@launchsecure/launch-kit 0.0.26 → 0.0.28

package/dist/server/init-entry.js

@@ -0,0 +1,939 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/server/init-entry.ts
+var import_node_child_process = require("node:child_process");
+var fs2 = __toESM(require("node:fs"));
+var import_node_http = require("node:http");
+var import_node_https = require("node:https");
+var path2 = __toESM(require("node:path"));
+var readline = __toESM(require("node:readline"));
+var import_node_url = require("node:url");
+
+// src/server/cred-shape.ts
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
+var CONFIG_FILENAME = ".launch-secure.cred.config";
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function upsertProfile(existing, name, profile) {
+  const base = existing ? toNested(existing) ?? { active: name, profiles: {} } : { active: name, profiles: {} };
+  return {
+    active: name,
+    profiles: { ...base.profiles, [name]: profile }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function writeJsonAtomic(absPath, value, mode) {
+  const tmp = `${absPath}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
+  if (mode !== void 0) {
+    try {
+      fs.chmodSync(tmp, mode);
+    } catch {
+    }
+  }
+  fs.renameSync(tmp, absPath);
+}
+
+// src/server/init-entry.ts
+var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
+var LEGACY_CONFIG_FILENAME = ".launch-secure.config";
+var ONBOARD_SCRIPT_NAME = "onboard";
+var LAUNCH_KIT_PKG = "@launchsecure/launch-kit";
+var LAUNCH_KIT_TOOLS_GUIDE = `
+Wired in Claude Code (.mcp.json):
+  launch-secure   \u2014 LS API: work items, comms, secrets, members, board
+  launch-chart    \u2014 code search + project graph (use instead of grep/glob)
+  launch-deck     \u2014 visual playground / blast-radius diagrams
+  launch-orbit    \u2014 git worktree orchestration (branch / merge gates)
+  launch-recall   \u2014 restore deleted/modified files from shadow git
+
+Other tools (run on demand via npx):
+  npx launch-pod radar       \u2014 webhook listener (LS pings \u2192 terminal/UI)
+  npx launch-pod             \u2014 full pipeline UI (separate launch-pod login)
+  npx launch-beacon monitor  \u2014 local HTTP receiver for the launch-kit-beacon
+                               in-browser monitor. Paste the printed URL into
+                               the beacon debug panel; events stream to
+                               .launchsecure/beacon-<token>.ndjson for the
+                               /ls:beacon-* commands below to read.
+
+LS slash commands (run inside Claude Code in this project):
+  /ls:activate-beacon        \u2014 wire the launch-kit-beacon in-app feedback
+                               widget into this app (mounts the <launch-kit-
+                               beacon> Web Component + scaffolds /api/feedback
+                               forwarding to LaunchSecure Comm Hub)
+  /ls:standup                \u2014 draft a daily standup from work since the last
+                               push (chart-grouped themes, work-item linkage,
+                               release detection) and post to LS Comm Hub as
+                               a daily_update after you confirm
+  /ls:show-mcp-status        \u2014 show recall watcher health + last snapshot.
+                               Add 'full' for expanded report (PID, shadow
+                               repo size, recent snaps)
+  /ls:beacon-scan            \u2014 scan recent events from the active
+                               launch-beacon monitor session. Pass a kind
+                               (error/click/fetch/route/dialog/probe) and/or
+                               a limit to filter.
+  /ls:beacon-pulse           \u2014 most recent error + the N events that preceded
+                               it. "What was happening just before it broke."
+  /ls:beacon-array           \u2014 list monitor sessions in .launchsecure/ with
+                               event counts, last activity, liveness glyph.
+                               Add 'full' for a per-session expanded report.
+  /ls:beacon-clear           \u2014 wipe the latest monitor session NDJSON (or
+                               'all'). Confirms before deleting.
+
+  Open this repo in Claude Code; on first open you'll be prompted to install
+  the "launchsecure" marketplace \u2014 accept to enable the commands above.
