@launchsecure/launch-kit 0.0.14 → 0.0.16

package/dist/server/cli.js

@@ -554,7 +554,7 @@ var require_claude_bridge = __commonJS({
     "use strict";
     var { spawn: spawn3 } = require("node-pty");
     var path9 = require("path");
-    var fs9 = require("fs");
+    var fs10 = require("fs");
     var ClaudeBridge = class {
       constructor() {
         this.sessions = /* @__PURE__ */ new Map();
@@ -572,7 +572,7 @@ var require_claude_bridge = __commonJS({
         ];
         for (const cmd of possibleCommands) {
           try {
-            if (fs9.existsSync(cmd) || this.commandExists(cmd)) {
+            if (fs10.existsSync(cmd) || this.commandExists(cmd)) {
               console.log(`Found Claude command at: ${cmd}`);
               return cmd;
             }
@@ -773,7 +773,7 @@ var require_codex_bridge = __commonJS({
     "use strict";
     var { spawn: spawn3 } = require("node-pty");
     var path9 = require("path");
-    var fs9 = require("fs");
+    var fs10 = require("fs");
     var CodexBridge = class {
       constructor() {
         this.sessions = /* @__PURE__ */ new Map();
@@ -790,7 +790,7 @@ var require_codex_bridge = __commonJS({
         ];
         for (const cmd of possibleCommands) {
           try {
-            if (fs9.existsSync(cmd) || this.commandExists(cmd)) {
+            if (fs10.existsSync(cmd) || this.commandExists(cmd)) {
               console.log(`Found Codex command at: ${cmd}`);
               return cmd;
             }
@@ -966,7 +966,7 @@ var require_agent_bridge = __commonJS({
     "use strict";
     var { spawn: spawn3 } = require("node-pty");
     var path9 = require("path");
-    var fs9 = require("fs");
+    var fs10 = require("fs");
     var AgentBridge = class {
       constructor() {
         this.sessions = /* @__PURE__ */ new Map();
@@ -982,7 +982,7 @@ var require_agent_bridge = __commonJS({
         ];
         for (const cmd of possibleCommands) {
           try {
-            if (fs9.existsSync(cmd) || this.commandExists(cmd)) {
+            if (fs10.existsSync(cmd) || this.commandExists(cmd)) {
               console.log(`Found Agent command at: ${cmd}`);
               return cmd;
             }
@@ -1306,7 +1306,7 @@ var require_script_bridge = __commonJS({
 var require_session_store = __commonJS({
   "../claude-code-web/src/utils/session-store.js"(exports2, module2) {
     "use strict";
-    var fs9 = require("fs").promises;
+    var fs10 = require("fs").promises;
     var path9 = require("path");
     var os2 = require("os");
     var SessionStore = class {
@@ -1317,14 +1317,14 @@ var require_session_store = __commonJS({
       }
       async initializeStorage() {
         try {
-          await fs9.mkdir(this.storageDir, { recursive: true });
+          await fs10.mkdir(this.storageDir, { recursive: true });
         } catch (error) {
           console.error("Failed to create storage directory:", error);
         }
       }
       async saveSessions(sessions) {
         try {
-          await fs9.mkdir(this.storageDir, { recursive: true });
+          await fs10.mkdir(this.storageDir, { recursive: true });
           const sessionsArray = Array.from(sessions.entries()).map(([id, session]) => ({
             id,
             name: session.name || "Unnamed Session",
@@ -1355,9 +1355,9 @@ var require_session_store = __commonJS({
             sessions: sessionsArray
           };
           const tempFile = `${this.sessionsFile}.tmp`;
-          await fs9.writeFile(tempFile, JSON.stringify(data, null, 2));
-          await fs9.mkdir(this.storageDir, { recursive: true });
-          await fs9.rename(tempFile, this.sessionsFile);
+          await fs10.writeFile(tempFile, JSON.stringify(data, null, 2));
+          await fs10.mkdir(this.storageDir, { recursive: true });
+          await fs10.rename(tempFile, this.sessionsFile);
           return true;
         } catch (error) {
           console.error("Failed to save sessions:", error.message);
@@ -1366,8 +1366,8 @@ var require_session_store = __commonJS({
       }
       async loadSessions() {
         try {
-          await fs9.access(this.sessionsFile);
-          const data = await fs9.readFile(this.sessionsFile, "utf8");
+          await fs10.access(this.sessionsFile);
+          const data = await fs10.readFile(this.sessionsFile, "utf8");
           if (!data || !data.trim()) {
             console.log("Sessions file is empty, starting fresh");
             return /* @__PURE__ */ new Map();
@@ -1378,7 +1378,7 @@ var require_session_store = __commonJS({
           } catch (parseError) {
             console.error("Sessions file is corrupted, starting fresh:", parseError.message);
             try {
-              await fs9.rename(this.sessionsFile, `${this.sessionsFile}.corrupted.${Date.now()}`);
+              await fs10.rename(this.sessionsFile, `${this.sessionsFile}.corrupted.${Date.now()}`);
             } catch (renameError) {
             }
             return /* @__PURE__ */ new Map();
@@ -1422,7 +1422,7 @@ var require_session_store = __commonJS({
       }
       async clearOldSessions() {
         try {
-          await fs9.unlink(this.sessionsFile);
+          await fs10.unlink(this.sessionsFile);
           console.log("Cleared old sessions");
           return true;
         } catch (error) {
@@ -1434,9 +1434,9 @@ var require_session_store = __commonJS({
       }
       async getSessionMetadata() {
         try {
-          await fs9.access(this.sessionsFile);
-          const stats = await fs9.stat(this.sessionsFile);
-          const data = await fs9.readFile(this.sessionsFile, "utf8");
+          await fs10.access(this.sessionsFile);
+          const stats = await fs10.stat(this.sessionsFile);
+          const data = await fs10.readFile(this.sessionsFile, "utf8");
           const parsed = JSON.parse(data);
           return {
             exists: true,
@@ -1461,7 +1461,7 @@ var require_session_store = __commonJS({
 var require_usage_reader = __commonJS({
   "../claude-code-web/src/usage-reader.js"(exports2, module2) {
     "use strict";
-    var fs9 = require("fs").promises;
+    var fs10 = require("fs").promises;
     var path9 = require("path");
     var readline = require("readline");
     var { createReadStream } = require("fs");
@@ -1669,12 +1669,12 @@ var require_usage_reader = __commonJS({
           const projectDirName = cwd.replace(/\//g, "-");
           let projectPath = path9.join(this.claudeProjectsPath, projectDirName);
           try {
-            await fs9.access(projectPath);
+            await fs10.access(projectPath);
           } catch (err2) {
             console.log(`Project directory not found: ${projectPath}`);
             return null;
           }
-          const files = await fs9.readdir(projectPath);
+          const files = await fs10.readdir(projectPath);
           const jsonlFiles = files.filter((f) => f.endsWith(".jsonl"));
           if (jsonlFiles.length === 0) {
             return null;
@@ -1683,7 +1683,7 @@ var require_usage_reader = __commonJS({
           let mostRecentTime = 0;
           for (const file of jsonlFiles) {
             const filePath = path9.join(projectPath, file);
-            const stat = await fs9.stat(filePath);
+            const stat = await fs10.stat(filePath);
             if (stat.mtime.getTime() > mostRecentTime) {
               mostRecentTime = stat.mtime.getTime();
               mostRecentFile = filePath;
@@ -1698,17 +1698,17 @@ var require_usage_reader = __commonJS({
       async findJsonlFiles(onlyRecent = false) {
         const files = [];
         try {
-          const projectDirs = await fs9.readdir(this.claudeProjectsPath);
+          const projectDirs = await fs10.readdir(this.claudeProjectsPath);
           for (const projectDir of projectDirs) {
             const projectPath = path9.join(this.claudeProjectsPath, projectDir);
-            const stat = await fs9.stat(projectPath);
+            const stat = await fs10.stat(projectPath);
             if (stat.isDirectory()) {
-              const projectFiles = await fs9.readdir(projectPath);
+              const projectFiles = await fs10.readdir(projectPath);
               const jsonlFiles = projectFiles.filter((f) => f.endsWith(".jsonl"));
               for (const jsonlFile of jsonlFiles) {
                 const filePath = path9.join(projectPath, jsonlFile);
                 if (onlyRecent) {
-                  const fileStat = await fs9.stat(filePath);
+                  const fileStat = await fs10.stat(filePath);
                   const hoursSinceModified = (Date.now() - fileStat.mtime.getTime()) / (1e3 * 60 * 60);
                   if (hoursSinceModified <= 24) {
                     files.push(filePath);
@@ -1871,7 +1871,7 @@ var require_usage_reader = __commonJS({
           }
