@launchsecure/launch-kit 0.0.30 → 0.0.31

package/dist/server/init-entry.js

@@ -317,24 +317,30 @@ var LAUNCH_KIT_TOOLS_GUIDE_STATIC_TAIL = `
   Open this repo in Claude Code; on first open you'll be prompted to install
   the "launch-secure" marketplace \u2014 accept to enable the commands above.
 `;
-function renderEntries(dir, kindLabel) {
+function listEntries(dir, kind) {
+  if (kind === "commands") {
+    return fs4.readdirSync(dir).filter((f) => f.endsWith(".md")).sort().map((f) => ({ name: f.replace(/\.md$/, ""), file: path4.join(dir, f) }));
+  }
+  return fs4.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && fs4.existsSync(path4.join(dir, e.name, "SKILL.md"))).map((e) => e.name).sort().map((name) => ({ name, file: path4.join(dir, name, "SKILL.md") }));
+}
+function renderEntries(dir, kind) {
   if (!fs4.existsSync(dir)) return `
-LS slash ${kindLabel}: (scaffold dir not bundled \u2014 this is a packaging bug)
+LS slash ${kind}: (scaffold dir not bundled \u2014 this is a packaging bug)
 `;
-  const files = fs4.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
-  if (files.length === 0) return `
-LS slash ${kindLabel}: (none defined)
+  const entries = listEntries(dir, kind);
+  if (entries.length === 0) return `
+LS slash ${kind}: (none defined)
 `;
-  const names = files.map((file) => `/${PLUGIN_ID}:${file.replace(/\.md$/, "")}`);
+  const names = entries.map((e) => `/${PLUGIN_ID}:${e.name}`);
   const colWidth = Math.max(26, ...names.map((n) => n.length + 2));
-  const lines = files.map((file, i) => {
-    const text = fs4.readFileSync(path4.join(dir, file), "utf-8");
+  const lines = entries.map((entry, i) => {
+    const text = fs4.readFileSync(entry.file, "utf-8");
     const fmMatch = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     const desc = fmMatch?.[1].match(/^description:\s*(.+)$/m)?.[1]?.trim() ?? "";
     return `  ${names[i].padEnd(colWidth)} \u2014 ${desc}`;
   });
   return `
-LS slash ${kindLabel} (run inside Claude Code in this project):
+LS slash ${kind} (run inside Claude Code in this project):
 ${lines.join("\n")}
 `;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchsecure/launch-kit",
-  "version": "0.0.30",
+  "version": "0.0.31",
   "description": "LaunchSecure toolkit — launch-pod (pipeline), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup).",
   "license": "MIT",
   "author": "LaunchSecure - AutomateWithUs",
@@ -56,6 +56,24 @@
     "launch-course": "./dist/server/course-entry.js",
     "launch-beacon": "./dist/server/beacon-monitor-entry.js"
   },
+  "scripts": {
+    "build": "pnpm build:client && pnpm build:chart-client && pnpm build:deck-client && pnpm build:council-client && pnpm build:beacon && pnpm build:server",
+    "build:beacon": "vite build --config vite.beacon.config.ts && tsc -p tsconfig.beacon.json --emitDeclarationOnly --outDir dist/beacon/types",
+    "test:beacon": "vitest run --config vite.beacon.config.ts",
+    "test:radar": "vitest run --config vite.radar.config.ts",
+    "test:chart": "vitest run --config vite.chart.test.config.ts",
+    "build:deck-client": "vite build --config vite.deck.config.ts",
+    "build:council-client": "vite build --config vite.council.config.ts",
+    "build:client": "vite build",
+    "build:chart-client": "vite build --config vite.chart.config.ts",
+    "build:server": "esbuild src/server/cli.ts src/server/fb-wizard.ts src/server/graph-mcp-entry.ts src/server/chart-serve.ts src/server/deck-mcp-entry.ts src/server/deck-serve.ts src/server/council-entry.ts src/server/council-serve.ts src/server/recall-entry.ts src/server/init-entry.ts src/server/orbit-entry.ts src/server/course-entry.ts src/server/beacon-monitor-entry.ts src/server/parse-worker-entry.ts --bundle --platform=node --target=node18 --outdir=dist/server --external:node-pty --external:ws --external:typescript --external:web-tree-sitter --external:tree-sitter-typescript --external:cloudflared --external:pg --external:pg-native --external:pgsql-parser --external:libpg-query && rm -rf dist/server/public && cp -r ../claude-code-web/src/public dist/server/public && rm -rf dist/server/graph/queries && mkdir -p dist/server/graph && cp -r src/server/graph/queries dist/server/graph/queries",
+    "dev:client": "vite",
+    "dev:deck-serve": "cd ../.. && tsx watch packages/cli/src/server/deck-mcp-entry.ts serve",
+    "dev:chart": "pnpm build:server && pnpm build:chart-client && node dist/server/graph-mcp-entry.js serve",
+    "dev:server": "pnpm build:server && node dist/server/cli.js",
+    "dev": "pnpm build:server && concurrently -k -n client,server -c cyan,magenta \"vite\" \"node dist/server/cli.js\"",
+    "prepublishOnly": "pnpm build"
+  },
   "files": [
     "dist",
     "prompts",
@@ -76,6 +94,8 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
+    "@launchsecure/claude-code-web": "workspace:*",
+    "@launchsecure/ui": "workspace:*",
     "@types/node": "^20.0.0",
     "@types/pg": "^8.11.10",
     "@types/react": "^18.3.12",
@@ -99,24 +119,6 @@
     "react-router-dom": "^6.28.0",
     "tailwindcss": "^3.4.19",
     "vite": "^5.4.11",
-    "vitest": "^1.6.0",
-    "@launchsecure/claude-code-web": "0.0.1",
-    "@launchsecure/ui": "0.0.1"
-  },
-  "scripts": {
-    "build": "pnpm build:client && pnpm build:chart-client && pnpm build:deck-client && pnpm build:council-client && pnpm build:beacon && pnpm build:server",
-    "build:beacon": "vite build --config vite.beacon.config.ts && tsc -p tsconfig.beacon.json --emitDeclarationOnly --outDir dist/beacon/types",
-    "test:beacon": "vitest run --config vite.beacon.config.ts",
-    "test:radar": "vitest run --config vite.radar.config.ts",
-    "test:chart": "vitest run --config vite.chart.test.config.ts",
-    "build:deck-client": "vite build --config vite.deck.config.ts",
-    "build:council-client": "vite build --config vite.council.config.ts",
-    "build:client": "vite build",
-    "build:chart-client": "vite build --config vite.chart.config.ts",
-    "build:server": "esbuild src/server/cli.ts src/server/fb-wizard.ts src/server/graph-mcp-entry.ts src/server/chart-serve.ts src/server/deck-mcp-entry.ts src/server/deck-serve.ts src/server/council-entry.ts src/server/council-serve.ts src/server/recall-entry.ts src/server/init-entry.ts src/server/orbit-entry.ts src/server/course-entry.ts src/server/beacon-monitor-entry.ts src/server/parse-worker-entry.ts --bundle --platform=node --target=node18 --outdir=dist/server --external:node-pty --external:ws --external:typescript --external:web-tree-sitter --external:tree-sitter-typescript --external:cloudflared --external:pg --external:pg-native --external:pgsql-parser --external:libpg-query && rm -rf dist/server/public && cp -r ../claude-code-web/src/public dist/server/public && rm -rf dist/server/graph/queries && mkdir -p dist/server/graph && cp -r src/server/graph/queries dist/server/graph/queries",
-    "dev:client": "vite",
-    "dev:chart": "pnpm build:server && pnpm build:chart-client && node dist/server/graph-mcp-entry.js serve",
-    "dev:server": "pnpm build:server && node dist/server/cli.js",
-    "dev": "pnpm build:server && concurrently -k -n client,server -c cyan,magenta \"vite\" \"node dist/server/cli.js\""
+    "vitest": "^1.6.0"
   }
-}
+}