+`;
+var PACKAGE_MANAGERS = [
+  { name: "pnpm", binary: "pnpm", lockfiles: ["pnpm-lock.yaml"], workspaceFiles: ["pnpm-workspace.yaml"], installArgs: ["install"] },
+  { name: "yarn", binary: "yarn", lockfiles: ["yarn.lock"], installArgs: ["install"] },
+  { name: "bun", binary: "bun", lockfiles: ["bun.lockb", "bun.lock"], installArgs: ["install"] },
+  { name: "npm", binary: "npm", lockfiles: ["package-lock.json"], installArgs: ["install"] }
+];
+function parseArgs(argv) {
+  const args = {
+    token: process.env.LS_PAT ?? null,
+    orgSlug: null,
+    projectSlug: null,
+    serverUrl: DEFAULT_SERVER_URL,
+    targetDir: null,
+    course: null,
+    noInstall: false,
+    noRecall: false,
+    noMigrateSafety: false,
+    noLsMarketplace: false,
+    noRecallHook: false,
+    dryRun: false,
+    help: false
+  };
+  for (const raw of argv) {
+    if (raw === "--help" || raw === "-h") {
+      args.help = true;
+      continue;
+    }
+    if (raw === "--no-install") {
+      args.noInstall = true;
+      continue;
+    }
+    if (raw === "--no-recall") {
+      args.noRecall = true;
+      continue;
+    }
+    if (raw === "--no-migrate-safety") {
+      args.noMigrateSafety = true;
+      continue;
+    }
+    if (raw === "--no-ls-marketplace") {
+      args.noLsMarketplace = true;
+      continue;
+    }
+    if (raw === "--no-recall-hook") {
+      args.noRecallHook = true;
+      continue;
+    }
+    if (raw === "--dry-run") {
+      args.dryRun = true;
+      continue;
+    }
+    const eq = raw.indexOf("=");
+    if (!raw.startsWith("--") || eq < 0) continue;
+    const key = raw.slice(2, eq);
+    const val = raw.slice(eq + 1);
+    if (key === "token") args.token = val;
+    else if (key === "org") args.orgSlug = val;
+    else if (key === "project") args.projectSlug = val;
+    else if (key === "url") args.serverUrl = val.replace(/\/+$/, "");
+    else if (key === "dir") args.targetDir = val;
+    else if (key === "course") args.course = val;
+  }
+  return args;
+}
+function printHelp() {
+  console.log(`launch-kit init \u2014 bootstrap a LaunchSecure project on this machine
+
+Usage:
+  npx launch-kit init --token=<pat> --org=<orgSlug> --project=<projectSlug> [options]
+
+Required:
+  --token=<pat>            LaunchSecure PAT (ls_pat_...). Or set LS_PAT env var.
+  --org=<orgSlug>          Organization slug.
+  --project=<projectSlug>  Project slug.
+
+Options:
+  --url=<serverUrl>        LaunchSecure base URL (default: ${DEFAULT_SERVER_URL}).
+  --dir=<path>             Target directory (default: ./<projectSlug>).
+  --course=<name>          Name for the course (profile) being added to
+                           .launch-secure.cred.config. When omitted, inferred
+                           from --url: localhost\u2192"local", *staging*\u2192"staging",
+                           *.vercel.app\u2192"prod", else hostname. The course
+                           becomes active; re-run with a different --course
+                           and --url to add another (e.g. local + staging).
+                           Use \`launch-course set <name>\` to switch later.
+  --no-install             Skip dependency install step.
+  --no-recall              Skip launch-recall (shadow git backup) scaffold.
+  --no-migrate-safety      Skip migrate-safety scaffold (pg_dump-before-migrate
+                           wrapper + GitHub Action + runbook).
+  --no-ls-marketplace      Skip the Claude Code "launchsecure" marketplace
+                           scaffold (.claude/marketplace/ + .claude/settings.json
+                           wiring \u2014 exposes /ls:activate-beacon and future
+                           ls-namespaced slash commands).
+  --no-recall-hook         Skip the SessionStart hook scaffold (Claude Code
+                           hook + scripts/ensure-recall.sh that auto-restarts
+                           the launch-recall watcher if it died between
+                           sessions). The hook is the surfacing layer for
+                           watcher-died-silently scenarios.
+  --dry-run                Preview every file write, merge, clone, and install
+                           command without making any changes. Useful before
+                           re-running init against a customized project. The
+                           project_info HTTP call still runs (it's read-only).
+  --help                   Show this help.
+
+What it does:
+  1. Preflight: checks git + node + (optional) gh.
+  2. Calls LaunchSecure to resolve the project + its git remote.
+  3. Clones the repo (prefers gh, falls back to git) \u2014 skipped if dir already
+     contains the matching clone.
+  4. Writes .launch-secure.cred.config (gitignored). Auto-migrates any
+     legacy .launch-secure.config that contains a PAT.
+  5. Merges .mcp.json with 5 entries (launch-secure / -chart / -deck / -orbit /
+     -recall). Preserves your other MCP entries. Auth via headersHelper \u2014
+     no secrets written into .mcp.json.
+  6. Detects package manager (packageManager field > lockfile > npm fallback)
+     and runs install. Skip with --no-install.
