@launchsecure/launch-kit 0.0.27 → 0.0.28

package/dist/server/init-entry.js

@@ -25,14 +25,78 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 
 // src/server/init-entry.ts
 var import_node_child_process = require("node:child_process");
-var fs = __toESM(require("node:fs"));
+var fs2 = __toESM(require("node:fs"));
 var import_node_http = require("node:http");
 var import_node_https = require("node:https");
-var path = __toESM(require("node:path"));
+var path2 = __toESM(require("node:path"));
 var readline = __toESM(require("node:readline"));
 var import_node_url = require("node:url");
-var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
+
+// src/server/cred-shape.ts
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
 var CONFIG_FILENAME = ".launch-secure.cred.config";
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function upsertProfile(existing, name, profile) {
+  const base = existing ? toNested(existing) ?? { active: name, profiles: {} } : { active: name, profiles: {} };
+  return {
+    active: name,
+    profiles: { ...base.profiles, [name]: profile }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function writeJsonAtomic(absPath, value, mode) {
+  const tmp = `${absPath}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
+  if (mode !== void 0) {
+    try {
+      fs.chmodSync(tmp, mode);
+    } catch {
+    }
+  }
+  fs.renameSync(tmp, absPath);
+}
+
+// src/server/init-entry.ts
+var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
 var LEGACY_CONFIG_FILENAME = ".launch-secure.config";
 var ONBOARD_SCRIPT_NAME = "onboard";
 var LAUNCH_KIT_PKG = "@launchsecure/launch-kit";
@@ -47,6 +111,38 @@ Wired in Claude Code (.mcp.json):
 Other tools (run on demand via npx):
   npx launch-pod radar       \u2014 webhook listener (LS pings \u2192 terminal/UI)
   npx launch-pod             \u2014 full pipeline UI (separate launch-pod login)
+  npx launch-beacon monitor  \u2014 local HTTP receiver for the launch-kit-beacon
+                               in-browser monitor. Paste the printed URL into
+                               the beacon debug panel; events stream to
+                               .launchsecure/beacon-<token>.ndjson for the
+                               /ls:beacon-* commands below to read.
+
+LS slash commands (run inside Claude Code in this project):
+  /ls:activate-beacon        \u2014 wire the launch-kit-beacon in-app feedback
+                               widget into this app (mounts the <launch-kit-
+                               beacon> Web Component + scaffolds /api/feedback
+                               forwarding to LaunchSecure Comm Hub)
+  /ls:standup                \u2014 draft a daily standup from work since the last
+                               push (chart-grouped themes, work-item linkage,
+                               release detection) and post to LS Comm Hub as
+                               a daily_update after you confirm
+  /ls:show-mcp-status        \u2014 show recall watcher health + last snapshot.
+                               Add 'full' for expanded report (PID, shadow
+                               repo size, recent snaps)
+  /ls:beacon-scan            \u2014 scan recent events from the active
+                               launch-beacon monitor session. Pass a kind
+                               (error/click/fetch/route/dialog/probe) and/or
+                               a limit to filter.
+  /ls:beacon-pulse           \u2014 most recent error + the N events that preceded
+                               it. "What was happening just before it broke."
+  /ls:beacon-array           \u2014 list monitor sessions in .launchsecure/ with
+                               event counts, last activity, liveness glyph.
+                               Add 'full' for a per-session expanded report.
+  /ls:beacon-clear           \u2014 wipe the latest monitor session NDJSON (or
+                               'all'). Confirms before deleting.
+
+  Open this repo in Claude Code; on first open you'll be prompted to install
+  the "launchsecure" marketplace \u2014 accept to enable the commands above.
