@launchsecure/launch-kit 0.0.27 → 0.0.29

package/dist/server/init-entry.js

@@ -6,6 +6,13 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -23,20 +30,273 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/server/statusline-install.ts
+var statusline_install_exports = {};
+__export(statusline_install_exports, {
+  activateStatusline: () => activateStatusline,
+  deactivateStatusline: () => deactivateStatusline
+});
+function readSettings() {
+  if (!fs3.existsSync(SETTINGS_PATH)) return null;
+  try {
+    return JSON.parse(fs3.readFileSync(SETTINGS_PATH, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeSettings(s) {
+  fs3.mkdirSync(path3.dirname(SETTINGS_PATH), { recursive: true });
+  fs3.writeFileSync(SETTINGS_PATH, JSON.stringify(s, null, 2) + "\n", "utf-8");
+}
+function readScaffold(name) {
+  const p = path3.resolve(__dirname, "..", "..", "scaffolds", "statusline", name);
+  return fs3.readFileSync(p, "utf-8");
+}
+function writeScripts() {
+  fs3.mkdirSync(LK_DIR, { recursive: true });
+  fs3.writeFileSync(WRAPPER_PATH, readScaffold("statusline-wrapper.sh"), { mode: 493 });
+  fs3.writeFileSync(CHIP_PATH, readScaffold("statusline-mcp.sh"), { mode: 493 });
+}
+function wrapperCommand(opts) {
+  const env = [];
+  if (opts.show) env.push(`LK_STATUSLINE_SHOW=${opts.show}`);
+  if (opts.compact) env.push(`LK_STATUSLINE_COMPACT=1`);
+  const prefix = env.length > 0 ? env.join(" ") + " " : "";
+  return `${prefix}bash ${WRAPPER_PATH}`;
+}
+function activateStatusline(opts = {}) {
+  const settings = readSettings();
+  if (!settings) {
+    return { ok: false, outcome: "no-settings", message: `no ~/.claude/settings.json \u2014 nothing to wrap` };
+  }
+  const currentCmd = settings.statusLine?.command;
+  const alreadyWrapped = typeof currentCmd === "string" && currentCmd.includes(WRAPPER_PATH);
+  if (alreadyWrapped) {
+    writeScripts();
+    if (opts.show !== void 0 || opts.compact !== void 0) {
+      const updated = {
+        ...settings,
+        statusLine: { type: "command", command: wrapperCommand(opts) }
+      };
+      writeSettings(updated);
+      const parts = [];
+      if (opts.show) parts.push(`--show=${opts.show}`);
+      if (opts.compact) parts.push("--compact");
+      const desc = parts.length > 0 ? parts.join(" ") : "default (all chips, verbose)";
+      return { ok: true, outcome: "refreshed", message: `refreshed chip scripts and updated mode: ${desc}` };
+    }
+    return { ok: true, outcome: "refreshed", message: "statusline already wrapped \u2014 refreshed chip scripts only" };
+  }
+  if (!currentCmd) {
+    return { ok: false, outcome: "no-statusline", message: "no statusLine.command in ~/.claude/settings.json \u2014 launch-kit only extends an existing statusline" };
+  }
+  writeScripts();
+  const wrapped = {
+    ...settings,
+    statusLine: { type: "command", command: wrapperCommand(opts) },
+    [ORIGINAL_KEY]: settings.statusLine
+  };
+  writeSettings(wrapped);
+  const modeParts = [];
+  if (opts.show) modeParts.push(`chips: ${opts.show}`);
+  if (opts.compact) modeParts.push("compact mode");
+  const modeDesc = modeParts.length > 0 ? ` (${modeParts.join(", ")})` : "";
+  return { ok: true, outcome: "activated", message: `wrapped statusLine.command${modeDesc}; original stashed under ${ORIGINAL_KEY}` };
+}
+function deactivateStatusline() {
+  const settings = readSettings();
+  if (!settings) return { ok: false, outcome: "no-settings", message: "no ~/.claude/settings.json" };
+  const original = settings[ORIGINAL_KEY];
+  if (!original) {
+    return { ok: false, outcome: "not-active", message: `no ${ORIGINAL_KEY} in settings.json \u2014 statusline isn't wrapped by launch-kit` };
+  }
+  const restored = { ...settings, statusLine: original };
+  delete restored[ORIGINAL_KEY];
+  writeSettings(restored);
+  for (const p of [WRAPPER_PATH, CHIP_PATH]) {
+    try {
+      fs3.unlinkSync(p);
+    } catch {
+    }
+  }
+  return { ok: true, outcome: "deactivated", message: "restored original statusLine.command" };
+}
+var fs3, path3, import_node_os, LK_DIR, WRAPPER_PATH, CHIP_PATH, SETTINGS_PATH, ORIGINAL_KEY;
+var init_statusline_install = __esm({
+  "src/server/statusline-install.ts"() {
+    "use strict";
+    fs3 = __toESM(require("node:fs"));
+    path3 = __toESM(require("node:path"));
+    import_node_os = require("node:os");
+    LK_DIR = path3.join((0, import_node_os.homedir)(), ".launchsecure");
+    WRAPPER_PATH = path3.join(LK_DIR, "statusline-wrapper.sh");
+    CHIP_PATH = path3.join(LK_DIR, "statusline-mcp.sh");
+    SETTINGS_PATH = path3.join((0, import_node_os.homedir)(), ".claude", "settings.json");
+    ORIGINAL_KEY = "_launchKitStatuslineOriginal";
+  }
+});
+
 // src/server/init-entry.ts
 var import_node_child_process = require("node:child_process");
-var fs = __toESM(require("node:fs"));
+var crypto = __toESM(require("node:crypto"));
+var fs4 = __toESM(require("node:fs"));
 var import_node_http = require("node:http");
 var import_node_https = require("node:https");
-var path = __toESM(require("node:path"));
+var path4 = __toESM(require("node:path"));
 var readline = __toESM(require("node:readline"));
 var import_node_url = require("node:url");
-var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
+
+// src/server/cred-shape.ts
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
 var CONFIG_FILENAME = ".launch-secure.cred.config";
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function upsertProfile(existing, name, profile) {
+  const base = existing ? toNested(existing) ?? { active: name, profiles: {} } : { active: name, profiles: {} };
+  return {
+    active: name,
+    profiles: { ...base.profiles, [name]: profile }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function writeJsonAtomic(absPath, value, mode) {
+  const tmp = `${absPath}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
+  if (mode !== void 0) {
+    try {
+      fs.chmodSync(tmp, mode);
+    } catch {
+    }
+  }
+  fs.renameSync(tmp, absPath);
+}
+
+// src/server/cred-recovery.ts
+var fs2 = __toESM(require("node:fs"));
+var path2 = __toESM(require("node:path"));
 var LEGACY_CONFIG_FILENAME = ".launch-secure.config";
+function migrateLegacyCredFile(targetDir, opts) {
+  const legacy = path2.join(targetDir, LEGACY_CONFIG_FILENAME);
+  const dest = path2.join(targetDir, CONFIG_FILENAME);
+  if (!fs2.existsSync(legacy) || fs2.existsSync(dest)) return;
+  let parsed;
+  try {
+    parsed = JSON.parse(fs2.readFileSync(legacy, "utf-8"));
+  } catch {
+    return;
+  }
+  const pat = parsed?.pat;
+  if (typeof pat !== "string" || !pat.startsWith("ls_pat_")) return;
+  if (opts.dryRun) {
+    opts.log.dryNote(`would migrate legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} and strip the legacy gitignore line`);
+    return;
+  }
+  fs2.renameSync(legacy, dest);
+  removeGitignoreLine(targetDir, LEGACY_CONFIG_FILENAME, opts);
+  opts.log.ok(`migrated legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} (the old name is now reserved for file-backed-config)`);
+}
+function removeGitignoreLine(targetDir, line, opts) {
+  const p = path2.join(targetDir, ".gitignore");
+  if (!fs2.existsSync(p)) return;
+  const before = fs2.readFileSync(p, "utf-8");
+  const after = before.split(/\r?\n/).filter((l) => l.trim() !== line).join("\n");
+  if (after === before) return;
+  if (opts.dryRun) {
+    opts.log.dryNote(`would remove "${line}" from .gitignore`);
+    return;
+  }
+  fs2.writeFileSync(p, after, "utf-8");
+  opts.log.ok(`removed ${line} from .gitignore (now reserved for file-backed-config)`);
+}
+function recoverCredFromMcp(targetDir) {
+  const p = path2.join(targetDir, ".mcp.json");
+  if (!fs2.existsSync(p)) return null;
+  let mcp;
+  try {
+    mcp = JSON.parse(fs2.readFileSync(p, "utf-8"));
+  } catch {
+    return null;
+  }
+  const entry = mcp.mcpServers?.["launch-secure"];
+  if (!entry?.headers || !entry.url) return null;
+  const auth = entry.headers["Authorization"];
+  const pat = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice("Bearer ".length).trim() : null;
+  const orgSlug = entry.headers["X-Org-Slug"];
+  const projectSlug = entry.headers["X-Project-Slug"];
