@launchsecure/launch-kit 0.0.27 → 0.0.28

package/dist/server/beacon-monitor-entry.js

@@ -0,0 +1,353 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/server/beacon-monitor-entry.ts
+var import_node_crypto = require("node:crypto");
+var import_node_path2 = require("node:path");
+
+// src/server/beacon/ndjson-writer.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+function openNdjsonWriter(opts) {
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(opts.path), { recursive: true });
+  const stream = (0, import_node_fs.createWriteStream)(opts.path, { flags: "a" });
+  let total = 0;
+  let closed = false;
+  stream.on("error", (err) => {
+    opts.onError?.(err);
+  });
+  return {
+    write(event) {
+      if (closed) return;
+      let line;
+      try {
+        line = JSON.stringify(event);
+      } catch (err) {
+        opts.onError?.(err instanceof Error ? err : new Error(String(err)));
+        return;
+      }
+      stream.write(line + "\n");
+      total += 1;
+    },
+    count() {
+      return total;
+    },
+    path() {
+      return opts.path;
+    },
+    close() {
+      return new Promise((resolveClose) => {
+        if (closed) {
+          resolveClose();
+          return;
+        }
+        closed = true;
+        stream.end(() => resolveClose());
+      });
+    }
+  };
+}
+
+// src/server/beacon/server.ts
+var import_node_http = require("node:http");
+var MAX_BODY_BYTES = 1048576;
+var TOKEN_PATH_PREFIX = "/m/";
+function writeCors(res, origin) {
+  res.setHeader("Access-Control-Allow-Origin", origin && origin !== "null" ? origin : "*");
+  res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "content-type");
+  res.setHeader("Access-Control-Max-Age", "600");
+  res.setHeader("Vary", "Origin");
+}
+function readBody(req) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    let total = 0;
+    req.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > MAX_BODY_BYTES) {
+        reject(new Error("payload too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve2(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", (err) => reject(err));
+  });
+}
+function isMonitorBatchEnvelope(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  if (typeof v.sessionId !== "string") return false;
+  if (!Array.isArray(v.events)) return false;
+  if (!v.meta || typeof v.meta !== "object") return false;
+  const meta = v.meta;
+  if (typeof meta.url !== "string" || typeof meta.userAgent !== "string") return false;
+  return true;
+}
+function startBeaconServer(opts) {
+  return new Promise((resolveStart, rejectStart) => {
+    const server = (0, import_node_http.createServer)(async (req, res) => {
+      writeCors(res, req.headers.origin);
+      if (req.method === "OPTIONS") {
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+      if (req.method !== "POST") {
+        res.writeHead(405, { "content-type": "text/plain" });
+        res.end("method not allowed");
+        return;
+      }
+      const url = req.url ?? "/";
+      const pathOnly = url.split("?")[0] ?? "/";
+      if (!pathOnly.startsWith(TOKEN_PATH_PREFIX)) {
+        res.writeHead(404, { "content-type": "text/plain" });
+        res.end("not found");
+        return;
+      }
+      const provided = pathOnly.slice(TOKEN_PATH_PREFIX.length).replace(/\/+$/, "");
+      if (provided !== opts.token) {
+        res.writeHead(403, { "content-type": "text/plain" });
+        res.end("bad token");
+        return;
+      }
+      let bodyText;
+      try {
+        bodyText = await readBody(req);
+      } catch (err) {
+        opts.onBadBatch?.(`body read failed: ${err.message}`, req);
+        res.writeHead(413, { "content-type": "text/plain" });
+        res.end("payload error");
+        return;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(bodyText);
+      } catch {
+        opts.onBadBatch?.("invalid JSON", req);
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("invalid json");
