@launchsecure/launch-kit 0.0.27 → 0.0.29

package/dist/server/cli.js

@@ -553,8 +553,8 @@ var require_claude_bridge = __commonJS({
   "../claude-code-web/src/claude-bridge.js"(exports2, module2) {
     "use strict";
     var { spawn: spawn4 } = require("node-pty");
-    var path12 = require("path");
-    var fs10 = require("fs");
+    var path13 = require("path");
+    var fs11 = require("fs");
     var ClaudeBridge = class {
       constructor() {
         this.sessions = /* @__PURE__ */ new Map();
@@ -565,14 +565,14 @@ var require_claude_bridge = __commonJS({
           "/home/ec2-user/.claude/local/claude",
           "claude",
           "claude-code",
-          path12.join(process.env.HOME || "/", ".claude", "local", "claude"),
-          path12.join(process.env.HOME || "/", ".local", "bin", "claude"),
+          path13.join(process.env.HOME || "/", ".claude", "local", "claude"),
+          path13.join(process.env.HOME || "/", ".local", "bin", "claude"),
           "/usr/local/bin/claude",
           "/usr/bin/claude"
         ];
         for (const cmd of possibleCommands) {
           try {
-            if (fs10.existsSync(cmd) || this.commandExists(cmd)) {
+            if (fs11.existsSync(cmd) || this.commandExists(cmd)) {
               console.log(`Found Claude command at: ${cmd}`);
               return cmd;
             }
@@ -797,8 +797,8 @@ var require_codex_bridge = __commonJS({
   "../claude-code-web/src/codex-bridge.js"(exports2, module2) {
     "use strict";
     var { spawn: spawn4 } = require("node-pty");
-    var path12 = require("path");
-    var fs10 = require("fs");
+    var path13 = require("path");
+    var fs11 = require("fs");
     var CodexBridge = class {
       constructor() {
         this.sessions = /* @__PURE__ */ new Map();
@@ -806,16 +806,16 @@ var require_codex_bridge = __commonJS({
       }
       findCodexCommand() {
         const possibleCommands = [
-          path12.join(process.env.HOME || "/", ".codex", "local", "codex"),
+          path13.join(process.env.HOME || "/", ".codex", "local", "codex"),
           "codex",
           "codex-code",
-          path12.join(process.env.HOME || "/", ".local", "bin", "codex"),
+          path13.join(process.env.HOME || "/", ".local", "bin", "codex"),
           "/usr/local/bin/codex",
           "/usr/bin/codex"
         ];
         for (const cmd of possibleCommands) {
           try {
-            if (fs10.existsSync(cmd) || this.commandExists(cmd)) {
+            if (fs11.existsSync(cmd) || this.commandExists(cmd)) {
               console.log(`Found Codex command at: ${cmd}`);
               return cmd;
             }
@@ -990,8 +990,8 @@ var require_agent_bridge = __commonJS({
   "../claude-code-web/src/agent-bridge.js"(exports2, module2) {
     "use strict";
     var { spawn: spawn4 } = require("node-pty");
-    var path12 = require("path");
-    var fs10 = require("fs");
+    var path13 = require("path");
+    var fs11 = require("fs");
     var AgentBridge = class {
       constructor() {
         this.sessions = /* @__PURE__ */ new Map();
@@ -999,15 +999,15 @@ var require_agent_bridge = __commonJS({
       }
       findAgentCommand() {
         const possibleCommands = [
-          path12.join(process.env.HOME || "/", ".cursor", "local", "cursor-agent"),
+          path13.join(process.env.HOME || "/", ".cursor", "local", "cursor-agent"),
           "cursor-agent",
-          path12.join(process.env.HOME || "/", ".local", "bin", "cursor-agent"),
+          path13.join(process.env.HOME || "/", ".local", "bin", "cursor-agent"),
           "/usr/local/bin/cursor-agent",
           "/usr/bin/cursor-agent"
         ];
         for (const cmd of possibleCommands) {
           try {
-            if (fs10.existsSync(cmd) || this.commandExists(cmd)) {
+            if (fs11.existsSync(cmd) || this.commandExists(cmd)) {
               console.log(`Found Agent command at: ${cmd}`);
               return cmd;
             }
@@ -1331,25 +1331,25 @@ var require_script_bridge = __commonJS({
 var require_session_store = __commonJS({
   "../claude-code-web/src/utils/session-store.js"(exports2, module2) {
     "use strict";
-    var fs10 = require("fs").promises;
-    var path12 = require("path");
+    var fs11 = require("fs").promises;
+    var path13 = require("path");
     var os4 = require("os");
     var SessionStore = class {
       constructor(options = {}) {
-        this.storageDir = options.storageDir || path12.join(os4.homedir(), ".claude-code-web");
-        this.sessionsFile = path12.join(this.storageDir, "sessions.json");
+        this.storageDir = options.storageDir || path13.join(os4.homedir(), ".claude-code-web");
+        this.sessionsFile = path13.join(this.storageDir, "sessions.json");
         this.initializeStorage();
       }
       async initializeStorage() {
         try {
-          await fs10.mkdir(this.storageDir, { recursive: true });
+          await fs11.mkdir(this.storageDir, { recursive: true });
         } catch (error) {
           console.error("Failed to create storage directory:", error);
         }
       }
       async saveSessions(sessions) {
         try {
-          await fs10.mkdir(this.storageDir, { recursive: true });
+          await fs11.mkdir(this.storageDir, { recursive: true });
           const sessionsArray = Array.from(sessions.entries()).map(([id, session]) => ({
             id,
             name: session.name || "Unnamed Session",
@@ -1380,9 +1380,9 @@ var require_session_store = __commonJS({
             sessions: sessionsArray
           };
           const tempFile = `${this.sessionsFile}.tmp`;
-          await fs10.writeFile(tempFile, JSON.stringify(data, null, 2));
-          await fs10.mkdir(this.storageDir, { recursive: true });
-          await fs10.rename(tempFile, this.sessionsFile);
+          await fs11.writeFile(tempFile, JSON.stringify(data, null, 2));
+          await fs11.mkdir(this.storageDir, { recursive: true });
+          await fs11.rename(tempFile, this.sessionsFile);
           return true;