 `;
 var PACKAGE_MANAGERS = [
   { name: "pnpm", binary: "pnpm", lockfiles: ["pnpm-lock.yaml"], workspaceFiles: ["pnpm-workspace.yaml"], installArgs: ["install"] },
@@ -61,9 +157,13 @@ function parseArgs(argv) {
     projectSlug: null,
     serverUrl: DEFAULT_SERVER_URL,
     targetDir: null,
+    course: null,
     noInstall: false,
     noRecall: false,
     noMigrateSafety: false,
+    noLsMarketplace: false,
+    noRecallHook: false,
+    dryRun: false,
     help: false
   };
   for (const raw of argv) {
@@ -83,6 +183,18 @@ function parseArgs(argv) {
       args.noMigrateSafety = true;
       continue;
     }
+    if (raw === "--no-ls-marketplace") {
+      args.noLsMarketplace = true;
+      continue;
+    }
+    if (raw === "--no-recall-hook") {
+      args.noRecallHook = true;
+      continue;
+    }
+    if (raw === "--dry-run") {
+      args.dryRun = true;
+      continue;
+    }
     const eq = raw.indexOf("=");
     if (!raw.startsWith("--") || eq < 0) continue;
     const key = raw.slice(2, eq);
@@ -92,6 +204,7 @@ function parseArgs(argv) {
     else if (key === "project") args.projectSlug = val;
     else if (key === "url") args.serverUrl = val.replace(/\/+$/, "");
     else if (key === "dir") args.targetDir = val;
+    else if (key === "course") args.course = val;
   }
   return args;
 }
@@ -109,10 +222,30 @@ Required:
 Options:
   --url=<serverUrl>        LaunchSecure base URL (default: ${DEFAULT_SERVER_URL}).
   --dir=<path>             Target directory (default: ./<projectSlug>).
+  --course=<name>          Name for the course (profile) being added to
+                           .launch-secure.cred.config. When omitted, inferred
+                           from --url: localhost\u2192"local", *staging*\u2192"staging",
+                           *.vercel.app\u2192"prod", else hostname. The course
+                           becomes active; re-run with a different --course
+                           and --url to add another (e.g. local + staging).
+                           Use \`launch-course set <name>\` to switch later.
   --no-install             Skip dependency install step.
   --no-recall              Skip launch-recall (shadow git backup) scaffold.
   --no-migrate-safety      Skip migrate-safety scaffold (pg_dump-before-migrate
                            wrapper + GitHub Action + runbook).
+  --no-ls-marketplace      Skip the Claude Code "launchsecure" marketplace
+                           scaffold (.claude/marketplace/ + .claude/settings.json
+                           wiring \u2014 exposes /ls:activate-beacon and future
+                           ls-namespaced slash commands).
+  --no-recall-hook         Skip the SessionStart hook scaffold (Claude Code
+                           hook + scripts/ensure-recall.sh that auto-restarts
+                           the launch-recall watcher if it died between
+                           sessions). The hook is the surfacing layer for
+                           watcher-died-silently scenarios.
+  --dry-run                Preview every file write, merge, clone, and install
+                           command without making any changes. Useful before
+                           re-running init against a customized project. The
+                           project_info HTTP call still runs (it's read-only).
   --help                   Show this help.
 
 What it does:
@@ -132,6 +265,15 @@ What it does:
   8. Scaffolds launch-recall (shadow git backup). Skip with --no-recall.
   9. Scaffolds migrate-safety (pg_dump wrapper + GHA backup workflow +
      runbook + .backups/ gitignore line). Skip with --no-migrate-safety.
+ 10. Scaffolds the Claude Code "launchsecure" marketplace at
+     .claude/marketplace/ and wires .claude/settings.json so Claude Code
+     auto-discovers it and enables the "ls" plugin (exposes
+     /ls:activate-beacon for wiring the launch-kit-beacon in-app feedback
+     widget). Skip with --no-ls-marketplace.
+ 11. Scaffolds scripts/ensure-recall.sh and appends a SessionStart hook to
+     .claude/settings.json that respawns the launch-recall watcher if it
+     died between sessions. Idempotent (dedupes by hook command-match).
+     Skip with --no-recall-hook.
