@launchsecure/launch-kit 0.0.26 → 0.0.27

package/dist/server/recall-entry.js

@@ -122,8 +122,8 @@ function loadConfig(workTree) {
     return { config: { ...DEFAULT_CONFIG }, source: "defaults", path: configPath };
   }
   try {
-    const text = fs.readFileSync(configPath, "utf8");
-    const raw = JSON.parse(text);
+    const text2 = fs.readFileSync(configPath, "utf8");
+    const raw = JSON.parse(text2);
     return { config: mergeConfig(raw), source: "file", path: configPath };
   } catch (err) {
     process.stderr.write(
@@ -259,14 +259,346 @@ var init_init = __esm({
   }
 });
 
+// src/server/recall-mcp.ts
+var recall_mcp_exports = {};
+__export(recall_mcp_exports, {
+  startRecallMcpServer: () => startRecallMcpServer
+});
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH") return false;
+    if (code === "EPERM") return true;
+    return false;
+  }
+}
+function pidFilePath(recallDir) {
+  return `${recallDir}/watch.pid`;
+}
+function existingWatcherPid() {
+  const { recallDir } = resolveRecallPaths();
+  const pf = pidFilePath(recallDir);
+  if (!(0, import_node_fs.existsSync)(pf)) return null;
+  const pid = Number((0, import_node_fs.readFileSync)(pf, "utf-8").trim());
+  if (!Number.isFinite(pid) || pid <= 0) return null;
+  return isPidAlive(pid) ? pid : null;
+}
+function ensureWatcher() {
+  const { gitDir, workTree } = resolveRecallPaths();
+  if (!(0, import_node_fs.existsSync)(gitDir)) {
+    process.stderr.write(
+      `[launch-recall mcp] shadow repo missing at ${gitDir} \u2014 run \`launch-recall init\` first. MCP tools will still serve read-only queries, but nothing will be captured.
+`
+    );
+    return;
+  }
+  const existing = existingWatcherPid();
+  if (existing !== null) {
+    process.stderr.write(
+      `[launch-recall mcp] external watcher detected (pid ${existing}) \u2014 serving tools only, not spawning a sibling
+`
+    );
+    return;
+  }
+  const entry = process.argv[1];
+  if (!entry) {
+    process.stderr.write(`[launch-recall mcp] cannot resolve entry path from argv \u2014 watcher not spawned
+`);
+    return;
+  }
+  childWatcher = (0, import_node_child_process2.spawn)(process.execPath, [entry, "watch"], {
+    cwd: workTree,
+    stdio: ["ignore", "ignore", "inherit"],
+    detached: false
+  });
+  process.stderr.write(`[launch-recall mcp] spawned watcher (pid ${childWatcher.pid}) in ${workTree}
+`);
+  childWatcher.on("exit", (code, sig) => {
+    process.stderr.write(`[launch-recall mcp] child watcher exited (code=${code} sig=${sig})
+`);
+    childWatcher = null;
+  });
+}
+function killChildWatcher() {
+  if (childWatcher && !childWatcher.killed) {
+    try {
+      childWatcher.kill("SIGTERM");
+    } catch {
+    }
+  }
+}
+function text(payload) {
+  const t = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2);
+  return { content: [{ type: "text", text: t }] };
+}
+async function handleTool(name, args) {
+  switch (name) {
+    case "recall.doctor":
+      return text(doctorTool());
+    case "recall.report":
+      return text(reportTool());
+    case "recall.status":
+      return text(statusTool());
+    case "recall.history": {
+      const path7 = String(args.path ?? "");
+      if (!path7) return text({ error: "path is required" });
+      const limit = typeof args.limit === "number" && args.limit > 0 ? Math.floor(args.limit) : 50;
+      return text(historyTool(path7, limit));
+    }
+    default:
+      return text({ error: `unknown tool: ${name}` });
+  }
+}
+function doctorTool() {
+  const { gitDir, recallDir } = resolveRecallPaths();
+  const checks = [];
+  const shadowOk = (0, import_node_fs.existsSync)(gitDir);
+  checks.push({
+    name: "shadow_repo",
+    ok: shadowOk,