         } catch (error) {
           console.error("Failed to save sessions:", error.message);
@@ -1391,8 +1391,8 @@ var require_session_store = __commonJS({
       }
       async loadSessions() {
         try {
-          await fs10.access(this.sessionsFile);
-          const data = await fs10.readFile(this.sessionsFile, "utf8");
+          await fs11.access(this.sessionsFile);
+          const data = await fs11.readFile(this.sessionsFile, "utf8");
           if (!data || !data.trim()) {
             console.log("Sessions file is empty, starting fresh");
             return /* @__PURE__ */ new Map();
@@ -1403,7 +1403,7 @@ var require_session_store = __commonJS({
           } catch (parseError) {
             console.error("Sessions file is corrupted, starting fresh:", parseError.message);
             try {
-              await fs10.rename(this.sessionsFile, `${this.sessionsFile}.corrupted.${Date.now()}`);
+              await fs11.rename(this.sessionsFile, `${this.sessionsFile}.corrupted.${Date.now()}`);
             } catch (renameError) {
             }
             return /* @__PURE__ */ new Map();
@@ -1447,7 +1447,7 @@ var require_session_store = __commonJS({
       }
       async clearOldSessions() {
         try {
-          await fs10.unlink(this.sessionsFile);
+          await fs11.unlink(this.sessionsFile);
           console.log("Cleared old sessions");
           return true;
         } catch (error) {
@@ -1459,9 +1459,9 @@ var require_session_store = __commonJS({
       }
       async getSessionMetadata() {
         try {
-          await fs10.access(this.sessionsFile);
-          const stats = await fs10.stat(this.sessionsFile);
-          const data = await fs10.readFile(this.sessionsFile, "utf8");
+          await fs11.access(this.sessionsFile);
+          const stats = await fs11.stat(this.sessionsFile);
+          const data = await fs11.readFile(this.sessionsFile, "utf8");
           const parsed = JSON.parse(data);
           return {
             exists: true,
@@ -1486,13 +1486,13 @@ var require_session_store = __commonJS({
 var require_usage_reader = __commonJS({
   "../claude-code-web/src/usage-reader.js"(exports2, module2) {
     "use strict";
-    var fs10 = require("fs").promises;
-    var path12 = require("path");
+    var fs11 = require("fs").promises;
+    var path13 = require("path");
     var readline = require("readline");
     var { createReadStream } = require("fs");
     var UsageReader = class {
       constructor(sessionDurationHours = 5) {
-        this.claudeProjectsPath = path12.join(process.env.HOME, ".claude", "projects");
+        this.claudeProjectsPath = path13.join(process.env.HOME, ".claude", "projects");
         this.cache = null;
         this.cacheTime = null;
         this.cacheTimeout = 5e3;
@@ -1692,14 +1692,14 @@ var require_usage_reader = __commonJS({
         try {
           const cwd = process.cwd();
           const projectDirName = cwd.replace(/\//g, "-");
-          let projectPath = path12.join(this.claudeProjectsPath, projectDirName);
+          let projectPath = path13.join(this.claudeProjectsPath, projectDirName);
           try {
-            await fs10.access(projectPath);
+            await fs11.access(projectPath);
           } catch (err2) {
             console.log(`Project directory not found: ${projectPath}`);
             return null;
           }
-          const files = await fs10.readdir(projectPath);
+          const files = await fs11.readdir(projectPath);
           const jsonlFiles = files.filter((f) => f.endsWith(".jsonl"));
           if (jsonlFiles.length === 0) {
             return null;
@@ -1707,8 +1707,8 @@ var require_usage_reader = __commonJS({
           let mostRecentFile = null;
           let mostRecentTime = 0;
           for (const file of jsonlFiles) {
-            const filePath = path12.join(projectPath, file);
-            const stat = await fs10.stat(filePath);
+            const filePath = path13.join(projectPath, file);
+            const stat = await fs11.stat(filePath);
             if (stat.mtime.getTime() > mostRecentTime) {
               mostRecentTime = stat.mtime.getTime();
               mostRecentFile = filePath;
@@ -1723,17 +1723,17 @@ var require_usage_reader = __commonJS({
       async findJsonlFiles(onlyRecent = false) {
         const files = [];
         try {
-          const projectDirs = await fs10.readdir(this.claudeProjectsPath);
+          const projectDirs = await fs11.readdir(this.claudeProjectsPath);
           for (const projectDir of projectDirs) {
-            const projectPath = path12.join(this.claudeProjectsPath, projectDir);
-            const stat = await fs10.stat(projectPath);
+            const projectPath = path13.join(this.claudeProjectsPath, projectDir);
+            const stat = await fs11.stat(projectPath);
             if (stat.isDirectory()) {
-              const projectFiles = await fs10.readdir(projectPath);
+              const projectFiles = await fs11.readdir(projectPath);
               const jsonlFiles = projectFiles.filter((f) => f.endsWith(".jsonl"));
               for (const jsonlFile of jsonlFiles) {
-                const filePath = path12.join(projectPath, jsonlFile);
+                const filePath = path13.join(projectPath, jsonlFile);
                 if (onlyRecent) {
-                  const fileStat = await fs10.stat(filePath);
+                  const fileStat = await fs11.stat(filePath);
                   const hoursSinceModified = (Date.now() - fileStat.mtime.getTime()) / (1e3 * 60 * 60);
                   if (hoursSinceModified <= 24) {
                     files.push(filePath);
@@ -1894,9 +1894,9 @@ var require_usage_reader = __commonJS({
           if (!sessionId) {
             return null;
           }
-          const sessionFile = path12.join(this.claudeProjectsPath, path12.basename(process.cwd()).replace(/[^a-zA-Z0-9-]/g, "-"), `${sessionId}.jsonl`);
+          const sessionFile = path13.join(this.claudeProjectsPath, path13.basename(process.cwd()).replace(/[^a-zA-Z0-9-]/g, "-"), `${sessionId}.jsonl`);