package/scaffolds/ls-marketplace/plugins/kit/skills/analyse/SKILL.md

@@ -0,0 +1,180 @@
+---
+description: Source-code analysis using launch-chart as the default tool. Routes structural / internal-state / content queries to the chart MCP first; falls back to grep/Read only when the chart cannot answer (non-TS files, missing layer, parser gap). Files a one-line LS feedback comment whenever the fallback is the chart's fault, so gaps get fixed.
+when_to_use: |
+  Auto-fire whenever the user wants to understand, explore, audit, or trace source code or codebase structure — INSTEAD of defaulting to grep / glob / Read. Trigger phrases: "analyse" / "analyze" / "analysis", "explain how X works", "how does X work", "where is X", "what depends on / calls / renders / imports X", "trace / walk through Y", "explore the codebase", "understand this module", "audit X", "show me all / list every X" (pages, endpoints, tables, hooks, components), "what state does X track", "what conditions exist in X", "which endpoints check Y", "what tables relate to X", "what permissions does role X grant", "is migration X destructive", "what seed roles / tags / providers exist", "find FIXME / TODO". Also auto-fire on open-ended structural questions ("how is auth set up", "where does the work-item flow happen") even without explicit "analyse" wording. Do NOT auto-fire for: bug investigation framed as symptom ("X is broken", "why doesn't Y work" — use /kit:debug), refactor blast assessment ("what breaks if I change Z" — use /kit:blast-radius), or render-as-diagram requests (use /kit:diagram).
+allowed-tools:
+  - mcp__launch-chart__read_graph
+  - mcp__launch-chart__inspect_node
+  - mcp__launch-chart__grep_nodes
+  - mcp__launch-chart__detect_project_stack
+  - mcp__launch-chart__blast_points
+  - mcp__launch-chart__effects_index
+  - mcp__launch-chart__list_notes
+  - mcp__launch-chart__who_uses
+  - mcp__launch-chart__trace_path
+  - mcp__launch-chart__migration_audit
+  - mcp__launch-chart__drift_report
+  - mcp__launch-chart__auth_coverage_report
+  - mcp__launch-secure__kit_feedback_submit
+---
+
+# /kit:analyse
+
+Source-code analysis using launch-chart as the default tool. The chart indexes ~1,200 typed nodes across 4 layers (ui / api / db / static) with cross-layer edges and AST-level deep fields — almost everything grep/glob/Read would surface is queryable here, faster and cheaper in tokens.
+
+## Discipline (non-negotiable)
+
+1. **Chart-first.** Default to launch-chart MCP for any code-structure or behavior query. Do NOT reach for grep / glob / Read first.
+2. **On illegitimate chart gap, file ONE LS feedback report** via `mcp__launch-secure__kit_feedback_submit` (the kit-self feedback channel — NOT `communication_write`, which would land in the user's own project Comm Hub instead of the launch-kit project). One report per invocation, not per query.
+3. **Fall back to grep / Read** only per the rules below.
+4. **Surface the fallback verbatim** in your final output — silent fallbacks hide gaps and let the chart rot.
+
+## Routing table — chart tool per question shape
+
+Specialized tools (use these first when the question matches):
+
+| Question shape | Chart tool | Notes |
+|---|---|---|
+| "Where is X referenced from other layers / who uses permission P / who calls endpoint E / who references table T" | `who_uses(target: X)` | scans all layers' cross_refs (calls_api, references_static, reads_via, mutates_via, reads, mutates, references_api). Paginated. |
+| "Trace path between A and B / how does page X end up reading table T" | `trace_path(from: A, to: B)` | BFS via cross_refs including via[] middleware chains. Bounded by max_hops/max_paths. Paginated. |
+| "Are migrations safe / which destructive migrations lack guards" | `migration_audit` | codifies CLAUDE.md's three-layer discipline. Lists destructives missing orphan_check / sidecar_backup / pre_flight_notice. Paginated. |
+| "Show drift / SQL vs ORM mismatches / unresolved routes / FK drift" | `drift_report(layer?, kind?, confidence?)` | aggregates contradictions + flagged_edges across layers. Generalizes db-only include_findings. Paginated. |
+| "Audit auth coverage / which endpoints are public / how many use withAuth" | `auth_coverage_report(module?, strategy?)` | aggregates api endpoints by auth[] wrapper. Surfaces unauthenticated. Grouped by module. |
+| "What endpoints call /api/X / what URLs does UI fetch / who calls this endpoint" | `effects_index(kind: "fetch_calls", key?)` | UI→API call inventory from cross_refs[calls_api] + raw effects.fetches. |
+| "Invert endpoint effects / which endpoints call db.user.findUnique" | `effects_index(kind: "api_effects", key?)` | inverts api endpoint effects.{calls,fetches,persists,…}. Use `key` for full caller list across categories. |
+
+General routes (use these when no specialized tool fits):
+
+| Question shape | Chart tool | Notes |
+|---|---|---|
+| "Where is X defined / what is it" | `read_graph(search: X)` | substring match on id, name, route, JSX text, ui_labels, notes |
+| "What pages / hooks / endpoints / tables / migrations exist" | `read_graph(layer: <L>, type: <T>)` | layer + type filters |
+| "What's in module Y" | `read_graph(module: Y)` | module tags from `.launchchart.json` |
+| "Filter by multiple conditions (e.g. destructive AND missing orphan check)" | `read_graph(tag_predicates: [{field,op,value},...])` | ops: eq/ne/gt/lt/gte/lte/exists/not_exists/in. Matches top-level node attrs OR tag keys. |