+  7. If package.json declares a "${ONBOARD_SCRIPT_NAME}" script, runs it
+     (your repo's hook for codegen / env pull / db setup / etc.).
+  8. Scaffolds launch-recall (shadow git backup). Skip with --no-recall.
+  9. Scaffolds migrate-safety (pg_dump wrapper + GHA backup workflow +
+     runbook + .backups/ gitignore line). Skip with --no-migrate-safety.
+ 10. Scaffolds the Claude Code "launchsecure" marketplace at
+     .claude/marketplace/ and wires .claude/settings.json so Claude Code
+     auto-discovers it and enables the "ls" plugin (exposes
+     /ls:activate-beacon for wiring the launch-kit-beacon in-app feedback
+     widget). Skip with --no-ls-marketplace.
+ 11. Scaffolds scripts/ensure-recall.sh and appends a SessionStart hook to
+     .claude/settings.json that respawns the launch-recall watcher if it
+     died between sessions. Idempotent (dedupes by hook command-match).
+     Skip with --no-recall-hook.
+`);
+}
+async function prompt(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2) => rl.question(question, (answer) => {
+    rl.close();
+    resolve2(answer.trim());
+  }));
+}
+function fail(msg) {
+  console.error(`[launch-kit] \u2717 ${msg}`);
+  process.exit(1);
+}
+function info(msg) {
+  console.log(`[launch-kit] ${msg}`);
+}
+function ok(msg) {
+  console.log(`[launch-kit] \u2713 ${msg}`);
+}
+var DRY_RUN = false;
+function dryNote(msg) {
+  console.log(`[launch-kit] (dry-run) ${msg}`);
+}
+function which(bin) {
+  const res = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
+  if (res.status !== 0) return null;
+  return res.stdout.split(/\r?\n/)[0]?.trim() || null;
+}
+function preflight() {
+  const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
+  if (nodeMajor < 18) fail(`Node.js >= 18 required (current: ${process.versions.node}).`);
+  if (!which("git")) fail("git not found in PATH. Install git: https://git-scm.com/downloads");
+  const hasGh = which("gh") !== null;
+  ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh ? ", gh present" : ", gh not found (will use git for clone)"}`);
+  return { hasGh };
+}
+function callProjectInfo(args) {
+  return new Promise((resolve2, reject) => {
+    const mcpUrl = new import_node_url.URL("/api/mcp/project", args.serverUrl);
+    const body = JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "tools/call",
+      params: {
+        name: "project_info",
+        arguments: { org_slug: args.orgSlug, project_slug: args.projectSlug }
+      }
+    });
+    const requester = mcpUrl.protocol === "https:" ? import_node_https.request : import_node_http.request;
+    const req = requester(
+      {
+        host: mcpUrl.hostname,
+        port: mcpUrl.port || (mcpUrl.protocol === "https:" ? 443 : 80),
+        path: mcpUrl.pathname,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json, text/event-stream",
+          "Content-Length": String(Buffer.byteLength(body)),
+          "Authorization": `Bearer ${args.token}`,
+          "X-Org-Slug": args.orgSlug,
+          "X-Project-Slug": args.projectSlug
+        }
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          if (res.statusCode === 401 || res.statusCode === 403) {
+            reject(new Error(`PAT rejected (${res.statusCode}). Check token + that it has access to ${args.orgSlug}/${args.projectSlug}.`));
+            return;
+          }
+          if (res.statusCode && res.statusCode >= 400) {
+            reject(new Error(`LaunchSecure responded ${res.statusCode}: ${text.slice(0, 300)}`));
+            return;
+          }
+          let json = text;
+          if (text.startsWith("event:") || text.includes("\ndata: ")) {
+            for (const line of text.split("\n")) {
+              if (line.startsWith("data: ")) {
+                json = line.slice(6);
+                break;
+              }
+            }
+          }
+          try {
+            const parsed = JSON.parse(json);
+            if (parsed.error) {
+              reject(new Error(`project_info error: ${parsed.error.message ?? "unknown"}`));
+              return;
+            }
+            const inner = parsed.result?.content?.[0]?.text;
+            if (!inner) {
+              reject(new Error("project_info returned no content"));
+              return;
+            }
+            if (inner.startsWith("\u2500\u2500 Error")) {
+              const firstLine = inner.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("\u2500\u2500"))[0];
+              reject(new Error(`project_info: ${firstLine ?? inner}`));