+  if (!pat || !pat.startsWith("ls_pat_") || !orgSlug || !projectSlug) return null;
+  const serverUrl = entry.url.replace(/\/api\/mcp\/project\/?$/, "").replace(/\/+$/, "");
+  return { pat, orgSlug, projectSlug, serverUrl };
+}
+function recoverCred(targetDir, opts) {
+  migrateLegacyCredFile(targetDir, opts);
+  let cred = null;
+  try {
+    cred = readCredFile(targetDir);
+  } catch {
+  }
+  if (cred) return { cred, source: "cred-file" };
+  if (opts.dryRun) {
+    const legacyPath = path2.join(targetDir, LEGACY_CONFIG_FILENAME);
+    if (fs2.existsSync(legacyPath)) {
+      try {
+        const parsed = JSON.parse(fs2.readFileSync(legacyPath, "utf-8"));
+        if (typeof parsed?.pat === "string" && parsed.pat.startsWith("ls_pat_")) {
+          opts.log.info(`(dry-run) using legacy ${LEGACY_CONFIG_FILENAME} for preview \u2014 a real run would migrate it to ${CONFIG_FILENAME} first`);
+          return { cred: parsed, source: "legacy-dry-run" };
+        }
+      } catch {
+      }
+    }
+  }
+  const recovered = recoverCredFromMcp(targetDir);
+  if (recovered) return { cred: recovered, source: "mcp" };
+  return { cred: null, source: null };
+}
+
+// src/server/init-entry.ts
+init_statusline_install();
+var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
 var ONBOARD_SCRIPT_NAME = "onboard";
 var LAUNCH_KIT_PKG = "@launchsecure/launch-kit";
-var LAUNCH_KIT_TOOLS_GUIDE = `
+var LAUNCH_KIT_TOOLS_GUIDE_STATIC_HEAD = `
 Wired in Claude Code (.mcp.json):
   launch-secure   \u2014 LS API: work items, comms, secrets, members, board
   launch-chart    \u2014 code search + project graph (use instead of grep/glob)
@@ -47,13 +307,60 @@ Wired in Claude Code (.mcp.json):
 Other tools (run on demand via npx):
   npx launch-pod radar       \u2014 webhook listener (LS pings \u2192 terminal/UI)
   npx launch-pod             \u2014 full pipeline UI (separate launch-pod login)
+  npx launch-beacon monitor  \u2014 local HTTP receiver for the launch-kit-beacon
+                               in-browser monitor. Paste the printed URL into
+                               the beacon debug panel; events stream to
+                               .launchsecure/beacon-<token>.ndjson for the
+                               /kit:beacon-* commands below to read.
+`;
+var LAUNCH_KIT_TOOLS_GUIDE_STATIC_TAIL = `
+  Open this repo in Claude Code; on first open you'll be prompted to install
+  the "launch-secure" marketplace \u2014 accept to enable the commands above.
 `;
+function renderLsCommandsSection() {
+  const dir = path4.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace", "plugins", "kit", "commands");
+  if (!fs4.existsSync(dir)) {
+    return "\nLS slash commands: (scaffold dir not bundled \u2014 this is a packaging bug)\n";
+  }
+  const files = fs4.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+  if (files.length === 0) return "\nLS slash commands: (none defined)\n";
+  const lines = files.map((file) => {
+    const name = file.replace(/\.md$/, "");
+    const text = fs4.readFileSync(path4.join(dir, file), "utf-8");
+    const fmMatch = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    const desc = fmMatch?.[1].match(/^description:\s*(.+)$/m)?.[1]?.trim() ?? "";
+    const padded = `/${PLUGIN_ID}:${name}`.padEnd(26);
+    return `  ${padded} \u2014 ${desc}`;
+  });
+  return `
+LS slash commands (run inside Claude Code in this project):
+${lines.join("\n")}
+`;
+}
+function getLaunchKitToolsGuide() {
+  return `${LAUNCH_KIT_TOOLS_GUIDE_STATIC_HEAD}${renderLsCommandsSection()}${LAUNCH_KIT_TOOLS_GUIDE_STATIC_TAIL}`;
+}
 var PACKAGE_MANAGERS = [
   { name: "pnpm", binary: "pnpm", lockfiles: ["pnpm-lock.yaml"], workspaceFiles: ["pnpm-workspace.yaml"], installArgs: ["install"] },
   { name: "yarn", binary: "yarn", lockfiles: ["yarn.lock"], installArgs: ["install"] },
   { name: "bun", binary: "bun", lockfiles: ["bun.lockb", "bun.lock"], installArgs: ["install"] },
   { name: "npm", binary: "npm", lockfiles: ["package-lock.json"], installArgs: ["install"] }
 ];
+var KNOWN_BOOL_FLAGS = /* @__PURE__ */ new Set([
+  "--help",
+  "-h",
+  "--no-install",
+  "--no-onboard",
+  "--no-recall",
+  "--no-migrate-safety",
+  "--no-ls-marketplace",
+  "--no-recall-hook",
+  "--refresh-scaffolds",
+  "--quiet",
+  "--force",
+  "--dry-run"
+]);
+var KNOWN_KV_KEYS = /* @__PURE__ */ new Set(["token", "org", "project", "url", "dir", "course"]);
 function parseArgs(argv) {
   const args = {
     token: process.env.LS_PAT ?? null,
@@ -61,12 +368,23 @@ function parseArgs(argv) {
     projectSlug: null,
     serverUrl: DEFAULT_SERVER_URL,
     targetDir: null,
+    course: null,
     noInstall: false,
+    noOnboard: false,
     noRecall: false,
     noMigrateSafety: false,
+    noLsMarketplace: false,
+    noRecallHook: false,
+    refreshScaffolds: false,
+    quiet: false,
+    force: false,
+    dryRun: false,
     help: false
   };
-  for (const raw of argv) {
+  const unknown = [];
+  for (let i = 0; i < argv.length; i++) {
+    const raw = argv[i];
+    if (i === 0 && !raw.startsWith("--") && !raw.startsWith("-")) continue;
     if (raw === "--help" || raw === "-h") {
       args.help = true;
       continue;
@@ -75,6 +393,10 @@ function parseArgs(argv) {
       args.noInstall = true;
       continue;
     }
+    if (raw === "--no-onboard") {
+      args.noOnboard = true;
+      continue;
+    }
     if (raw === "--no-recall") {
       args.noRecall = true;
       continue;
@@ -83,23 +405,124 @@ function parseArgs(argv) {
       args.noMigrateSafety = true;
       continue;
     }
+    if (raw === "--no-ls-marketplace") {
+      args.noLsMarketplace = true;
+      continue;
+    }
+    if (raw === "--no-recall-hook") {
+      args.noRecallHook = true;
+      continue;
+    }
+    if (raw === "--refresh-scaffolds") {
+      args.refreshScaffolds = true;
+      continue;
+    }
+    if (raw === "--quiet") {
+      args.quiet = true;
+      continue;
+    }
+    if (raw === "--force") {
+      args.force = true;
+      continue;
+    }
+    if (raw === "--dry-run") {
+      args.dryRun = true;
+      continue;
+    }
     const eq = raw.indexOf("=");
-    if (!raw.startsWith("--") || eq < 0) continue;
-    const key = raw.slice(2, eq);
-    const val = raw.slice(eq + 1);
-    if (key === "token") args.token = val;
-    else if (key === "org") args.orgSlug = val;
-    else if (key === "project") args.projectSlug = val;
-    else if (key === "url") args.serverUrl = val.replace(/\/+$/, "");
-    else if (key === "dir") args.targetDir = val;
+    if (raw.startsWith("--") && eq > 0) {
+      const key = raw.slice(2, eq);
+      const val = raw.slice(eq + 1);
+      if (key === "token") {
+        args.token = val;
+        continue;
+      }
+      if (key === "org") {
+        args.orgSlug = val;
+        continue;
+      }
+      if (key === "project") {
+        args.projectSlug = val;
+        continue;
+      }
+      if (key === "url") {
+        args.serverUrl = val.replace(/\/+$/, "");
+        continue;
+      }
+      if (key === "dir") {
+        args.targetDir = val;
+        continue;
+      }
+      if (key === "course") {
+        args.course = val;
+        continue;
+      }
+      unknown.push(raw);
+      continue;
+    }
+    if (raw.startsWith("-")) {
+      unknown.push(raw);
+      continue;
+    }
+    unknown.push(raw);
+  }
+  if (unknown.length > 0) {
+    const knownBool = [...KNOWN_BOOL_FLAGS].join(", ");
+    const knownKv = [...KNOWN_KV_KEYS].map((k) => `--${k}=<value>`).join(", ");
+    fail(`Unknown argument(s): ${unknown.join(" ")}
+  Known boolean flags: ${knownBool}
+  Known key=value flags: ${knownKv}`);
   }
   return args;
 }
+function printRefreshHelp() {
+  console.log(`launch-kit refresh \u2014 re-apply launch-kit scaffolds in an already-initialized project
+
+Usage:
+  npx @launchsecure/launch-kit@latest refresh [--dir=<path>] [options]
+
+What it does:
+  Re-merges .mcp.json with the latest launch-kit entries (preserves your other
+  entries), refreshes the launch-secure marketplace tree at .claude/marketplace/
+  (picks up any new /kit:* commands), refreshes scripts/ensure-recall.sh and
+  the SessionStart hook, and refreshes the migrate-safety scaffold.