           const sessionFile = path9.join(this.claudeProjectsPath, path9.basename(process.cwd()).replace(/[^a-zA-Z0-9-]/g, "-"), `${sessionId}.jsonl`);
           try {
-            await fs9.access(sessionFile);
+            await fs10.access(sessionFile);
           } catch (err2) {
             return null;
           }
@@ -2537,7 +2537,7 @@ var require_src = __commonJS({
     var SessionStore = require_session_store();
     var UsageReader = require_usage_reader();
     var UsageAnalytics = require_usage_analytics();
-    var fs9 = require("fs");
+    var fs10 = require("fs");
     function stripAnsi(str) {
       return str.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "").replace(/\x1b\][^\x07]*\x07/g, "").replace(/\x1b[()][AB012]/g, "").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "").replace(/\r\n?/g, "\n").trim();
     }
@@ -2795,7 +2795,7 @@ var require_src = __commonJS({
             return true;
           }
           try {
-            const items = fs9.readdirSync(validation.path, { withFileTypes: true });
+            const items = fs10.readdirSync(validation.path, { withFileTypes: true });
             const showHidden = url.searchParams.get("showHidden") === "true";
             const folders = items.filter((item) => item.isDirectory()).filter((item) => !item.name.startsWith(".") || showHidden).map((item) => ({
               name: item.name,
@@ -2830,7 +2830,7 @@ var require_src = __commonJS({
                 res.end(JSON.stringify({ error: validation.error }));
                 return;
               }
-              if (!fs9.existsSync(validation.path) || !fs9.statSync(validation.path).isDirectory()) {
+              if (!fs10.existsSync(validation.path) || !fs10.statSync(validation.path).isDirectory()) {
                 res.writeHead(400, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ error: "Not a valid directory" }));
                 return;
@@ -2857,7 +2857,7 @@ var require_src = __commonJS({
                 res.end(JSON.stringify({ error: validation.error }));
                 return;
               }
-              if (!fs9.existsSync(validation.path) || !fs9.statSync(validation.path).isDirectory()) {
+              if (!fs10.existsSync(validation.path) || !fs10.statSync(validation.path).isDirectory()) {
                 res.writeHead(400, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ error: "Invalid directory path" }));
                 return;
@@ -2892,12 +2892,12 @@ var require_src = __commonJS({
                 res.end(JSON.stringify({ message: "Cannot create folder outside the allowed area" }));
                 return;
               }
-              if (fs9.existsSync(fullValidation.path)) {
+              if (fs10.existsSync(fullValidation.path)) {
                 res.writeHead(409, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ message: "Folder already exists" }));
                 return;
               }
-              fs9.mkdirSync(fullValidation.path, { recursive: true });
+              fs10.mkdirSync(fullValidation.path, { recursive: true });
               res.writeHead(200, { "Content-Type": "application/json" });
               res.end(JSON.stringify({ success: true, path: fullValidation.path }));
             } catch (e) {
@@ -2923,7 +2923,7 @@ var require_src = __commonJS({
         if (!filePath || filePath === "") filePath = "index.html";
         const fullPath = path9.join(__dirname, "public", filePath);
         try {
-          if (!fs9.existsSync(fullPath)) return false;
+          if (!fs10.existsSync(fullPath)) return false;
           const ext = path9.extname(fullPath);
           const mimeTypes = {
             ".html": "text/html",
@@ -2935,7 +2935,7 @@ var require_src = __commonJS({
             ".ico": "image/x-icon"
           };
           const mime = mimeTypes[ext] || "application/octet-stream";
-          const content = fs9.readFileSync(fullPath);
+          const content = fs10.readFileSync(fullPath);
           res.writeHead(200, { "Content-Type": mime });
           res.end(content);
           return true;
@@ -4363,6 +4363,7 @@ function shutdownTerminalBridge() {
 // src/server/mcp-config-writer.ts
 var import_fs = __toESM(require("fs"));
 var import_path = __toESM(require("path"));
+var MANAGED_SERVERS = ["launch-pod", "launch-chart"];
 var writtenPaths = [];
 function writeMcpConfigs(opts) {
   const { projectDir, token, serverUrl } = opts;
@@ -4373,7 +4374,10 @@ function writeMcpConfigs(opts) {
 function removeMcpConfigs() {
   for (const filePath of writtenPaths) {
     try {
-      if (import_fs.default.existsSync(filePath)) {
+      if (!import_fs.default.existsSync(filePath)) continue;
+      if (filePath.endsWith(".mcp.json")) {
+        removeClaudeEntries(filePath);
+      } else {
         import_fs.default.unlinkSync(filePath);
         console.log(`MCP config removed: ${filePath}`);
       }
@@ -4382,46 +4386,88 @@ function removeMcpConfigs() {
   }
   writtenPaths.length = 0;
 }
+function removeClaudeEntries(filePath) {
+  try {
+    const raw = import_fs.default.readFileSync(filePath, "utf-8");
+    const existing = JSON.parse(raw);
+    const servers = existing.mcpServers ?? {};
+    for (const key of MANAGED_SERVERS) {
+      delete servers[key];
+    }
+    if (Object.keys(servers).length === 0 && Object.keys(existing).length <= 1) {
+      import_fs.default.unlinkSync(filePath);
+      console.log(`MCP config removed (empty): ${filePath}`);
+    } else {
+      existing.mcpServers = servers;
+      import_fs.default.writeFileSync(filePath, JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+      console.log(`MCP config cleaned (LaunchPod entries removed): ${filePath}`);
+    }
+  } catch {
+    try {
+      import_fs.default.unlinkSync(filePath);
+    } catch {
+    }
+    console.log(`MCP config removed: ${filePath}`);
+  }
+}
 function writeClaudeConfig(projectDir, mcpUrl, token) {
-  const config = {
-    mcpServers: {
-      "launch-pod": {
-        type: "http",
-        url: mcpUrl,
-        headers: {
-          Authorization: `Bearer ${token}`
-        }
-      },
-      "launch-chart": {
-        command: "launch-chart",
-        args: []
-      }
+  const filePath = import_path.default.join(projectDir, ".mcp.json");
+  let existing = {};
+  try {
+    if (import_fs.default.existsSync(filePath)) {
+      existing = JSON.parse(import_fs.default.readFileSync(filePath, "utf-8"));
+    }
+  } catch {
+    console.warn(`Warning: existing .mcp.json was malformed, preserving as .mcp.json.bak`);
+    try {
+      import_fs.default.copyFileSync(filePath, filePath + ".bak");
+    } catch {
+    }
+  }
+  const servers = existing.mcpServers ?? {};
+  servers["launch-pod"] = {
+    type: "http",
+    url: mcpUrl,
+    headers: {
+      Authorization: `Bearer ${token}`
     }
   };
-  const filePath = import_path.default.join(projectDir, ".mcp.json");
-  import_fs.default.writeFileSync(filePath, JSON.stringify(config, null, 2), { mode: 384 });
+  servers["launch-chart"] = {
+    command: "launch-chart",
+    args: []
+  };
+  existing.mcpServers = servers;
+  import_fs.default.writeFileSync(filePath, JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
   writtenPaths.push(filePath);
-  console.log(`Claude Code MCP config written to ${filePath}`);
+  console.log(`Claude Code MCP config merged into ${filePath}`);
 }
 function writeCodexConfig(projectDir, mcpUrl, token) {
   const codexDir = import_path.default.join(projectDir, ".codex");
   if (!import_fs.default.existsSync(codexDir)) {
     import_fs.default.mkdirSync(codexDir, { recursive: true, mode: 448 });
   }
-  const toml = [
+  const filePath = import_path.default.join(codexDir, "config.toml");
+  let existingContent = "";
+  try {
+    if (import_fs.default.existsSync(filePath)) {
+      existingContent = import_fs.default.readFileSync(filePath, "utf-8");
+    }
+  } catch {
+  }
+  const cleaned = existingContent.replace(/\[mcp_servers\.launch-pod\][^\[]*/, "").replace(/\[mcp_servers\.launch-chart\][^\[]*/, "").trim();
+  const launchPodBlock = [
     `[mcp_servers.launch-pod]`,
     `url = "${mcpUrl}"`,
     `http_headers = { "Authorization" = "Bearer ${token}" }`,
     ``,
     `[mcp_servers.launch-chart]`,
     `command = "launch-chart"`,
-    `args = []`,
-    ``
+    `args = []`
   ].join("\n");
-  const filePath = import_path.default.join(codexDir, "config.toml");
-  import_fs.default.writeFileSync(filePath, toml, { mode: 384 });
+  const merged = cleaned ? cleaned + "\n\n" + launchPodBlock + "\n" : launchPodBlock + "\n";
+  import_fs.default.writeFileSync(filePath, merged, { mode: 384 });
   writtenPaths.push(filePath);
-  console.log(`Codex MCP config written to ${filePath}`);
+  console.log(`Codex MCP config merged into ${filePath}`);
 }
 
 // src/server/tracker-poller.ts
@@ -4528,13 +4574,18 @@ All pipeline data lives in the **database**, not on the local filesystem.