+              return;
+            }
+            const payload = JSON.parse(inner);
+            resolve2({
+              orgSlug: payload.org.slug,
+              projectSlug: payload.project.slug,
+              projectName: payload.project.name,
+              repositoryUrl: payload.project.repositoryUrl
+            });
+          } catch (err) {
+            reject(new Error(`Could not parse project_info response: ${err instanceof Error ? err.message : String(err)}`));
+          }
+        });
+      }
+    );
+    req.on("error", reject);
+    req.write(body);
+    req.end();
+  });
+}
+function gitRemoteUrl(dir) {
+  const res = (0, import_node_child_process.spawnSync)("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf-8" });
+  if (res.status !== 0) return null;
+  return res.stdout.trim() || null;
+}
+function normalizeRepoUrl(url) {
+  let u = url.trim().replace(/\.git$/, "").replace(/\/+$/, "");
+  const sshMatch = u.match(/^git@([^:]+):(.+)$/);
+  if (sshMatch) u = `https://${sshMatch[1]}/${sshMatch[2]}`;
+  try {
+    const parsed = new import_node_url.URL(u);
+    return `${parsed.protocol}//${parsed.host.toLowerCase()}${parsed.pathname}`;
+  } catch {
+    return u;
+  }
+}
+function isGitRepo(dir) {
+  return fs2.existsSync(path2.join(dir, ".git"));
+}
+function dirIsEmpty(dir) {
+  if (!fs2.existsSync(dir)) return true;
+  return fs2.readdirSync(dir).length === 0;
+}
+function cloneRepo(repoUrl, targetDir, hasGh) {
+  const isGithub = /github\.com/i.test(repoUrl);
+  let cmd;
+  let args;
+  if (hasGh && isGithub) {
+    cmd = "gh";
+    args = ["repo", "clone", repoUrl, targetDir];
+    info(`cloning via gh: ${repoUrl} \u2192 ${targetDir}`);
+  } else {
+    cmd = "git";
+    args = ["clone", repoUrl, targetDir];
+    info(`cloning via git: ${repoUrl} \u2192 ${targetDir}`);
+  }
+  if (DRY_RUN) {
+    dryNote(`would run: ${cmd} ${args.join(" ")}`);
+    return;
+  }
+  const res = (0, import_node_child_process.spawnSync)(cmd, args, { stdio: "inherit" });
+  if (res.status !== 0) {
+    fail(
+      `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\` or an SSH key on your GitHub account.`
+    );
+  }
+  ok(`cloned to ${targetDir}`);
+}
+function writeConfigFile(targetDir, cfg, courseName) {
+  migrateLegacyCredFile(targetDir);
+  const p = path2.join(targetDir, CONFIG_FILENAME);
+  const existing = readCredFile(targetDir);
+  const isNew = existing === null;
+  const isUpdate = !isNew && Boolean(existing?.profiles?.[courseName]);
+  if (DRY_RUN) {
+    const verb = isNew ? "write" : isUpdate ? "update course" : "add course";
+    dryNote(`would ${verb} "${courseName}" in ${CONFIG_FILENAME} (org=${cfg.orgSlug}, project=${cfg.projectSlug}, url=${cfg.serverUrl})`);
+    return;
+  }
+  const nested = upsertProfile(existing, courseName, cfg);
+  writeJsonAtomic(p, nested, 384);
+  const action = isNew ? "wrote" : isUpdate ? `updated course "${courseName}" in` : `added course "${courseName}" to`;
+  ok(`${action} ${CONFIG_FILENAME} (active: ${courseName})`);
+}
+function migrateLegacyCredFile(targetDir) {
+  const legacy = path2.join(targetDir, LEGACY_CONFIG_FILENAME);
+  const dest = path2.join(targetDir, CONFIG_FILENAME);
+  if (!fs2.existsSync(legacy) || fs2.existsSync(dest)) return;
+  let parsed;
+  try {
+    parsed = JSON.parse(fs2.readFileSync(legacy, "utf-8"));
+  } catch {
+    return;
+  }
+  const pat = parsed?.pat;
+  if (typeof pat !== "string" || !pat.startsWith("ls_pat_")) return;
+  if (DRY_RUN) {
+    dryNote(`would migrate legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} and strip the legacy gitignore line`);
+    return;
+  }
+  fs2.renameSync(legacy, dest);
+  removeGitignoreLine(targetDir, LEGACY_CONFIG_FILENAME);
+  ok(`migrated legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} (the old name is now reserved for file-backed-config)`);
+}
+function removeGitignoreLine(targetDir, line) {
+  const p = path2.join(targetDir, ".gitignore");
+  if (!fs2.existsSync(p)) return;
+  const before = fs2.readFileSync(p, "utf-8");
+  const after = before.split(/\r?\n/).filter((l) => l.trim() !== line).join("\n");
+  if (after === before) return;
+  if (DRY_RUN) {
+    dryNote(`would remove "${line}" from .gitignore`);
+    return;
+  }
+  fs2.writeFileSync(p, after, "utf-8");
+  ok(`removed ${line} from .gitignore (now reserved for file-backed-config)`);
+}