+
+  Reads org/project/serverUrl/pat from the existing .launch-secure.cred.config.
+  Does NOT clone, re-install deps, re-prompt for PAT, or re-run the onboard
+  script. Use \`init\` for those.
+
+Options:
+  --dir=<path>             Target directory (default: cwd). Must contain a
+                           valid .launch-secure.cred.config.
+  --no-migrate-safety      Skip refreshing the migrate-safety scaffold.
+  --no-ls-marketplace      Skip refreshing the launch-secure marketplace.
+  --no-recall-hook         Skip refreshing the recall-hook scaffold.
+  --refresh-scaffolds      Force-overwrite migrate-safety files (default is to
+                           preserve user edits). Use this to pull updates
+                           published to @launchsecure/launch-kit.
+  --quiet                  Suppress the post-run tools guide.
+  --dry-run                Preview every file write without making changes.
+  --help                   Show this help.
+
+Tip: prefix the command with @latest (\`launch-kit@latest refresh\`) to force
+npx to pull the newest published version instead of using a cached older one.
+`);
+}
 function printHelp() {
-  console.log(`launch-kit init \u2014 bootstrap a LaunchSecure project on this machine
+  console.log(`launch-kit \u2014 bootstrap and refresh a LaunchSecure project on this machine
+
+Subcommands:
+  init                  Bootstrap a new project (clone, cred file, MCP, scaffolds, install)
+  refresh               Re-apply scaffolds + MCP entries in an already-initialized project
+                        (no clone, no install, no PAT prompt \u2014 see \`launch-kit refresh --help\`)
+  statusline activate   Wrap ~/.claude/settings.json's statusLine.command so MCP daemon
+                        chips (recall, chart, deck, council) get appended. Refuses to
+                        create one if none exists \u2014 additive only.
+  statusline deactivate Restore the original statusLine.command and remove kit scripts.
 
 Usage:
-  npx launch-kit init --token=<pat> --org=<orgSlug> --project=<projectSlug> [options]
+  npx @launchsecure/launch-kit init --token=<pat> --org=<orgSlug> --project=<projectSlug> [options]
+  npx @launchsecure/launch-kit@latest refresh [--dir=<path>] [options]
 
 Required:
   --token=<pat>            LaunchSecure PAT (ls_pat_...). Or set LS_PAT env var.
@@ -109,10 +532,45 @@ Required:
 Options:
   --url=<serverUrl>        LaunchSecure base URL (default: ${DEFAULT_SERVER_URL}).
   --dir=<path>             Target directory (default: ./<projectSlug>).
-  --no-install             Skip dependency install step.
+  --course=<name>          Name for the course (profile) being added to
+                           .launch-secure.cred.config. When omitted, inferred
+                           from --url: localhost\u2192"local", *staging*\u2192"staging",
+                           *.vercel.app\u2192"prod", else hostname. The course
+                           becomes active; re-run with a different --course
+                           and --url to add another (e.g. local + staging).
+                           Use \`launch-course set <name>\` to switch later.
+  --no-install             Skip dependency install step (also skips the onboard
+                           script \u2014 install is its prerequisite).
+  --no-onboard             Skip the onboard script even when install runs.
   --no-recall              Skip launch-recall (shadow git backup) scaffold.
   --no-migrate-safety      Skip migrate-safety scaffold (pg_dump-before-migrate
                            wrapper + GitHub Action + runbook).
+  --no-ls-marketplace      Skip the Claude Code "launch-secure" marketplace
+                           scaffold (.claude/marketplace/ + .claude/settings.json
+                           wiring \u2014 exposes /kit:activate-beacon and future
+                           ls-namespaced slash commands).
+  --no-recall-hook         Skip the SessionStart hook scaffold (Claude Code
+                           hook + scripts/ensure-recall.sh that auto-restarts
+                           the launch-recall watcher if it died between
+                           sessions). The hook is the surfacing layer for
+                           watcher-died-silently scenarios.
+  --refresh-scaffolds      Force-overwrite migrate-safety scaffold files even
+                           when they already exist. Default behavior preserves
+                           user edits; use this to pull updates published to
+                           @launchsecure/launch-kit (e.g., a newer
+                           migrate-with-backup.sh).
+  --quiet                  Suppress the post-run tools guide (the long block
+                           listing /kit:* commands and wired MCPs). Useful for
+                           idempotent re-runs in CI or scripts.
+  --force                  Skip the auto-delegate-to-refresh check. By default
+                           init detects an existing bootstrap (cred file +
+                           launch-secure MCP entry) and runs refresh instead.
+                           Pass --force to re-init from scratch even when the
+                           target dir is already set up.
+  --dry-run                Preview every file write, merge, clone, and install
+                           command without making any changes. Useful before
+                           re-running init against a customized project. The
+                           project_info HTTP call still runs (it's read-only).
   --help                   Show this help.
 
 What it does:
@@ -132,13 +590,22 @@ What it does:
   8. Scaffolds launch-recall (shadow git backup). Skip with --no-recall.
   9. Scaffolds migrate-safety (pg_dump wrapper + GHA backup workflow +
      runbook + .backups/ gitignore line). Skip with --no-migrate-safety.
+ 10. Scaffolds the Claude Code "launch-secure" marketplace at
+     .claude/marketplace/ and wires .claude/settings.json so Claude Code
+     auto-discovers it and enables the "kit" plugin (exposes
+     /kit:activate-beacon for wiring the launch-kit-beacon in-app feedback
+     widget). Skip with --no-ls-marketplace.
+ 11. Scaffolds scripts/ensure-recall.sh and appends a SessionStart hook to
+     .claude/settings.json that respawns the launch-recall watcher if it
+     died between sessions. Idempotent (dedupes by hook command-match).
+     Skip with --no-recall-hook.
