wall of text the colored stream avoids). Explicit `--plain` still wins.
+    const plain = opts.flags['--plain'] === true ||
+        (opts.flags['--color'] !== true && !process.stdout.isTTY);
     const reqPath = `/webpack/logs?tail=${tail}&follow=${follow ? 1 : 0}${plain ? '&plain=1' : ''}`;
     return new Promise((done) => {
         const req = httpRequest({ socketPath: target.sock, path: reqPath, method: 'GET' }, (res) => {

package/lib/sweep.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Retention sweep at gateway start — the one moment we KNOW no gateway is writing these files.
+ * The bus rotates round-robin (`events.jsonl.1` … `.N`, 50 MB per generation, oldest dropped —
+ * emit.ts's `LENSMCP_EVENT_MAX_BYTES`/`LENSMCP_EVENT_MAX_FILES` contract); this prunes what that
+ * scheme can't reach: legacy `.old` files older schemes left behind (a tetros workspace carried an
+ * 8.6 GB `events.jsonl.old` from July), generations beyond the horizon, oversized generations from
+ * the pre-cap era, and a grown `gateway.log` (rotated to `.1` so the append-only log doesn't creep
+ * to hundreds of MB across restarts). Lives outside cli.ts so it stays CJS-jestable (cli.ts uses
+ * import.meta).
+ */
+export declare function sweepLensRuntimeFiles(cwd: string, logFile: string): void;
+//# sourceMappingURL=sweep.d.ts.map

package/lib/sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep.d.ts","sourceRoot":"","sources":["../../src/lib/sweep.ts"],"names":[],"mappings":"AAWA;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAgCxE"}

package/lib/sweep.js

@@ -0,0 +1,60 @@
+import { readdirSync, renameSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+const removeQuietly = (path) => {
+    try {
+        rmSync(path, { force: true });
+    }
+    catch {
+        /* best-effort — a vanished file or racing sweep must never block a start */
+    }
+};
+/**
+ * Retention sweep at gateway start — the one moment we KNOW no gateway is writing these files.
+ * The bus rotates round-robin (`events.jsonl.1` … `.N`, 50 MB per generation, oldest dropped —
+ * emit.ts's `LENSMCP_EVENT_MAX_BYTES`/`LENSMCP_EVENT_MAX_FILES` contract); this prunes what that
+ * scheme can't reach: legacy `.old` files older schemes left behind (a tetros workspace carried an
+ * 8.6 GB `events.jsonl.old` from July), generations beyond the horizon, oversized generations from
+ * the pre-cap era, and a grown `gateway.log` (rotated to `.1` so the append-only log doesn't creep
+ * to hundreds of MB across restarts). Lives outside cli.ts so it stays CJS-jestable (cli.ts uses
+ * import.meta).
+ */
+export function sweepLensRuntimeFiles(cwd, logFile) {
+    const dir = join(cwd, '.lensmcp');
+    const eventFile = join(dir, 'events.jsonl');
+    removeQuietly(`${eventFile}.old`);
+    removeQuietly(`${logFile}.old`);
+    const maxFiles = (() => {
+        const n = Number(process.env['LENSMCP_EVENT_MAX_FILES']);
+        return Number.isFinite(n) && n >= 1 && n <= 20 ? Math.floor(n) : 5;
+    })();
+    const MAX_GENERATION_BYTES = 64 * 1024 * 1024; // legit generations are ≤ ~50 MB; bigger = pre-cap era litter
+    try {
+        for (const name of readdirSync(dir)) {
+            const m = /^events\.jsonl\.(\d+)$/.exec(name);
+            if (!m)
+                continue;
+            const gen = Number(m[1]);
+            const file = join(dir, name);
+            if (gen < 1 || gen > maxFiles)
+                removeQuietly(file);
+            else {
+                try {
+                    if (statSync(file).size > MAX_GENERATION_BYTES)
+                        removeQuietly(file);
+                }
+                catch { /* raced away */ }
+            }
+        }
+    }
+    catch {
+        /* no .lensmcp dir yet */
+    }
+    const MAX_GATEWAY_LOG_BYTES = 16 * 1024 * 1024;
+    try {
+        if (statSync(logFile).size > MAX_GATEWAY_LOG_BYTES)
+            renameSync(logFile, `${logFile}.1`);
+    }
+    catch {
+        /* no log yet */
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lensmcp",
-  "version": "1.16.29",
+  "version": "1.16.31",
   "type": "module",
   "main": "./index.js",
   "module": "./index.js",

package/plugin/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "lensmcp",
   "displayName": "LensMCP",
   "description": "The observability lens for coding agents. One command brings up the dev cluster gateway (every project.json `cluster` decl → its host on :443), the per-project lens dashboard at https://lensmcp.local/<project>/, and the MCP server your agent connects to — scoped automatically to whatever project you opened Claude Code in.",
-  "version": "1.16.29",
+  "version": "1.16.31",
   "author": {
     "name": "David Antoon",
     "email": "davidmantoon@gmail.com"