+var LAUNCH_SECURE_HEADERS_HELPER = `node -e 'const j=JSON.parse(require("fs").readFileSync(".launch-secure.cred.config","utf-8"));const c=j.profiles&&j.active?j.profiles[j.active]:j;process.stdout.write(JSON.stringify({Authorization:"Bearer "+c.pat,"X-Org-Slug":c.orgSlug,"X-Project-Slug":c.projectSlug}))'`;
+function buildLaunchKitMcpEntries(cfg) {
+  return {
+    "launch-secure": {
+      type: "http",
+      url: `${cfg.serverUrl}/api/mcp/project`,
+      headersHelper: LAUNCH_SECURE_HEADERS_HELPER
+    },
+    "launch-chart": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"],
+      env: { LAUNCH_CHART_AUTOSERVE: "1" }
+    },
+    "launch-deck": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-deck"]
+    },
+    "launch-orbit": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-orbit", "mcp"]
+    },
+    "launch-recall": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "mcp"]
+    }
+  };
+}
+function mergeMcpFile(targetDir, launchKitEntries) {
+  const p = path2.join(targetDir, ".mcp.json");
+  const hadExisting = fs2.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs2.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const existingServerCount = Object.keys(existing.mcpServers ?? {}).length;
+  const merged = { ...existing, mcpServers: { ...existing.mcpServers ?? {} } };
+  const overwrites = [];
+  const additions = [];
+  for (const [name, entry] of Object.entries(launchKitEntries)) {
+    if (merged.mcpServers[name]) overwrites.push(name);
+    else additions.push(name);
+    merged.mcpServers[name] = entry;
+  }
+  if (DRY_RUN) {
+    const action2 = hadExisting && existingServerCount > 0 ? "would merge into" : "would write";
+    dryNote(`${action2} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}]`);
+    return;
+  }
+  fs2.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  const action = hadExisting && existingServerCount > 0 ? "merged into" : "wrote";
+  ok(`${action} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
+}
+function detectPackageManager(repoDir) {
+  const pkgPath = path2.join(repoDir, "package.json");
+  if (!fs2.existsSync(pkgPath)) return null;
+  try {
+    const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf-8"));
+    if (typeof pkg.packageManager === "string") {
+      const name = pkg.packageManager.split("@")[0];
+      const match = PACKAGE_MANAGERS.find((p) => p.name === name);
+      if (match) return { pm: match, source: `package.json packageManager (${pkg.packageManager})` };
+      info(`packageManager field "${pkg.packageManager}" is not recognized \u2014 falling back to lockfile detection`);
+    }
+  } catch {
+  }
+  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs2.existsSync(path2.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
+  if (matches.length === 1) {
+    return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile}` };
+  }
+  if (matches.length > 1) {
+    info(`multiple lockfiles found (${matches.map((m) => m.lockfile).join(", ")}) \u2014 picking ${matches[0].pm.name} by precedence`);
+    return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile} (multiple present)` };
+  }
+  for (const pm of PACKAGE_MANAGERS) {
+    if (pm.workspaceFiles?.some((wf) => fs2.existsSync(path2.join(repoDir, wf)))) {
+      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs2.existsSync(path2.join(repoDir, wf)))})` };
+    }
+  }
+  const npm = PACKAGE_MANAGERS.find((p) => p.name === "npm");
+  return { pm: npm, source: "default (no signal found)" };
+}
+function runInstall(repoDir, detected) {
+  const { pm } = detected;
+  if (!which(pm.binary)) {
+    fail(
+      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path2.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+    );
+  }
+  info(`running ${pm.binary} ${pm.installArgs.join(" ")} \u2026`);
+  if (DRY_RUN) {
+    dryNote(`would run: ${pm.binary} ${pm.installArgs.join(" ")} (cwd: ${repoDir})`);
+    return;
+  }
+  const res = (0, import_node_child_process.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
+  if (res.status !== 0) {
+    fail(
+      `${pm.name} install failed (exit ${res.status}). Configs and clone are intact \u2014 fix the underlying error and retry: cd ${path2.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+    );
+  }
+  ok(`${pm.name} install complete`);
+}
+function hasOnboardScript(repoDir) {
+  const pkgPath = path2.join(repoDir, "package.json");
+  if (!fs2.existsSync(pkgPath)) return false;
+  try {
+    const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf-8"));
+    return typeof pkg.scripts?.[ONBOARD_SCRIPT_NAME] === "string";