 ---
 
 `;
-function resolvePrompt(agentId, unitId, inputs) {
-  const hyphenated = agentId.replace(/_/g, "-");
-  const filePath = import_path2.default.join(PROMPTS_DIR, `${hyphenated}.md`);
-  if (!import_fs2.default.existsSync(filePath)) {
-    throw new Error(`Prompt file not found for agent "${agentId}": ${filePath}`);
+function resolvePrompt(agentId, unitId, inputs, promptOverride) {
+  let raw;
+  if (promptOverride) {
+    raw = promptOverride;
+  } else {
+    const hyphenated = agentId.replace(/_/g, "-");
+    const filePath = import_path2.default.join(PROMPTS_DIR, `${hyphenated}.md`);
+    if (!import_fs2.default.existsSync(filePath)) {
+      throw new Error(`Prompt file not found for agent "${agentId}": ${filePath}`);
+    }
+    raw = import_fs2.default.readFileSync(filePath, "utf-8");
   }
-  const raw = import_fs2.default.readFileSync(filePath, "utf-8");
   const unitPreamble = unitId ? `
 ---
 
@@ -4653,7 +4704,7 @@ var NodeTriggerController = class {
   async startSession(agentId, agent, unitId) {
     const key = this.sessionKey(agentId, unitId);
     try {
-      const prompt = resolvePrompt(agentId, unitId, agent.in);
+      const prompt = resolvePrompt(agentId, unitId, agent.in, agent.po);
       const sessionId = await this.adapter.start({
         agentId,
         prompt,
@@ -6906,19 +6957,26 @@ init_config();
 // src/server/graph/core/resolve-paths.ts
 var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
+function detectDbDir(rootDir, config) {
+  if (config.paths?.dbDir) return (0, import_node_path2.join)(rootDir, config.paths.dbDir);
+  const prismaDir = (0, import_node_path2.join)(rootDir, "prisma");
+  if ((0, import_node_fs2.existsSync)(prismaDir)) return prismaDir;
+  return null;
+}
 function resolveProjectPaths(rootDir, config) {
+  const dbDir = detectDbDir(rootDir, config);
   if (config.paths?.appDir) {
     const appDir = (0, import_node_path2.join)(rootDir, config.paths.appDir);
     const srcDir = config.paths.srcDir ? (0, import_node_path2.join)(rootDir, config.paths.srcDir) : (0, import_node_path2.dirname)(appDir);
-    return { srcDir, appDir, apiDir: (0, import_node_path2.join)(appDir, "api") };
+    return { srcDir, appDir, apiDir: (0, import_node_path2.join)(appDir, "api"), dbDir };
   }
   const srcApp = (0, import_node_path2.join)(rootDir, "src", "app");
   if ((0, import_node_fs2.existsSync)(srcApp)) {
-    return { srcDir: (0, import_node_path2.join)(rootDir, "src"), appDir: srcApp, apiDir: (0, import_node_path2.join)(srcApp, "api") };
+    return { srcDir: (0, import_node_path2.join)(rootDir, "src"), appDir: srcApp, apiDir: (0, import_node_path2.join)(srcApp, "api"), dbDir };
   }
   const rootApp = (0, import_node_path2.join)(rootDir, "app");
   if ((0, import_node_fs2.existsSync)(rootApp)) {
-    return { srcDir: rootDir, appDir: rootApp, apiDir: (0, import_node_path2.join)(rootApp, "api") };
+    return { srcDir: rootDir, appDir: rootApp, apiDir: (0, import_node_path2.join)(rootApp, "api"), dbDir };
   }
   return null;
 }
@@ -8282,6 +8340,7 @@ function resolveUrlPath(urlPath, apiPathMap, apiRoutes) {
 var fetchResolverParser = {
   id: "fetch-resolver",
   layer: "crosslayer",
+  concern: "api-binding",
   detect(_rootDir) {
     return true;
   },
@@ -8395,6 +8454,7 @@ function toNodeId2(srcDir, absPath) {
 var apiAnnotationsParser = {
   id: "api-annotations",
   layer: "crosslayer",
+  concern: "api-binding",
   detect(rootDir) {
     return (0, import_node_fs7.existsSync)((0, import_node_path7.join)(rootDir, "src"));
   },
@@ -8481,6 +8541,7 @@ function toNodeId3(srcDir, absPath) {
 var urlLiteralScannerParser = {
   id: "url-literal-scanner",
   layer: "crosslayer",
+  concern: "api-binding",
   detect(rootDir) {
     const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
     return paths !== null;
@@ -9092,6 +9153,7 @@ function collectStaticRefsRegex(content, valueLookup, allValues) {
 var staticRefScannerParser = {
   id: "static-ref-scanner",
   layer: "crosslayer",
+  concern: "static-ref",
   detect(rootDir) {
     const paths = resolveProjectPaths(rootDir, loadConfig(rootDir));
     return paths !== null;
@@ -9276,6 +9338,9 @@ function loadCustomParsers(registry, config, rootDir, disabled) {
 `
         );
       }
+      if (parser.layer === "crosslayer" && entry.concern && !("concern" in parser && parser.concern)) {
+        parser.concern = entry.concern;
+      }
       registry.register(parser);
     } catch (err2) {
       process.stderr.write(`[launch-chart] failed to load custom parser from ${entry.path}: ${err2}
@@ -9373,44 +9438,21 @@ function dedupCrossRefs(refs) {
   }
   return result;
 }
-function applyCrossLayerResults(uiOutput, results, primaryId) {
-  const allCrossRefs = [...uiOutput.cross_refs];
-  const allFlagged = [...uiOutput.flagged_edges];
-  const allWarnings = [...uiOutput.warnings];
-  const primaryResult = results.find((r) => r.parserId === primaryId);
-  const secondaryResults = results.filter((r) => r.parserId !== primaryId);
-  if (primaryResult) {
-    allCrossRefs.push(...primaryResult.output.cross_refs);
-    allFlagged.push(...primaryResult.output.flagged_edges);
-    allWarnings.push(...primaryResult.output.warnings);
-  }
-  const primarySet = new Set(
-    (primaryResult?.output.cross_refs ?? []).map((r) => `${r.source}|${r.target}|${r.type}`)
-  );
-  for (const sec of secondaryResults) {
-    for (const ref of sec.output.cross_refs) {
-      const key = `${ref.source}|${ref.target}|${ref.type}`;
-      if (primarySet.has(key)) {
-        allCrossRefs.push(ref);
-      } else {
-        allFlagged.push({
-          source: ref.source,
-          target: ref.target,
-          type: "out_of_pattern",
-          label: `API call detected by ${sec.parserId} but not by primary (${primaryId})`,
-          confidence: "medium"
-        });
-        allCrossRefs.push(ref);
-      }
-    }
-    allFlagged.push(...sec.output.flagged_edges);
-    allWarnings.push(...sec.output.warnings);
-  }
+function applyCrossLayerResults(uiOutput, results) {
   return {
     ...uiOutput,
-    cross_refs: dedupCrossRefs(allCrossRefs),
-    flagged_edges: allFlagged,
-    warnings: allWarnings
+    cross_refs: dedupCrossRefs([
+      ...uiOutput.cross_refs,
+      ...results.flatMap((r) => r.output.cross_refs)
+    ]),
+    flagged_edges: [
+      ...uiOutput.flagged_edges,
+      ...results.flatMap((r) => r.output.flagged_edges)
+    ],
+    warnings: [
+      ...uiOutput.warnings,
+      ...results.flatMap((r) => r.output.warnings)
+    ]
   };
 }
 
@@ -9449,10 +9491,9 @@ function generateLayer(rootDir, layer) {
       if (existing) layerOutputs.set(otherLayer, existing);
     }
     const crossParsers = registry.getCrossLayerParsers();
-    const primaryId = config.parsers?.primary?.crosslayer ?? crossParsers[0]?.id ?? null;
     const crossResults = crossParsers.filter((p) => p.detect(rootDir)).map((p) => ({ parserId: p.id, output: p.generate(rootDir, layerOutputs) }));
     if (crossResults.length > 0) {
-      merged = applyCrossLayerResults(merged, crossResults, primaryId);
+      merged = applyCrossLayerResults(merged, crossResults);
     }
   }
   return {
@@ -9499,11 +9540,10 @@ function generateAll(rootDir) {
     });
   }
   const crossParsers = registry.getCrossLayerParsers();
-  const primaryId = config.parsers?.primary?.crosslayer ?? crossParsers[0]?.id ?? null;
   const crossResults = crossParsers.filter((p) => p.detect(rootDir)).map((p) => ({ parserId: p.id, output: p.generate(rootDir, layerOutputs) }));
   if (crossResults.length > 0 && layerOutputs.has("ui")) {
     const uiOutput = layerOutputs.get("ui");
-    const merged = applyCrossLayerResults(uiOutput, crossResults, primaryId);
+    const merged = applyCrossLayerResults(uiOutput, crossResults);
     layerOutputs.set("ui", merged);
     const uiResult = results.find((r) => r.layer === "ui");
     if (uiResult) {
@@ -10110,35 +10150,237 @@ async function handleGraphCommand(subcommand, args) {
 }
 
 // src/server/graph-mcp.ts
-var import_node_fs18 = require("node:fs");
-var import_node_path20 = require("node:path");
+var import_node_fs19 = require("node:fs");
+var import_node_path21 = require("node:path");
 var import_node_child_process2 = require("node:child_process");
 var import_node_os2 = require("node:os");
 
+// src/server/blast-radius-builder.ts