+| "Per-node incoming + outgoing cross-layer refs" | `read_graph(node_id: X, include_cross_refs: true, cross_ref_type?)` OR `inspect_node(node_id: X, fields: ["crossRefs"])` | when you want crossRefs inline alongside other data |
+| "Surface flagged_edges by confidence (DYNAMIC routes, FK drift)" | `read_graph(layer: <L>, edge_confidence: ["medium","high"])` | layer-independent flagged_edges filter |
+| "What does X render / what renders X" | `read_graph(node_id: X, hops: 1, include_edges: true)` | renders / imports edges |
+| "Which UI calls API endpoint E" | `read_graph(node_id: E, layer: "api", include_edges: true)` OR `who_uses(target: E)` | cross-layer `calls_api` edges |
+| "What endpoints touch table T" | `read_graph(layer: "api", search: T)` then check `db_models[]` | endpoints already index `db_models` and `db_operations` |
+| "What auth does endpoint E use" | `read_graph(layer: "api", search: E)` then check `auth[]` | auth wrappers extracted per endpoint |
+| "Is endpoint E mutating" | `read_graph(layer: "api", search: E)` then check `mutates` flag | already extracted |
+| "What state does Z hold" | `inspect_node(node_id: Z, fields: ["stateVars"])` | start narrow, always |
+| "What conditions exist in Z" | `inspect_node(node_id: Z, fields: ["conditions"])` | if / else / ternary tests with their test expressions |
+| "Which nodes match pattern P inside conditions/vars/elements" | `inspect_node(layer: <L>, filter: P, fields: ["conditions"])` | regex over deep fields, raises node limit to 50 |
+| "DOM ids / storage keys / window events / fetch urls / timers / singleton risks" | `effects_index(kind: <kind>, key?)` | precomputed cross-cutting inverted indexes |
+| "DOM-id / storage-key collisions" | `effects_index(kind: "collisions")` | impossible without graph |
+| "What tables relate to X" | `read_graph(layer: "db", node_id: X, include_edges: true)` | belongs_to / has_many edges |
+| "Single migration M's safety status" | `read_graph(layer: "db", type: "migration", search: M)` | migration nodes carry `is_destructive`, `has_orphan_check`, `has_sidecar_backup`, `has_pre_flight_notice`, `contains_backfill`, `contains_drop_column` (use `migration_audit` for cross-migration audits) |
+| "What seed roles / permissions / tags / providers / plans exist" | `read_graph(layer: "static", type: "seed_role")` etc. | static layer covers `prisma/seed.ts` |
+| "What permissions does role R grant" | `read_graph(layer: "static", node_id: "seed:role:R", include_edges: true)` | `grants` edges |
+| "Find pattern P in module M's files only" | `grep_nodes(layer: <L>, module: M, pattern: P)` | grep scoped via graph — much narrower than raw grep |
+| "What breaks if I delete / change X" | `blast_points(node_id: X, direction: "reverse")` | reverse-dep walk across all layers in one call |
+| "Find FIXME / TODO / tagged notes" | `read_graph(search: "FIXME")` or `list_notes` | tagged comments indexed |
+| "What's the current stack / which parsers run / which layers are available" | `detect_project_stack` | run before concluding a layer is missing |
+
+## inspect_node strategy — start narrow, widen if needed
+
+1. **Decide first**: structure or variables? Structure (renders/imports/depends) → `read_graph`. Variables/state/conditions → `inspect_node`.
+2. **Always pass `fields` and/or `filter`** to keep the response small and inline. Examples:
+   - State only → `inspect_node(node_id: X, fields: ["stateVars"])`
+   - Pattern across many nodes → `inspect_node(layer: "ui", filter: "isAdmin", fields: ["conditions"])`
+3. **Only broaden if narrow returns nothing.** Remove `filter`, add more `fields`, or omit `fields` entirely as a last resort.
+4. **Never** call `inspect_node` with no `fields` and no `filter` on a large page or component — returns 50-80KB dumps that get persisted to disk and force a second read step.
+
+## parser_warning awareness
+
+Several chart tools (`who_uses`, `trace_path`, `drift_report`, `read_graph` with `include_cross_refs` or `edge_confidence`, `inspect_node` with `crossRefs`, `effects_index` with `fetch_calls`) attach a `parser_warning` field when the underlying source data (cross_refs / flagged_edges / contradictions) is completely empty for the scanned layer(s). This is the chart **telling you the parser may not have run** — not "there's no match."
+
+When you see `parser_warning` in a tool response:
+1. **Don't silently report "no results."** Empty-with-warning is a different signal than empty-without-warning.
+2. **Run `detect_project_stack`** to verify which parsers are detected. If the parser referenced in the warning IS detected, the data should be present — that's a chart-gap worth filing per the protocol below.
+3. **If the parser isn't detected for this stack** (e.g. cross-layer parsers don't apply because the project isn't TS/Next), surface that to the user — the chart doesn't claim coverage here.
+4. **Never strip `parser_warning` from your output.** Include it (or a short paraphrase) in the user-facing summary so they can act.
+
+## Chart breakage triage — BEFORE filing any feedback comment
+
+When a chart query returns empty / errors / fires `parser_warning`, walk this triage. Two upstream causes are common and require NO feedback comment — they're user-action gaps, not chart bugs. File a comment ONLY after both are ruled out.
+
+### Step 1 — does the graph file even exist?
+
+If a chart tool returns an error like `"No <layer> graph found at .launchsecure/graphs/<layer>.json"` or `"Run generate_graph first"`, the user hasn't built the graph yet. **Do NOT file a comment.** Tell the user verbatim and stop:
+- `"No chart graph found in this project. Run mcp__launch-chart__generate_graph (or `npx launch-chart generate`) once, then retry the query."`
+
+### Step 2 — is the graph stale?
+
+Every chart response carries `_meta.state`. If it's anything other than `"fresh"` (e.g. `"stale"`, `"escalated"`), the graph hasn't been regenerated since recent file edits — your query may be looking at an outdated snapshot. **Do NOT file a comment for stale-graph results.** Surface to the user:
+- `"Chart graph is <state> (last full regen: <_meta.lastFullRegenAt>, <N> patches since). Recent edits may not be visible. Run generate_graph to refresh, then retry."`
+- Then either stop OR proceed with the stale results, flagging the staleness in your final output.
+
+### Step 3 — parser produced empty/wrong output (the only chart-gap case)
+
+Only AFTER ruling out steps 1 + 2: if `detect_project_stack` shows the relevant parser is detected, the graph file exists, AND `_meta.state` is fresh — and the query still returns empty / missing expected fields / missing cross-layer edges — that's a real chart gap. File the LS feedback comment per the template below, with parser-specific fields populated (parser name, layer, graph_meta).
+
+## When the fallback is legitimate (NO feedback comment)
+
+These are expected gaps — the chart doesn't claim coverage here:
+
+- **Non-TS source files** — SQL (`prisma/migrations/**/*.sql` and other), JS/CJS/MJS files, JSON, markdown (docs/), env files, CSS / Tailwind config, YAML / TOML
+- **CSS classes, Tailwind utilities, inline styles** — chart doesn't model class names or computed styles
+- **CLI bin / Node script files** — the typescript-project parser is Next.js-shaped and may skip standalone server entrypoints (e.g. `packages/cli/src/server/init-entry.ts` is known to be unindexed)
+- **Untagged comment content** — only notes-tagged comments are indexed; arbitrary inline comments are not
+- **Verifying a file's literal contents for review or editing** — Read is correct for "show me lines 40-80 of foo.ts"
+
+In these cases, jump to grep / Read directly. Tell the user explicitly which non-coverage rule applied — e.g. `"Symptom is in an SQL migration file; chart doesn't model raw SQL — using Read directly."`
+
+## When the fallback is illegitimate (FEEDBACK COMMENT REQUIRED)
+
+The chart should have answered but didn't. File ONE comment before falling back:
+
+- `read_graph(search: "X")` returns 0 candidates AND a quick `grep` confirms "X" exists in indexed TS source
+- A layer listed by `detect_project_stack` returns 0 nodes for any well-formed query (parser misconfig)
+- `inspect_node` returns no `columns` / `elements` / `stateVars` for a known table or component (extractor gap)
+- A cross-layer edge that should exist (e.g. UI page that fetches `/api/foo` should have a `calls_api` edge) is missing
+
+### Feedback report template
+
+Call `mcp__launch-secure__kit_feedback_submit` — routes to the launch-kit project regardless of which repo the user is in:
+
+```
+title: "launch-chart gap: <one-line, e.g. 'fetch-resolver produced 0 calls_api refs on ui layer'>"
+source: "kit:analyse"
+body: |
+  Skill: /kit:analyse
+  Query: <one-line what the user asked>
+  Tool:  <chart_tool>(<args>)
+  Returned: <summary — e.g. "0 nodes" or "missing 'columns' field">
+  Cross-check: grep "<term>" matched <N> files (sample: <path1>, <path2>)
+  Project stack: <one-line from detect_project_stack>
+  Triage:
+    graph_exists: yes
+    graph_state: <_meta.state>           # fresh — ruled out staleness
+    parser_detected: <parser_id>          # from detect_project_stack
+  Parser: <parser_id>                     # e.g. fetch-resolver, typescript-project
+  Layer:  <layer_id>                      # ui / api / db / static
+  Graph meta:
+    state: <_meta.state>
+    last_full_regen_at: <_meta.lastFullRegenAt>
+```
+
+One report per invocation. After filing, surface to the user: `"(Filed chart-gap report to launch-kit project. Falling back to grep / Read for this query.)"` and continue.
+
+## Output shape
+
+For every analysis, return:
+
+1. **One-paragraph answer** to the user's question — direct, no preamble.
+2. **Citations as chart node ids** — each claim links to a node (file path like `app/api/orgs/.../route.ts`, table name like `WorkItem`, route like `/admin/analytics`). The user must be able to verify by clicking through.
+3. **The chart query path you used** — one or two lines naming the tools + arguments. Lets the user re-run or extend the investigation.
+
+If a fallback happened, prefix the output with one of:
+- `(Filed gap report id: <id>. Falling back to grep — chart should have answered.)`
+- `(Symptom is in <non-TS asset class>; chart doesn't model it — using grep / Read directly.)`
+
+## Constraints
+
+- **Chart-first. No exceptions.** Default to MCP queries. grep / glob / Read only per the fallback rules above.
+- **One feedback report per invocation.** Do not spam — bundle multiple chart issues into one report if they fire in the same run.
+- **Cloud LS by default.** Use `mcp__launch-secure__kit_feedback_submit` (cloud). The local variant only if the user explicitly said "local".
+- **No implementation.** This skill explains and traces; it does not edit. If the user wants the fix, hand the diagnosis back and let them invoke an editor flow.
+- **Cite by node id.** Every claim links to a chart node so the user can verify.
+- **Surface the fallback verbatim.** Silent fallbacks hide gaps and let the chart rot.