           try {
-            await fs10.access(sessionFile);
+            await fs11.access(sessionFile);
           } catch (err2) {
             return null;
           }
@@ -2552,7 +2552,7 @@ var require_usage_analytics = __commonJS({
 var require_src = __commonJS({
   "../claude-code-web/src/index.js"(exports2, module2) {
     "use strict";
-    var path12 = require("path");
+    var path13 = require("path");
     var WebSocket2 = require("ws");
     var { v4: uuidv4 } = (init_esm_node(), __toCommonJS(esm_node_exports));
     var ClaudeBridge = require_claude_bridge();
@@ -2562,7 +2562,7 @@ var require_src = __commonJS({
     var SessionStore = require_session_store();
     var UsageReader = require_usage_reader();
     var UsageAnalytics = require_usage_analytics();
-    var fs10 = require("fs");
+    var fs11 = require("fs");
     function stripAnsi2(str) {
       return str.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "").replace(/\x1b\][^\x07]*\x07/g, "").replace(/\x1b[()][AB012]/g, "").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "").replace(/\r\n?/g, "\n").trim();
     }
@@ -2637,8 +2637,8 @@ var require_src = __commonJS({
       // ── Path validation ──────────────────────────────────────────────────
       isPathWithinBase(targetPath) {
         try {
-          const resolvedTarget = path12.resolve(targetPath);
-          const resolvedBase = path12.resolve(this.baseFolder);
+          const resolvedTarget = path13.resolve(targetPath);
+          const resolvedBase = path13.resolve(this.baseFolder);
           return resolvedTarget.startsWith(resolvedBase);
         } catch (error) {
           return false;
@@ -2648,7 +2648,7 @@ var require_src = __commonJS({
         if (!targetPath) {
           return { valid: false, error: "Path is required" };
         }
-        const resolvedPath = path12.resolve(targetPath);
+        const resolvedPath = path13.resolve(targetPath);
         if (!this.isPathWithinBase(resolvedPath)) {
           return {
             valid: false,
@@ -2820,14 +2820,14 @@ var require_src = __commonJS({
             return true;
           }
           try {
-            const items = fs10.readdirSync(validation.path, { withFileTypes: true });
+            const items = fs11.readdirSync(validation.path, { withFileTypes: true });
             const showHidden = url.searchParams.get("showHidden") === "true";
             const folders = items.filter((item) => item.isDirectory()).filter((item) => !item.name.startsWith(".") || showHidden).map((item) => ({
               name: item.name,
-              path: path12.join(validation.path, item.name),
+              path: path13.join(validation.path, item.name),
               isDirectory: true
             })).sort((a, b) => a.name.localeCompare(b.name));
-            const parentDir = path12.dirname(validation.path);
+            const parentDir = path13.dirname(validation.path);
             const canGoUp = this.isPathWithinBase(parentDir) && parentDir !== validation.path;
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({
@@ -2855,7 +2855,7 @@ var require_src = __commonJS({
                 res.end(JSON.stringify({ error: validation.error }));
                 return;
               }
-              if (!fs10.existsSync(validation.path) || !fs10.statSync(validation.path).isDirectory()) {
+              if (!fs11.existsSync(validation.path) || !fs11.statSync(validation.path).isDirectory()) {
                 res.writeHead(400, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ error: "Not a valid directory" }));
                 return;
@@ -2882,7 +2882,7 @@ var require_src = __commonJS({
                 res.end(JSON.stringify({ error: validation.error }));
                 return;
               }
-              if (!fs10.existsSync(validation.path) || !fs10.statSync(validation.path).isDirectory()) {
+              if (!fs11.existsSync(validation.path) || !fs11.statSync(validation.path).isDirectory()) {
                 res.writeHead(400, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ error: "Invalid directory path" }));
                 return;
@@ -2909,7 +2909,7 @@ var require_src = __commonJS({
                 return;
               }
               const basePath = parentPath || this.baseFolder;
-              const fullPath = path12.join(basePath, folderName);
+              const fullPath = path13.join(basePath, folderName);
               const parentValidation = this.validatePath(basePath);
               const fullValidation = this.validatePath(fullPath);
               if (!parentValidation.valid || !fullValidation.valid) {
@@ -2917,12 +2917,12 @@ var require_src = __commonJS({
                 res.end(JSON.stringify({ message: "Cannot create folder outside the allowed area" }));
                 return;
               }
-              if (fs10.existsSync(fullValidation.path)) {
+              if (fs11.existsSync(fullValidation.path)) {
                 res.writeHead(409, { "Content-Type": "application/json" });
                 res.end(JSON.stringify({ message: "Folder already exists" }));
                 return;
               }
-              fs10.mkdirSync(fullValidation.path, { recursive: true });
+              fs11.mkdirSync(fullValidation.path, { recursive: true });
               res.writeHead(200, { "Content-Type": "application/json" });
               res.end(JSON.stringify({ success: true, path: fullValidation.path }));
             } catch (e) {
@@ -2946,10 +2946,10 @@ var require_src = __commonJS({
         const url = new URL(req.url || "/", `http://localhost`);
         let filePath = url.pathname.replace(/^\/terminal\/?/, "");
         if (!filePath || filePath === "") filePath = "index.html";
-        const fullPath = path12.join(__dirname, "public", filePath);
+        const fullPath = path13.join(__dirname, "public", filePath);
         try {
-          if (!fs10.existsSync(fullPath)) return false;
-          const ext = path12.extname(fullPath);