+var import_node_fs15 = __toESM(require("node:fs"));
+var import_node_path17 = require("node:path");
+var FALLBACK_DEFAULTS = {
+  rings: [
+    { id: "modify", name: "Modify", color: "#ff6b00" },
+    { id: "ripple", name: "Ripple (verify)", color: "#ffff00" },
+    { id: "create", name: "Create", color: "#00ff00" }
+  ],
+  layers: {
+    db: { name: "Database", icon: "database", color: "#cbd5e1" },
+    api: { name: "API", icon: "server", color: "#cbd5e1" },
+    middleware: { name: "Middleware", icon: "shield", color: "#cbd5e1" },
+    ui: { name: "UI", icon: "layout-dashboard", color: "#cbd5e1" },
+    config: { name: "Config / Seed", icon: "settings", color: "#cbd5e1" },
+    shared: { name: "Shared Types", icon: "box", color: "#cbd5e1" }
+  },
+  center: { color: "#ff0000" }
+};
+function loadDefaults(rootDir) {
+  const filePath = (0, import_node_path17.join)(rootDir, ".launchsecure", "blast-radius-defaults.json");
+  try {
+    if (import_node_fs15.default.existsSync(filePath)) {
+      const raw = import_node_fs15.default.readFileSync(filePath, "utf-8");
+      return JSON.parse(raw);
+    }
+  } catch {
+  }
+  return FALLBACK_DEFAULTS;
+}
+function generateAcceptance(node, inspect) {
+  const criteria = [];
+  const t = node.type?.toLowerCase() ?? "";
+  if (t === "endpoint" || t === "mcp-tool") {
+    const methods = inspect?.methods ?? [];
+    const path9 = inspect?.path ?? node.id;
+    if (methods.length > 0) {
+      criteria.push(`${methods.join("/")} ${path9} still returns correct responses for authorized users`);
+    } else {
+      criteria.push(`${path9} still responds correctly`);
+    }
+    if (inspect?.auth && inspect.auth.includes("withAuth")) {
+      criteria.push("Authentication and authorization still enforced");
+    }
+    if (inspect?.db_models && inspect.db_models.length > 0) {
+      criteria.push(`DB operations on ${inspect.db_models.join(", ")} still work correctly`);
+    }
+  } else if (t === "page" || t === "component" || t === "layout") {
+    criteria.push(`${node.name} renders without errors`);
+    if (inspect?.stateVars && inspect.stateVars.length > 0) {
+      criteria.push("State management still works correctly");
+    }
+    if (inspect?.elements && inspect.elements.length > 5) {
+      criteria.push("All child components render correctly");
+    }
+  } else if (t === "table" || t === "enum") {
+    criteria.push(`${node.name} schema unchanged or migration applies cleanly`);
+    criteria.push("Existing queries against this table still work");
+  } else if (t === "hook") {
+    criteria.push(`${node.name} returns expected shape`);
+    if (inspect?.stateVars && inspect.stateVars.length > 0) {
+      criteria.push(`State variables [${inspect.stateVars.map((s) => s.name).join(", ")}] still returned`);
+    }
+  } else if (t === "context") {
+    criteria.push(`${node.name} provides correct context to consumers`);
+  } else if (t === "lib" || t === "config" || t === "types") {
+    criteria.push(`${node.name} exports still conform to expected interface`);
+  } else if (t === "seed" || t === "seed_role" || t === "seed_permission") {
+    criteria.push("Seed runs without errors");
+    criteria.push("Expected rows created in database");
+  } else {
+    criteria.push("Verify no regression");
+  }
+  return criteria;
+}
+function buildManifest(input) {
+  const { mode, title, description, subtitle, blastResults, createNodes, inspectData, defaults } = input;
+  const nodeMap = /* @__PURE__ */ new Map();
+  const centerNodeIds = /* @__PURE__ */ new Set();
+  for (const result of blastResults) {
+    centerNodeIds.add(result.center.id);
+    for (const node of result.affected) {
+      const existing = nodeMap.get(node.id);
+      if (!existing || node.hop < existing.hop) {
+        nodeMap.set(node.id, node);
+      }
+    }
+  }
+  for (const id of centerNodeIds) {
+    nodeMap.delete(id);
+  }
+  const manifestNodes = [];
+  for (const result of blastResults) {
+    const c = result.center;
+    if (manifestNodes.some((n) => n.id === c.id)) continue;
+    const inspect = inspectData[c.id];
+    manifestNodes.push({
+      id: c.id,
+      name: c.name,
+      layer: c.layer,
+      ring: "modify",
+      type: c.type,
+      reason: `Direct change target`,
+      acceptance: generateAcceptance(
+        { id: c.id, name: c.name, type: c.type, layer: c.layer, hop: 0 },
+        inspect
+      )
+    });
+  }
+  for (const [, node] of nodeMap) {
+    const ring = node.hop <= 1 ? "modify" : "ripple";
+    const inspect = inspectData[node.id];
+    const reason = node.hop <= 1 ? `Directly depends on changed node` : `Indirect dependency (${node.hop} hops away)`;
+    manifestNodes.push({
+      id: node.id,
+      name: node.name,
+      layer: node.layer,
+      ring,
+      type: node.type,
+      reason,
+      acceptance: generateAcceptance(node, inspect)
+    });
+  }
+  for (const cn of createNodes) {
+    manifestNodes.push({
+      id: cn.id,
+      name: cn.name,
+      layer: cn.layer,
+      ring: "create",
+      type: cn.type ?? "unknown",
+      reason: cn.reason,
+      acceptance: cn.acceptance ?? ["Verify implementation matches spec"]
+    });
+  }
+  const layerIds = /* @__PURE__ */ new Set();
+  for (const n of manifestNodes) {
+    layerIds.add(n.layer);
+  }
+  const layers = [];
+  for (const id of layerIds) {
+    const def = defaults.layers[id];
+    if (def) {
+      layers.push({ id, name: def.name, icon: def.icon, color: def.color });
+    } else {
+      layers.push({ id, name: id, icon: "box", color: "#cbd5e1" });
+    }
+  }
+  const edgeSet = /* @__PURE__ */ new Set();
+  const edges = [];
+  const allNodeIds = new Set(manifestNodes.map((n) => n.id));
+  for (const cId of centerNodeIds) {
+    for (const result of blastResults) {
+      for (const affected of result.affected) {
+        if (affected.hop === 1 && result.center.id === cId && allNodeIds.has(affected.id)) {
+          const key = `${cId}->${affected.id}`;
+          if (!edgeSet.has(key)) {
+            edgeSet.add(key);
+            edges.push({ source: cId, target: affected.id });
+          }
+        }
+      }
+    }
+  }
+  for (const result of blastResults) {
+    if (result.edges) {
+      for (const edge of result.edges) {
+        if (allNodeIds.has(edge.source) && allNodeIds.has(edge.target)) {
+          const key = `${edge.source}->${edge.target}`;
+          if (!edgeSet.has(key)) {
+            edgeSet.add(key);
+            edges.push({ source: edge.source, target: edge.target });
+          }
+        }
+      }
+    }
+  }
+  for (const cn of createNodes) {
+    edges.push({ source: "center", target: cn.id });
+    if (cn.connects_to) {
+      for (const targetId of cn.connects_to) {
+        if (allNodeIds.has(targetId) || createNodes.some((c) => c.id === targetId)) {
+          const key = `${cn.id}->${targetId}`;
+          if (!edgeSet.has(key)) {
+            edgeSet.add(key);
+            edges.push({ source: cn.id, target: targetId });
+          }
+        }
+      }
+    }
+  }
+  return {
+    mode,
+    title,
+    subtitle,
+    layers,
+    rings: defaults.rings,
+    center: { name: title, description },
+    nodes: manifestNodes,
+    edges
+  };
+}
+
 // src/server/lockfile.ts
 var import_node_child_process = require("node:child_process");
-var import_node_fs15 = require("node:fs");
+var import_node_fs16 = require("node:fs");
 var import_node_os = require("node:os");
-var import_node_path17 = require("node:path");
+var import_node_path18 = require("node:path");
 function lockDir(projectRoot) {
   if (projectRoot) {
-    return (0, import_node_path17.join)(projectRoot, ".launchsecure");
+    return (0, import_node_path18.join)(projectRoot, ".launchsecure");
   }
-  return (0, import_node_path17.join)((0, import_node_os.homedir)(), ".launchsecure");
+  return (0, import_node_path18.join)((0, import_node_os.homedir)(), ".launchsecure");
 }
 function lockPath(projectRoot) {
-  return (0, import_node_path17.join)(lockDir(projectRoot), "launch-chart.lock");
+  return (0, import_node_path18.join)(lockDir(projectRoot), "launch-chart.lock");
 }
 var _activeProjectRoot;
 function readLock(projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
   const p = lockPath(root);
-  if (!(0, import_node_fs15.existsSync)(p)) {