+        return;
+      }
+      if (!isMonitorBatchEnvelope(parsed)) {
+        opts.onBadBatch?.("schema mismatch", req);
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("bad batch shape");
+        return;
+      }
+      try {
+        opts.onBatch(parsed, req);
+      } catch (err) {
+        opts.onServerError?.(err instanceof Error ? err : new Error(String(err)));
+      }
+      res.writeHead(204);
+      res.end();
+    });
+    server.on("error", (err) => {
+      opts.onServerError?.(err);
+      rejectStart(err);
+    });
+    server.listen(opts.port, opts.host, () => {
+      const addr = server.address();
+      const port = addr ? addr.port : opts.port;
+      const url = `http://${opts.host}:${port}/m/${opts.token}`;
+      resolveStart({
+        url,
+        port,
+        close() {
+          return new Promise((resolveClose) => {
+            server.close(() => resolveClose());
+          });
+        }
+      });
+    });
+  });
+}
+
+// src/server/beacon-monitor-entry.ts
+function parseMonitorFlags(argv) {
+  const flags = { port: 9876, host: "127.0.0.1", quiet: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--port") {
+      const n = Number(argv[++i]);
+      if (!Number.isInteger(n) || n < 0 || n > 65535) {
+        die(`--port must be an integer in 0..65535 (got "${argv[i]}")`);
+      }
+      flags.port = n;
+    } else if (a === "--host") {
+      const v = argv[++i];
+      if (!v) die("--host requires a value");
+      flags.host = v;
+    } else if (a === "--out") {
+      const v = argv[++i];
+      if (!v) die("--out requires a path");
+      flags.out = v;
+    } else if (a === "--token") {
+      const v = argv[++i];
+      if (!v) die("--token requires a value");
+      if (!/^[A-Za-z0-9_-]+$/.test(v)) die("--token must be alphanumeric (plus _ or -)");
+      flags.token = v;
+    } else if (a === "--quiet") {
+      flags.quiet = true;
+    } else if (a === "--help" || a === "-h") {
+      printHelp();
+      process.exit(0);
+    } else if (a.startsWith("--")) {
+      die(`unknown flag: ${a}`);
+    } else {
+      die(`unexpected argument: ${a}`);
+    }
+  }
+  return flags;
+}
+function mintToken() {
+  return (0, import_node_crypto.randomBytes)(4).toString("hex");
+}
+async function runMonitor(argv) {
+  const flags = parseMonitorFlags(argv);
+  const token = flags.token ?? mintToken();
+  const projectRoot = process.cwd();
+  const outPath = flags.out ? (0, import_node_path2.resolve)(projectRoot, flags.out) : (0, import_node_path2.resolve)(projectRoot, ".launchsecure", `beacon-${token}.ndjson`);
+  const writer = openNdjsonWriter({
+    path: outPath,
+    onError: (err) => {
+      process.stderr.write(`
+[launch-beacon] ndjson write error: ${err.message}
+`);
+    }
+  });
+  const stats = {
+    events: 0,
+    badBatches: 0,
+    lastKind: "",
+    lastAt: 0
+  };
+  let server;
+  try {
+    server = await startBeaconServer({
+      port: flags.port,
+      host: flags.host,
+      token,
+      onBatch: (batch) => {
+        for (const raw of batch.events) {
+          writer.write(raw);
+          stats.events += 1;
+          const ev = raw;
+          if (typeof ev.kind === "string") stats.lastKind = ev.kind;
+          if (typeof ev.ts === "number") stats.lastAt = ev.ts;
+        }
+        draw();
+      },
+      onBadBatch: (reason) => {
+        stats.badBatches += 1;
+        process.stderr.write(`
+[launch-beacon] bad batch: ${reason}
+`);
+      },
+      onServerError: (err) => {
+        process.stderr.write(`
+[launch-beacon] server error: ${err.message}
+`);
+      }
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("EADDRINUSE")) {
+      die(`port ${flags.port} already in use \u2014 pass --port <n> to choose another`);
+    }
+    die(`failed to start: ${msg}`);
+    return;
+  }
+  process.stdout.write(`
+launch-beacon monitor \u2014 listening
+`);