+          if (!fs11.existsSync(fullPath)) return false;
+          const ext = path13.extname(fullPath);
           const mimeTypes = {
             ".html": "text/html",
             ".js": "application/javascript",
@@ -2960,7 +2960,7 @@ var require_src = __commonJS({
             ".ico": "image/x-icon"
           };
           const mime = mimeTypes[ext] || "application/octet-stream";
-          const content = fs10.readFileSync(fullPath);
+          const content = fs11.readFileSync(fullPath);
           res.writeHead(200, { "Content-Type": mime });
           res.end(content);
           return true;
@@ -4553,14 +4553,14 @@ var require_util = __commonJS({
         }
         const port = url.port != null ? url.port : url.protocol === "https:" ? 443 : 80;
         let origin = url.origin != null ? url.origin : `${url.protocol || ""}//${url.hostname || ""}:${port}`;
-        let path12 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
+        let path13 = url.path != null ? url.path : `${url.pathname || ""}${url.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path12 && path12[0] !== "/") {
-          path12 = `/${path12}`;
+        if (path13 && path13[0] !== "/") {
+          path13 = `/${path13}`;
         }
-        return new URL(`${origin}${path12}`);
+        return new URL(`${origin}${path13}`);
       }
       if (!isHttpOrHttpsPrefixed(url.origin || url.protocol)) {
         throw new InvalidArgumentError("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -5011,39 +5011,39 @@ var require_diagnostics = __commonJS({
       });
       diagnosticsChannel.channel("undici:client:sendHeaders").subscribe((evt) => {
         const {
-          request: { method, path: path12, origin }
+          request: { method, path: path13, origin }
         } = evt;
-        debuglog("sending request to %s %s/%s", method, origin, path12);
+        debuglog("sending request to %s %s/%s", method, origin, path13);
       });
       diagnosticsChannel.channel("undici:request:headers").subscribe((evt) => {
         const {
-          request: { method, path: path12, origin },
+          request: { method, path: path13, origin },
           response: { statusCode }
         } = evt;
         debuglog(
           "received response to %s %s/%s - HTTP %d",
           method,
           origin,
-          path12,
+          path13,
           statusCode
         );
       });
       diagnosticsChannel.channel("undici:request:trailers").subscribe((evt) => {
         const {
-          request: { method, path: path12, origin }
+          request: { method, path: path13, origin }
         } = evt;
-        debuglog("trailers received from %s %s/%s", method, origin, path12);
+        debuglog("trailers received from %s %s/%s", method, origin, path13);
       });
       diagnosticsChannel.channel("undici:request:error").subscribe((evt) => {
         const {
-          request: { method, path: path12, origin },
+          request: { method, path: path13, origin },
           error
         } = evt;
         debuglog(
           "request to %s %s/%s errored - %s",
           method,
           origin,
-          path12,
+          path13,
           error.message
         );
       });
@@ -5092,9 +5092,9 @@ var require_diagnostics = __commonJS({
         });
         diagnosticsChannel.channel("undici:client:sendHeaders").subscribe((evt) => {
           const {
-            request: { method, path: path12, origin }
+            request: { method, path: path13, origin }
           } = evt;
-          debuglog("sending request to %s %s/%s", method, origin, path12);
+          debuglog("sending request to %s %s/%s", method, origin, path13);
         });
       }
       diagnosticsChannel.channel("undici:websocket:open").subscribe((evt) => {
@@ -5157,7 +5157,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request = class {
       constructor(origin, {
-        path: path12,
+        path: path13,
         method,
         body,
         headers,
@@ -5172,11 +5172,11 @@ var require_request = __commonJS({
         expectContinue,
         servername
       }, handler2) {
-        if (typeof path12 !== "string") {
+        if (typeof path13 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path12[0] !== "/" && !(path12.startsWith("http://") || path12.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path13[0] !== "/" && !(path13.startsWith("http://") || path13.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path12)) {
+        } else if (invalidPathRegex.test(path13)) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -5242,7 +5242,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? buildURL(path12, query) : path12;
+        this.path = query ? buildURL(path13, query) : path13;
         this.origin = origin;
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
         this.blocking = blocking == null ? false : blocking;
@@ -9768,7 +9768,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request) {
-      const { method, path: path12, host, upgrade, blocking, reset } = request;
+      const { method, path: path13, host, upgrade, blocking, reset } = request;
       let { body, headers, contentLength } = request;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -9834,7 +9834,7 @@ var require_client_h1 = __commonJS({
       if (blocking) {
         socket[kBlocking] = true;
       }
-      let header = `${method} ${path12} HTTP/1.1\r
+      let header = `${method} ${path13} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -10360,7 +10360,7 @@ var require_client_h2 = __commonJS({
     }
     function writeH2(client, request) {
       const session = client[kHTTP2Session];
-      const { method, path: path12, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
+      const { method, path: path13, host, upgrade, expectContinue, signal, headers: reqHeaders } = request;
       let { body } = request;
       if (upgrade) {
         util.errorRequest(client, request, new Error("Upgrade not supported for H2"));
@@ -10427,7 +10427,7 @@ var require_client_h2 = __commonJS({