+    detail: shadowOk ? gitDir : `missing \u2014 run \`launch-recall init\``
+  });
+  const pid = existingWatcherPid();
+  checks.push({
+    name: "watcher_alive",
+    ok: pid !== null,
+    detail: pid !== null ? `pid ${pid}` : `no live pid in ${pidFilePath(recallDir)}`
+  });
+  let recentOk = false;
+  let recentDetail = "no snapshots yet";
+  if (shadowOk) {
+    try {
+      const out = (0, import_node_child_process2.execFileSync)("git", [`--git-dir=${gitDir}`, "log", "-1", "--format=%aI"], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+      if (out) {
+        const ageHours = (Date.now() - new Date(out).getTime()) / 36e5;
+        recentOk = ageHours < 24;
+        recentDetail = `${out} (${ageHours.toFixed(1)}h ago)`;
+      }
+    } catch {
+    }
+  }
+  checks.push({ name: "recent_snapshot", ok: recentOk, detail: recentDetail });
+  return { ok: checks.every((c) => c.ok), checks };
+}
+function reportTool() {
+  const { gitDir, recallDir, workTree } = resolveRecallPaths();
+  if (!(0, import_node_fs.existsSync)(gitDir)) return { error: "shadow repo not initialised" };
+  let totalSnapshots = 0;
+  try {
+    const out = (0, import_node_child_process2.execFileSync)("git", [`--git-dir=${gitDir}`, "rev-list", "--count", "HEAD"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+    totalSnapshots = Number(out) || 0;
+  } catch {
+  }
+  let shadowSizeBytes = 0;
+  try {
+    const out = (0, import_node_child_process2.execFileSync)("du", ["-sk", recallDir], { encoding: "utf-8" }).trim();
+    const kb = Number(out.split(/\s+/)[0]);
+    if (Number.isFinite(kb)) shadowSizeBytes = kb * 1024;
+  } catch {
+  }
+  const recentSnapshots = [];
+  let lastSnapshot = null;
+  try {
+    const out = (0, import_node_child_process2.execFileSync)(
+      "git",
+      [`--git-dir=${gitDir}`, "log", "-10", "--format=%H|%aI|%s"],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }
+    );
+    for (const line of out.split("\n").filter(Boolean)) {
+      const [sha, ts, ...rest] = line.split("|");
+      recentSnapshots.push({ sha, ts, message: rest.join("|") });
+    }
+    if (recentSnapshots.length > 0) lastSnapshot = recentSnapshots[0].ts;
+  } catch {
+  }
+  let config = null;
+  const cfgPath = `${workTree}/.launch-recall.json`;
+  if ((0, import_node_fs.existsSync)(cfgPath)) {
+    try {
+      config = JSON.parse((0, import_node_fs.readFileSync)(cfgPath, "utf-8"));
+    } catch {
+    }
+  }
+  return { totalSnapshots, shadowSizeBytes, lastSnapshot, recentSnapshots, config, workTree };
+}
+function historyTool(path7, limit) {
+  const { gitDir, workTree } = resolveRecallPaths();
+  if (!(0, import_node_fs.existsSync)(gitDir)) return { error: "shadow repo not initialised", path: path7, snapshots: [] };
+  const rel = path7.startsWith("/") ? path7.replace(`${workTree}/`, "").replace(/^\/+/, "") : path7;
+  const snapshots = [];
+  try {
+    const out = (0, import_node_child_process2.execFileSync)(
+      "git",
+      [`--git-dir=${gitDir}`, `--work-tree=${workTree}`, "log", `-${limit}`, "--format=%H|%aI|%s", "--", rel],
+      { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }
+    );
+    for (const line of out.split("\n").filter(Boolean)) {
+      const [sha, ts, ...rest] = line.split("|");
+      snapshots.push({ sha, ts, message: rest.join("|") });
+    }
+  } catch {
+  }
+  return { path: rel, snapshots };
+}
+function statusTool() {
+  const { gitDir, workTree } = resolveRecallPaths();
+  const pid = existingWatcherPid();
+  let lastSnapshotAt = null;
+  if ((0, import_node_fs.existsSync)(gitDir)) {
+    try {
+      lastSnapshotAt = (0, import_node_child_process2.execFileSync)("git", [`--git-dir=${gitDir}`, "log", "-1", "--format=%aI"], {
