@launchsecure/launch-kit 0.0.31 → 0.0.33

package/dist/server/init-entry.js

@@ -30,6 +30,217 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/server/cred-shape.ts
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function upsertProfile(existing, name, profile) {
+  const base = existing ? toNested(existing) ?? { active: name, profiles: {} } : { active: name, profiles: {} };
+  return {
+    active: name,
+    profiles: { ...base.profiles, [name]: profile }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function writeJsonAtomic(absPath, value, mode) {
+  const tmp = `${absPath}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
+  if (mode !== void 0) {
+    try {
+      fs.chmodSync(tmp, mode);
+    } catch {
+    }
+  }
+  fs.renameSync(tmp, absPath);
+}
+var fs, path, CONFIG_FILENAME;
+var init_cred_shape = __esm({
+  "src/server/cred-shape.ts"() {
+    "use strict";
+    fs = __toESM(require("node:fs"));
+    path = __toESM(require("node:path"));
+    CONFIG_FILENAME = ".launch-secure.cred.config";
+  }
+});
+
+// src/server/secrets-pull.ts
+var secrets_pull_exports = {};
+__export(secrets_pull_exports, {
+  runSecretsPull: () => runSecretsPull
+});
+async function runSecretsPull(opts) {
+  const cred = readCredFile(opts.targetDir);
+  if (!cred) {
+    throw new Error(
+      `No ${CONFIG_FILENAME} found in ${opts.targetDir}. Run \`launch-kit init\` first.`
+    );
+  }
+  const nested = toNested(cred);
+  if (!nested) {
+    throw new Error(`${CONFIG_FILENAME} is missing required fields (pat, orgSlug, projectSlug, serverUrl).`);
+  }
+  const profile = nested.profiles[nested.active];
+  if (!profile) {
+    throw new Error(`Active profile "${nested.active}" not found in ${CONFIG_FILENAME}.`);
+  }
+  const envsRaw = await callMcp(profile, "environments_list", {});
+  const envsResult = Array.isArray(envsRaw) ? { environments: envsRaw, defaultPullEnvSlug: null } : envsRaw;
+  const envSlug = resolveEnvSlug(opts.envOverride, envsResult);
+  if (!envSlug) {
+    const list = envsResult.environments.map((e) => e.slug).join(", ") || "(none)";
+    throw new Error(
+      `No env specified and no default set. Available: ${list}. Pass --env=<slug>, set $LS_ENV, or set a project-level default at ${profile.serverUrl}/${profile.orgSlug}/projects/${profile.projectSlug}/settings.`
+    );
+  }
+  const pullResult = await callMcp(profile, "secrets_pull_env", { env_slug: envSlug });
+  const filePath = path3.join(opts.targetDir, opts.fileName);
+  writeEnvFile(filePath, pullResult.vars);
+  console.log(
+    `\u2714 wrote ${pullResult.vars.length} secrets from "${pullResult.env.slug}" \u2192 ${path3.relative(opts.targetDir, filePath) || opts.fileName}`
+  );
+}
+function resolveEnvSlug(override, envs) {
+  if (override) return override;
+  if (process.env.LS_ENV) return process.env.LS_ENV;
+  if (envs.defaultPullEnvSlug) return envs.defaultPullEnvSlug;
+  if (envs.environments.length === 1) return envs.environments[0].slug;
+  return null;
+}
+function writeEnvFile(filePath, vars) {
+  const lines = vars.map((v) => `${v.key}=${formatValue(v.value)}`);
+  fs3.writeFileSync(filePath, lines.join("\n") + "\n", "utf-8");
+  try {
+    fs3.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function formatValue(v) {
+  if (v === "") return "";
+  if (/[\s"'\\$`#=]/.test(v)) {
+    return `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`;
+  }
+  return v;
+}
+async function callMcp(profile, toolName, args) {
+  return new Promise((resolve3, reject) => {
+    const mcpUrl = new import_node_url.URL("/api/mcp/project", profile.serverUrl);
+    const body = JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "tools/call",
+      params: { name: toolName, arguments: args }
+    });