+  if (!(0, import_node_fs16.existsSync)(p)) {
     if (root) {
       const globalP = lockPath();
-      if ((0, import_node_fs15.existsSync)(globalP)) {
+      if ((0, import_node_fs16.existsSync)(globalP)) {
         try {
-          const data = JSON.parse((0, import_node_fs15.readFileSync)(globalP, "utf-8"));
+          const data = JSON.parse((0, import_node_fs16.readFileSync)(globalP, "utf-8"));
           if (typeof data.pid === "number" && typeof data.port === "number" && data.cwd === root) {
             return data;
           }
@@ -10149,7 +10391,7 @@ function readLock(projectRoot) {
     return null;
   }
   try {
-    const data = JSON.parse((0, import_node_fs15.readFileSync)(p, "utf-8"));
+    const data = JSON.parse((0, import_node_fs16.readFileSync)(p, "utf-8"));
     if (typeof data.pid !== "number" || typeof data.port !== "number") return null;
     return data;
   } catch {
@@ -10186,7 +10428,7 @@ function getLiveLock(projectRoot) {
   const live = listenerPid !== null ? listenerPid === lock.pid : isPidAlive(lock.pid);
   if (!live) {
     try {
-      (0, import_node_fs15.unlinkSync)(lockPath(root));
+      (0, import_node_fs16.unlinkSync)(lockPath(root));
     } catch {
     }
     return null;
@@ -10196,7 +10438,7 @@ function getLiveLock(projectRoot) {
 function clearLock(projectRoot) {
   const root = projectRoot ?? _activeProjectRoot;
   try {
-    (0, import_node_fs15.unlinkSync)(lockPath(root));
+    (0, import_node_fs16.unlinkSync)(lockPath(root));
   } catch {
   }
 }
@@ -10205,8 +10447,8 @@ function clearLock(projectRoot) {
 init_config();
 
 // src/server/graph/core/language-detection.ts
-var import_node_fs16 = require("node:fs");
-var import_node_path18 = require("node:path");
+var import_node_fs17 = require("node:fs");
+var import_node_path19 = require("node:path");
 var EXTENSION_TO_LANGUAGE = {
   // Web / Frontend
   ".ts": "typescript",
@@ -10318,10 +10560,10 @@ var AUXILIARY_LANGUAGES = /* @__PURE__ */ new Set([
 ]);
 function walkForExtensions(dir, extCounts, depth = 0) {
   if (depth > 10) return;
-  if (!(0, import_node_fs16.existsSync)(dir)) return;
+  if (!(0, import_node_fs17.existsSync)(dir)) return;
   let entries;
   try {
-    entries = (0, import_node_fs16.readdirSync)(dir, { withFileTypes: true });
+    entries = (0, import_node_fs17.readdirSync)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -10329,9 +10571,9 @@ function walkForExtensions(dir, extCounts, depth = 0) {
     if (entry.name.startsWith(".") && entry.isDirectory()) continue;
     if (entry.isDirectory()) {
       if (IGNORE_DIRS.has(entry.name)) continue;
-      walkForExtensions((0, import_node_path18.join)(dir, entry.name), extCounts, depth + 1);
+      walkForExtensions((0, import_node_path19.join)(dir, entry.name), extCounts, depth + 1);
     } else {
-      const ext = (0, import_node_path18.extname)(entry.name).toLowerCase();
+      const ext = (0, import_node_path19.extname)(entry.name).toLowerCase();
       if (ext && EXTENSION_TO_LANGUAGE[ext]) {
         extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
       }
@@ -10372,13 +10614,13 @@ function detectLanguages(rootDir, supportedLanguages) {
 }
 
 // src/server/graph/core/audit-core.ts
-var import_node_fs17 = require("node:fs");
-var import_node_path19 = require("node:path");
+var import_node_fs18 = require("node:fs");
+var import_node_path20 = require("node:path");
 function readGraphFile(rootDir, layer) {
-  const filePath = (0, import_node_path19.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
-  if (!(0, import_node_fs17.existsSync)(filePath)) return null;
+  const filePath = (0, import_node_path20.join)(rootDir, ".launchsecure", "graphs", `${layer}.json`);
+  if (!(0, import_node_fs18.existsSync)(filePath)) return null;
   try {
-    return JSON.parse((0, import_node_fs17.readFileSync)(filePath, "utf-8"));
+    return JSON.parse((0, import_node_fs18.readFileSync)(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -10422,10 +10664,10 @@ function checkUnprotectedRoutes(rootDir) {
   const api = readGraphFile(rootDir, "api");
   const staticGraph = readGraphFile(rootDir, "static");
   if (!api) return buildReport("api", "unprotected_routes", findings);
-  const routePermsPath = (0, import_node_path19.join)(rootDir, "src", "config", "route-permissions.ts");
+  const routePermsPath = (0, import_node_path20.join)(rootDir, "src", "config", "route-permissions.ts");
   let routePermsContent = "";
-  if ((0, import_node_fs17.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs17.readFileSync)(routePermsPath, "utf-8");
+  if ((0, import_node_fs18.existsSync)(routePermsPath)) {
+    routePermsContent = (0, import_node_fs18.readFileSync)(routePermsPath, "utf-8");
   }
   const registeredRoutes = /* @__PURE__ */ new Set();
   const routeEntryRe = /path:\s*'([^']+)'/g;
@@ -10502,10 +10744,10 @@ function checkUnenforcedPermissions(rootDir) {
   const staticGraph = readGraphFile(rootDir, "static");
   if (!staticGraph) return buildReport("static", "unenforced_permissions", findings);
   const permissions = staticGraph.nodes.filter((n) => n.type === "seed_permission").map((n) => ({ id: n.id, key: n.value, name: n.name }));
-  const routePermsPath = (0, import_node_path19.join)(rootDir, "src", "config", "route-permissions.ts");
+  const routePermsPath = (0, import_node_path20.join)(rootDir, "src", "config", "route-permissions.ts");
   let routePermsContent = "";
-  if ((0, import_node_fs17.existsSync)(routePermsPath)) {
-    routePermsContent = (0, import_node_fs17.readFileSync)(routePermsPath, "utf-8");
+  if ((0, import_node_fs18.existsSync)(routePermsPath)) {
+    routePermsContent = (0, import_node_fs18.readFileSync)(routePermsPath, "utf-8");
   }
   for (const perm of permissions) {
     const regex = new RegExp(`permission:\\s*['"]${perm.key}['"]`);
@@ -10535,9 +10777,9 @@ function checkHardcodedValues(rootDir) {
   const seen = /* @__PURE__ */ new Set();
   for (const node of api.nodes) {
     if (node.type !== "endpoint") continue;
-    const filePath = (0, import_node_path19.join)(rootDir, "src", node.id);
-    if (!(0, import_node_fs17.existsSync)(filePath)) continue;
-    const content = (0, import_node_fs17.readFileSync)(filePath, "utf-8");
+    const filePath = (0, import_node_path20.join)(rootDir, "src", node.id);
+    if (!(0, import_node_fs18.existsSync)(filePath)) continue;
+    const content = (0, import_node_fs18.readFileSync)(filePath, "utf-8");
     let m;
     allCapsRe.lastIndex = 0;
     while ((m = allCapsRe.exec(content)) !== null) {
@@ -10901,6 +11143,116 @@ Use this when the user asks "is the chart running", "show me the project graph U
       },
       required: ["layer"]
     }
+  },
+  {
+    name: "blast_points",
+    description: `Calculate the blast radius for a node \u2014 what depends on it across all project layers. Returns reverse dependencies aggregated with hop distance and summary stats.
+
+USE THIS when assessing the impact of changing a file, table, or endpoint. Replaces multiple read_graph calls with a single query that:
+- Traverses REVERSE edges (who imports/depends on this node)
+- Searches across ALL layers if layer is omitted
+- Returns affected nodes with hop distance, type, layer, and module
+- Provides a summary with counts by layer, by hop, and risk assessment
+
+Example: blast_points(node_id: "server/auth/middleware.ts", hops: 2) \u2192 returns all files that import middleware.ts, and all files that import THOSE files.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        node_id: {
+          type: "string",
+          description: "The node to analyze (file path, table name, etc.)"
+        },
+        layer: {
+          type: "string",
+          description: "Layer the node lives in (e.g. 'ui', 'api', 'db'). Omit to auto-detect by searching all layers."
+        },
+        hops: {
+          type: "number",
+          description: "Max hops to traverse outward. Default 2."
+        },
+        direction: {
+          type: "string",
+          enum: ["reverse", "both"],
+          description: "'reverse' (default) = only what depends on this node. 'both' = full neighborhood."
+        }
+      },
+      required: ["node_id"]
+    }
+  },
+  {
+    name: "generate_blast_radius",
+    description: `Generate a complete BlastRadiusManifest from graph data \u2014 ready to push to deck.