         });
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path12;
+      headers[HTTP2_HEADER_PATH] = path13;
       headers[HTTP2_HEADER_SCHEME] = "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -10780,9 +10780,9 @@ var require_redirect_handler = __commonJS({
           return this.handler.onHeaders(statusCode, headers, resume, statusText);
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path12 = search ? `${pathname}${search}` : pathname;
+        const path13 = search ? `${pathname}${search}` : pathname;
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path12;
+        this.opts.path = path13;
         this.opts.origin = origin;
         this.opts.maxRedirections = 0;
         this.opts.query = null;
@@ -12017,10 +12017,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path12 = "/",
+          path: path13 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path12;
+        opts.path = origin + path13;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL3(origin);
           headers.host = host;
@@ -13941,20 +13941,20 @@ var require_mock_utils = __commonJS({
       }
       return true;
     }
-    function safeUrl(path12) {
-      if (typeof path12 !== "string") {
-        return path12;
+    function safeUrl(path13) {
+      if (typeof path13 !== "string") {
+        return path13;
       }
-      const pathSegments = path12.split("?");
+      const pathSegments = path13.split("?");
       if (pathSegments.length !== 2) {
-        return path12;
+        return path13;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path12, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path12);
+    function matchKey(mockDispatch2, { path: path13, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path13);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -13976,7 +13976,7 @@ var require_mock_utils = __commonJS({
     function getMockDispatch(mockDispatches, key) {
       const basePath = key.query ? buildURL(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path12 }) => matchValue(safeUrl(path12), resolvedPath));
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path13 }) => matchValue(safeUrl(path13), resolvedPath));
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
       }
@@ -14014,9 +14014,9 @@ var require_mock_utils = __commonJS({
       }
     }
     function buildKey(opts) {
-      const { path: path12, method, body, headers, query } = opts;
+      const { path: path13, method, body, headers, query } = opts;
       return {
-        path: path12,
+        path: path13,
         method,
         body,
         headers,
@@ -14479,10 +14479,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path12, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path13, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path12,
+            Path: path13,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19363,9 +19363,9 @@ var require_util6 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path12) {
-      for (let i = 0; i < path12.length; ++i) {
-        const code = path12.charCodeAt(i);
+    function validateCookiePath(path13) {
+      for (let i = 0; i < path13.length; ++i) {
+        const code = path13.charCodeAt(i);
         if (code < 32 || // exclude CTLs (0-31)
         code === 127 || // DEL
         code === 59) {
@@ -22042,11 +22042,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path12 = opts.path;
+          let path13 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path12 = `/${path12}`;
+            path13 = `/${path13}`;
           }
-          url = new URL(util.parseOrigin(url).origin + path12);
+          url = new URL(util.parseOrigin(url).origin + path13);
         } else {
           if (!opts) {
             opts = typeof url === "object" ? url : {};
@@ -22727,9 +22727,9 @@ function buildEffectsIndex(layerOutputs) {
   return idx;
 }
 function writeEffectsIndex(rootDir, idx) {
-  const path12 = (0, import_node_path11.join)(rootDir, LAUNCHSECURE_DIR, "graphs", "effects-index.json");
-  atomicWriteFileSync(path12, JSON.stringify(idx, null, 2) + "\n");
-  return path12;
+  const path13 = (0, import_node_path11.join)(rootDir, LAUNCHSECURE_DIR, "graphs", "effects-index.json");
+  atomicWriteFileSync(path13, JSON.stringify(idx, null, 2) + "\n");
+  return path13;
 }
 var import_node_path11;
 var init_effects_index = __esm({
@@ -23040,10 +23040,10 @@ async function generateGraph(rootDir, layer) {
   return results;
 }
 function readEffectsIndex(rootDir) {
-  const path12 = (0, import_node_path13.join)(rootDir, GRAPHS_DIR2, "effects-index.json");
-  if (!(0, import_node_fs11.existsSync)(path12)) return null;
+  const path13 = (0, import_node_path13.join)(rootDir, GRAPHS_DIR2, "effects-index.json");
+  if (!(0, import_node_fs11.existsSync)(path13)) return null;
   try {
-    return JSON.parse((0, import_node_fs11.readFileSync)(path12, "utf-8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)(path13, "utf-8"));
   } catch {
     return null;
   }
@@ -24463,6 +24463,18 @@ function initLaunchPodTerminalBridge(httpServer, projectDir) {
 var import_fs = __toESM(require("fs"));
 var import_path2 = __toESM(require("path"));
 var MANAGED_SERVERS = ["launch-pod", "launch-chart"];
+function mergeMcpEntry(existing, ours) {
+  if (!existing || typeof existing !== "object") return ours;
+  const prev = existing;
+  const merged = { ...prev, ...ours };
+  if (prev.headers || ours.headers) {
+    merged.headers = { ...prev.headers ?? {}, ...ours.headers ?? {} };
+  }
+  if (prev.env || ours.env) {
+    merged.env = { ...prev.env ?? {}, ...ours.env ?? {} };
+  }
+  return merged;
+}
 var writtenPaths = [];
 function writeMcpConfigs(opts) {
   const { projectDir, token, serverUrl } = opts;
@@ -24524,17 +24536,17 @@ function writeClaudeConfig(projectDir, mcpUrl, token) {
     }
   }
   const servers = existing.mcpServers ?? {};
-  servers["launch-pod"] = {
+  servers["launch-pod"] = mergeMcpEntry(servers["launch-pod"], {
     type: "http",
     url: mcpUrl,
     headers: {