package/scaffolds/ls-marketplace/plugins/kit/skills/{blast-radius.md → blast-radius/SKILL.md}

@@ -1,5 +1,17 @@
 ---
 description: Build a blast radius for a file/table/endpoint via launch-chart and push it to launch-deck as an interactive radial graph. Use to assess "what breaks if I change X" before refactors, schema migrations, or API contract changes. Chart-first; on chart gaps (no nodes, missing layer, empty edges) files a feedback comment to LaunchSecure so the gap is monitored.
+when_to_use: |
+  Auto-fire when the user wants to VISUALISE the reverse-dependency blast radius for a specific node (file / table / endpoint / hook) before a refactor, migration, or contract change. Trigger phrases: "what breaks if I change X", "blast radius for X", "impact of refactoring X", "who's affected if I rename / drop / remove X", "scope this migration", "ripple effect of changing X", "is X safe to remove". Deck is required because the deliverable is an interactive radial graph — a flat list of dependents in the terminal misses ring/layer structure. Do NOT auto-fire for: simple "who imports X" or "where is X used" (use /kit:analyse), reading the structure of one file (use chart read_graph directly), planning the change itself (separate step that runs after blast-radius), plain-text dependency summaries the user can read in the terminal, or any request without a clear named target node.
+allowed-tools:
+  - mcp__launch-deck__server_status
+  - mcp__launch-deck__start_server
+  - mcp__launch-deck__deck
+  - mcp__launch-chart__chart_server_status
+  - mcp__launch-chart__detect_project_stack
+  - mcp__launch-chart__blast_points
+  - mcp__launch-chart__read_graph
+  - mcp__launch-secure__kit_feedback_submit
+  - Bash
 ---
 
 # /kit:blast-radius
@@ -57,7 +69,18 @@ Edges: connect the centre to every hop=1 node; connect each hop=2 node to one ho
 
 Call `mcp__launch-deck__deck` with `session: <session>`, `mode: "show"`, `blocks: [{ type: "blast-radius", label: <target>, manifest: <built-manifest> }]`.
 
-If the deck server isn't running, call `mcp__launch-deck__start_server` first, then retry. Report the deck URL back to the user.
+If the deck server isn't running, call `mcp__launch-deck__start_server` first, then retry.
+
+## 4. Open in browser
+
+After the push, open the per-session URL so the user lands directly on this blast-radius:
+
+```
+open "<deck-url>/#<session>"          # macOS
+xdg-open "<deck-url>/#<session>"      # Linux
+```
+
+`<deck-url>` is the `url` returned by `mcp__launch-deck__server_status` (typically `http://localhost:52829`). The `#<session>` hash deep-links to this exact session.
 
 ## Output
 
@@ -66,32 +89,25 @@ After the push, print a terse summary:
 ```
 blast-radius for <target> — <N> direct, <M> indirect (<hops> hops)
   by layer: db 4, api 7, ui 12
-  pushed to deck session "<session>" — http://localhost:52829/?session=<session>
+  pushed to deck session "<session>" — <deck-url>/#<session>
 ```
 
 ## Chart-gap protocol (shared)
 
-When the chart MCP returns less data than expected, file ONE feedback comment in the project's Comm Hub (cloud LS by default per project memory — use `mcp__launch-secure__communication_write`, not the local variant) before stopping:
+When the chart MCP returns less data than expected, file ONE report via `mcp__launch-secure__kit_feedback_submit` (the kit-self feedback channel — NOT `communication_write`, which would land in the user's own project Comm Hub instead of the launch-kit project) before stopping:
 
 ```
-resource_type: "feedback"
 title: "launch-chart gap: <one-line>"
+source: "kit:blast-radius"
 body: |
   Skill: /kit:blast-radius
   Tool:  blast_points(node_id=<id>, hops=<n>, layer=<layer?>)
   Returned: <nodes_count> nodes, layers=<layers_seen>
   Expected: <what-was-expected, e.g. "node exists at <path>" or "layer X should appear">
   Project stack: <one-line summary from detect_project_stack>
-fields:
-  severity: "low"
-  source: "kit-skill"
-  skill: "blast-radius"
-  tool: "blast_points"
-  args: { node_id, hops, layer }
-  response_summary: { nodes_count, layers_seen, error }
 ```
 