 `);
 }
 async function prompt(question) {
@@ -151,6 +293,10 @@ function info(msg) {
 function ok(msg) {
   console.log(`[launch-kit] \u2713 ${msg}`);
 }
+var DRY_RUN = false;
+function dryNote(msg) {
+  console.log(`[launch-kit] (dry-run) ${msg}`);
+}
 function which(bin) {
   const res = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
   if (res.status !== 0) return null;
@@ -265,11 +411,11 @@ function normalizeRepoUrl(url) {
   }
 }
 function isGitRepo(dir) {
-  return fs.existsSync(path.join(dir, ".git"));
+  return fs2.existsSync(path2.join(dir, ".git"));
 }
 function dirIsEmpty(dir) {
-  if (!fs.existsSync(dir)) return true;
-  return fs.readdirSync(dir).length === 0;
+  if (!fs2.existsSync(dir)) return true;
+  return fs2.readdirSync(dir).length === 0;
 }
 function cloneRepo(repoUrl, targetDir, hasGh) {
   const isGithub = /github\.com/i.test(repoUrl);
@@ -284,6 +430,10 @@ function cloneRepo(repoUrl, targetDir, hasGh) {
     args = ["clone", repoUrl, targetDir];
     info(`cloning via git: ${repoUrl} \u2192 ${targetDir}`);
   }
+  if (DRY_RUN) {
+    dryNote(`would run: ${cmd} ${args.join(" ")}`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(cmd, args, { stdio: "inherit" });
   if (res.status !== 0) {
     fail(
@@ -292,43 +442,56 @@ function cloneRepo(repoUrl, targetDir, hasGh) {
   }
   ok(`cloned to ${targetDir}`);
 }
-function writeConfigFile(targetDir, cfg) {
+function writeConfigFile(targetDir, cfg, courseName) {
   migrateLegacyCredFile(targetDir);
-  const p = path.join(targetDir, CONFIG_FILENAME);
-  const existed = fs.existsSync(p);
-  fs.writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
-  try {
-    fs.chmodSync(p, 384);
-  } catch {
+  const p = path2.join(targetDir, CONFIG_FILENAME);
+  const existing = readCredFile(targetDir);
+  const isNew = existing === null;
+  const isUpdate = !isNew && Boolean(existing?.profiles?.[courseName]);
+  if (DRY_RUN) {
+    const verb = isNew ? "write" : isUpdate ? "update course" : "add course";
+    dryNote(`would ${verb} "${courseName}" in ${CONFIG_FILENAME} (org=${cfg.orgSlug}, project=${cfg.projectSlug}, url=${cfg.serverUrl})`);
+    return;
   }
-  ok(`${existed ? "updated" : "wrote"} ${CONFIG_FILENAME}`);
+  const nested = upsertProfile(existing, courseName, cfg);
+  writeJsonAtomic(p, nested, 384);
+  const action = isNew ? "wrote" : isUpdate ? `updated course "${courseName}" in` : `added course "${courseName}" to`;
+  ok(`${action} ${CONFIG_FILENAME} (active: ${courseName})`);
 }
 function migrateLegacyCredFile(targetDir) {
-  const legacy = path.join(targetDir, LEGACY_CONFIG_FILENAME);
-  const dest = path.join(targetDir, CONFIG_FILENAME);
-  if (!fs.existsSync(legacy) || fs.existsSync(dest)) return;
+  const legacy = path2.join(targetDir, LEGACY_CONFIG_FILENAME);
+  const dest = path2.join(targetDir, CONFIG_FILENAME);
+  if (!fs2.existsSync(legacy) || fs2.existsSync(dest)) return;
   let parsed;
   try {
-    parsed = JSON.parse(fs.readFileSync(legacy, "utf-8"));
+    parsed = JSON.parse(fs2.readFileSync(legacy, "utf-8"));
   } catch {
     return;
   }
   const pat = parsed?.pat;
   if (typeof pat !== "string" || !pat.startsWith("ls_pat_")) return;
-  fs.renameSync(legacy, dest);
+  if (DRY_RUN) {
+    dryNote(`would migrate legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} and strip the legacy gitignore line`);
+    return;
+  }
+  fs2.renameSync(legacy, dest);
   removeGitignoreLine(targetDir, LEGACY_CONFIG_FILENAME);
   ok(`migrated legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} (the old name is now reserved for file-backed-config)`);
 }
 function removeGitignoreLine(targetDir, line) {
-  const p = path.join(targetDir, ".gitignore");
-  if (!fs.existsSync(p)) return;
-  const before = fs.readFileSync(p, "utf-8");
+  const p = path2.join(targetDir, ".gitignore");
+  if (!fs2.existsSync(p)) return;
+  const before = fs2.readFileSync(p, "utf-8");
   const after = before.split(/\r?\n/).filter((l) => l.trim() !== line).join("\n");
   if (after === before) return;
-  fs.writeFileSync(p, after, "utf-8");
+  if (DRY_RUN) {
+    dryNote(`would remove "${line}" from .gitignore`);
+    return;
+  }
+  fs2.writeFileSync(p, after, "utf-8");
   ok(`removed ${line} from .gitignore (now reserved for file-backed-config)`);
 }