       Authorization: `Bearer ${token}`
     }
-  };
-  servers["launch-chart"] = {
+  });
+  servers["launch-chart"] = mergeMcpEntry(servers["launch-chart"], {
     command: "launch-chart",
     args: []
-  };
+  });
   existing.mcpServers = servers;
   import_fs.default.writeFileSync(filePath, JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
   writtenPaths.push(filePath);
@@ -27072,8 +27084,7 @@ function buildAnalyzerMcpConfig() {
       "launch-chart": {
         command: process.execPath,
         // current node binary, guaranteed-resolvable
-        args: [graphEntry],
-        env: { LAUNCH_CHART_AUTOSERVE: "1" }
+        args: [graphEntry]
       }
     }
   });
@@ -27091,7 +27102,7 @@ function buildAnalyzerPrompt(ctx) {
   lines.push("If this feedback contains MULTIPLE distinct issues, the first line categorises the PRIMARY one. List the others on subsequent lines as `also <bug|feature|\u2026>: <one sentence>`. The first line is harvested as the card preview; the rest belong to your detailed analysis.");
   lines.push("");
   lines.push("ISSUE ENUMERATION \u2014 DO THIS BEFORE ANY OTHER STEP.");
-  lines.push("The user's intent is spread across THREE places: the FEEDBACK BODY, each PIN's NOTE, and the SCREENSHOT. Sub-bugs frequently live in pin notes, not the body. Before any tool call, enumerate every distinct issue you can identify across all three sources. For each issue, decide one of:");
+  lines.push("The user's intent + diagnostic signal is spread across FOUR places: the FEEDBACK BODY, each PIN's NOTE, any RUNTIME EVENTS the beacon captured around the report (silent errors / unhandled rejections \u2014 these often reveal the real failure even when the body is vague), and the SCREENSHOT. Sub-bugs frequently live in pin notes, not the body. Before any tool call, enumerate every distinct issue you can identify across all four sources. For each issue, decide one of:");
   lines.push("  \u2022 fix it now (add to your plan)");
   lines.push("  \u2022 defer it (note why \u2014 out of scope, requires user input, etc.)");
   lines.push("  \u2022 ambiguous \u2192 surface via `AskUserQuestion` BEFORE editing. Do NOT silently drop unclear fragments.");
@@ -27141,6 +27152,21 @@ function buildAnalyzerPrompt(ctx) {
     }
     lines.push("");
   }
+  if (ctx.events && ctx.events.length > 0) {
+    lines.push(`RUNTIME EVENTS (${ctx.events.length}) \u2014 captured by the beacon between page load and Send. Treat these as the highest-signal diagnostic when the body is short. Always check whether the named source file matches a route/component you're investigating before blaming the user-described symptom.`);
+    for (const ev of ctx.events) {
+      const offset = formatEventOffset(ev.ts, ctx.capturedAt);
+      const kindLabel = ev.kind === "unhandledrejection" ? "rejection" : "error";
+      const location = ev.source ? `${ev.source}${ev.line ? `:${ev.line}` : ""}${ev.col ? `:${ev.col}` : ""}` : null;
+      lines.push(`${kindLabel.toUpperCase()} (${offset}): ${ev.message}`);
+      if (location) lines.push(`  at ${location}`);
+      if (ev.stack) {
+        const stackHead = ev.stack.split("\n").slice(0, 5).join("\n").slice(0, 600);
+        for (const sl of stackHead.split("\n")) lines.push(`  ${sl}`);
+      }
+    }
+    lines.push("");
+  }
   lines.push("PROCEDURE (step 0 is the mandatory category line above \u2014 do NOT repeat the format instruction):");
   let n = 1;
   if (ctx.screenshotLocalPath) {
@@ -27161,6 +27187,16 @@ function buildAnalyzerPrompt(ctx) {
   lines.push(`  ${n++}. If any fix is non-trivial, ambiguous, or would touch many files, STOP and either (a) ask via \`AskUserQuestion\`, or (b) write a plan in your final response instead of editing. Better to leave the user a clear next-step than to commit a wrong change.`);
   return lines.join("\n");
 }
+function formatEventOffset(eventTs, capturedAt) {
+  if (!capturedAt) return `ts=${eventTs}`;
+  const diffMs = eventTs - new Date(capturedAt).getTime();
+  if (!Number.isFinite(diffMs)) return `ts=${eventTs}`;
+  const direction = diffMs <= 0 ? "before report" : "after report";
+  const abs = Math.abs(diffMs);
+  if (abs < 1e3) return `${abs}ms ${direction}`;
+  if (abs < 6e4) return `${(abs / 1e3).toFixed(1)}s ${direction}`;
+  return `${(abs / 6e4).toFixed(1)}m ${direction}`;
+}
 async function resumeAnalysisSession(params) {
   const { sessionId, projectDir } = params;
   const id = createSessionDirect(`radar: ${sessionId.slice(-8)} (resumed)`, projectDir, sessionId);
@@ -27561,6 +27597,23 @@ function buildContext(payload) {
   const body = typeof resource.body === "string" ? resource.body : payload.message;
   const severity = typeof fields.severity === "string" ? fields.severity : void 0;
   const route = typeof beaconMeta.url === "string" ? beaconMeta.url : void 0;
+  const rawEvents = Array.isArray(fields.events) ? fields.events : [];
+  const events = rawEvents.map((e) => {
+    const kind = e.kind === "error" || e.kind === "unhandledrejection" ? e.kind : null;
+    const ts = typeof e.ts === "number" ? e.ts : null;
+    const message = typeof e.message === "string" ? e.message : null;
+    if (!kind || ts === null || !message) return null;
+    return {
+      ts,
+      kind,
+      message,
+      ...typeof e.stack === "string" ? { stack: e.stack } : {},
+      ...typeof e.source === "string" ? { source: e.source } : {},
+      ...typeof e.line === "number" ? { line: e.line } : {},
+      ...typeof e.col === "number" ? { col: e.col } : {}
+    };
+  }).filter((e) => e !== null);
+  const capturedAt = typeof beaconMeta.capturedAt === "string" ? beaconMeta.capturedAt : void 0;
   const viewport = isViewport(beaconMeta.viewport) ? { w: beaconMeta.viewport.w, h: beaconMeta.viewport.h } : void 0;
   const theme = beaconMeta.theme === "light" || beaconMeta.theme === "dark" ? beaconMeta.theme : void 0;
   const userAgent = typeof beaconMeta.userAgent === "string" ? beaconMeta.userAgent : void 0;
@@ -27573,6 +27626,8 @@ function buildContext(payload) {