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim() || null;
+    } catch {
+    }
+  }
+  return {
+    running: pid !== null,
+    pid,
+    lastSnapshotAt,
+    watchTree: workTree,
+    shadowRepo: gitDir
+  };
+}
+function send(msg) {
+  process.stdout.write(JSON.stringify(msg) + "\n");
+}
+function sendResponse(id, result) {
+  send({ jsonrpc: "2.0", id, result });
+}
+function sendError(id, code, message) {
+  send({ jsonrpc: "2.0", id, error: { code, message } });
+}
+async function handleMessage(parsed) {
+  const id = parsed.id;
+  const method = parsed.method;
+  const params = parsed.params ?? {};
+  switch (method) {
+    case "initialize":
+      sendResponse(id ?? null, {
+        protocolVersion: "2024-11-05",
+        capabilities: { tools: {} },
+        serverInfo: SERVER_INFO
+      });
+      break;
+    case "notifications/initialized":
+      break;
+    case "tools/list":
+      sendResponse(id ?? null, { tools: TOOLS });
+      break;
+    case "tools/call": {
+      const toolName = params.name;
+      const toolArgs = params.arguments ?? {};
+      try {
+        const result = await handleTool(toolName, toolArgs);
+        sendResponse(id ?? null, result);
+      } catch (err) {
+        sendError(id ?? null, -32603, `Tool error: ${err.message}`);
+      }
+      break;
+    }
+    case "ping":
+      sendResponse(id ?? null, {});
+      break;
+    default:
+      if (id !== void 0) sendError(id ?? null, -32601, `Method not found: ${method}`);
+  }
+}
+function startRecallMcpServer() {
+  process.stderr.write("[launch-recall mcp] starting on stdio\n");
+  ensureWatcher();
+  const teardown = () => {
+    killChildWatcher();
+    process.exit(0);
+  };
+  process.on("SIGTERM", teardown);
+  process.on("SIGINT", teardown);
+  process.on("exit", killChildWatcher);
+  process.stdin.setEncoding("utf-8");
+  let buffer = "";
+  process.stdin.on("data", (chunk) => {
+    buffer += chunk;
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        handleMessage(JSON.parse(trimmed)).catch((err) => {
+          process.stderr.write(`[launch-recall mcp] message error: ${err}
+`);
+        });
+      } catch (err) {
+        process.stderr.write(`[launch-recall mcp] parse error: ${err}
+`);
+      }
+    }
+  });
+  process.stdin.on("end", () => {
+    process.stderr.write("[launch-recall mcp] stdin closed, exiting\n");
+    teardown();
+  });
+  void import_node_fs.statSync;
+}
+var import_node_child_process2, import_node_fs, SERVER_INFO, TOOLS, childWatcher;
+var init_recall_mcp = __esm({
+  "src/server/recall-mcp.ts"() {
+    "use strict";
+    import_node_child_process2 = require("node:child_process");
+    import_node_fs = require("node:fs");
+    init_paths();
+    SERVER_INFO = { name: "launch-recall", version: "0.0.1" };
+    TOOLS = [
+      {
+        name: "recall.doctor",
+        description: "Health check on the launch-recall watcher and its shadow repo.\n\nReturns: { ok, checks: [{ name, ok, detail }] }. Names: shadow_repo (exists + valid), watcher_alive (pid file points at live pid), recent_snapshot (any snapshot within 24h).",
+        inputSchema: { type: "object", properties: {} }
+      },
+      {
+        name: "recall.report",
+        description: "Project-wide details on what recall has captured.\n\nReturns: { totalSnapshots, shadowSizeBytes, lastSnapshot, recentSnapshots: [{ sha, ts, message }], config: { debounce, ignore, retention } }. recentSnapshots is the last 10.",
+        inputSchema: { type: "object", properties: {} }
+      },
+      {
+        name: "recall.history",