-Do NOT spam — file at most one comment per skill invocation. After filing, tell the user "Filed chart-gap report to LS (id: …). Falling back to read_graph + Read." and continue with a degraded path: try `mcp__launch-chart__read_graph` with `search: <target>` to confirm the node exists in any layer; if so, do the blast-radius math from `include_edges: true` results manually; otherwise stop and surface the gap to the user.
+Do NOT spam — file at most one report per skill invocation. After filing, tell the user "Filed chart-gap report to launch-kit project. Falling back to read_graph + Read." and continue with a degraded path: try `mcp__launch-chart__read_graph` with `search: <target>` to confirm the node exists in any layer; if so, do the blast-radius math from `include_edges: true` results manually; otherwise stop and surface the gap to the user.
 
 ## Constraints
 

package/scaffolds/ls-marketplace/plugins/kit/skills/{debug.md → debug/SKILL.md}

@@ -60,11 +60,11 @@ Then use `grep`/`Read` directly. Always tell the user explicitly: `"Chart return
 
 ## Chart-gap protocol (shared)
 
-When the chart MCP returns less than the symptom suggests it should, file ONE feedback comment in the project's Comm Hub via `mcp__launch-secure__communication_write` (cloud LS by default):
+When the chart MCP returns less than the symptom suggests it should, file ONE report via `mcp__launch-secure__kit_feedback_submit` (the kit-self feedback channel — NOT `communication_write`, which would land in the user's own project Comm Hub instead of the launch-kit project):
 
 ```
-resource_type: "feedback"
 title: "launch-chart gap: <one-line>"
+source: "kit:debug"
 body: |
   Skill: /kit:debug
   Symptom: <one-line symptom>
@@ -72,13 +72,6 @@ body: |
   Returned: 0 nodes
   Cross-check: grep "<term>" matched <N> files (sample: <path1>, <path2>)
   Project stack: <detect_project_stack one-liner>
-fields:
-  severity: "low"
-  source: "kit-skill"
-  skill: "debug"
-  tool: "read_graph"
-  args: { search, layer, type }
-  response_summary: { nodes_count: 0, grep_hit_count }
 ```
 
 Then continue with the grep fallback for THIS query. Don't file again in the same invocation.

package/scaffolds/ls-marketplace/plugins/kit/skills/{diagram.md → diagram/SKILL.md}

@@ -1,5 +1,18 @@
 ---
 description: Render a Mermaid diagram (flowchart, sequence, ERD, state, gantt) via launch-deck. For ERDs, auto-derives tables and relations from launch-chart's db layer so the diagram matches the real schema. Files a chart-gap feedback comment to LS if the db layer is missing or empty.
+when_to_use: |
+  Auto-fire when the user wants a RENDERED Mermaid diagram visible in the browser — flowchart, sequence, ERD, state machine, or gantt. Trigger phrases: "diagram X", "draw the flowchart for Y", "sequence diagram of W", "ERD for the schema / for X module", "state diagram for V's lifecycle", "gantt of the rollout", "show me visually how X flows", "render this as a diagram", "give me a chart of the user table relations". Deck is required because Mermaid must be rendered to be useful — DSL text in the terminal cannot substitute. Do NOT auto-fire for: plain-text process explanations the user can read in the terminal ("walk me through how X works" — that's /kit:analyse or a direct terminal answer), ASCII flowcharts inline in chat, requests that already include Mermaid the user wrote, or schema questions where the answer is a few sentences rather than a diagram.
+allowed-tools:
+  - mcp__launch-deck__server_status
+  - mcp__launch-deck__start_server
+  - mcp__launch-deck__deck
+  - mcp__launch-deck__await_feedback
+  - mcp__launch-chart__chart_server_status
+  - mcp__launch-chart__detect_project_stack
+  - mcp__launch-chart__read_graph
+  - mcp__launch-chart__inspect_node
+  - mcp__launch-secure__kit_feedback_submit
+  - Bash
 ---
 
 # /kit:diagram
@@ -93,10 +106,21 @@ Call `mcp__launch-deck__deck` with:
 
 If `--feedback`, call `await_feedback` and surface the response.
 
+## Open in browser
+
+After the push (and after `await_feedback` if `--feedback`), open the per-session URL so the user lands directly on this diagram:
+
+```
+open "<deck-url>/#<session>"          # macOS
+xdg-open "<deck-url>/#<session>"      # Linux
+```
+
+`<deck-url>` is the `url` returned by `mcp__launch-deck__server_status` (typically `http://localhost:52829`). The `#<session>` hash deep-links to this exact session.
+
 ## Output
 
 ```
-diagram pushed — deck session "<session>" — http://localhost:52829/?session=<session>
+diagram pushed — deck session "<session>" — <deck-url>/#<session>
 kind: <kind>
 nodes: <N>  edges: <M>
 ```
@@ -105,23 +129,17 @@ For ERDs add `tables: <N>  relations: <M>  scope: <scope or "all">`.
 