-var LAUNCH_SECURE_HEADERS_HELPER = `node -e 'const j=JSON.parse(require("fs").readFileSync(".launch-secure.cred.config","utf-8"));process.stdout.write(JSON.stringify({Authorization:"Bearer "+j.pat,"X-Org-Slug":j.orgSlug,"X-Project-Slug":j.projectSlug}))'`;
+var LAUNCH_SECURE_HEADERS_HELPER = `node -e 'const j=JSON.parse(require("fs").readFileSync(".launch-secure.cred.config","utf-8"));const c=j.profiles&&j.active?j.profiles[j.active]:j;process.stdout.write(JSON.stringify({Authorization:"Bearer "+c.pat,"X-Org-Slug":c.orgSlug,"X-Project-Slug":c.projectSlug}))'`;
 function buildLaunchKitMcpEntries(cfg) {
   return {
     "launch-secure": {
@@ -356,30 +519,39 @@ function buildLaunchKitMcpEntries(cfg) {
   };
 }
 function mergeMcpFile(targetDir, launchKitEntries) {
-  const p = path.join(targetDir, ".mcp.json");
-  const hadExisting = fs.existsSync(p);
+  const p = path2.join(targetDir, ".mcp.json");
+  const hadExisting = fs2.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs2.readFileSync(p, "utf-8"));
     } catch (err) {
       fail(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const existingServerCount = Object.keys(existing.mcpServers ?? {}).length;
   const merged = { ...existing, mcpServers: { ...existing.mcpServers ?? {} } };
+  const overwrites = [];
+  const additions = [];
   for (const [name, entry] of Object.entries(launchKitEntries)) {
+    if (merged.mcpServers[name]) overwrites.push(name);
+    else additions.push(name);
     merged.mcpServers[name] = entry;
   }
-  fs.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  if (DRY_RUN) {
+    const action2 = hadExisting && existingServerCount > 0 ? "would merge into" : "would write";
+    dryNote(`${action2} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}]`);
+    return;
+  }
+  fs2.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   const action = hadExisting && existingServerCount > 0 ? "merged into" : "wrote";
   ok(`${action} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
 }
 function detectPackageManager(repoDir) {
-  const pkgPath = path.join(repoDir, "package.json");
-  if (!fs.existsSync(pkgPath)) return null;
+  const pkgPath = path2.join(repoDir, "package.json");
+  if (!fs2.existsSync(pkgPath)) return null;
   try {
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf-8"));
     if (typeof pkg.packageManager === "string") {
       const name = pkg.packageManager.split("@")[0];
       const match = PACKAGE_MANAGERS.find((p) => p.name === name);
@@ -388,7 +560,7 @@ function detectPackageManager(repoDir) {
     }
   } catch {
   }
-  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs.existsSync(path.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
+  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs2.existsSync(path2.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
   if (matches.length === 1) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile}` };
   }
@@ -397,8 +569,8 @@ function detectPackageManager(repoDir) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile} (multiple present)` };
   }
   for (const pm of PACKAGE_MANAGERS) {
-    if (pm.workspaceFiles?.some((wf) => fs.existsSync(path.join(repoDir, wf)))) {
-      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs.existsSync(path.join(repoDir, wf)))})` };
+    if (pm.workspaceFiles?.some((wf) => fs2.existsSync(path2.join(repoDir, wf)))) {
+      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs2.existsSync(path2.join(repoDir, wf)))})` };
     }
   }
   const npm = PACKAGE_MANAGERS.find((p) => p.name === "npm");
@@ -408,23 +580,27 @@ function runInstall(repoDir, detected) {
   const { pm } = detected;
   if (!which(pm.binary)) {
     fail(
-      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path2.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
     );
   }
   info(`running ${pm.binary} ${pm.installArgs.join(" ")} \u2026`);
+  if (DRY_RUN) {
+    dryNote(`would run: ${pm.binary} ${pm.installArgs.join(" ")} (cwd: ${repoDir})`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
     fail(
-      `${pm.name} install failed (exit ${res.status}). Configs and clone are intact \u2014 fix the underlying error and retry: cd ${path.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+      `${pm.name} install failed (exit ${res.status}). Configs and clone are intact \u2014 fix the underlying error and retry: cd ${path2.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