+        description: "Snapshot history for a specific file or directory. Path is relative to the project root (or an absolute path under it).\n\nReturns: { path, snapshots: [{ sha, ts, message }] }. Empty array if the path was never captured (e.g. ignored, or simply has no churn).",
+        inputSchema: {
+          type: "object",
+          properties: {
+            path: { type: "string", description: "File or directory to query." },
+            limit: { type: "number", description: "Max snapshots to return (default 50)." }
+          },
+          required: ["path"]
+        }
+      },
+      {
+        name: "recall.status",
+        description: "Quick liveness + last-snapshot info. Cheaper than recall.doctor \u2014 no historical inspection.\n\nReturns: { running, pid, lastSnapshotAt, watchTree }.",
+        inputSchema: { type: "object", properties: {} }
+      }
+    ];
+    childWatcher = null;
+  }
+});
+
 // src/server/recall/stop.ts
 var stop_exports = {};
 __export(stop_exports, {
-  pidFilePath: () => pidFilePath,
+  pidFilePath: () => pidFilePath2,
   runStop: () => runStop,
   stopWatcher: () => stopWatcher
 });
-function pidFilePath(recallDir) {
+function pidFilePath2(recallDir) {
   return path4.join(recallDir, "watch.pid");
 }
 function isAlive(pid) {
@@ -285,7 +617,7 @@ function sleep(ms) {
 }
 async function stopWatcher(quiet = false) {
   const { recallDir } = resolveRecallPaths();
-  const pf = pidFilePath(recallDir);
+  const pf = pidFilePath2(recallDir);
   if (!fs3.existsSync(pf)) {
     if (!quiet) process.stderr.write(`[launch-recall] no PID file at ${pf}
 `);
@@ -353,7 +685,7 @@ var watch_exports = {};
 __export(watch_exports, {
   runWatch: () => runWatch
 });
-function isPidAlive(pid) {
+function isPidAlive2(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -385,10 +717,10 @@ async function runWatch(args) {
     log(`not initialised \u2014 run: launch-recall init`);
     process.exit(1);
   }
-  const pf = pidFilePath(recallDir);
+  const pf = pidFilePath2(recallDir);
   if (fs4.existsSync(pf)) {
     const existing = Number(fs4.readFileSync(pf, "utf8").trim());
-    if (Number.isFinite(existing) && isPidAlive(existing)) {
+    if (Number.isFinite(existing) && isPidAlive2(existing)) {
       log(`watcher already running (pid ${existing}) \u2014 run \`launch-recall stop\` first`);
       process.exit(1);
     }
@@ -426,7 +758,7 @@ async function runWatch(args) {
       return;
     }
     busy = true;
-    const add = (0, import_node_child_process2.spawn)("git", addArgs, { env, stdio: "ignore" });
+    const add = (0, import_node_child_process3.spawn)("git", addArgs, { env, stdio: "ignore" });
     add.on("exit", (addCode) => {
       if (addCode !== 0) {
         busy = false;
@@ -436,7 +768,7 @@ async function runWatch(args) {
         }
         return;
       }
-      const check = (0, import_node_child_process2.spawn)("git", ["diff", "--cached", "--quiet"], { env, stdio: "ignore" });
+      const check = (0, import_node_child_process3.spawn)("git", ["diff", "--cached", "--quiet"], { env, stdio: "ignore" });
       check.on("exit", (checkCode) => {
         if (checkCode === 0) {
           busy = false;
@@ -446,7 +778,7 @@ async function runWatch(args) {
           }
           return;
         }
-        const commit = (0, import_node_child_process2.spawn)(
+        const commit = (0, import_node_child_process3.spawn)(
           "git",
           ["commit", "-q", "-m", `snap ${stamp()}`],
           { env, stdio: "ignore" }
@@ -492,13 +824,13 @@ async function runWatch(args) {
     process.exit(1);
   }
 }
-var fs4, fsp, import_node_child_process2;
+var fs4, fsp, import_node_child_process3;
 var init_watch = __esm({
   "src/server/recall/watch.ts"() {
     "use strict";
     fs4 = __toESM(require("node:fs"));
     fsp = __toESM(require("node:fs/promises"));