+  } catch {
+    return false;
+  }
+}
+function runRecallInit(repoDir) {
+  info(`scaffolding launch-recall (shadow git backup) \u2026`);
+  const recallEntry = path2.resolve(__dirname, "recall-entry.js");
+  const useSibling = fs2.existsSync(recallEntry);
+  const cmd = useSibling ? process.execPath : "npx";
+  const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "init"];
+  if (DRY_RUN) {
+    dryNote(`would run launch-recall init: ${cmd} ${args.join(" ")} (cwd: ${repoDir})`);
+    return;
+  }
+  const res = (0, import_node_child_process.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
+  if (res.status !== 0) {
+    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path2.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
+    return;
+  }
+  ok(`launch-recall ready (shadow git initialized)`);
+}
+function runOnboard(repoDir, pm) {
+  info(`running ${pm.binary} run ${ONBOARD_SCRIPT_NAME} \u2026`);
+  if (DRY_RUN) {
+    dryNote(`would run: ${pm.binary} run ${ONBOARD_SCRIPT_NAME} (cwd: ${repoDir})`);
+    return;
+  }
+  const res = (0, import_node_child_process.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
+  if (res.status !== 0) {
+    fail(
+      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path2.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
+    );
+  }
+  ok(`${ONBOARD_SCRIPT_NAME} script complete`);
+}
+function ensureGitignoreLine(targetDir, line) {
+  const p = path2.join(targetDir, ".gitignore");
+  let content = fs2.existsSync(p) ? fs2.readFileSync(p, "utf-8") : "";
+  const lines = content.split(/\r?\n/);
+  if (lines.some((l) => l.trim() === line)) return;
+  if (content.length && !content.endsWith("\n")) content += "\n";
+  content += `${line}
+`;
+  if (DRY_RUN) {
+    dryNote(`would append "${line}" to .gitignore`);
+    return;
+  }
+  fs2.writeFileSync(p, content, "utf-8");
+  ok(`appended ${line} to .gitignore`);
+}
+function copyScaffoldIfMissing(srcPath, destPath, label) {
+  if (!fs2.existsSync(srcPath)) return "missing-src";
+  if (fs2.existsSync(destPath)) {
+    info(`${label} already present \u2014 leaving alone`);
+    return "existed";
+  }
+  if (DRY_RUN) {
+    dryNote(`would write ${label}`);
+    return "wrote";
+  }
+  fs2.mkdirSync(path2.dirname(destPath), { recursive: true });
+  fs2.copyFileSync(srcPath, destPath);
+  try {
+    const srcMode = fs2.statSync(srcPath).mode;
+    fs2.chmodSync(destPath, srcMode);
+  } catch {
+  }
+  ok(`wrote ${label}`);
+  return "wrote";
+}
+function copyScaffoldDirAlways(srcDir, destDir, labelPrefix) {
+  if (!fs2.existsSync(srcDir)) return;
+  for (const entry of fs2.readdirSync(srcDir, { withFileTypes: true })) {
+    const srcPath = path2.join(srcDir, entry.name);
+    const destPath = path2.join(destDir, entry.name);
+    const label = labelPrefix ? `${labelPrefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      copyScaffoldDirAlways(srcPath, destPath, label);
+    } else if (entry.isFile()) {
+      const existed = fs2.existsSync(destPath);
+      if (DRY_RUN) {
+        dryNote(`would ${existed ? "refresh" : "write"} ${label}`);
+        continue;
+      }
+      fs2.mkdirSync(path2.dirname(destPath), { recursive: true });
+      fs2.copyFileSync(srcPath, destPath);
+      try {
+        const srcMode = fs2.statSync(srcPath).mode;
+        fs2.chmodSync(destPath, srcMode);
+      } catch {
+      }
+      ok(`${existed ? "refreshed" : "wrote"} ${label}`);
+    }
+  }
+}
+function scaffoldMigrateSafety(targetDir) {
+  const scaffoldsRoot = path2.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
+  if (!fs2.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 migrate-safety scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  const files = [
+    {
+      src: path2.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
+      dest: path2.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
+      label: ".github/workflows/backup-on-migration.yml"
+    },
+    {
+      src: path2.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
+      dest: path2.join(targetDir, "scripts", "migrate-with-backup.sh"),
+      label: "scripts/migrate-with-backup.sh"
+    },
+    {
+      src: path2.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
+      dest: path2.join(targetDir, "docs", "migrations-runbook.md"),
+      label: "docs/migrations-runbook.md"
+    }
+  ];
+  info("scaffolding migrate-safety (pg_dump wrapper + GHA backup workflow + runbook) \u2026");
+  for (const f of files) copyScaffoldIfMissing(f.src, f.dest, f.label);