     );
   }
   ok(`${pm.name} install complete`);
 }
 function hasOnboardScript(repoDir) {
-  const pkgPath = path.join(repoDir, "package.json");
-  if (!fs.existsSync(pkgPath)) return false;
+  const pkgPath = path2.join(repoDir, "package.json");
+  if (!fs2.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf-8"));
     return typeof pkg.scripts?.[ONBOARD_SCRIPT_NAME] === "string";
   } catch {
     return false;
@@ -432,74 +608,115 @@ function hasOnboardScript(repoDir) {
 }
 function runRecallInit(repoDir) {
   info(`scaffolding launch-recall (shadow git backup) \u2026`);
-  const recallEntry = path.resolve(__dirname, "recall-entry.js");
-  const useSibling = fs.existsSync(recallEntry);
+  const recallEntry = path2.resolve(__dirname, "recall-entry.js");
+  const useSibling = fs2.existsSync(recallEntry);
   const cmd = useSibling ? process.execPath : "npx";
   const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "init"];
+  if (DRY_RUN) {
+    dryNote(`would run launch-recall init: ${cmd} ${args.join(" ")} (cwd: ${repoDir})`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
+    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path2.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
     return;
   }
   ok(`launch-recall ready (shadow git initialized)`);
 }
 function runOnboard(repoDir, pm) {
   info(`running ${pm.binary} run ${ONBOARD_SCRIPT_NAME} \u2026`);
+  if (DRY_RUN) {
+    dryNote(`would run: ${pm.binary} run ${ONBOARD_SCRIPT_NAME} (cwd: ${repoDir})`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
     fail(
-      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
+      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path2.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
     );
   }
   ok(`${ONBOARD_SCRIPT_NAME} script complete`);
 }
 function ensureGitignoreLine(targetDir, line) {
-  const p = path.join(targetDir, ".gitignore");
-  let content = fs.existsSync(p) ? fs.readFileSync(p, "utf-8") : "";
+  const p = path2.join(targetDir, ".gitignore");
+  let content = fs2.existsSync(p) ? fs2.readFileSync(p, "utf-8") : "";
   const lines = content.split(/\r?\n/);
   if (lines.some((l) => l.trim() === line)) return;
   if (content.length && !content.endsWith("\n")) content += "\n";
   content += `${line}
 `;
-  fs.writeFileSync(p, content, "utf-8");
+  if (DRY_RUN) {
+    dryNote(`would append "${line}" to .gitignore`);
+    return;
+  }
+  fs2.writeFileSync(p, content, "utf-8");
   ok(`appended ${line} to .gitignore`);
 }
 function copyScaffoldIfMissing(srcPath, destPath, label) {
-  if (!fs.existsSync(srcPath)) return "missing-src";
-  if (fs.existsSync(destPath)) {
+  if (!fs2.existsSync(srcPath)) return "missing-src";
+  if (fs2.existsSync(destPath)) {
     info(`${label} already present \u2014 leaving alone`);
     return "existed";
   }
-  fs.mkdirSync(path.dirname(destPath), { recursive: true });
-  fs.copyFileSync(srcPath, destPath);
+  if (DRY_RUN) {
+    dryNote(`would write ${label}`);
+    return "wrote";
+  }
+  fs2.mkdirSync(path2.dirname(destPath), { recursive: true });
+  fs2.copyFileSync(srcPath, destPath);
   try {
-    const srcMode = fs.statSync(srcPath).mode;
-    fs.chmodSync(destPath, srcMode);
+    const srcMode = fs2.statSync(srcPath).mode;
+    fs2.chmodSync(destPath, srcMode);
   } catch {
   }
   ok(`wrote ${label}`);
   return "wrote";
 }
+function copyScaffoldDirAlways(srcDir, destDir, labelPrefix) {
+  if (!fs2.existsSync(srcDir)) return;
+  for (const entry of fs2.readdirSync(srcDir, { withFileTypes: true })) {
+    const srcPath = path2.join(srcDir, entry.name);
+    const destPath = path2.join(destDir, entry.name);
+    const label = labelPrefix ? `${labelPrefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      copyScaffoldDirAlways(srcPath, destPath, label);
+    } else if (entry.isFile()) {
+      const existed = fs2.existsSync(destPath);
+      if (DRY_RUN) {
+        dryNote(`would ${existed ? "refresh" : "write"} ${label}`);
+        continue;
+      }
+      fs2.mkdirSync(path2.dirname(destPath), { recursive: true });
+      fs2.copyFileSync(srcPath, destPath);
+      try {