 `);
 }
 async function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2) => rl.question(question, (answer) => {
+  return new Promise((resolve3) => rl.question(question, (answer) => {
     rl.close();
-    resolve2(answer.trim());
+    resolve3(answer.trim());
   }));
 }
 function fail(msg) {
@@ -151,6 +618,10 @@ function info(msg) {
 function ok(msg) {
   console.log(`[launch-kit] \u2713 ${msg}`);
 }
+var DRY_RUN = false;
+function dryNote(msg) {
+  console.log(`[launch-kit] (dry-run) ${msg}`);
+}
 function which(bin) {
   const res = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
   if (res.status !== 0) return null;
@@ -164,8 +635,17 @@ function preflight() {
   ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh ? ", gh present" : ", gh not found (will use git for clone)"}`);
   return { hasGh };
 }
-function callProjectInfo(args) {
-  return new Promise((resolve2, reject) => {
+var PROJECT_INFO_TIMEOUT_MS = 3e4;
+var PROJECT_INFO_MAX_ATTEMPTS = 3;
+var ProjectInfoHttpError = class extends Error {
+  constructor(status, retryable, message) {
+    super(message);
+    this.status = status;
+    this.retryable = retryable;
+  }
+};
+function attemptProjectInfo(args) {
+  return new Promise((resolve3, reject) => {
     const mcpUrl = new import_node_url.URL("/api/mcp/project", args.serverUrl);
     const body = JSON.stringify({
       jsonrpc: "2.0",
@@ -197,12 +677,24 @@ function callProjectInfo(args) {
         res.on("data", (c) => chunks.push(c));
         res.on("end", () => {
           const text = Buffer.concat(chunks).toString("utf-8");
-          if (res.statusCode === 401 || res.statusCode === 403) {
-            reject(new Error(`PAT rejected (${res.statusCode}). Check token + that it has access to ${args.orgSlug}/${args.projectSlug}.`));
+          if (res.statusCode === 401) {
+            reject(new ProjectInfoHttpError(401, false, `PAT rejected (401). Token is invalid or expired. Generate a new PAT at ${args.serverUrl}/settings/tokens and retry.`));
+            return;
+          }
+          if (res.statusCode === 403) {
+            reject(new ProjectInfoHttpError(403, false, `Access denied (403). Token is valid but lacks access to ${args.orgSlug}/${args.projectSlug}. Check membership/permissions on the project.`));
+            return;
+          }
+          if (res.statusCode === 404) {
+            reject(new ProjectInfoHttpError(404, false, `Project not found (404). Verify ${args.orgSlug}/${args.projectSlug} exists at ${args.serverUrl}.`));
+            return;
+          }
+          if (res.statusCode && res.statusCode >= 500) {
+            reject(new ProjectInfoHttpError(res.statusCode, true, `LaunchSecure server error ${res.statusCode}: ${text.slice(0, 200)}`));
             return;
           }
           if (res.statusCode && res.statusCode >= 400) {
-            reject(new Error(`LaunchSecure responded ${res.statusCode}: ${text.slice(0, 300)}`));
+            reject(new ProjectInfoHttpError(res.statusCode, false, `LaunchSecure responded ${res.statusCode}: ${text.slice(0, 300)}`));
             return;
           }
           let json = text;
@@ -231,7 +723,7 @@ function callProjectInfo(args) {
               return;
             }
             const payload = JSON.parse(inner);
-            resolve2({
+            resolve3({
               orgSlug: payload.org.slug,
               projectSlug: payload.project.slug,
               projectName: payload.project.name,
@@ -243,11 +735,34 @@ function callProjectInfo(args) {
         });
       }
     );
-    req.on("error", reject);
+    req.setTimeout(PROJECT_INFO_TIMEOUT_MS, () => {
+      req.destroy(new Error(`project_info timed out after ${PROJECT_INFO_TIMEOUT_MS / 1e3}s`));
+    });
+    req.on("error", (err) => {
+      const code = err.code;
+      const retryable = code === "ECONNRESET" || code === "ECONNREFUSED" || code === "ETIMEDOUT" || code === "ENOTFOUND" || code === "EAI_AGAIN" || /timed out/.test(err.message);
+      reject(retryable ? new ProjectInfoHttpError(0, true, err.message) : err);
+    });
     req.write(body);
     req.end();
   });
 }
+async function callProjectInfo(args) {
+  let lastErr;
+  for (let attempt = 1; attempt <= PROJECT_INFO_MAX_ATTEMPTS; attempt++) {
+    try {
+      return await attemptProjectInfo(args);
+    } catch (err) {
+      lastErr = err;
+      const retryable = err instanceof ProjectInfoHttpError && err.retryable;
+      if (!retryable || attempt === PROJECT_INFO_MAX_ATTEMPTS) break;
+      const delayMs = 1e3 * 2 ** (attempt - 1);
+      info(`project_info attempt ${attempt}/${PROJECT_INFO_MAX_ATTEMPTS} failed (${err instanceof Error ? err.message : String(err)}) \u2014 retrying in ${delayMs}ms`);
+      await new Promise((r) => setTimeout(r, delayMs));
+    }
+  }
+  throw lastErr;
+}
 function gitRemoteUrl(dir) {
   const res = (0, import_node_child_process.spawnSync)("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf-8" });
   if (res.status !== 0) return null;
@@ -265,11 +780,11 @@ function normalizeRepoUrl(url) {
   }
 }
 function isGitRepo(dir) {
-  return fs.existsSync(path.join(dir, ".git"));
+  return fs4.existsSync(path4.join(dir, ".git"));
 }
 function dirIsEmpty(dir) {
-  if (!fs.existsSync(dir)) return true;
-  return fs.readdirSync(dir).length === 0;
+  if (!fs4.existsSync(dir)) return true;
+  return fs4.readdirSync(dir).length === 0;
 }
 function cloneRepo(repoUrl, targetDir, hasGh) {
   const isGithub = /github\.com/i.test(repoUrl);
@@ -284,51 +799,59 @@ function cloneRepo(repoUrl, targetDir, hasGh) {
     args = ["clone", repoUrl, targetDir];
     info(`cloning via git: ${repoUrl} \u2192 ${targetDir}`);
   }
+  if (DRY_RUN) {
+    dryNote(`would run: ${cmd} ${args.join(" ")}`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(cmd, args, { stdio: "inherit" });
   if (res.status !== 0) {
     fail(
       `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\` or an SSH key on your GitHub account.`
     );
   }
+  if (!fs4.existsSync(path4.join(targetDir, ".git"))) {
+    fail(`Clone reported success but .git is missing at ${targetDir}. Possible partial clone, filesystem issue, or sandboxing \u2014 investigate manually.`);
+  }
   ok(`cloned to ${targetDir}`);
 }
-function writeConfigFile(targetDir, cfg) {
-  migrateLegacyCredFile(targetDir);
-  const p = path.join(targetDir, CONFIG_FILENAME);
-  const existed = fs.existsSync(p);
-  fs.writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
-  try {
-    fs.chmodSync(p, 384);
-  } catch {
+function writeConfigFile(targetDir, cfg, courseName) {
+  recoverCred(targetDir, getRecoveryOptions());
+  const p = path4.join(targetDir, CONFIG_FILENAME);
+  const existing = readCredFile(targetDir);
+  const isNew = existing === null;
+  const isUpdate = !isNew && Boolean(existing?.profiles?.[courseName]);
+  if (DRY_RUN) {
+    const verb = isNew ? "write" : isUpdate ? "update course" : "add course";
+    dryNote(`would ${verb} "${courseName}" in ${CONFIG_FILENAME} (org=${cfg.orgSlug}, project=${cfg.projectSlug}, url=${cfg.serverUrl})`);
+    return;
   }
-  ok(`${existed ? "updated" : "wrote"} ${CONFIG_FILENAME}`);
+  const nested = upsertProfile(existing, courseName, cfg);
+  writeJsonAtomic(p, nested, 384);
+  const action = isNew ? "wrote" : isUpdate ? `updated course "${courseName}" in` : `added course "${courseName}" to`;
+  ok(`${action} ${CONFIG_FILENAME} (active: ${courseName})`);
 }
-function migrateLegacyCredFile(targetDir) {
-  const legacy = path.join(targetDir, LEGACY_CONFIG_FILENAME);
-  const dest = path.join(targetDir, CONFIG_FILENAME);
-  if (!fs.existsSync(legacy) || fs.existsSync(dest)) return;
-  let parsed;
+var recoveryLog = { info, ok, dryNote };
+function getRecoveryOptions() {
+  return { dryRun: DRY_RUN, log: recoveryLog };
+}