+
+Two modes:
+- **Structural**: single node changed \u2192 auto-discover what's affected via reverse BFS
+  Example: generate_blast_radius({ mode: "structural", node_id: "CommentChannel", title: "CommentChannel refactor" })
+- **Feature**: new feature \u2192 multiple starting nodes + new nodes to create
+  Example: generate_blast_radius({ mode: "feature", title: "Client Role", description: "...", center_nodes: ["CommentChannel", "ProjectMember"], create_nodes: [{ id: "ChannelMember", name: "ChannelMember table", layer: "db", reason: "..." }] })
+
+Output is a BlastRadiusManifest JSON that passes directly to the deck tool's blast-radius block.
+Reads ring/layer/center colors from .launchsecure/blast-radius-defaults.json.
+Auto-generates acceptance criteria per node using inspect_node AST data.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        mode: {
+          type: "string",
+          enum: ["structural", "feature"],
+          description: '"structural" = single node changed. "feature" = new feature with multiple nodes.'
+        },
+        title: {
+          type: "string",
+          description: "Title for the blast radius (shown in center node and header)."
+        },
+        description: {
+          type: "string",
+          description: "Description of the change or feature."
+        },
+        subtitle: {
+          type: "string",
+          description: "Optional subtitle shown above title in the viz."
+        },
+        node_id: {
+          type: "string",
+          description: "Structural mode only: the node being changed."
+        },
+        center_nodes: {
+          type: "array",
+          items: { type: "string" },
+          description: "Feature mode: existing graph node IDs that are the starting points for traversal."
+        },
+        create_nodes: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              id: { type: "string" },
+              name: { type: "string" },
+              layer: { type: "string" },
+              type: { type: "string" },
+              reason: { type: "string" },
+              acceptance: { type: "array", items: { type: "string" } },
+              connects_to: { type: "array", items: { type: "string" }, description: "IDs of existing nodes this new node has FK/relationship edges to." }
+            },
+            required: ["id", "name", "layer", "reason"]
+          },
+          description: "Feature mode: new nodes that need to be created (not in graph yet)."
+        },
+        hops: {
+          type: "number",
+          description: "Max hops for traversal. Default 2. Hop 1 = modify ring, hop 2+ = ripple ring."
+        },
+        push_to_deck: {
+          type: "boolean",
+          description: "If true, pushes the manifest directly to LaunchDeck browser (requires deck server running). Default false."
+        },
+        session: {
+          type: "string",
+          description: "Session name for the deck tab. Required when push_to_deck is true."
+        }
+      },
+      required: ["title"]
+    }
   }
 ];
 function matchesSearch(node, query) {
@@ -11058,6 +11410,263 @@ function neighborhood(graph, centerId, hops, layer, minimal) {
   const edges = graph.edges.filter((e) => visited.has(e.source) && visited.has(e.target));
   return { nodes, edges, budgetExceeded, stoppedAtHop };
 }
+function reverseNeighborhood(graph, centerId, hops, direction) {
+  const center = graph.nodes.find((n) => n.id === centerId);
+  if (!center) return { nodes: /* @__PURE__ */ new Map(), edges: [] };
+  const visited = /* @__PURE__ */ new Map();
+  visited.set(centerId, { node: center, hop: 0 });
+  let frontier = /* @__PURE__ */ new Set([centerId]);
+  for (let h = 0; h < hops; h++) {
+    const next = /* @__PURE__ */ new Set();
+    for (const edge of graph.edges) {
+      if (direction === "reverse") {
+        if (frontier.has(edge.target) && !visited.has(edge.source)) next.add(edge.source);
+      } else {
+        if (frontier.has(edge.source) && !visited.has(edge.target)) next.add(edge.target);
+        if (frontier.has(edge.target) && !visited.has(edge.source)) next.add(edge.source);
+      }
+    }
+    for (const id of next) {
+      const node = graph.nodes.find((n) => n.id === id);
+      if (node) visited.set(id, { node, hop: h + 1 });
+    }
+    frontier = next;
+    if (frontier.size === 0) break;
+  }
+  const nodeIds = new Set(visited.keys());
+  const edges = graph.edges.filter((e) => nodeIds.has(e.source) && nodeIds.has(e.target));
+  return { nodes: visited, edges };
+}
+function handleBlastPoints(args) {
+  const rootDir = process.cwd();
+  const nodeId = args.node_id;
+  const requestedLayer = args.layer;
+  const hops = args.hops ?? 2;
+  const direction = args.direction ?? "reverse";
+  let targetLayer = requestedLayer;
+  if (!targetLayer) {
+    const graphs = readAllGraphs(rootDir);
+    for (const [layer, graph2] of Object.entries(graphs)) {
+      if (graph2 && graph2.nodes.some((n) => n.id === nodeId)) {
+        targetLayer = layer;
+        break;
+      }
+    }
+    if (!targetLayer) {
+      return err(`Node "${nodeId}" not found in any layer. Available layers: ${getAvailableLayers(rootDir).join(", ")}`);
+    }
+  }
+  const graph = readGraph(rootDir, targetLayer);
+  if (!graph) {
+    return err(`No graph for layer "${targetLayer}". Run generate_graph first.`);
+  }
+  const center = graph.nodes.find((n) => n.id === nodeId);
+  if (!center) {
+    return err(`Node "${nodeId}" not found in ${targetLayer} layer.`);
+  }
+  const result = reverseNeighborhood(graph, nodeId, hops, direction);
+  const affected = [];
+  for (const [id, { node, hop }] of result.nodes) {
+    if (id === nodeId) continue;
+    const tags = node.tags;
+    affected.push({
+      id: node.id,
+      name: node.name,
+      type: node.type,
+      layer: targetLayer,
+      hop,
+      module: tags?.module
+    });
+  }
+  const otherLayers = getAvailableLayers(rootDir).filter((l) => l !== targetLayer && l !== "static");
+  for (const otherLayer of otherLayers) {
+    const otherGraph = readGraph(rootDir, otherLayer);
+    if (!otherGraph) continue;
+    for (const edge of otherGraph.edges) {
+      if (edge.target === nodeId || edge.source === nodeId) {
+        const dependentId = edge.target === nodeId ? edge.source : edge.target;
+        if (affected.some((a) => a.id === dependentId)) continue;
+        const depNode = otherGraph.nodes.find((n) => n.id === dependentId);
+        if (depNode) {
+          const tags = depNode.tags;
+          affected.push({
+            id: depNode.id,
+            name: depNode.name,
+            type: depNode.type,
+            layer: otherLayer,
+            hop: 1,
+            module: tags?.module
+          });
+        }
+      }
+    }
+  }
+  const byLayer = {};
+  const byHop = {};
+  const modulesSet = /* @__PURE__ */ new Set();
+  for (const a of affected) {
+    byLayer[a.layer] = (byLayer[a.layer] ?? 0) + 1;
+    byHop[String(a.hop)] = (byHop[String(a.hop)] ?? 0) + 1;
+    if (a.module) modulesSet.add(a.module);
+  }
+  const crossesLayers = Object.keys(byLayer).length > 1;
+  const centerTags = center.tags;
+  return okJson({
+    center: {
+      id: center.id,
+      name: center.name,
+      type: center.type,
+      layer: targetLayer,
+      module: centerTags?.module
+    },
+    affected,
+    summary: {
+      total: affected.length,
+      by_layer: byLayer,
+      by_hop: byHop,
+      modules_touched: Array.from(modulesSet).sort(),
+      crosses_layers: crossesLayers
+    }
+  });
+}
+function handleGenerateBlastRadius(args) {
+  const rootDir = process.cwd();
+  const mode = args.mode ?? "structural";
+  const title = args.title;
+  const description = args.description ?? title;
+  const subtitle = args.subtitle;
+  const hops = args.hops ?? 2;
+  const defaults = loadDefaults(rootDir);
+  let centerNodeIds = [];
+  if (mode === "structural") {
+    const nodeId = args.node_id;
+    if (!nodeId) return err("structural mode requires node_id");
+    centerNodeIds = [nodeId];
+  } else {
+    centerNodeIds = args.center_nodes ?? [];
+    if (centerNodeIds.length === 0) return err("feature mode requires center_nodes[]");
+  }
+  const createNodes = args.create_nodes ?? [];
+  const blastResults = [];
+  for (const nodeId of centerNodeIds) {
+    let targetLayer;
+    const graphs = readAllGraphs(rootDir);
+    for (const [layer, graph2] of Object.entries(graphs)) {
+      if (graph2 && graph2.nodes.some((n) => n.id === nodeId)) {
+        targetLayer = layer;
+        break;