+  ensureGitignoreLine(targetDir, ".backups/");
+  ok("migrate-safety ready \u2014 see docs/migrations-runbook.md for db:migrate wiring + PROD_DATABASE_URL secret setup");
+}
+var MARKETPLACE_ID = "launchsecure";
+var LS_PLUGIN_ID = "ls";
+function scaffoldLsMarketplace(targetDir) {
+  const scaffoldsRoot = path2.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace");
+  if (!fs2.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 ls-marketplace scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  const marketplaceRoot = path2.join(targetDir, ".claude", "marketplace");
+  info("scaffolding ls marketplace (Claude Code /ls: namespace \u2014 refreshes every /ls:* command found in the scaffold) \u2026");
+  copyScaffoldDirAlways(scaffoldsRoot, marketplaceRoot, ".claude/marketplace");
+  wireLsSettings(targetDir);
+  ok(`ls marketplace ready \u2014 open this repo in Claude Code, approve the "${MARKETPLACE_ID}" marketplace prompt, then try /ls:activate-beacon, /ls:standup, or /ls:show-mcp-status`);
+}
+function wireLsSettings(targetDir) {
+  const p = path2.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs2.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs2.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const merged = { ...existing };
+  merged.extraKnownMarketplaces = {
+    ...existing.extraKnownMarketplaces ?? {},
+    [MARKETPLACE_ID]: {
+      source: { source: "directory", path: "./.claude/marketplace" }
+    }
+  };
+  merged.enabledPlugins = {
+    ...existing.enabledPlugins ?? {},
+    [`${LS_PLUGIN_ID}@${MARKETPLACE_ID}`]: true
+  };
+  if (DRY_RUN) {
+    dryNote(`would ${hadExisting ? "merge into" : "write"} .claude/settings.json (set extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${LS_PLUGIN_ID}@${MARKETPLACE_ID}; preserves every other key)`);
+    return;
+  }
+  fs2.mkdirSync(path2.dirname(p), { recursive: true });
+  fs2.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  ok(`${hadExisting ? "merged into" : "wrote"} .claude/settings.json (extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${LS_PLUGIN_ID}@${MARKETPLACE_ID})`);
+}
+var RECALL_HOOK_SIGNATURE = "ensure-recall.sh";
+var RECALL_HOOK_COMMAND = 'bash "${CLAUDE_PROJECT_DIR:-$PWD}/scripts/ensure-recall.sh"';
+function scaffoldRecallHook(targetDir) {
+  const scaffoldsRoot = path2.resolve(__dirname, "..", "..", "scaffolds", "recall-hook");
+  if (!fs2.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 recall-hook scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  info("scaffolding recall-hook (SessionStart watcher-respawn hook + ensure-recall.sh) \u2026");
+  copyScaffoldDirAlways(scaffoldsRoot, targetDir, "");
+  wireRecallHook(targetDir);
+  ok("recall-hook ready \u2014 opens with Claude Code will respawn the launch-recall watcher if it died between sessions");
+}
+function wireRecallHook(targetDir) {
+  const p = path2.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs2.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs2.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const hooks = existing.hooks ?? {};
+  const sessionStart = hooks.SessionStart ?? [];
+  const alreadyWired = sessionStart.some(
+    (group) => (group.hooks ?? []).some((h) => typeof h?.command === "string" && h.command.includes(RECALL_HOOK_SIGNATURE))
+  );
+  if (alreadyWired) {
+    info(".claude/settings.json SessionStart hook already references ensure-recall.sh \u2014 leaving alone");
+    return;
+  }
+  const newGroup = {
+    hooks: [{ type: "command", command: RECALL_HOOK_COMMAND }]
+  };
+  const merged = {
+    ...existing,
+    hooks: {
+      ...hooks,
+      SessionStart: [...sessionStart, newGroup]
+    }
+  };
+  if (DRY_RUN) {
+    dryNote(`would append SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh; preserves every other key + existing hooks)`);
+    return;
+  }
+  fs2.mkdirSync(path2.dirname(p), { recursive: true });
+  fs2.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  ok(`appended SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh)`);
+}
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    printHelp();
+    return;
+  }
+  const subcommand = process.argv[2];
+  if (subcommand && subcommand !== "init" && !subcommand.startsWith("--")) {
+    fail(`Unknown subcommand "${subcommand}". Only "init" is supported. Run with --help for usage.`);
+  }
+  DRY_RUN = args.dryRun;
+  if (DRY_RUN) {
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    info("DRY RUN \u2014 no files will be written, no commands will run.");