+function detectExistingBootstrap(targetDir) {
+  if (!fs4.existsSync(path4.join(targetDir, CONFIG_FILENAME))) {
+    return { bootstrapped: false };
+  }
+  const mcpPath = path4.join(targetDir, ".mcp.json");
+  if (!fs4.existsSync(mcpPath)) {
+    return { bootstrapped: false };
+  }
   try {
-    parsed = JSON.parse(fs.readFileSync(legacy, "utf-8"));
+    const mcp = JSON.parse(fs4.readFileSync(mcpPath, "utf-8"));
+    if (mcp.mcpServers?.["launch-secure"]) {
+      return { bootstrapped: true, reason: `${CONFIG_FILENAME} present + launch-secure MCP entry in .mcp.json` };
+    }
   } catch {
-    return;
   }
-  const pat = parsed?.pat;
-  if (typeof pat !== "string" || !pat.startsWith("ls_pat_")) return;
-  fs.renameSync(legacy, dest);
-  removeGitignoreLine(targetDir, LEGACY_CONFIG_FILENAME);
-  ok(`migrated legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} (the old name is now reserved for file-backed-config)`);
-}
-function removeGitignoreLine(targetDir, line) {
-  const p = path.join(targetDir, ".gitignore");
-  if (!fs.existsSync(p)) return;
-  const before = fs.readFileSync(p, "utf-8");
-  const after = before.split(/\r?\n/).filter((l) => l.trim() !== line).join("\n");
-  if (after === before) return;
-  fs.writeFileSync(p, after, "utf-8");
-  ok(`removed ${line} from .gitignore (now reserved for file-backed-config)`);
+  return { bootstrapped: false };
 }
-var LAUNCH_SECURE_HEADERS_HELPER = `node -e 'const j=JSON.parse(require("fs").readFileSync(".launch-secure.cred.config","utf-8"));process.stdout.write(JSON.stringify({Authorization:"Bearer "+j.pat,"X-Org-Slug":j.orgSlug,"X-Project-Slug":j.projectSlug}))'`;
+var LAUNCH_SECURE_HEADERS_HELPER = `node -e 'const j=JSON.parse(require("fs").readFileSync(".launch-secure.cred.config","utf-8"));const c=j.profiles&&j.active?j.profiles[j.active]:j;process.stdout.write(JSON.stringify({Authorization:"Bearer "+c.pat,"X-Org-Slug":c.orgSlug,"X-Project-Slug":c.projectSlug}))'`;
 function buildLaunchKitMcpEntries(cfg) {
   return {
     "launch-secure": {
@@ -339,6 +862,11 @@ function buildLaunchKitMcpEntries(cfg) {
     "launch-chart": {
       command: "npx",
       args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"],
+      // Tells launch-chart to also start its HTTP UI alongside the MCP, so
+      // users can open the chart viewer at localhost:<port> while queries
+      // hit the MCP. Without this, the MCP runs passively (queries work,
+      // no UI). I4 deep-merge preserves user-added env keys; this default
+      // ensures the auto-serve UX ships out of the box.
       env: { LAUNCH_CHART_AUTOSERVE: "1" }
     },
     "launch-deck": {
@@ -355,31 +883,61 @@ function buildLaunchKitMcpEntries(cfg) {
     }
   };
 }
+function mergeMcpEntry(existing, ours) {
+  const merged = { ...existing, ...ours };
+  if (existing.headers || ours.headers) {
+    const authKeys = /* @__PURE__ */ new Set(["Authorization", "X-Org-Slug", "X-Project-Slug"]);
+    const baseHeaders = ours.headersHelper ? Object.fromEntries(Object.entries(existing.headers ?? {}).filter(([k]) => !authKeys.has(k))) : { ...existing.headers ?? {} };
+    const combinedHeaders = { ...baseHeaders, ...ours.headers ?? {} };
+    if (Object.keys(combinedHeaders).length > 0) merged.headers = combinedHeaders;
+    else delete merged.headers;
+  }
+  if (existing.env || ours.env) {
+    const combinedEnv = { ...existing.env ?? {}, ...ours.env ?? {} };
+    if (Object.keys(combinedEnv).length > 0) merged.env = combinedEnv;
+    else delete merged.env;
+  }
+  return merged;
+}
 function mergeMcpFile(targetDir, launchKitEntries) {
-  const p = path.join(targetDir, ".mcp.json");
-  const hadExisting = fs.existsSync(p);
+  const p = path4.join(targetDir, ".mcp.json");
+  const hadExisting = fs4.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
     } catch (err) {
       fail(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const existingServerCount = Object.keys(existing.mcpServers ?? {}).length;
   const merged = { ...existing, mcpServers: { ...existing.mcpServers ?? {} } };
+  const overwrites = [];
+  const additions = [];
   for (const [name, entry] of Object.entries(launchKitEntries)) {
-    merged.mcpServers[name] = entry;
+    const existingEntry = merged.mcpServers[name];
+    if (existingEntry) {
+      overwrites.push(name);
+      merged.mcpServers[name] = mergeMcpEntry(existingEntry, entry);
+    } else {
+      additions.push(name);
+      merged.mcpServers[name] = entry;
+    }
+  }
+  if (DRY_RUN) {
+    const action2 = hadExisting && existingServerCount > 0 ? "would merge into" : "would write";
+    dryNote(`${action2} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}]`);
+    return;
   }
-  fs.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   const action = hadExisting && existingServerCount > 0 ? "merged into" : "wrote";
   ok(`${action} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
 }
 function detectPackageManager(repoDir) {
-  const pkgPath = path.join(repoDir, "package.json");
-  if (!fs.existsSync(pkgPath)) return null;
+  const pkgPath = path4.join(repoDir, "package.json");
+  if (!fs4.existsSync(pkgPath)) return null;
   try {
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
     if (typeof pkg.packageManager === "string") {
       const name = pkg.packageManager.split("@")[0];
       const match = PACKAGE_MANAGERS.find((p) => p.name === name);
@@ -388,7 +946,7 @@ function detectPackageManager(repoDir) {
     }
   } catch {
   }
-  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs.existsSync(path.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
+  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs4.existsSync(path4.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
   if (matches.length === 1) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile}` };
   }
@@ -397,8 +955,8 @@ function detectPackageManager(repoDir) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile} (multiple present)` };
   }
   for (const pm of PACKAGE_MANAGERS) {
-    if (pm.workspaceFiles?.some((wf) => fs.existsSync(path.join(repoDir, wf)))) {
-      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs.existsSync(path.join(repoDir, wf)))})` };
+    if (pm.workspaceFiles?.some((wf) => fs4.existsSync(path4.join(repoDir, wf)))) {
+      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs4.existsSync(path4.join(repoDir, wf)))})` };
     }
   }
   const npm = PACKAGE_MANAGERS.find((p) => p.name === "npm");
@@ -408,23 +966,43 @@ function runInstall(repoDir, detected) {
   const { pm } = detected;
   if (!which(pm.binary)) {
     fail(
-      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path4.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
     );
   }
   info(`running ${pm.binary} ${pm.installArgs.join(" ")} \u2026`);
+  if (DRY_RUN) {
+    dryNote(`would run: ${pm.binary} ${pm.installArgs.join(" ")} (cwd: ${repoDir})`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
     fail(
-      `${pm.name} install failed (exit ${res.status}). Configs and clone are intact \u2014 fix the underlying error and retry: cd ${path.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+      `${pm.name} install failed (exit ${res.status}).
+
+Half-init state \u2014 install didn't complete, but these files ARE on disk:
+  - ${path4.join(repoDir, CONFIG_FILENAME)} (cred file)
+  - ${path4.join(repoDir, ".mcp.json")} (5 launch-kit MCP entries merged)
+  - ${path4.join(repoDir, ".gitignore")} (cred line appended)
+  - clone at ${repoDir}
+
+Scaffolds (recall, migrate-safety, marketplace, recall-hook) were NOT yet written.
+
+To retry install only:
+  cd ${path4.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}
+
+To re-run init after fixing the install error:
+  cd ${path4.basename(repoDir)} && npx @launchsecure/launch-kit init --dir=.