     severity,
     route,
     pins: pins.length > 0 ? pins : void 0,
+    events: events.length > 0 ? events : void 0,
+    capturedAt,
     viewport,
     theme,
     userAgent,
@@ -27718,19 +27773,19 @@ var import_node_path3 = require("node:path");
 init_launch_kit_paths();
 var MAX_DEDUPE_SET = 1e3;
 var MAX_PINGS = 200;
-function readJson(path12, fallback) {
-  if (!(0, import_node_fs2.existsSync)(path12)) return fallback;
+function readJson(path13, fallback) {
+  if (!(0, import_node_fs2.existsSync)(path13)) return fallback;
   try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(path12, "utf-8"));
+    return JSON.parse((0, import_node_fs2.readFileSync)(path13, "utf-8"));
   } catch {
     return fallback;
   }
 }
-function writeJsonAtomic(path12, value) {
-  (0, import_node_fs2.mkdirSync)((0, import_node_path3.dirname)(path12), { recursive: true });
-  const tmp = `${path12}.tmp.${process.pid}.${Date.now()}`;
+function writeJsonAtomic(path13, value) {
+  (0, import_node_fs2.mkdirSync)((0, import_node_path3.dirname)(path13), { recursive: true });
+  const tmp = `${path13}.tmp.${process.pid}.${Date.now()}`;
   (0, import_node_fs2.writeFileSync)(tmp, JSON.stringify(value, null, 2), "utf-8");
-  (0, import_node_fs2.renameSync)(tmp, path12);
+  (0, import_node_fs2.renameSync)(tmp, path13);
 }
 var RadarState = class {
   constructor(projectRoot) {
@@ -27863,9 +27918,9 @@ var RadarState = class {
     });
   }
   /** Persist the local path of a successfully-prefetched screenshot. */
-  setScreenshotLocalPath(id, path12) {
+  setScreenshotLocalPath(id, path13) {
     return this.mutate(id, (p) => {
-      p.context.screenshotLocalPath = path12;
+      p.context.screenshotLocalPath = path13;
     });
   }
   /**
@@ -30882,12 +30937,12 @@ init_launch_kit_paths();
 function loadApiRoutesFromOutput(apiOutput) {
   const routes = [];
   for (const n of apiOutput.nodes) {
-    const path12 = n.path;
-    if (!path12 || typeof path12 !== "string") continue;
+    const path13 = n.path;
+    if (!path13 || typeof path13 !== "string") continue;
     routes.push({
-      path: path12,
+      path: path13,
       nodeId: n.id,
-      segments: path12.split("/").filter(Boolean)
+      segments: path13.split("/").filter(Boolean)
     });
   }
   return routes;
@@ -30979,16 +31034,16 @@ function resolveFetchCall(call, apiPathMap, apiRoutes) {
   if (call.isConcat) {
     return { kind: "dynamic", normalizedUrl: raw };
   }
-  const { path: path12, hadInterpolation } = normalizeFetchUrl(raw);
-  if (!path12.startsWith("/")) {
-    return { kind: "unresolved", normalizedUrl: path12 };
+  const { path: path13, hadInterpolation } = normalizeFetchUrl(raw);
+  if (!path13.startsWith("/")) {
+    return { kind: "unresolved", normalizedUrl: path13 };
   }
-  const segs = path12.split("/").filter(Boolean);
+  const segs = path13.split("/").filter(Boolean);
   if (hadInterpolation && segs.length > 0 && segs[0].startsWith(":")) {
-    return { kind: "dynamic", normalizedUrl: path12 };
+    return { kind: "dynamic", normalizedUrl: path13 };
   }
-  const exact = apiPathMap.get(path12);
-  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path12 };
+  const exact = apiPathMap.get(path13);
+  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path13 };
   let bestScore = -1;
   let bestId = null;
   for (const r of apiRoutes) {
@@ -30999,21 +31054,21 @@ function resolveFetchCall(call, apiPathMap, apiRoutes) {
     }
   }
   if (bestId && bestScore > 0) {
-    return { kind: "resolved", nodeId: bestId, normalizedUrl: path12 };
+    return { kind: "resolved", nodeId: bestId, normalizedUrl: path13 };
   }
-  return { kind: "unresolved", normalizedUrl: path12 };
+  return { kind: "unresolved", normalizedUrl: path13 };
 }
 function resolveUrlPath(urlPath, apiPathMap, apiRoutes) {
-  const { path: path12, hadInterpolation } = normalizeFetchUrl(urlPath);
-  if (!path12.startsWith("/")) {
-    return { kind: "unresolved", normalizedUrl: path12 };
+  const { path: path13, hadInterpolation } = normalizeFetchUrl(urlPath);
+  if (!path13.startsWith("/")) {
+    return { kind: "unresolved", normalizedUrl: path13 };
   }
-  const segs = path12.split("/").filter(Boolean);
+  const segs = path13.split("/").filter(Boolean);
   if (hadInterpolation && segs.length > 0 && segs[0].startsWith(":")) {
-    return { kind: "dynamic", normalizedUrl: path12 };
+    return { kind: "dynamic", normalizedUrl: path13 };
   }
-  const exact = apiPathMap.get(path12);
-  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path12 };
+  const exact = apiPathMap.get(path13);
+  if (exact) return { kind: "resolved", nodeId: exact, normalizedUrl: path13 };
   let bestScore = -1;
   let bestId = null;
   for (const r of apiRoutes) {
@@ -31024,9 +31079,9 @@ function resolveUrlPath(urlPath, apiPathMap, apiRoutes) {
     }
   }
   if (bestId && bestScore > 0) {
-    return { kind: "resolved", nodeId: bestId, normalizedUrl: path12 };
+    return { kind: "resolved", nodeId: bestId, normalizedUrl: path13 };
   }
-  return { kind: "unresolved", normalizedUrl: path12 };
+  return { kind: "unresolved", normalizedUrl: path13 };
 }
 
 // src/server/graph/parsers/crosslayer/fetch-resolver.ts
@@ -32004,9 +32059,9 @@ function collectTargets(apiOutput, uiOutput) {
   const out = [];
   for (const n of apiOutput?.nodes ?? []) {
     if (n.type !== "endpoint") continue;
-    const path12 = n.path;
-    if (typeof path12 !== "string" || !path12) continue;
-    out.push({ id: n.id, route: path12, layer: "api" });
+    const path13 = n.path;
+    if (typeof path13 !== "string" || !path13) continue;
+    out.push({ id: n.id, route: path13, layer: "api" });
   }
   for (const n of uiOutput?.nodes ?? []) {
     if (n.type !== "page") continue;
@@ -34297,8 +34352,7 @@ function handleStartChartServer(args) {
   const portArgs = args.port ? ["--port", String(args.port)] : [];
   const child = (0, import_node_child_process3.spawn)(process.execPath, [entryPath, "serve", ...portArgs], {
     detached: true,
-    stdio: ["ignore", out, err2],