-    import_node_child_process2 = require("node:child_process");
+    import_node_child_process3 = require("node:child_process");
     init_git();
     init_paths();
     init_config();
@@ -930,8 +1262,8 @@ function promptYesNo(question) {
 }
 function removeGitignoreLine(gitignorePath) {
   if (!fs10.existsSync(gitignorePath)) return "no-file";
-  const text = fs10.readFileSync(gitignorePath, "utf8");
-  const lines = text.split(/\r?\n/);
+  const text2 = fs10.readFileSync(gitignorePath, "utf8");
+  const lines = text2.split(/\r?\n/);
   const matches = (l) => {
     const t = l.trim();
     return t === `/${RECALL_DIR_NAME}/` || t === `${RECALL_DIR_NAME}/` || t === RECALL_DIR_NAME || t === `/${RECALL_DIR_NAME}` || t === `${RECALL_DIR_NAME}/**`;
@@ -946,15 +1278,15 @@ async function runUninstall(args) {
   const { workTree, recallDir } = resolveRecallPaths();
   const configPath = path6.join(workTree, CONFIG_FILENAME);
   const gitignorePath = path6.join(workTree, ".gitignore");
-  const pf = pidFilePath(recallDir);
+  const pf = pidFilePath2(recallDir);
   const watcherRunning = fs10.existsSync(pf);
   const shadowPresent = fs10.existsSync(recallDir);
   const configPresent = fs10.existsSync(configPath);
   const shadowSize = shadowPresent ? dirSizeBytes(recallDir) : 0;
   let gitignoreHasLine = false;
   if (fs10.existsSync(gitignorePath)) {
-    const text = fs10.readFileSync(gitignorePath, "utf8");
-    gitignoreHasLine = text.split(/\r?\n/).some((l) => {
+    const text2 = fs10.readFileSync(gitignorePath, "utf8");
+    gitignoreHasLine = text2.split(/\r?\n/).some((l) => {
       const t = l.trim();
       return t === `/${RECALL_DIR_NAME}/` || t === `${RECALL_DIR_NAME}/` || t === RECALL_DIR_NAME || t === `/${RECALL_DIR_NAME}` || t === `${RECALL_DIR_NAME}/**`;
     });
@@ -1034,6 +1366,7 @@ function printUsage() {
       "  init                              create .recall/repo.git + gitignore entry + default config",
       "  watch [--debounce <ms>]           foreground watcher (defaults from .launch-recall.json)",
       "  stop                              terminate the running watcher",
+      "  mcp                               stdio MCP server (spawns watcher as child)",
       "  log [path]                        show shadow history (passthrough to git log)",
       "  restore <path> [--at <ref>]       extract a file from a snapshot",
       "  forget [--keep-last N] [--max-age 30d] [--dry-run]",
@@ -1059,6 +1392,11 @@ async function main() {
       await runInit2(argv.slice(1));
       return;
     }
+    case "mcp": {
+      const { startRecallMcpServer: startRecallMcpServer2 } = await Promise.resolve().then(() => (init_recall_mcp(), recall_mcp_exports));
+      startRecallMcpServer2();
+      return;
+    }
     case "watch": {
       const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_watch(), watch_exports));
       await runWatch2(argv.slice(1));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchsecure/launch-kit",
-  "version": "0.0.26",
+  "version": "0.0.27",
   "description": "LaunchSecure toolkit — launch-pod (pipeline), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup).",
   "license": "MIT",
   "author": "LaunchSecure - AutomateWithUs",
@@ -47,20 +47,41 @@
     "access": "public"
   },
   "bin": {
+    "launch-kit": "./dist/server/init-entry.js",
     "launch-pod": "./dist/server/cli.js",
     "launch-chart": "./dist/server/graph-mcp-entry.js",
     "launch-deck": "./dist/server/deck-mcp-entry.js",
-    "launch-recall": "./dist/server/recall-entry.js"
+    "launch-recall": "./dist/server/recall-entry.js",
+    "launch-orbit": "./dist/server/orbit-entry.js"
+  },
+  "scripts": {