+
+To fully reset: delete the files listed above and the clone, then re-init.`
     );
   }
   ok(`${pm.name} install complete`);
 }
 function hasOnboardScript(repoDir) {
-  const pkgPath = path.join(repoDir, "package.json");
-  if (!fs.existsSync(pkgPath)) return false;
+  const pkgPath = path4.join(repoDir, "package.json");
+  if (!fs4.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
     return typeof pkg.scripts?.[ONBOARD_SCRIPT_NAME] === "string";
   } catch {
     return false;
@@ -432,91 +1010,430 @@ function hasOnboardScript(repoDir) {
 }
 function runRecallInit(repoDir) {
   info(`scaffolding launch-recall (shadow git backup) \u2026`);
-  const recallEntry = path.resolve(__dirname, "recall-entry.js");
-  const useSibling = fs.existsSync(recallEntry);
+  const recallEntry = path4.resolve(__dirname, "recall-entry.js");
+  const useSibling = fs4.existsSync(recallEntry);
   const cmd = useSibling ? process.execPath : "npx";
   const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "init"];
+  if (DRY_RUN) {
+    dryNote(`would run launch-recall init: ${cmd} ${args.join(" ")} (cwd: ${repoDir})`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
+    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path4.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
     return;
   }
   ok(`launch-recall ready (shadow git initialized)`);
 }
 function runOnboard(repoDir, pm) {
   info(`running ${pm.binary} run ${ONBOARD_SCRIPT_NAME} \u2026`);
+  if (DRY_RUN) {
+    dryNote(`would run: ${pm.binary} run ${ONBOARD_SCRIPT_NAME} (cwd: ${repoDir})`);
+    return;
+  }
   const res = (0, import_node_child_process.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
     fail(
-      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
+      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path4.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
     );
   }
   ok(`${ONBOARD_SCRIPT_NAME} script complete`);
 }
 function ensureGitignoreLine(targetDir, line) {
-  const p = path.join(targetDir, ".gitignore");
-  let content = fs.existsSync(p) ? fs.readFileSync(p, "utf-8") : "";
+  const p = path4.join(targetDir, ".gitignore");
+  let content = fs4.existsSync(p) ? fs4.readFileSync(p, "utf-8") : "";
   const lines = content.split(/\r?\n/);
   if (lines.some((l) => l.trim() === line)) return;
   if (content.length && !content.endsWith("\n")) content += "\n";
   content += `${line}
 `;
-  fs.writeFileSync(p, content, "utf-8");
+  if (DRY_RUN) {
+    dryNote(`would append "${line}" to .gitignore`);
+    return;
+  }
+  fs4.writeFileSync(p, content, "utf-8");
   ok(`appended ${line} to .gitignore`);
 }
-function copyScaffoldIfMissing(srcPath, destPath, label) {
-  if (!fs.existsSync(srcPath)) return "missing-src";
-  if (fs.existsSync(destPath)) {
-    info(`${label} already present \u2014 leaving alone`);
-    return "existed";
-  }
-  fs.mkdirSync(path.dirname(destPath), { recursive: true });
-  fs.copyFileSync(srcPath, destPath);
-  try {
-    const srcMode = fs.statSync(srcPath).mode;
-    fs.chmodSync(destPath, srcMode);
-  } catch {
+function copyScaffoldDirAlways(srcDir, destDir, labelPrefix) {
+  if (!fs4.existsSync(srcDir)) return;
+  for (const entry of fs4.readdirSync(srcDir, { withFileTypes: true })) {
+    const srcPath = path4.join(srcDir, entry.name);
+    const destPath = path4.join(destDir, entry.name);
+    const label = labelPrefix ? `${labelPrefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      copyScaffoldDirAlways(srcPath, destPath, label);
+    } else if (entry.isFile()) {
+      const existed = fs4.existsSync(destPath);
+      if (DRY_RUN) {
+        dryNote(`would ${existed ? "refresh" : "write"} ${label}`);
+        continue;
+      }
+      fs4.mkdirSync(path4.dirname(destPath), { recursive: true });
+      fs4.copyFileSync(srcPath, destPath);
+      try {
+        const srcMode = fs4.statSync(srcPath).mode;
+        fs4.chmodSync(destPath, srcMode);
+      } catch {
+      }
+      ok(`${existed ? "refreshed" : "wrote"} ${label}`);
+    }
   }
-  ok(`wrote ${label}`);
-  return "wrote";
 }
-function scaffoldMigrateSafety(targetDir) {
-  const scaffoldsRoot = path.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
-  if (!fs.existsSync(scaffoldsRoot)) {
+function scaffoldMigrateSafety(targetDir, refreshScaffolds = false) {
+  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
+  if (!fs4.existsSync(scaffoldsRoot)) {
     info(`\u26A0 migrate-safety scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
     return;
   }
   const files = [
     {
-      src: path.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
-      dest: path.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
+      src: path4.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
+      dest: path4.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
       label: ".github/workflows/backup-on-migration.yml"
     },
     {
-      src: path.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
-      dest: path.join(targetDir, "scripts", "migrate-with-backup.sh"),
+      src: path4.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
+      dest: path4.join(targetDir, "scripts", "migrate-with-backup.sh"),
       label: "scripts/migrate-with-backup.sh"
     },
     {
-      src: path.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
-      dest: path.join(targetDir, "docs", "migrations-runbook.md"),
+      src: path4.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
+      dest: path4.join(targetDir, "docs", "migrations-runbook.md"),
       label: "docs/migrations-runbook.md"
     }
   ];
-  info("scaffolding migrate-safety (pg_dump wrapper + GHA backup workflow + runbook) \u2026");
-  for (const f of files) copyScaffoldIfMissing(f.src, f.dest, f.label);
+  info(`scaffolding migrate-safety (pg_dump wrapper + GHA backup workflow + runbook)${refreshScaffolds ? " \u2014 --refresh-scaffolds active" : ""} \u2026`);
+  for (const f of files) copyScaffoldDriftAware(f.src, f.dest, f.label, refreshScaffolds);
   ensureGitignoreLine(targetDir, ".backups/");
   ok("migrate-safety ready \u2014 see docs/migrations-runbook.md for db:migrate wiring + PROD_DATABASE_URL secret setup");
 }
+function hashFile(p) {
+  try {
+    return crypto.createHash("sha256").update(fs4.readFileSync(p)).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function copyScaffoldDriftAware(srcPath, destPath, label, refreshScaffolds) {
+  if (!fs4.existsSync(srcPath)) {
+    info(`\u26A0 scaffold src missing for ${label} \u2014 skipping (packaging bug)`);
+    return "missing-src";
+  }
+  if (!fs4.existsSync(destPath)) {
+    if (DRY_RUN) {
+      dryNote(`would write ${label}`);
+      return "wrote";
+    }
+    fs4.mkdirSync(path4.dirname(destPath), { recursive: true });
+    fs4.copyFileSync(srcPath, destPath);
+    try {
+      fs4.chmodSync(destPath, fs4.statSync(srcPath).mode);
+    } catch {
+    }
+    ok(`wrote ${label}`);
+    return "wrote";
+  }
+  const srcHash = hashFile(srcPath);
+  const destHash = hashFile(destPath);
+  if (srcHash && destHash && srcHash === destHash) {
+    if (DRY_RUN) dryNote(`${label} in sync with shipped scaffold \u2014 no change`);
+    else info(`${label} in sync with shipped scaffold \u2014 no change`);
+    return "in-sync";
+  }
+  if (refreshScaffolds) {
+    if (DRY_RUN) {
+      dryNote(`would refresh ${label} (overrides local edits)`);
+      return "drifted-refreshed";
+    }
+    fs4.copyFileSync(srcPath, destPath);
+    try {
+      fs4.chmodSync(destPath, fs4.statSync(srcPath).mode);
+    } catch {
+    }
+    ok(`refreshed ${label} (overrode local edits \u2014 drift detected before write)`);
+    return "drifted-refreshed";
+  }
+  info(`${label} differs from shipped scaffold (customized or older version) \u2014 preserving. Pass --refresh-scaffolds to overwrite.`);
+  return "drifted-preserved";
+}
+var MARKETPLACE_ID = "launch-secure";
+var PLUGIN_ID = "kit";
+function isDogfoodMarketplace(targetDir) {
+  const p = path4.join(targetDir, ".claude", "settings.json");
+  if (!fs4.existsSync(p)) return { isDogfood: false };