+  process.stdout.write(`  paste URL    ${server.url}
+`);
+  process.stdout.write(`  writing      ${outPath}
+`);
+  process.stdout.write(`  session      ${token}
+
+`);
+  let heartbeatTimer = null;
+  const draw = () => {
+    if (flags.quiet) return;
+    const since = stats.lastAt ? Math.max(0, Math.round((Date.now() - stats.lastAt) / 1e3)) : null;
+    const sinceStr = since === null ? "\u2014" : since < 5 ? "just now" : `${since}s ago`;
+    const lastStr = stats.lastKind ? `${stats.lastKind} (${sinceStr})` : "\u2014";
+    const badStr = stats.badBatches > 0 ? ` | bad: ${stats.badBatches}` : "";
+    const line = `  events: ${stats.events}${badStr} | last: ${lastStr}`;
+    process.stdout.write(`\r\x1B[K${line}`);
+  };
+  if (!flags.quiet) {
+    heartbeatTimer = setInterval(draw, 1e3);
+    draw();
+  }
+  const shutdown = async (signal) => {
+    if (heartbeatTimer) clearInterval(heartbeatTimer);
+    process.stdout.write(`
+
+[launch-beacon] caught ${signal}, shutting down\u2026
+`);
+    try {
+      await server.close();
+    } catch (err) {
+      process.stderr.write(`[launch-beacon] server close error: ${err.message}
+`);
+    }
+    try {
+      await writer.close();
+    } catch (err) {
+      process.stderr.write(`[launch-beacon] writer close error: ${err.message}
+`);
+    }
+    process.stdout.write(`  events written: ${writer.count()}
+`);
+    process.stdout.write(`  file:           ${outPath}
+`);
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+}
+function printHelp() {
+  process.stdout.write(
+    `launch-beacon
+
+Usage:
+  launch-beacon monitor [flags]    Start the HTTP receiver for beacon monitor batches
+
+Flags for "monitor":
+  --port <n>       port to listen on (default: 9876)
+  --host <host>    host to bind to (default: 127.0.0.1)
+  --out <path>     output NDJSON file (default: .launchsecure/beacon-<token>.ndjson)
+  --token <str>    use this token instead of a random 8-char hex
+  --quiet          suppress the live heartbeat line
+
+The printed URL is what you paste into the beacon debug panel. Beacon POSTs
+monitor batches there; this process writes each event as a JSON line to the
+output file. Ctrl+C shuts down cleanly.
+`
+  );
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  const subcommand = argv[0];
+  if (!subcommand || subcommand === "monitor") {
+    await runMonitor(subcommand === "monitor" ? argv.slice(1) : argv);
+    return;
+  }
+  if (subcommand === "--help" || subcommand === "-h" || subcommand === "help") {
+    printHelp();
+    return;
+  }
+  die(`unknown subcommand: ${subcommand}`);
+}
+function die(msg) {
+  process.stderr.write(`[launch-beacon] ${msg}
+`);
+  process.exit(2);
+}
+void main();

package/dist/server/cli.js

@@ -27091,7 +27091,7 @@ function buildAnalyzerPrompt(ctx) {
   lines.push("If this feedback contains MULTIPLE distinct issues, the first line categorises the PRIMARY one. List the others on subsequent lines as `also <bug|feature|\u2026>: <one sentence>`. The first line is harvested as the card preview; the rest belong to your detailed analysis.");
   lines.push("");
   lines.push("ISSUE ENUMERATION \u2014 DO THIS BEFORE ANY OTHER STEP.");
-  lines.push("The user's intent is spread across THREE places: the FEEDBACK BODY, each PIN's NOTE, and the SCREENSHOT. Sub-bugs frequently live in pin notes, not the body. Before any tool call, enumerate every distinct issue you can identify across all three sources. For each issue, decide one of:");
+  lines.push("The user's intent + diagnostic signal is spread across FOUR places: the FEEDBACK BODY, each PIN's NOTE, any RUNTIME EVENTS the beacon captured around the report (silent errors / unhandled rejections \u2014 these often reveal the real failure even when the body is vague), and the SCREENSHOT. Sub-bugs frequently live in pin notes, not the body. Before any tool call, enumerate every distinct issue you can identify across all four sources. For each issue, decide one of:");