+      }
+    }
+    if (!targetLayer) continue;
+    const graph = readGraph(rootDir, targetLayer);
+    if (!graph) continue;
+    const center = graph.nodes.find((n) => n.id === nodeId);
+    if (!center) continue;
+    const result2 = reverseNeighborhood(graph, nodeId, hops, "reverse");
+    const affected = [];
+    for (const [id, { node, hop }] of result2.nodes) {
+      if (id === nodeId) continue;
+      const tags = node.tags;
+      affected.push({ id: node.id, name: node.name, type: node.type, layer: targetLayer, hop, module: tags?.module });
+    }
+    const otherLayers = getAvailableLayers(rootDir).filter((l) => l !== targetLayer && l !== "static");
+    for (const otherLayer of otherLayers) {
+      const otherGraph = readGraph(rootDir, otherLayer);
+      if (!otherGraph) continue;
+      for (const edge of otherGraph.edges) {
+        if (edge.target === nodeId || edge.source === nodeId) {
+          const dependentId = edge.target === nodeId ? edge.source : edge.target;
+          if (affected.some((a) => a.id === dependentId)) continue;
+          const depNode = otherGraph.nodes.find((n) => n.id === dependentId);
+          if (depNode) {
+            const tags = depNode.tags;
+            affected.push({ id: depNode.id, name: depNode.name, type: depNode.type, layer: otherLayer, hop: 1, module: tags?.module });
+          }
+        }
+      }
+    }
+    const centerTags = center.tags;
+    const edges = result2.edges.map((e) => ({ source: e.source, target: e.target }));
+    blastResults.push({
+      center: { id: center.id, name: center.name, type: center.type, layer: targetLayer, module: centerTags?.module },
+      affected,
+      edges
+    });
+  }
+  if (blastResults.length === 0) {
+    return err(`None of the center nodes were found in any graph layer: ${centerNodeIds.join(", ")}`);
+  }
+  const inspectData = {};
+  const allAffectedIds = /* @__PURE__ */ new Set();
+  for (const r of blastResults) {
+    allAffectedIds.add(r.center.id);
+    for (const a of r.affected) allAffectedIds.add(a.id);
+  }
+  const allGraphs = readAllGraphs(rootDir);
+  for (const id of allAffectedIds) {
+    for (const [, graph] of Object.entries(allGraphs)) {
+      if (!graph) continue;
+      const node = graph.nodes.find((n) => n.id === id);
+      if (node) {
+        inspectData[id] = {
+          type: node.type,
+          name: node.name,
+          methods: node.methods,
+          path: node.path ?? node.handler,
+          auth: node.auth,
+          db_models: node.db_models
+        };
+        break;
+      }
+    }
+  }
+  const manifest = buildManifest({
+    mode,
+    title,
+    description,
+    subtitle,
+    blastResults,
+    createNodes,
+    inspectData,
+    defaults
+  });
+  const pushToDeck = args.push_to_deck;
+  const session = args.session;
+  let deckResult;
+  if (pushToDeck) {
+    if (!session) return err("push_to_deck requires a session name");
+    const deckLockPath = (0, import_node_path21.join)(rootDir, ".launchsecure", "launch-deck.lock");
+    if (!(0, import_node_fs19.existsSync)(deckLockPath)) {
+      deckResult = { pushed: false, reason: "Deck server not running (no lock file). Push manually via deck tool." };
+    } else {
+      try {
+        const lock = JSON.parse((0, import_node_fs19.readFileSync)(deckLockPath, "utf-8"));
+        const deckUrl = lock.url;
+        const body = JSON.stringify({
+          session,
+          mode: "show",
+          blocks: [{ type: "blast-radius", label: title, manifest }]
+        });
+        (0, import_node_child_process2.execFileSync)("curl", [
+          "-s",
+          "-X",
+          "POST",
+          deckUrl + "/api/deck",
+          "-H",
+          "Content-Type: application/json",
+          "-d",
+          body
+        ], { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] });
+        deckResult = { pushed: true, session, url: deckUrl };
+      } catch (e) {
+        deckResult = { pushed: false, reason: `Failed to push to deck: ${e}` };
+      }
+    }
+  }
+  const result = { ...manifest };
+  if (deckResult) result._deck = deckResult;
+  return okJson(result);
+}
 function layerSummary(graph) {
   const typeCounts = {};
   const moduleCounts = {};
@@ -11286,12 +11895,12 @@ function handleReadGraph(args) {
   return okJson(result);
 }
 function nodeToFilePath(rootDir, layer, nodeId) {
-  if (layer === "ui" || layer === "api") return (0, import_node_path20.join)(rootDir, "src", nodeId);
-  if (layer === "db") return (0, import_node_path20.join)(rootDir, "prisma", "schema.prisma");
-  const withSrc = (0, import_node_path20.join)(rootDir, "src", nodeId);
-  if ((0, import_node_fs18.existsSync)(withSrc)) return withSrc;
-  const direct = (0, import_node_path20.join)(rootDir, nodeId);
-  if ((0, import_node_fs18.existsSync)(direct)) return direct;
+  if (layer === "ui" || layer === "api") return (0, import_node_path21.join)(rootDir, "src", nodeId);
+  if (layer === "db") return (0, import_node_path21.join)(rootDir, "prisma", "schema.prisma");
+  const withSrc = (0, import_node_path21.join)(rootDir, "src", nodeId);
+  if ((0, import_node_fs19.existsSync)(withSrc)) return withSrc;
+  const direct = (0, import_node_path21.join)(rootDir, nodeId);
+  if ((0, import_node_fs19.existsSync)(direct)) return direct;
   return null;
 }
 function handleInspectNode(args) {
@@ -11434,11 +12043,11 @@ function handleGrepNodes(args) {
   let filesSearched = 0;
   let truncated = false;
   for (const [filePath, nodeId] of filePaths) {
-    if (!(0, import_node_fs18.existsSync)(filePath)) continue;
+    if (!(0, import_node_fs19.existsSync)(filePath)) continue;
     filesSearched++;
     let content;
     try {
-      content = (0, import_node_fs18.readFileSync)(filePath, "utf-8");
+      content = (0, import_node_fs19.readFileSync)(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -11503,11 +12112,11 @@ function handleStartChartServer(args) {
     });
   }
   const entryPath = process.argv[1];
-  const logDir = (0, import_node_path20.join)((0, import_node_os2.homedir)(), ".launchsecure");
-  (0, import_node_fs18.mkdirSync)(logDir, { recursive: true });
-  const logPath = (0, import_node_path20.join)(logDir, "launch-chart.log");
-  const out = (0, import_node_fs18.openSync)(logPath, "a");
-  const err2 = (0, import_node_fs18.openSync)(logPath, "a");
+  const logDir = (0, import_node_path21.join)((0, import_node_os2.homedir)(), ".launchsecure");
+  (0, import_node_fs19.mkdirSync)(logDir, { recursive: true });
+  const logPath = (0, import_node_path21.join)(logDir, "launch-chart.log");
+  const out = (0, import_node_fs19.openSync)(logPath, "a");
+  const err2 = (0, import_node_fs19.openSync)(logPath, "a");
   const portArgs = args.port ? ["--port", String(args.port)] : [];
   const child = (0, import_node_child_process2.spawn)(process.execPath, [entryPath, "serve", ...portArgs], {
     detached: true,
@@ -11619,31 +12228,28 @@ function handleDetectProjectStack() {
       for (const l of p.layers) availableLayers.add(l);
     }
   }
-  let stats = { calls_api: 0, references_api: 0, out_of_pattern: 0, annotations: 0 };
+  const stats = { calls_api: 0, references_api: 0, annotations: 0 };
   const uiGraph = readGraph(rootDir, "ui");
   if (uiGraph) {
     for (const ref of uiGraph.cross_refs ?? []) {
       if (ref.type === "calls_api") stats.calls_api++;
       if (ref.type === "references_api") stats.references_api++;
     }
-    for (const f of uiGraph.flagged_edges ?? []) {
-      if (f.type === "out_of_pattern") stats.out_of_pattern++;
-    }
   }
-  const srcDir = (0, import_node_path20.join)(rootDir, "src");
-  if ((0, import_node_fs18.existsSync)(srcDir)) {
+  const srcDir = (0, import_node_path21.join)(rootDir, "src");
+  if ((0, import_node_fs19.existsSync)(srcDir)) {
     const scanDir = (dir) => {
-      if (!(0, import_node_fs18.existsSync)(dir)) return;
-      for (const entry of (0, import_node_fs18.readdirSync)(dir, { withFileTypes: true })) {
+      if (!(0, import_node_fs19.existsSync)(dir)) return;
+      for (const entry of (0, import_node_fs19.readdirSync)(dir, { withFileTypes: true })) {
         if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-        const full = (0, import_node_path20.join)(dir, entry.name);
+        const full = (0, import_node_path21.join)(dir, entry.name);
         if (entry.isDirectory()) {
           scanDir(full);
           continue;
         }
-        if (![".ts", ".tsx"].includes((0, import_node_path20.extname)(entry.name))) continue;