+  try {
+    const settings = JSON.parse(fs4.readFileSync(p, "utf-8"));
+    const existingPath = settings.extraKnownMarketplaces?.[MARKETPLACE_ID]?.source?.path;
+    if (existingPath && existingPath !== "./.claude/marketplace") {
+      return { isDogfood: true, existingPath };
+    }
+    return { isDogfood: false };
+  } catch {
+    return { isDogfood: false };
+  }
+}
+function scaffoldLsMarketplace(targetDir) {
+  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace");
+  if (!fs4.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 ls-marketplace scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  const dogfood = isDogfoodMarketplace(targetDir);
+  if (dogfood.isDogfood) {
+    info(`dogfood marketplace pointer detected (${dogfood.existingPath}) \u2014 skipping copy, only refreshing enabledPlugins`);
+    wireLsSettings(targetDir);
+    ok(`launch-secure marketplace (dogfood) \u2014 Claude Code loads commands from ${dogfood.existingPath}`);
+    return;
+  }
+  const marketplaceRoot = path4.join(targetDir, ".claude", "marketplace");
+  info("scaffolding launch-secure marketplace (Claude Code /kit: namespace \u2014 refreshes every /kit:* command found in the scaffold) \u2026");
+  copyScaffoldDirAlways(scaffoldsRoot, marketplaceRoot, ".claude/marketplace");
+  wireLsSettings(targetDir);
+  ok(`launch-secure marketplace ready \u2014 open this repo in Claude Code, approve the "${MARKETPLACE_ID}" marketplace prompt, then try /kit:activate-beacon, /kit:standup, or /kit:show-mcp-status`);
+}
+function wireLsSettings(targetDir) {
+  const p = path4.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs4.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const merged = { ...existing };
+  const existingMarketplacePath = existing.extraKnownMarketplaces?.[MARKETPLACE_ID]?.source?.path;
+  const targetPath = existingMarketplacePath ?? "./.claude/marketplace";
+  if (existingMarketplacePath && existingMarketplacePath !== "./.claude/marketplace") {
+    info(`preserving existing marketplace path: ${existingMarketplacePath} (likely dogfood \u2014 leaving alone)`);
+  }
+  merged.extraKnownMarketplaces = {
+    ...existing.extraKnownMarketplaces ?? {},
+    [MARKETPLACE_ID]: {
+      source: { source: "directory", path: targetPath }
+    }
+  };
+  const pluginKey = `${PLUGIN_ID}@${MARKETPLACE_ID}`;
+  const existingEnabledPlugins = existing.enabledPlugins ?? {};
+  merged.enabledPlugins = {
+    ...existingEnabledPlugins,
+    ...pluginKey in existingEnabledPlugins ? {} : { [pluginKey]: true }
+  };
+  if (pluginKey in existingEnabledPlugins && existingEnabledPlugins[pluginKey] === false) {
+    info(`enabledPlugins["${pluginKey}"] is explicitly false \u2014 leaving disabled (re-enable manually to use /kit:* commands)`);
+  }
+  if (DRY_RUN) {
+    dryNote(`would ${hadExisting ? "merge into" : "write"} .claude/settings.json (set extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${PLUGIN_ID}@${MARKETPLACE_ID}; preserves every other key)`);
+    return;
+  }
+  fs4.mkdirSync(path4.dirname(p), { recursive: true });
+  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  ok(`${hadExisting ? "merged into" : "wrote"} .claude/settings.json (extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${PLUGIN_ID}@${MARKETPLACE_ID})`);
+}
+var RECALL_HOOK_SIGNATURE = "ensure-recall.sh";
+var RECALL_HOOK_COMMAND = 'bash "${CLAUDE_PROJECT_DIR:-$PWD}/scripts/ensure-recall.sh"';
+function scaffoldRecallHook(targetDir) {
+  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "recall-hook");
+  if (!fs4.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 recall-hook scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  info("scaffolding recall-hook (SessionStart watcher-respawn hook + ensure-recall.sh) \u2026");
+  copyScaffoldDirAlways(scaffoldsRoot, targetDir, "");
+  wireRecallHook(targetDir);
+  ok("recall-hook ready \u2014 opens with Claude Code will respawn the launch-recall watcher if it died between sessions");
+}
+function wireRecallHook(targetDir) {
+  const p = path4.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs4.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const hooks = existing.hooks ?? {};
+  const sessionStart = hooks.SessionStart ?? [];
+  const alreadyWired = sessionStart.some(
+    (group) => (group.hooks ?? []).some((h) => typeof h?.command === "string" && h.command.includes(RECALL_HOOK_SIGNATURE))
+  );
+  if (alreadyWired) {
+    info(".claude/settings.json SessionStart hook already references ensure-recall.sh \u2014 leaving alone");
+    return;
+  }
+  const newGroup = {
+    hooks: [{ type: "command", command: RECALL_HOOK_COMMAND }]
+  };
+  const merged = {
+    ...existing,
+    hooks: {
+      ...hooks,
+      SessionStart: [...sessionStart, newGroup]
+    }
+  };
+  if (DRY_RUN) {
+    dryNote(`would append SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh; preserves every other key + existing hooks)`);
+    return;
+  }
+  fs4.mkdirSync(path4.dirname(p), { recursive: true });
+  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  ok(`appended SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh)`);
+}
+function tryActivateStatusline() {
+  if (DRY_RUN) {
+    dryNote(`would wrap ~/.claude/settings.json statusLine.command with launch-kit's MCP chip wrapper (skips silently if no statusline configured)`);
+    return;
+  }
+  const res = activateStatusline();
+  if (res.ok && res.outcome === "activated") {
+    ok(`statusline wrapped \u2014 MCP chips will render alongside your existing statusline next session`);
+  } else if (res.ok && res.outcome === "refreshed") {
+    info(`statusline already wrapped \u2014 refreshed chip scripts`);
+  }
+}
 async function main() {
+  const subcommand = process.argv[2];
+  if (subcommand === "statusline") {
+    const action = process.argv[3];
+    if (!action || action === "--help" || action === "-h") {
+      console.log("usage: launch-kit statusline activate [--show=recall,chart,deck,council] [--compact]");
+      console.log("       launch-kit statusline deactivate");
+      console.log("");
+      console.log("  --show     comma-separated subset of chips. Default: all four.");
+      console.log("  --compact  collapse to `mcp N/total` (green if all up, red otherwise).");
+      console.log("  Re-run activate with different flags to change in place.");
+      return;
+    }
+    let showArg;
+    let compactArg = false;
+    for (const a of process.argv.slice(4)) {
+      if (a.startsWith("--show=")) showArg = a.slice("--show=".length);
+      else if (a === "--compact") compactArg = true;
+      else fail(`Unknown statusline flag: "${a}". Supported: --show=<csv>, --compact.`);
+    }
+    const { activateStatusline: activateStatusline2, deactivateStatusline: deactivateStatusline2 } = await Promise.resolve().then(() => (init_statusline_install(), statusline_install_exports));
+    let res;
+    if (action === "activate") res = activateStatusline2({ show: showArg, compact: compactArg });
+    else if (action === "deactivate") res = deactivateStatusline2();
+    else fail(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
+    if (res.ok) ok(`statusline ${res.outcome} \u2014 ${res.message}`);
+    else info(`statusline ${res.outcome} \u2014 ${res.message}`);
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   if (args.help) {
-    printHelp();
+    if (subcommand === "refresh") printRefreshHelp();
+    else printHelp();
     return;
   }
-  const subcommand = process.argv[2];
-  if (subcommand && subcommand !== "init" && !subcommand.startsWith("--")) {
-    fail(`Unknown subcommand "${subcommand}". Only "init" is supported. Run with --help for usage.`);
+  if (!subcommand || subcommand.startsWith("--")) {
+    fail(`missing subcommand. Usage: launch-kit <init|refresh|statusline> [options]. Run with --help.`);
+  }
+  if (subcommand !== "init" && subcommand !== "refresh") {
+    fail(`Unknown subcommand "${subcommand}". Supported: init, refresh, statusline. Run with --help for usage.`);
+  }
+  DRY_RUN = args.dryRun;
+  if (DRY_RUN) {