   lines.push("  \u2022 fix it now (add to your plan)");
   lines.push("  \u2022 defer it (note why \u2014 out of scope, requires user input, etc.)");
   lines.push("  \u2022 ambiguous \u2192 surface via `AskUserQuestion` BEFORE editing. Do NOT silently drop unclear fragments.");
@@ -27141,6 +27141,21 @@ function buildAnalyzerPrompt(ctx) {
     }
     lines.push("");
   }
+  if (ctx.events && ctx.events.length > 0) {
+    lines.push(`RUNTIME EVENTS (${ctx.events.length}) \u2014 captured by the beacon between page load and Send. Treat these as the highest-signal diagnostic when the body is short. Always check whether the named source file matches a route/component you're investigating before blaming the user-described symptom.`);
+    for (const ev of ctx.events) {
+      const offset = formatEventOffset(ev.ts, ctx.capturedAt);
+      const kindLabel = ev.kind === "unhandledrejection" ? "rejection" : "error";
+      const location = ev.source ? `${ev.source}${ev.line ? `:${ev.line}` : ""}${ev.col ? `:${ev.col}` : ""}` : null;
+      lines.push(`${kindLabel.toUpperCase()} (${offset}): ${ev.message}`);
+      if (location) lines.push(`  at ${location}`);
+      if (ev.stack) {
+        const stackHead = ev.stack.split("\n").slice(0, 5).join("\n").slice(0, 600);
+        for (const sl of stackHead.split("\n")) lines.push(`  ${sl}`);
+      }
+    }
+    lines.push("");
+  }
   lines.push("PROCEDURE (step 0 is the mandatory category line above \u2014 do NOT repeat the format instruction):");
   let n = 1;
   if (ctx.screenshotLocalPath) {
@@ -27161,6 +27176,16 @@ function buildAnalyzerPrompt(ctx) {
   lines.push(`  ${n++}. If any fix is non-trivial, ambiguous, or would touch many files, STOP and either (a) ask via \`AskUserQuestion\`, or (b) write a plan in your final response instead of editing. Better to leave the user a clear next-step than to commit a wrong change.`);
   return lines.join("\n");
 }
+function formatEventOffset(eventTs, capturedAt) {
+  if (!capturedAt) return `ts=${eventTs}`;
+  const diffMs = eventTs - new Date(capturedAt).getTime();
+  if (!Number.isFinite(diffMs)) return `ts=${eventTs}`;
+  const direction = diffMs <= 0 ? "before report" : "after report";
+  const abs = Math.abs(diffMs);
+  if (abs < 1e3) return `${abs}ms ${direction}`;
+  if (abs < 6e4) return `${(abs / 1e3).toFixed(1)}s ${direction}`;
+  return `${(abs / 6e4).toFixed(1)}m ${direction}`;
+}
 async function resumeAnalysisSession(params) {
   const { sessionId, projectDir } = params;
   const id = createSessionDirect(`radar: ${sessionId.slice(-8)} (resumed)`, projectDir, sessionId);
@@ -27561,6 +27586,23 @@ function buildContext(payload) {
   const body = typeof resource.body === "string" ? resource.body : payload.message;
   const severity = typeof fields.severity === "string" ? fields.severity : void 0;
   const route = typeof beaconMeta.url === "string" ? beaconMeta.url : void 0;
+  const rawEvents = Array.isArray(fields.events) ? fields.events : [];
+  const events = rawEvents.map((e) => {
+    const kind = e.kind === "error" || e.kind === "unhandledrejection" ? e.kind : null;
+    const ts = typeof e.ts === "number" ? e.ts : null;
+    const message = typeof e.message === "string" ? e.message : null;
+    if (!kind || ts === null || !message) return null;
+    return {
+      ts,
+      kind,
+      message,
+      ...typeof e.stack === "string" ? { stack: e.stack } : {},
+      ...typeof e.source === "string" ? { source: e.source } : {},
+      ...typeof e.line === "number" ? { line: e.line } : {},
+      ...typeof e.col === "number" ? { col: e.col } : {}
+    };
+  }).filter((e) => e !== null);
+  const capturedAt = typeof beaconMeta.capturedAt === "string" ? beaconMeta.capturedAt : void 0;
   const viewport = isViewport(beaconMeta.viewport) ? { w: beaconMeta.viewport.w, h: beaconMeta.viewport.h } : void 0;