+        if (![".ts", ".tsx"].includes((0, import_node_path21.extname)(entry.name))) continue;
         try {
-          const content = (0, import_node_fs18.readFileSync)(full, "utf-8");
+          const content = (0, import_node_fs19.readFileSync)(full, "utf-8");
           const matches = content.match(/@api\s+(GET|POST|PUT|DELETE|PATCH)\s+\/\S+/g);
           if (matches) stats.annotations += matches.length;
         } catch {
@@ -11652,12 +12258,6 @@ function handleDetectProjectStack() {
     };
     scanDir(srcDir);
   }
-  let recommendedPrimary = "fetch-resolver";
-  if (stats.annotations > 0 && stats.annotations >= stats.calls_api) {
-    recommendedPrimary = "api-annotations";
-  } else if (stats.calls_api === 0 && stats.references_api > 0) {
-    recommendedPrimary = "url-literal-scanner";
-  }
   const supportedLanguages = /* @__PURE__ */ new Map();
   supportedLanguages.set("typescript", parserResults.filter((p) => p.detected && p.layers.some((l) => l === "ui" || l === "api")).map((p) => p.id));
   supportedLanguages.set("prisma", parserResults.filter((p) => p.detected && p.layers.includes("db")).map((p) => p.id));
@@ -11668,13 +12268,22 @@ function handleDetectProjectStack() {
     languages,
     parsers: parserResults,
     available_layers: [...availableLayers],
-    crosslayer_parsers: [
-      { id: "fetch-resolver", description: "Detects direct fetch()/api.get() calls with inline URLs" },
-      { id: "api-annotations", description: "Scans for @api METHOD /path annotations in JSDoc/comments" },
-      { id: "url-literal-scanner", description: "Finds /api/... string literals as fallback detection" }
-    ],
+    crosslayer_parsers: (() => {
+      const descriptions = {
+        "fetch-resolver": "Detects direct fetch()/api.get() calls with inline URLs",
+        "api-annotations": "Scans for @api METHOD /path annotations in JSDoc/comments",
+        "url-literal-scanner": "Finds /api/... string literals as fallback detection",
+        "static-ref-scanner": "Finds references to static values (enums, permissions, roles)"
+      };
+      const grouped = {};
+      for (const p of registry.getCrossLayerParsers()) {
+        const concern = p.concern ?? "api-binding";
+        if (!grouped[concern]) grouped[concern] = [];
+        grouped[concern].push({ id: p.id, description: descriptions[p.id] ?? p.id });
+      }
+      return grouped;
+    })(),
     stats,
-    recommended_primary: recommendedPrimary,
     ...unsupportedHint ? { unsupported_hint: unsupportedHint } : {},
     current_config: Object.keys(config).length > 0 ? config : null,
     config_path: ".launchchart.json"
@@ -11755,6 +12364,14 @@ async function handleMessage(msg) {
       respond(id ?? null, handleAuditLayer(args));
       return;
     }
+    if (toolName === "blast_points") {
+      respond(id ?? null, handleBlastPoints(args));
+      return;
+    }
+    if (toolName === "generate_blast_radius") {
+      respond(id ?? null, handleGenerateBlastRadius(args));
+      return;
+    }
     respondError(id ?? null, -32601, `Unknown tool: ${toolName}`);
     return;
   }
@@ -11806,7 +12423,8 @@ if (import_fs8.default.existsSync(envPath)) {
   }
 }
 var LAUNCHSECURE_URL = process.env.LAUNCHSECURE_URL || "http://localhost:4177";
-var CONFIG_FILE = "launchpod.config.json";
+var CONFIG_FILE = ".launchpod.json";
+var CONFIG_FILE_LEGACY = "launchpod.config.json";
 var REPO_ROOT = process.cwd();
 var PROJECT_DIR = REPO_ROOT;
 var CREDENTIALS_DIR = import_path8.default.join(PROJECT_DIR, ".launchpod");
@@ -11842,8 +12460,10 @@ function parseArgs() {
       port = parseInt(process.env.PORT, 10);
     } else {
       const configPath = import_path8.default.join(REPO_ROOT, CONFIG_FILE);
-      if (import_fs8.default.existsSync(configPath)) {
-        const config = JSON.parse(import_fs8.default.readFileSync(configPath, "utf-8"));
+      const legacyPath = import_path8.default.join(REPO_ROOT, CONFIG_FILE_LEGACY);
+      const resolvedPath = import_fs8.default.existsSync(configPath) ? configPath : import_fs8.default.existsSync(legacyPath) ? legacyPath : null;
+      if (resolvedPath) {
+        const config = JSON.parse(import_fs8.default.readFileSync(resolvedPath, "utf-8"));
         if (config.port) port = config.port;
       }
     }
@@ -12072,21 +12692,21 @@ function ensureGitRepo(runId) {
     console.log("Git repo initialized");
   }
   const branch = `pipeline/${runId}`;
-  try {
-    const currentBranch = (0, import_child_process4.execSync)("git rev-parse --abbrev-ref HEAD", { cwd: REPO_ROOT, stdio: "pipe" }).toString().trim();
-    if (currentBranch === branch) {
-      console.log(`Already on branch ${branch}`);
-      return;
-    }
-  } catch {
+  const worktreeDir = import_path8.default.join(REPO_ROOT, ".launchpod", "worktrees", runId);
+  if (import_fs8.default.existsSync(worktreeDir)) {
+    PROJECT_DIR = worktreeDir;
+    console.log(`Resuming in existing worktree ${worktreeDir}`);
+    return;
   }
+  import_fs8.default.mkdirSync(import_path8.default.join(REPO_ROOT, ".launchpod", "worktrees"), { recursive: true });
   try {
-    (0, import_child_process4.execSync)(`git checkout "${branch}"`, { cwd: REPO_ROOT, stdio: "pipe" });
-    console.log(`Checked out existing branch ${branch}`);
+    (0, import_child_process4.execSync)(`git worktree add "${worktreeDir}" "${branch}"`, { cwd: REPO_ROOT, stdio: "pipe" });
+    console.log(`Created worktree from existing branch ${branch}`);
   } catch {
-    (0, import_child_process4.execSync)(`git checkout -b "${branch}"`, { cwd: REPO_ROOT, stdio: "pipe" });
-    console.log(`Created branch ${branch}`);
+    (0, import_child_process4.execSync)(`git worktree add -b "${branch}" "${worktreeDir}"`, { cwd: REPO_ROOT, stdio: "pipe" });
+    console.log(`Created worktree with new branch ${branch}`);
   }
+  PROJECT_DIR = worktreeDir;
 }
 function normalizeGitUrl(url) {
   return url.replace(/\.git$/, "").replace(/^git@github\.com:/, "https://github.com/").replace(/\/$/, "").toLowerCase();
@@ -12189,7 +12809,8 @@ function parseTrackerData(result) {
   const runStatus = typeof run?.status === "string" ? run.status : void 0;
   return { agents, interventions, runStatus };
 }
-async function startPipelineSystem(creds) {
+async function startPipelineSystem(creds, capabilities) {
+  const activeCapabilities = capabilities ?? { ...DEFAULT_CAPABILITIES };
   try {
     writeMcpConfigs({
       projectDir: PROJECT_DIR,
@@ -12455,7 +13076,7 @@ if (!__isMcpMode) {
             });
             authenticated = true;
             const savedCreds = loadCredentials();
-            if (savedCreds) startPipelineSystem(savedCreds);
+            if (savedCreds) startPipelineSystem(savedCreds, activeCapabilities);
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({ success: true }));
           } catch {
@@ -12673,7 +13294,7 @@ if (!__isMcpMode) {
     }
     serveIndex(res);
   });
-  let activeCapabilities2 = { ...DEFAULT_CAPABILITIES };
+  let activeCapabilities = { ...DEFAULT_CAPABILITIES };
   async function main() {
     const { token, serverUrl } = parsedArgs;
     if (token) {
@@ -12690,8 +13311,8 @@ if (!__isMcpMode) {
         process.exit(1);
       }
       activeRunId = runId;
-      activeCapabilities2 = await fetchCapabilities(serverUrl, token);
-      console.log(`Capabilities: workspace_setup=${activeCapabilities2.workspace_setup}, terminal=${activeCapabilities2.terminal}`);
+      activeCapabilities = await fetchCapabilities(serverUrl, token);
+      console.log(`Capabilities: workspace_setup=${activeCapabilities.workspace_setup}, terminal=${activeCapabilities.terminal}`);
       ensureGitRepo(runId);
       await validateRepoUrl(serverUrl, token);
       const lock = checkLockfile();
@@ -12719,13 +13340,13 @@ if (!__isMcpMode) {
     const existingCreds = loadCredentials();
     if (existingCreds) {
       if (!token) {
-        activeCapabilities2 = await fetchCapabilities(existingCreds.serverUrl, existingCreds.token);
+        activeCapabilities = await fetchCapabilities(existingCreds.serverUrl, existingCreds.token);
       }
-      if (activeCapabilities2.terminal) {
+      if (activeCapabilities.terminal) {
         initTerminalBridge(server, PROJECT_DIR, import_path8.default.join(PROJECT_DIR, ".launchpod", "sessions"));
       }
-      startPipelineSystem(existingCreds);
-    } else if (activeCapabilities2.terminal) {
+      startPipelineSystem(existingCreds, activeCapabilities);
+    } else if (activeCapabilities.terminal) {
       initTerminalBridge(server, PROJECT_DIR, import_path8.default.join(PROJECT_DIR, ".launchpod", "sessions"));
     }
   }