 ## Chart-gap protocol (shared)
 
-When the chart MCP returns less data than expected (db layer missing, 0 tables, empty columns), file ONE feedback comment in the project's Comm Hub via `mcp__launch-secure__communication_write` (cloud LS, not local) before stopping:
+When the chart MCP returns less data than expected (db layer missing, 0 tables, empty columns), file ONE report via `mcp__launch-secure__kit_feedback_submit` (the kit-self feedback channel — NOT `communication_write`, which would land in the user's own project Comm Hub instead of the launch-kit project) before stopping:
 
 ```
-resource_type: "feedback"
 title: "launch-chart gap: <one-line>"
+source: "kit:diagram"
 body: |
   Skill: /kit:diagram
   Tool:  read_graph(layer="db", …) / inspect_node(...)
   Returned: <tables_count> tables, <relations_count> relations
   Expected: db layer present per detect_project_stack
   Project stack: <one-line summary>
-fields:
-  severity: "low"
-  source: "kit-skill"
-  skill: "diagram"
-  tool: "read_graph"
-  response_summary: { layer, tables_count, error }
 ```
 
 Then fall back: render a `flowchart` placeholder explaining "DB layer not available — re-run `npx launch-chart generate_graph` then retry" instead of the ERD.

package/scaffolds/ls-marketplace/plugins/kit/skills/{prototype.md → prototype/SKILL.md}

@@ -1,5 +1,14 @@
 ---
 description: Generate a working HTML/JS prototype page and push it to launch-deck for click-through review. Use to validate behavior — flow, transitions, interactions — before any framework code is touched. Calls deck's rich-html block with framework=raw; supports CDN scripts, animations, real DOM events.
+when_to_use: |
+  Auto-fire when the user wants an INTERACTIVE throwaway page to validate behavior — click flows, transitions, optimistic updates, keyboard shortcuts, drag/drop — before any production code. Trigger phrases: "prototype X", "let me click through Y", "build a working demo of Z", "test the interaction for X", "throwaway version of W", "make it interactive so I can try it", "show me how the kanban drag would feel". Deck is required because the deliverable is a rendered, clickable page the user must touch — text/code descriptions in the terminal don't substitute. Do NOT auto-fire for: production implementation (use the appropriate fe:* / be:* flow), static visual mockups (use /kit:wireframe), reading or explaining existing code behavior (use /kit:analyse), plain-text walkthroughs of an interaction that the user can read in the terminal, or any request that's clearly about discussion not artifact production.
+allowed-tools:
+  - mcp__launch-deck__server_status
+  - mcp__launch-deck__start_server
+  - mcp__launch-deck__deck
+  - mcp__launch-deck__await_feedback
+  - mcp__launch-chart__read_graph
+  - Bash
 ---
 
 # /kit:prototype
@@ -74,10 +83,21 @@ Call `mcp__launch-deck__deck` with:
 
 If `--feedback`, call `mcp__launch-deck__await_feedback` afterward and surface the response.
 
+## Open in browser
+
+After the push (and after `await_feedback` if `--feedback`), open the per-session URL so the user lands directly on this prototype:
+
+```
+open "<deck-url>/#<session>"          # macOS
+xdg-open "<deck-url>/#<session>"      # Linux
+```
+
+`<deck-url>` is the `url` returned by `mcp__launch-deck__server_status` (typically `http://localhost:52829`). The `#<session>` hash deep-links to this exact session.
+
 ## Output
 
 ```
-prototype pushed — deck session "<session>" — http://localhost:52829/?session=<session>
+prototype pushed — deck session "<session>" — <deck-url>/#<session>
 size: <N> KB markup, <M> CDN scripts, <K> inline event handlers
 demonstrates: <one-line>
 ```