   const theme = beaconMeta.theme === "light" || beaconMeta.theme === "dark" ? beaconMeta.theme : void 0;
   const userAgent = typeof beaconMeta.userAgent === "string" ? beaconMeta.userAgent : void 0;
@@ -27573,6 +27615,8 @@ function buildContext(payload) {
     severity,
     route,
     pins: pins.length > 0 ? pins : void 0,
+    events: events.length > 0 ? events : void 0,
+    capturedAt,
     viewport,
     theme,
     userAgent,
@@ -35283,7 +35327,11 @@ function readLaunchSecureMcpConfig() {
     } catch (err2) {
       throw new Error(`Could not parse ${configPath}: ${err2 instanceof Error ? err2.message : String(err2)}`);
     }
-    const { pat: pat2, orgSlug: orgSlug2, projectSlug: projectSlug2, serverUrl } = parsed;
+    const block = parsed.profiles && parsed.active ? parsed.profiles[parsed.active] : parsed;
+    if (!block) {
+      throw new Error(`${CRED_CONFIG_FILENAME} active course "${parsed.active}" not found in profiles.`);
+    }
+    const { pat: pat2, orgSlug: orgSlug2, projectSlug: projectSlug2, serverUrl } = block;
     if (!pat2 || !pat2.startsWith("ls_pat_")) {
       throw new Error(`${CRED_CONFIG_FILENAME} "pat" is missing or not a LaunchSecure PAT (ls_pat_...).`);
     }

package/dist/server/course-entry.js

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/server/course-entry.ts
+var fs2 = __toESM(require("node:fs"));
+var path2 = __toESM(require("node:path"));
+
+// src/server/cred-shape.ts
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
+var CONFIG_FILENAME = ".launch-secure.cred.config";
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function writeJsonAtomic(absPath, value, mode) {
+  const tmp = `${absPath}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
+  if (mode !== void 0) {
+    try {
+      fs.chmodSync(tmp, mode);
+    } catch {
+    }
+  }
+  fs.renameSync(tmp, absPath);
+}
+
+// src/server/course-entry.ts
+var MCP_FILENAME = ".mcp.json";
+var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
+function info(msg) {
+  console.log(`[launch-course] ${msg}`);
+}
+function ok(msg) {
+  console.log(`[launch-course] \u2713 ${msg}`);
+}
+function fail(msg) {
+  console.error(`[launch-course] \u2717 ${msg}`);
+  process.exit(1);
+}
+function readCredFile2() {
+  const cred = readCredFile(process.cwd());
+  if (!cred) {
+    fail(`${CONFIG_FILENAME} not found in ${process.cwd()}. Run \`npx launch-kit init \u2026\` first.`);
+  }
+  return cred;
+}
+function toNested2(cred) {
+  const nested = toNested(cred);
+  if (!nested) {
+    fail(`${CONFIG_FILENAME} is missing required fields (pat, orgSlug, projectSlug, serverUrl) and has no profiles. Run \`npx launch-kit init \u2026\` to (re)bootstrap.`);
+  }
+  return nested;
+}
+function parseFlag(argv, key) {
+  const prefix = `--${key}=`;
+  const found = argv.find((a) => a.startsWith(prefix));
+  return found ? found.slice(prefix.length) : void 0;
+}
+function cmdList() {
+  const nested = toNested2(readCredFile2());
+  const names = Object.keys(nested.profiles).sort();
+  if (names.length === 0) {
+    info("(no courses)");
+    return;
+  }
+  info(`courses (${names.length}):`);
+  const nameWidth = Math.max(...names.map((n) => n.length), 8);
+  for (const name of names) {
+    const p = nested.profiles[name];
+    const marker = name === nested.active ? "\u2605" : " ";
+    console.log(`  ${marker} ${name.padEnd(nameWidth)}  ${p.serverUrl}  (${p.orgSlug}/${p.projectSlug})`);
+  }
+}
+function cmdAdd(argv) {
+  const name = argv.find((a) => !a.startsWith("--"));
+  if (!name) fail("usage: launch-course add <name> --token=ls_pat_... --org=<slug> --project=<slug> [--url=<serverUrl>]");
+  const token = parseFlag(argv, "token");
+  const org = parseFlag(argv, "org");
+  const project = parseFlag(argv, "project");
+  const url = (parseFlag(argv, "url") ?? DEFAULT_SERVER_URL).replace(/\/+$/, "");
+  if (!token || !token.startsWith("ls_pat_")) fail("--token=<ls_pat_...> required");