+    "build": "pnpm build:client && pnpm build:chart-client && pnpm build:deck-client && pnpm build:council-client && pnpm build:beacon && pnpm build:server",
+    "build:beacon": "vite build --config vite.beacon.config.ts && tsc -p tsconfig.beacon.json --emitDeclarationOnly --outDir dist/beacon/types",
+    "test:beacon": "vitest run --config vite.beacon.config.ts",
+    "test:radar": "vitest run --config vite.radar.config.ts",
+    "test:chart": "vitest run --config vite.chart.test.config.ts",
+    "build:deck-client": "vite build --config vite.deck.config.ts",
+    "build:council-client": "vite build --config vite.council.config.ts",
+    "build:client": "vite build",
+    "build:chart-client": "vite build --config vite.chart.config.ts",
+    "build:server": "esbuild src/server/cli.ts src/server/fb-wizard.ts src/server/graph-mcp-entry.ts src/server/chart-serve.ts src/server/deck-mcp-entry.ts src/server/deck-serve.ts src/server/council-entry.ts src/server/council-serve.ts src/server/recall-entry.ts src/server/init-entry.ts src/server/orbit-entry.ts src/server/parse-worker-entry.ts --bundle --platform=node --target=node18 --outdir=dist/server --external:node-pty --external:ws --external:typescript --external:web-tree-sitter --external:tree-sitter-typescript --external:cloudflared --external:pg --external:pg-native && rm -rf dist/server/public && cp -r ../claude-code-web/src/public dist/server/public && rm -rf dist/server/graph/queries && mkdir -p dist/server/graph && cp -r src/server/graph/queries dist/server/graph/queries",
+    "dev:client": "vite",
+    "dev:chart": "pnpm build:server && pnpm build:chart-client && node dist/server/graph-mcp-entry.js serve",
+    "dev:server": "pnpm build:server && node dist/server/cli.js",
+    "dev": "pnpm build:server && concurrently -k -n client,server -c cyan,magenta \"vite\" \"node dist/server/cli.js\"",
+    "prepublishOnly": "pnpm build"
   },
   "files": [
     "dist",
-    "prompts"
+    "prompts",
+    "scaffolds"
   ],
   "dependencies": {
     "cacheable-lookup": "^7.0.0",
     "cloudflared": "^0.7.1",
     "html-to-image": "^1.11.13",
     "node-pty": "^1.2.0-beta.12",
+    "pg": "^8.13.0",
     "tree-sitter": "^0.21.1",
     "tree-sitter-typescript": "^0.23.2",
     "typescript": "^5.5.0",
@@ -69,7 +90,10 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
+    "@launchsecure/claude-code-web": "workspace:*",
+    "@launchsecure/ui": "workspace:*",
     "@types/node": "^20.0.0",
+    "@types/pg": "^8.11.10",
     "@types/react": "^18.3.12",
     "@types/react-dom": "^18.3.1",
     "@types/ws": "^8.5.10",
@@ -91,24 +115,6 @@
     "react-router-dom": "^6.28.0",
     "tailwindcss": "^3.4.19",
     "vite": "^5.4.11",
-    "vitest": "^1.6.0",
-    "@launchsecure/claude-code-web": "0.0.1",
-    "@launchsecure/ui": "0.0.1"
-  },
-  "scripts": {
-    "build": "pnpm build:client && pnpm build:chart-client && pnpm build:deck-client && pnpm build:council-client && pnpm build:beacon && pnpm build:server",
-    "build:beacon": "vite build --config vite.beacon.config.ts && tsc -p tsconfig.beacon.json --emitDeclarationOnly --outDir dist/beacon/types",
-    "test:beacon": "vitest run --config vite.beacon.config.ts",
-    "test:radar": "vitest run --config vite.radar.config.ts",
-    "test:chart": "vitest run --config vite.chart.test.config.ts",
-    "build:deck-client": "vite build --config vite.deck.config.ts",
-    "build:council-client": "vite build --config vite.council.config.ts",
-    "build:client": "vite build",
-    "build:chart-client": "vite build --config vite.chart.config.ts",