package/scaffolds/ls-marketplace/plugins/kit/skills/recovery/SKILL.md

@@ -0,0 +1,95 @@
+---
+description: Recover deleted, overwritten, or accidentally-modified files. Prefers launch-recall's shadow-git backup when wired (per-file snapshot history, debounced, doesn't need commits); falls back to git reflog / git stash / git log when recall isn't available. Read-only by default; restore is one-shot and prompts before overwriting. Never suggests destructive ops (git reset / git clean / rm) — recovery only.
+when_to_use: |
+  Auto-fire whenever the user signals they've lost work or want to undo something on disk. Trigger phrases: "I lost X", "lost my changes", "deleted by mistake", "accidentally deleted / removed / overwrote", "auto-formatter ate", "prettier ate my comments", "can I get back / recover / restore X", "undo my last edit", "undo what I did to X", "go back to previous version", "previous version of X", "what was in X before", "revert this file", "rollback this file" (note: "rollback the deploy" is NOT this — that's deploy-check / orbit territory), "the file is gone", "where did X go" when framed as loss. Also auto-fire on manual subcommand usage: status / doctor / history / show / restore / diff / report. Do NOT auto-fire for: bug investigation ("why doesn't X work" → /kit:debug), code structure ("how does X work" → /kit:analyse), git workflow ("how do I commit / push / merge" → general git help).
+allowed-tools:
+  - mcp__launch-recall__recall_status
+  - mcp__launch-recall__recall_doctor
+  - mcp__launch-recall__recall_history
+  - mcp__launch-recall__recall_report
+  - Bash(git --git-dir=*)
+  - Bash(git reflog*)
+  - Bash(git stash list*)
+  - Bash(git log*)
+  - Bash(git show*)
+  - Bash(git diff*)
+---
+
+# /kit:recovery
+
+Recover deleted / overwritten / lost files. **Recall-first** when wired, **git-fallback** when not. Read-only except for `restore` (which prompts).
+
+## Preflight — detect which path is available
+
+Always start by checking which recovery backend is reachable. Run BOTH probes (cheap, in parallel):
+
+1. `mcp__launch-recall__recall_status` → if it returns `{running: true, lastSnapshotAt: …}`, recall is the preferred path. Note the `watchTree` for context.
+2. `Bash("git rev-parse --is-inside-work-tree 2>&1")` → confirms a regular git repo exists (for the fallback path and for cross-checks).
+
+Surface what's available before doing anything else:
+- Both available → use recall first, mention git as fallback.
+- Only git available → tell user `"launch-recall not wired in this project — falling back to git reflog/log. (Recall would give you per-file history without needing commits. Run `npx @launchsecure/launch-kit refresh` to wire it.)"`
+- Neither available → stop and surface that. Can't recover blind.
+
+## Subcommand interface (manual invocation)
+
+Parse `$ARGUMENTS` — first token is the subcommand. If the first token doesn't match any known subcommand, treat the whole input as a **natural-language recovery request** (see below).
+
+- **status** — recall watcher liveness + last snapshot age (one line).
+- **doctor** — recall health check (3-line report: shadow_repo / watcher_alive / recent_snapshot).
+- **report** — project-wide recall stats (totalSnapshots, shadowSizeBytes, recentSnapshots).
+- **history `<path>`** — `[--limit=N]` — snapshots for the path (recall) OR `git log -p -- <path>` rows (fallback). Default limit 20.
+- **show `<path>` `<sha>`** — print the file at that snapshot (no write).
+- **diff `<path>` `<sha>`** — unified diff vs current working tree (or "file deleted from working tree" if absent). Cap 500 lines.
+- **restore `<path>` `<sha>`** — `[--to=<target-path>]` — restore the file. Strict confirmation protocol below.
+
+Examples:
+- `/kit:recovery status`
+- `/kit:recovery history src/server/comms/build-feed.ts`
+- `/kit:recovery show src/server/comms/build-feed.ts a1b2c3d`
+- `/kit:recovery restore src/server/comms/build-feed.ts a1b2c3d`
+- `/kit:recovery restore prisma/schema.prisma a1b2c3d --to=prisma/schema.recovered.prisma`
+
+## Natural-language recovery flow (auto-invoke path)
+
+When the user says "I lost X" / "deleted by mistake" / "prettier ate my comments" / "can I get back…", follow this loop:
+
+1. **Identify the target**: parse the user's prompt for a file path. If absent, ask: `"Which file or directory? (full path from repo root)"`. Do not guess.
+2. **Preflight** (see above) so you know which backend you're on.
+3. **List options**:
+   - Recall path: `recall_history(path: <path>, limit: 20)` → table of `sha | age | message`.
+   - Git path: `git log --oneline -20 -- <path>` (committed) AND `git reflog | head -20` (recent HEAD moves) AND `git stash list` (stashes). Present each source separately so the user knows which kind of recovery they're picking.
+4. **Show a candidate's content** before any restore: `show` the latest snapshot/commit so the user can confirm it's what they want.
+5. **Confirm restore** per the protocol below. NEVER restore without explicit `yes`.
+
+## Restore protocol (the only write operation)
+
+1. Resolve target path: `--to=<target>` if given, else the original `<path>`.
+2. If the target **exists on disk**:
+   - Print a side-by-side summary: `current size <N> bytes, snapshot size <M> bytes`.
+   - Show the first ~20 lines of the diff (current → snapshot).
+   - Ask: `"Overwrite <target>? (yes / show full diff / no)"` — wait for explicit `yes`.
+3. If the target does **NOT exist** on disk (file was deleted), restore without prompt but tell the user before writing: `"Restoring deleted file to <target> from snapshot <sha>."`
+4. Restore command:
+   - Recall path: `git --git-dir=<shadowRepoPath> --work-tree=<projectRoot> show <sha>:<path> > <target>`
+   - Git path: `git show <sha>:<path> > <target>` (against the regular repo)
+5. After restore: `"Restored. (Recall — if active — just captured a new snapshot of the restore itself, so your prior working-tree state is also recoverable.)"`
+
+## When recall is NOT wired — git fallback instructions
+
+If `recall_status` says recall isn't running OR the MCP isn't reachable, walk the user through the git-only path:
+
+- **Recently deleted file but no commit since**: `git checkout HEAD -- <path>` (restores from last commit). Confirm before running — this overwrites uncommitted changes if any exist.
+- **Lost edits made after the last commit, no stash**: usually unrecoverable from git alone unless your editor has a local history feature (VS Code: "Timeline" view, JetBrains: "Local History"). Surface this honestly: `"Git only tracks what you commit. Your editor may have local history — check VS Code's Timeline or JetBrains' Local History panel for unsaved changes."`
+- **File existed in a previous commit, deleted later**: `git log --oneline --all -- <path>` to find the last commit that contained it, then `git show <sha>:<path>` to view, then `git show <sha>:<path> > <path>` to restore.
+- **Stashed changes**: `git stash list` to enumerate, `git stash show -p stash@{N}` to view, `git stash apply stash@{N}` to apply (non-destructive — keeps the stash).
+- **Recent HEAD moves (force-push, rebase, reset)**: `git reflog` shows the prior positions. `git show <sha>:<path>` to view, then restore via `git show > file` (NOT `git reset --hard` — that moves your branch).
+
+## Constraints
+
+- **Read-only by default.** Only `restore` writes; everything else reads.
+- **Restore requires explicit `yes` confirmation** when overwriting an existing file. Never auto-overwrite — per project memory `feedback_no_dumb_reverts`, destructive ops need explicit confirmation.
+- **Never suggest `git reset --hard` / `git clean -f` / `rm` as recovery.** These DESTROY more state than they recover. Always restore via `git show > file` so the rest of the tree is untouched.
+- **Never auto-init recall.** If recall isn't wired, point at `npx @launchsecure/launch-kit refresh` — don't run it for the user. Their project, their choice.
+- **Surface both paths when both are available.** Recall has per-file granularity without needing commits; git has the canonical commit history. Sometimes the user wants the committed version, not the latest in-flight edit. Let them choose.
+- **Quote both ambiguities when history is empty.** If `recall_history` returns nothing AND the file still exists, say BOTH "path may be in recall's ignore list" AND "file may simply have no churn" — don't guess.