+        const srcMode = fs2.statSync(srcPath).mode;
+        fs2.chmodSync(destPath, srcMode);
+      } catch {
+      }
+      ok(`${existed ? "refreshed" : "wrote"} ${label}`);
+    }
+  }
+}
 function scaffoldMigrateSafety(targetDir) {
-  const scaffoldsRoot = path.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
-  if (!fs.existsSync(scaffoldsRoot)) {
+  const scaffoldsRoot = path2.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
+  if (!fs2.existsSync(scaffoldsRoot)) {
     info(`\u26A0 migrate-safety scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
     return;
   }
   const files = [
     {
-      src: path.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
-      dest: path.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
+      src: path2.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
+      dest: path2.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
       label: ".github/workflows/backup-on-migration.yml"
     },
     {
-      src: path.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
-      dest: path.join(targetDir, "scripts", "migrate-with-backup.sh"),
+      src: path2.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
+      dest: path2.join(targetDir, "scripts", "migrate-with-backup.sh"),
       label: "scripts/migrate-with-backup.sh"
     },
     {
-      src: path.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
-      dest: path.join(targetDir, "docs", "migrations-runbook.md"),
+      src: path2.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
+      dest: path2.join(targetDir, "docs", "migrations-runbook.md"),
       label: "docs/migrations-runbook.md"
     }
   ];
@@ -508,6 +725,101 @@ function scaffoldMigrateSafety(targetDir) {
   ensureGitignoreLine(targetDir, ".backups/");
   ok("migrate-safety ready \u2014 see docs/migrations-runbook.md for db:migrate wiring + PROD_DATABASE_URL secret setup");
 }
+var MARKETPLACE_ID = "launchsecure";
+var LS_PLUGIN_ID = "ls";
+function scaffoldLsMarketplace(targetDir) {
+  const scaffoldsRoot = path2.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace");
+  if (!fs2.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 ls-marketplace scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  const marketplaceRoot = path2.join(targetDir, ".claude", "marketplace");
+  info("scaffolding ls marketplace (Claude Code /ls: namespace \u2014 refreshes every /ls:* command found in the scaffold) \u2026");
+  copyScaffoldDirAlways(scaffoldsRoot, marketplaceRoot, ".claude/marketplace");
+  wireLsSettings(targetDir);
+  ok(`ls marketplace ready \u2014 open this repo in Claude Code, approve the "${MARKETPLACE_ID}" marketplace prompt, then try /ls:activate-beacon, /ls:standup, or /ls:show-mcp-status`);
+}
+function wireLsSettings(targetDir) {
+  const p = path2.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs2.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs2.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const merged = { ...existing };
+  merged.extraKnownMarketplaces = {
+    ...existing.extraKnownMarketplaces ?? {},
+    [MARKETPLACE_ID]: {
+      source: { source: "directory", path: "./.claude/marketplace" }
+    }
+  };
+  merged.enabledPlugins = {
+    ...existing.enabledPlugins ?? {},
+    [`${LS_PLUGIN_ID}@${MARKETPLACE_ID}`]: true
+  };
+  if (DRY_RUN) {
+    dryNote(`would ${hadExisting ? "merge into" : "write"} .claude/settings.json (set extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${LS_PLUGIN_ID}@${MARKETPLACE_ID}; preserves every other key)`);
+    return;
+  }
+  fs2.mkdirSync(path2.dirname(p), { recursive: true });
+  fs2.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  ok(`${hadExisting ? "merged into" : "wrote"} .claude/settings.json (extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${LS_PLUGIN_ID}@${MARKETPLACE_ID})`);
+}
+var RECALL_HOOK_SIGNATURE = "ensure-recall.sh";
+var RECALL_HOOK_COMMAND = 'bash "${CLAUDE_PROJECT_DIR:-$PWD}/scripts/ensure-recall.sh"';
+function scaffoldRecallHook(targetDir) {
+  const scaffoldsRoot = path2.resolve(__dirname, "..", "..", "scaffolds", "recall-hook");
+  if (!fs2.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 recall-hook scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  info("scaffolding recall-hook (SessionStart watcher-respawn hook + ensure-recall.sh) \u2026");