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    info("DRY RUN \u2014 no files will be written, no commands will run.");
+    info("Lines tagged (dry-run) show what would happen.");
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  }
+  if (subcommand === "refresh") return mainRefresh(args);
+  return mainInit(args);
+}
+async function mainRefresh(args) {
+  const cwd = process.cwd();
+  const targetDir = path4.resolve(args.targetDir ?? cwd);
+  if (!fs4.existsSync(targetDir)) fail(`target dir does not exist: ${targetDir}`);
+  let cred;
+  let source;
+  try {
+    const recovery = recoverCred(targetDir, getRecoveryOptions());
+    cred = recovery.cred;
+    source = recovery.source;
+  } catch (err) {
+    fail(err instanceof Error ? err.message : String(err));
+  }
+  if (cred && source === "mcp") {
+    info(`recovered cred from .mcp.json launch-secure headers (PAT + org + project + url)`);
+    const courseName = inferCourseName(cred.serverUrl);
+    const nested2 = upsertProfile(null, courseName, cred);
+    if (DRY_RUN) {
+      dryNote(`would write ${CONFIG_FILENAME} from recovered .mcp.json cred (course: ${courseName})`);
+    } else {
+      writeJsonAtomic(path4.join(targetDir, CONFIG_FILENAME), nested2, 384);
+      ok(`wrote ${CONFIG_FILENAME} (course: ${courseName})`);
+    }
+  }
+  if (!cred) {
+    fail(
+      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json. Refresh requires an existing cred or a hardcoded launch-secure MCP entry \u2014 run \`npx @launchsecure/launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path4.relative(cwd, targetDir) || "."}\` first.`
+    );
+  }
+  const nested = toNested(cred);
+  if (!nested) fail(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl).`);
+  const active = nested.profiles[nested.active];
+  if (!active) fail(`${CONFIG_FILENAME} active profile "${nested.active}" is not present in profiles.`);
+  info(`refreshing launch-kit in ${targetDir} (course: ${nested.active}, project: ${active.orgSlug}/${active.projectSlug}) \u2026`);
+  const cfg = { pat: active.pat, orgSlug: active.orgSlug, projectSlug: active.projectSlug, serverUrl: active.serverUrl };
+  mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg));
+  ensureGitignoreLine(targetDir, CONFIG_FILENAME);
+  if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir, args.refreshScaffolds);
+  if (!args.noLsMarketplace) scaffoldLsMarketplace(targetDir);
+  if (!args.noRecallHook) scaffoldRecallHook(targetDir);
+  tryActivateStatusline();
+  console.log("");
+  if (DRY_RUN) {
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    info(`DRY RUN COMPLETE \u2014 refresh would have applied the above; no files modified.`);
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    return;
+  }
+  ok(`refresh complete \u2014 restart Claude Code to pick up any new /kit:* commands`);
+  if (!args.quiet) {
+    console.log(`
+Skipped (refresh never runs these): clone, dependency install, onboard script, launch-recall init. Use \`npx @launchsecure/launch-kit init\` for a full bootstrap.
+${getLaunchKitToolsGuide()}`);
+  }
+}
+async function mainInit(args) {
+  const probeDir = path4.resolve(args.targetDir ?? process.cwd());
+  if (!args.force && fs4.existsSync(probeDir)) {
+    const detection = detectExistingBootstrap(probeDir);
+    if (detection.bootstrapped) {
+      info(`detected existing bootstrap at ${probeDir} (${detection.reason})`);
+      info(`delegating to refresh. Pass --force to re-init from scratch (will re-prompt for PAT if needed).`);
+      return mainRefresh({ ...args, targetDir: probeDir });
+    }
+  }
+  if (!args.token || !args.orgSlug || !args.projectSlug) {
+    const recoveryDir = path4.resolve(args.targetDir ?? process.cwd());
+    if (fs4.existsSync(recoveryDir)) {
+      const { cred } = recoverCred(recoveryDir, getRecoveryOptions());
+      const nested = cred ? toNested(cred) : null;
+      const recovered = nested ? nested.profiles[nested.active] : cred;
+      if (recovered) {
+        if (!args.token && recovered.pat) {
+          args.token = recovered.pat;
+          info(`recovered --token from existing config in ${recoveryDir}`);
+        }
+        if (!args.orgSlug && recovered.orgSlug) {
+          args.orgSlug = recovered.orgSlug;
+          info(`recovered --org=${recovered.orgSlug} from existing config`);
+        }
+        if (!args.projectSlug && recovered.projectSlug) {
+          args.projectSlug = recovered.projectSlug;
+          info(`recovered --project=${recovered.projectSlug} from existing config`);
+        }
+        if (args.serverUrl === DEFAULT_SERVER_URL && recovered.serverUrl) {
+          args.serverUrl = recovered.serverUrl;
+        }
+      }
+    }
   }
   if (!args.token) {
     const t = await prompt("LaunchSecure PAT (ls_pat_\u2026): ");
@@ -542,10 +1459,10 @@ async function main() {
   }
   const repoUrl = resolved.repositoryUrl;
   const cwd = process.cwd();
-  const targetDir = path.resolve(args.targetDir ?? path.join(cwd, resolved.projectSlug));
+  const targetDir = path4.resolve(args.targetDir ?? path4.join(cwd, resolved.projectSlug));
   const normalizedRemote = normalizeRepoUrl(repoUrl);
   let skipClone = false;
-  if (fs.existsSync(targetDir)) {
+  if (fs4.existsSync(targetDir)) {
     if (isGitRepo(targetDir)) {
       const existingRemote = gitRemoteUrl(targetDir);
       if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
@@ -565,7 +1482,8 @@ async function main() {
     projectSlug: resolved.projectSlug,
     serverUrl: args.serverUrl
   };
-  writeConfigFile(targetDir, cfg);
+  const courseName = args.course ?? inferCourseName(cfg.serverUrl);
+  writeConfigFile(targetDir, cfg, courseName);
   mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg));
   ensureGitignoreLine(targetDir, CONFIG_FILENAME);
   let installSkippedReason = null;
@@ -577,30 +1495,41 @@ async function main() {
     installSkippedReason = "no package.json found";
   } else {
     runInstall(targetDir, detected);
-    if (hasOnboardScript(targetDir)) runOnboard(targetDir, detected.pm);
+    if (!args.noOnboard && hasOnboardScript(targetDir)) runOnboard(targetDir, detected.pm);
   }
   const hasOnboard = hasOnboardScript(targetDir);
   if (!args.noRecall) runRecallInit(targetDir);
-  if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir);
-  const relTarget = path.relative(cwd, targetDir) || ".";
+  if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir, args.refreshScaffolds);
+  if (!args.noLsMarketplace) scaffoldLsMarketplace(targetDir);
+  if (!args.noRecallHook) scaffoldRecallHook(targetDir);
+  tryActivateStatusline();
+  const relTarget = path4.relative(cwd, targetDir) || ".";
   console.log("");
+  if (DRY_RUN) {
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    info(`DRY RUN COMPLETE \u2014 no files were modified, no commands ran.`);
+    info(`Target: ${targetDir}`);
+    info(`Re-run without --dry-run to apply the changes shown above.`);
+    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    return;
+  }
   ok(`done \u2014 ${resolved.projectName} is ready at ${targetDir}`);
   if (installSkippedReason) {
     const installLine = detected ? `  ${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` : `  npm install              # or your package manager of choice`;
-    const onboardLine = hasOnboard && detected ? `
+    const onboardLine = hasOnboard && detected && !args.noOnboard ? `
   ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}      # project setup hook` : "";
     console.log(`
 Next steps (install skipped: ${installSkippedReason}):
   cd ${relTarget}
 ${installLine}${onboardLine}
-  claude                   # launch Claude Code (5 MCPs wired)
-${LAUNCH_KIT_TOOLS_GUIDE}`);
-  } else {
+  claude                   # launch Claude Code (5 MCPs wired)${args.quiet ? "" : `
+${getLaunchKitToolsGuide()}`}`);
+  } else if (!args.quiet) {
     console.log(`
 Next steps:
   cd ${relTarget}
   claude                   # launch Claude Code (5 MCPs wired)
-${LAUNCH_KIT_TOOLS_GUIDE}`);
+${getLaunchKitToolsGuide()}`);
   }
 }
 main().catch((err) => {