-    "build:server": "esbuild src/server/cli.ts src/server/fb-wizard.ts src/server/graph-mcp-entry.ts src/server/chart-serve.ts src/server/deck-mcp-entry.ts src/server/deck-serve.ts src/server/council-entry.ts src/server/council-serve.ts src/server/recall-entry.ts --bundle --platform=node --target=node18 --outdir=dist/server --external:node-pty --external:ws --external:typescript --external:web-tree-sitter --external:tree-sitter-typescript --external:cloudflared && rm -rf dist/server/public && cp -r ../claude-code-web/src/public dist/server/public && rm -rf dist/server/graph/queries && mkdir -p dist/server/graph && cp -r src/server/graph/queries dist/server/graph/queries",
-    "dev:client": "vite",
-    "dev:chart": "pnpm build:server && pnpm build:chart-client && node dist/server/graph-mcp-entry.js serve",
-    "dev:server": "pnpm build:server && node dist/server/cli.js",
-    "dev": "pnpm build:server && concurrently -k -n client,server -c cyan,magenta \"vite\" \"node dist/server/cli.js\""
+    "vitest": "^1.6.0"
   }
-}
+}

package/scaffolds/migrate-safety/.github/workflows/backup-on-migration.yml

@@ -0,0 +1,72 @@
+name: Backup prod DB before migration deploys
+
+# Triggers a logical pg_dump of prod whenever a migration file lands on master
+# or implementation. Backup is uploaded as a workflow artifact (90-day retention)
+# tied to the commit SHA — see docs/migrations-runbook.md for restore steps.
+#
+# Required secrets (configure under repo Settings → Secrets and variables → Actions):
+#   PROD_DATABASE_URL  — full DATABASE_URL for the production DB.
+#                        Treat this as production credential — anyone who can
+#                        download the artifact effectively has prod data.
+#
+# Required permissions: this workflow only reads from the DB and writes an
+# artifact; it does not push code, deploy, or modify anything.
+
+on:
+  push:
+    branches: [master, implementation]
+    paths:
+      - 'prisma/migrations/**'
+      - 'prisma/schema.prisma'
+  workflow_dispatch: # allow manual runs for ad-hoc snapshots
+
+permissions:
+  contents: read
+
+jobs:
+  backup:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run wrapper in backup-only mode
+        env:
+          # The same env-var contract used for local — only the destination differs.
+          DATABASE_URL: ${{ secrets.PROD_DATABASE_URL }}
+          BACKUP_DIR: artifacts
+          # Force docker so the wrapper auto-detects the server's major version
+          # and pulls the matching postgres:<major> image. Avoids hardcoding a
+          # client version that drifts when prod Postgres is upgraded.
+          # ubuntu-latest runners ship with docker pre-installed.
+          PG_DUMP_VIA_DOCKER: '1'
+        run: |
+          if [[ -z "$DATABASE_URL" ]]; then
+            echo "::error::PROD_DATABASE_URL secret is not configured."
+            echo "Set it under repo Settings → Secrets and variables → Actions."
+            exit 1
+          fi
+          bash scripts/migrate-with-backup.sh backup-only
+
+      - name: Upload dump as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: prod-db-backup-${{ github.sha }}
+          path: artifacts/*.sql.gz
+          retention-days: 90
+          if-no-files-found: error
+
+      - name: Summary
+        run: |
+          echo "### Backup complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Triggered by: \`${{ github.event_name }}\` on \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "Commit: \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Download via:" >> $GITHUB_STEP_SUMMARY
+          echo '```bash' >> $GITHUB_STEP_SUMMARY
+          echo "gh run download ${{ github.run_id }} -n prod-db-backup-${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Restore steps: see [docs/migrations-runbook.md](../blob/${{ github.sha }}/docs/migrations-runbook.md)." >> $GITHUB_STEP_SUMMARY