+  copyScaffoldDirAlways(scaffoldsRoot, targetDir, "");
+  wireRecallHook(targetDir);
+  ok("recall-hook ready \u2014 opens with Claude Code will respawn the launch-recall watcher if it died between sessions");
+}
+function wireRecallHook(targetDir) {
+  const p = path2.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs2.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs2.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const hooks = existing.hooks ?? {};
+  const sessionStart = hooks.SessionStart ?? [];
+  const alreadyWired = sessionStart.some(
+    (group) => (group.hooks ?? []).some((h) => typeof h?.command === "string" && h.command.includes(RECALL_HOOK_SIGNATURE))
+  );
+  if (alreadyWired) {
+    info(".claude/settings.json SessionStart hook already references ensure-recall.sh \u2014 leaving alone");
+    return;
+  }
+  const newGroup = {
+    hooks: [{ type: "command", command: RECALL_HOOK_COMMAND }]
+  };
+  const merged = {
+    ...existing,
+    hooks: {
+      ...hooks,
+      SessionStart: [...sessionStart, newGroup]
+    }
+  };
+  if (DRY_RUN) {
+    dryNote(`would append SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh; preserves every other key + existing hooks)`);
+    return;
+  }
+  fs2.mkdirSync(path2.dirname(p), { recursive: true });
+  fs2.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  ok(`appended SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh)`);
+}
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (args.help) {
@@ -518,6 +830,13 @@ async function main() {
   if (subcommand && subcommand !== "init" && !subcommand.startsWith("--")) {
     fail(`Unknown subcommand "${subcommand}". Only "init" is supported. Run with --help for usage.`);
   }
+  DRY_RUN = args.dryRun;
+  if (DRY_RUN) {
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    info("DRY RUN \u2014 no files will be written, no commands will run.");
+    info("Lines tagged (dry-run) show what would happen.");
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  }
   if (!args.token) {
     const t = await prompt("LaunchSecure PAT (ls_pat_\u2026): ");
     args.token = t || null;
@@ -542,10 +861,10 @@ async function main() {
   }
   const repoUrl = resolved.repositoryUrl;
   const cwd = process.cwd();
-  const targetDir = path.resolve(args.targetDir ?? path.join(cwd, resolved.projectSlug));
+  const targetDir = path2.resolve(args.targetDir ?? path2.join(cwd, resolved.projectSlug));
   const normalizedRemote = normalizeRepoUrl(repoUrl);
   let skipClone = false;
-  if (fs.existsSync(targetDir)) {
+  if (fs2.existsSync(targetDir)) {
     if (isGitRepo(targetDir)) {
       const existingRemote = gitRemoteUrl(targetDir);
       if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
@@ -565,7 +884,8 @@ async function main() {
     projectSlug: resolved.projectSlug,
     serverUrl: args.serverUrl
   };
-  writeConfigFile(targetDir, cfg);
+  const courseName = args.course ?? inferCourseName(cfg.serverUrl);
+  writeConfigFile(targetDir, cfg, courseName);
   mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg));
   ensureGitignoreLine(targetDir, CONFIG_FILENAME);
   let installSkippedReason = null;
@@ -582,8 +902,18 @@ async function main() {
   const hasOnboard = hasOnboardScript(targetDir);
   if (!args.noRecall) runRecallInit(targetDir);
   if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir);
-  const relTarget = path.relative(cwd, targetDir) || ".";
+  if (!args.noLsMarketplace) scaffoldLsMarketplace(targetDir);
+  if (!args.noRecallHook) scaffoldRecallHook(targetDir);
+  const relTarget = path2.relative(cwd, targetDir) || ".";
   console.log("");
+  if (DRY_RUN) {
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    info(`DRY RUN COMPLETE \u2014 no files were modified, no commands ran.`);
+    info(`Target: ${targetDir}`);
+    info(`Re-run without --dry-run to apply the changes shown above.`);
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    return;
+  }
   ok(`done \u2014 ${resolved.projectName} is ready at ${targetDir}`);
   if (installSkippedReason) {
     const installLine = detected ? `  ${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` : `  npm install              # or your package manager of choice`;