+  if (!org) fail("--org=<slug> required");
+  if (!project) fail("--project=<slug> required");
+  const nested = toNested2(readCredFile2());
+  const existed = Boolean(nested.profiles[name]);
+  nested.profiles[name] = { pat: token, orgSlug: org, projectSlug: project, serverUrl: url };
+  writeJsonAtomic(path2.join(process.cwd(), CONFIG_FILENAME), nested, 384);
+  ok(`${existed ? "updated" : "added"} course "${name}" (${url})`);
+  if (nested.active !== name) {
+    info(`active course is still "${nested.active}" \u2014 run \`launch-course set ${name}\` to switch`);
+  }
+}
+function cmdSet(argv) {
+  const name = argv[0];
+  if (!name) fail("usage: launch-course set <name>");
+  const nested = toNested2(readCredFile2());
+  const target = nested.profiles[name];
+  if (!target) {
+    const known = Object.keys(nested.profiles).sort().join(", ") || "(none)";
+    fail(`no course named "${name}". known: ${known}`);
+  }
+  if (nested.active === name) {
+    info(`already on "${name}" \u2014 nothing to do`);
+    return;
+  }
+  const next = { active: name, profiles: nested.profiles };
+  writeJsonAtomic(path2.join(process.cwd(), CONFIG_FILENAME), next, 384);
+  const mcpStatus = updateMcpUrl(target.serverUrl);
+  ok(`active course \u2192 "${name}" (${target.serverUrl})`);
+  if (mcpStatus === "updated") {
+    info("reconnect MCP in Claude Code: /mcp \u2192 toggle launch-secure off/on (URL is read at connect time)");
+  }
+}
+function cmdRm(argv) {
+  const name = argv[0];
+  if (!name) fail("usage: launch-course rm <name>");
+  const nested = toNested2(readCredFile2());
+  if (!nested.profiles[name]) fail(`no course named "${name}"`);
+  if (nested.active === name) {
+    fail(`cannot remove the active course "${name}". \`launch-course set <other>\` first.`);
+  }
+  delete nested.profiles[name];
+  writeJsonAtomic(path2.join(process.cwd(), CONFIG_FILENAME), nested, 384);
+  ok(`removed course "${name}"`);
+}
+function updateMcpUrl(serverUrl) {
+  const p = path2.join(process.cwd(), MCP_FILENAME);
+  if (!fs2.existsSync(p)) {
+    info(`(no ${MCP_FILENAME} \u2014 skipped URL update; run \`npx launch-kit init \u2026\` to wire MCP)`);
+    return "missing-file";
+  }
+  let mcp;
+  try {
+    mcp = JSON.parse(fs2.readFileSync(p, "utf-8"));
+  } catch (err) {
+    fail(`could not parse ${MCP_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const entry = mcp.mcpServers?.["launch-secure"];
+  if (!entry) {
+    info(`(no "launch-secure" entry in ${MCP_FILENAME} \u2014 skipped URL update)`);
+    return "missing-entry";
+  }
+  entry.url = `${serverUrl.replace(/\/+$/, "")}/api/mcp/project`;
+  writeJsonAtomic(p, mcp);
+  ok(`updated ${MCP_FILENAME} launch-secure.url \u2192 ${entry.url}`);
+  return "updated";
+}
+function help() {
+  console.log(`launch-course \u2014 manage LaunchSecure server profiles ("courses").
+
+Usage:
+  launch-course list
+  launch-course add <name> --token=ls_pat_... --org=<slug> --project=<slug> [--url=<serverUrl>]
+  launch-course set <name>
+  launch-course rm  <name>
+
+The cred file (.launch-secure.cred.config) holds every course under \`profiles\`,
+with \`active\` selecting which one drives MCP / launch-pod auth. Legacy flat
+files are auto-migrated on the first multi-profile op. \`launch-course set\`
+also rewrites .mcp.json's launch-secure.url so Claude Code routes to the right
+server on next MCP reconnect.
+`);
+}
+function main() {
+  const [cmd, ...rest] = process.argv.slice(2);
+  switch (cmd) {
+    case "list":
+      return cmdList();
+    case "add":
+      return cmdAdd(rest);
+    case "set":
+    case "use":
+      return cmdSet(rest);
+    case "rm":
+    case "remove":
+    case "delete":
+      return cmdRm(rest);
+    case void 0:
+    case "help":
+    case "--help":
+    case "-h":
+      return help();
+    default:
+      fail(`unknown command "${cmd}". try \`launch-course help\``);
+  }
+}
+main();