-    env: { ...process.env, LAUNCH_CHART_AUTOSERVE: "" }
+    stdio: ["ignore", out, err2]
   });
   child.unref();
   return okJson({
@@ -34633,6 +34687,53 @@ function startGraphMcpServer() {
 
 // src/server/cli.ts
 init_launch_kit_paths();
+
+// src/server/cred-shape.ts
+var fs9 = __toESM(require("node:fs"));
+var path11 = __toESM(require("node:path"));
+var CONFIG_FILENAME = ".launch-secure.cred.config";
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path11.join(repoRoot, CONFIG_FILENAME);
+  if (!fs9.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs9.readFileSync(p, "utf-8"));
+  } catch (err2) {
+    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err2 instanceof Error ? err2.message : String(err2)}`);
+  }
+}
+
+// src/server/cli.ts
 var DEFAULT_CAPABILITIES = {
   workspace_setup: true,
   terminal: true
@@ -35246,7 +35347,7 @@ if (parsedArgs.subcommand === "graph:generate" || parsedArgs.subcommand === "gra
   const result = (0, import_child_process4.spawnSync)(
     process.execPath,
     [chartEntry, chartSubcommand, ...process.argv.slice(3)],
-    { stdio: "inherit", env: { ...process.env, LAUNCH_CHART_AUTOSERVE: "" } }
+    { stdio: "inherit" }
   );
   process.exit(result.status ?? 1);
 }
@@ -35256,71 +35357,28 @@ if (parsedArgs.subcommand === "mcp:graph") {
 var __isMcpMode = parsedArgs.subcommand === "mcp:graph";
 var __isRadarMode = parsedArgs.subcommand === "radar";
 var radar = null;
-var CRED_CONFIG_FILENAME = ".launch-secure.cred.config";
-var LEGACY_CRED_CONFIG_FILENAME = ".launch-secure.config";
-function migrateLegacyCredConfig(repoRoot) {
-  const legacy = import_path9.default.join(repoRoot, LEGACY_CRED_CONFIG_FILENAME);
-  const dest = import_path9.default.join(repoRoot, CRED_CONFIG_FILENAME);
-  if (!import_fs8.default.existsSync(legacy) || import_fs8.default.existsSync(dest)) return;
-  let parsed;
-  try {
-    parsed = JSON.parse(import_fs8.default.readFileSync(legacy, "utf-8"));
-  } catch {
-    return;
-  }
-  const pat = parsed?.pat;
-  if (typeof pat !== "string" || !pat.startsWith("ls_pat_")) return;
-  import_fs8.default.renameSync(legacy, dest);
-  console.warn(`[launchpod] migrated legacy ${LEGACY_CRED_CONFIG_FILENAME} \u2192 ${CRED_CONFIG_FILENAME} (the old name is now reserved for file-backed-config)`);
-}
 function readLaunchSecureMcpConfig() {
-  migrateLegacyCredConfig(REPO_ROOT);
-  const configPath = import_path9.default.join(REPO_ROOT, CRED_CONFIG_FILENAME);
-  if (import_fs8.default.existsSync(configPath)) {
-    let parsed;
-    try {
-      parsed = JSON.parse(import_fs8.default.readFileSync(configPath, "utf-8"));
-    } catch (err2) {
-      throw new Error(`Could not parse ${configPath}: ${err2 instanceof Error ? err2.message : String(err2)}`);
-    }
-    const { pat: pat2, orgSlug: orgSlug2, projectSlug: projectSlug2, serverUrl } = parsed;
-    if (!pat2 || !pat2.startsWith("ls_pat_")) {
-      throw new Error(`${CRED_CONFIG_FILENAME} "pat" is missing or not a LaunchSecure PAT (ls_pat_...).`);
-    }
-    if (!orgSlug2 || !projectSlug2 || !serverUrl) {
-      throw new Error(`${CRED_CONFIG_FILENAME} is missing required fields (orgSlug, projectSlug, serverUrl).`);
-    }
-    return { pat: pat2, orgSlug: orgSlug2, projectSlug: projectSlug2, serverUrl, source: CRED_CONFIG_FILENAME };
+  const fix = `Run \`npx @launchsecure/launch-kit@latest refresh\` to re-sync this project (or \`init\` if you haven't bootstrapped yet).`;
+  const cred = readCredFile(REPO_ROOT);
+  if (!cred) {
+    throw new Error(`${CONFIG_FILENAME} not found in ${REPO_ROOT}. ${fix}`);
   }
-  const mcpPath = import_path9.default.join(REPO_ROOT, ".mcp.json");
-  if (!import_fs8.default.existsSync(mcpPath)) {
-    throw new Error(
-      `Neither ${CRED_CONFIG_FILENAME} nor .mcp.json found in ${REPO_ROOT}. Run \`npx launch-kit init --token=... --org=... --project=...\` to bootstrap.`
-    );
+  const nested = toNested(cred);
+  if (!nested) {
+    throw new Error(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl). ${fix}`);
   }
-  const raw = JSON.parse(import_fs8.default.readFileSync(mcpPath, "utf-8"));
-  const envName = process.env.LAUNCHPOD_MCP_NAME;
-  const entryName = envName ?? (raw.mcpServers?.["local-launch-secure"] ? "local-launch-secure" : "launch-secure");
-  const entry = raw.mcpServers?.[entryName];
-  if (!entry?.url) {
-    throw new Error(`No "${entryName}" entry with url found in .mcp.json (set LAUNCHPOD_MCP_NAME=<name> to pick a different one, or migrate to ${CRED_CONFIG_FILENAME} via \`launch-kit init\`)`);
+  const profile = nested.profiles[nested.active];
+  if (!profile) {
+    throw new Error(`${CONFIG_FILENAME} active course "${nested.active}" not found in profiles. ${fix}`);
   }
-  const auth = entry.headers?.["Authorization"] ?? "";
-  const pat = auth.replace(/^Bearer\s+/i, "").trim();
-  if (!pat.startsWith("ls_pat_")) {
-    throw new Error(
-      `.mcp.json launch-secure Authorization header is not a PAT (ls_pat_...). Migrate to ${CRED_CONFIG_FILENAME} via \`launch-kit init\`, or update the header.`
-    );
+  const { pat, orgSlug, projectSlug, serverUrl } = profile;
+  if (!pat || !pat.startsWith("ls_pat_")) {
+    throw new Error(`${CONFIG_FILENAME} "pat" is missing or not a LaunchSecure PAT (ls_pat_...). ${fix}`);
   }
-  const orgSlug = entry.headers?.["X-Org-Slug"];
-  const projectSlug = entry.headers?.["X-Project-Slug"];
-  if (!orgSlug || !projectSlug) {
-    throw new Error(
-      "Missing X-Org-Slug / X-Project-Slug headers in .mcp.json launch-secure entry."
-    );
+  if (!orgSlug || !projectSlug || !serverUrl) {
+    throw new Error(`${CONFIG_FILENAME} is missing required fields (orgSlug, projectSlug, serverUrl). ${fix}`);
   }
-  const url = new URL(entry.url);
-  return { pat, orgSlug, projectSlug, serverUrl: `${url.protocol}//${url.host}`, source: `.mcp.json[${entryName}]` };
+  return { pat, orgSlug, projectSlug, serverUrl, source: `${CONFIG_FILENAME}[${nested.active}]` };
 }
 if (!__isMcpMode) {
   let gracefulShutdown = function() {