+    info("Lines tagged (dry-run) show what would happen.");
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  }
+  if (!args.token) {
+    const t = await prompt("LaunchSecure PAT (ls_pat_\u2026): ");
+    args.token = t || null;
+  }
+  if (!args.token) fail("--token (or LS_PAT env) is required.");
+  if (!/^ls_pat_/.test(args.token)) fail("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
+  if (!args.orgSlug) fail("--org=<orgSlug> is required.");
+  if (!args.projectSlug) fail("--project=<projectSlug> is required.");
+  const { hasGh } = preflight();
+  info(`resolving project ${args.orgSlug}/${args.projectSlug} on ${args.serverUrl} \u2026`);
+  let resolved;
+  try {
+    resolved = await callProjectInfo(args);
+  } catch (err) {
+    fail(err instanceof Error ? err.message : String(err));
+  }
+  ok(`resolved "${resolved.projectName}"`);
+  if (!resolved.repositoryUrl) {
+    fail(
+      `Project "${resolved.projectSlug}" has no GitHub repository configured. Connect GitHub at ${args.serverUrl}/${resolved.orgSlug}/projects/${resolved.projectSlug}/settings/integrations, then re-run init.`
+    );
+  }
+  const repoUrl = resolved.repositoryUrl;
+  const cwd = process.cwd();
+  const targetDir = path2.resolve(args.targetDir ?? path2.join(cwd, resolved.projectSlug));
+  const normalizedRemote = normalizeRepoUrl(repoUrl);
+  let skipClone = false;
+  if (fs2.existsSync(targetDir)) {
+    if (isGitRepo(targetDir)) {
+      const existingRemote = gitRemoteUrl(targetDir);
+      if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
+        ok(`${targetDir} is already a clone of ${repoUrl} \u2014 skipping clone, refreshing configs only`);
+        skipClone = true;
+      } else {
+        fail(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
+      }
+    } else if (!dirIsEmpty(targetDir)) {
+      fail(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
+    }
+  }
+  if (!skipClone) cloneRepo(repoUrl, targetDir, hasGh);
+  const cfg = {
+    pat: args.token,
+    orgSlug: resolved.orgSlug,
+    projectSlug: resolved.projectSlug,
+    serverUrl: args.serverUrl
+  };
+  const courseName = args.course ?? inferCourseName(cfg.serverUrl);
+  writeConfigFile(targetDir, cfg, courseName);
+  mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg));
+  ensureGitignoreLine(targetDir, CONFIG_FILENAME);
+  let installSkippedReason = null;
+  const detected = detectPackageManager(targetDir);
+  if (detected) info(`detected package manager: ${detected.pm.name} (${detected.source})`);
+  if (args.noInstall) {
+    installSkippedReason = "--no-install passed";
+  } else if (!detected) {
+    installSkippedReason = "no package.json found";
+  } else {
+    runInstall(targetDir, detected);
+    if (hasOnboardScript(targetDir)) runOnboard(targetDir, detected.pm);
+  }
+  const hasOnboard = hasOnboardScript(targetDir);
+  if (!args.noRecall) runRecallInit(targetDir);
+  if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir);
+  if (!args.noLsMarketplace) scaffoldLsMarketplace(targetDir);
+  if (!args.noRecallHook) scaffoldRecallHook(targetDir);
+  const relTarget = path2.relative(cwd, targetDir) || ".";
+  console.log("");
+  if (DRY_RUN) {
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    info(`DRY RUN COMPLETE \u2014 no files were modified, no commands ran.`);
+    info(`Target: ${targetDir}`);
+    info(`Re-run without --dry-run to apply the changes shown above.`);
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    return;
+  }
+  ok(`done \u2014 ${resolved.projectName} is ready at ${targetDir}`);
+  if (installSkippedReason) {
+    const installLine = detected ? `  ${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` : `  npm install              # or your package manager of choice`;
+    const onboardLine = hasOnboard && detected ? `
+  ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}      # project setup hook` : "";
+    console.log(`
+Next steps (install skipped: ${installSkippedReason}):
+  cd ${relTarget}
+${installLine}${onboardLine}
+  claude                   # launch Claude Code (5 MCPs wired)
+${LAUNCH_KIT_TOOLS_GUIDE}`);
+  } else {
+    console.log(`
+Next steps:
+  cd ${relTarget}
+  claude                   # launch Claude Code (5 MCPs wired)
+${LAUNCH_KIT_TOOLS_GUIDE}`);
+  }
+}
+main().catch((err) => {
+  console.error(`[launch-kit] unexpected error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
+  process.exit(1);
+});