+    const requester = mcpUrl.protocol === "https:" ? import_node_https.request : import_node_http.request;
+    const req = requester(
+      {
+        host: mcpUrl.hostname,
+        port: mcpUrl.port || (mcpUrl.protocol === "https:" ? 443 : 80),
+        path: mcpUrl.pathname,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json, text/event-stream",
+          "Content-Length": String(Buffer.byteLength(body)),
+          "Authorization": `Bearer ${profile.pat}`,
+          "X-Org-Slug": profile.orgSlug,
+          "X-Project-Slug": profile.projectSlug
+        }
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c2) => chunks.push(c2));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          if (res.statusCode === 401) {
+            return reject(new Error(`PAT rejected (401). Regenerate at ${profile.serverUrl}/settings/tokens.`));
+          }
+          if (res.statusCode === 403) {
+            return reject(new Error(`Access denied (403). PAT lacks the scope required for ${toolName}.`));
+          }
+          if (res.statusCode && res.statusCode >= 400) {
+            return reject(new Error(`LaunchSecure ${res.statusCode}: ${text.slice(0, 300)}`));
+          }
+          let json = text;
+          if (text.startsWith("event:") || text.includes("\ndata: ")) {
+            for (const line of text.split("\n")) {
+              if (line.startsWith("data: ")) {
+                json = line.slice(6);
+                break;
+              }
+            }
+          }
+          try {
+            const parsed = JSON.parse(json);
+            if (parsed.error) return reject(new Error(`${toolName}: ${parsed.error.message ?? "unknown"}`));
+            const inner = parsed.result?.content?.[0]?.text;
+            if (!inner) return reject(new Error(`${toolName} returned no content`));
+            if (inner.startsWith("\u2500\u2500 Error")) {
+              const firstLine = inner.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("\u2500\u2500"))[0];
+              return reject(new Error(`${toolName}: ${firstLine ?? inner}`));
+            }
+            resolve3(JSON.parse(inner));
+          } catch (err) {
+            reject(new Error(`Could not parse ${toolName} response: ${err instanceof Error ? err.message : String(err)}`));
+          }
+        });
+      }
+    );
+    req.setTimeout(TIMEOUT_MS, () => req.destroy(new Error(`${toolName} timed out after ${TIMEOUT_MS / 1e3}s`)));
+    req.on("error", reject);
+    req.write(body);
+    req.end();
+  });
+}
+var fs3, path3, import_node_http, import_node_https, import_node_url, TIMEOUT_MS;
+var init_secrets_pull = __esm({
+  "src/server/secrets-pull.ts"() {
+    "use strict";
+    fs3 = __toESM(require("node:fs"));
+    path3 = __toESM(require("node:path"));
+    import_node_http = require("node:http");
+    import_node_https = require("node:https");
+    import_node_url = require("node:url");
+    init_cred_shape();
+    TIMEOUT_MS = 15e3;
+  }
+});
+
 // src/server/statusline-install.ts
 var statusline_install_exports = {};
 __export(statusline_install_exports, {
@@ -37,25 +248,25 @@ __export(statusline_install_exports, {
   deactivateStatusline: () => deactivateStatusline
 });
 function readSettings() {
-  if (!fs3.existsSync(SETTINGS_PATH)) return null;
+  if (!fs4.existsSync(SETTINGS_PATH)) return null;
   try {
-    return JSON.parse(fs3.readFileSync(SETTINGS_PATH, "utf-8"));
+    return JSON.parse(fs4.readFileSync(SETTINGS_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeSettings(s) {
-  fs3.mkdirSync(path3.dirname(SETTINGS_PATH), { recursive: true });
-  fs3.writeFileSync(SETTINGS_PATH, JSON.stringify(s, null, 2) + "\n", "utf-8");
+  fs4.mkdirSync(path4.dirname(SETTINGS_PATH), { recursive: true });
+  fs4.writeFileSync(SETTINGS_PATH, JSON.stringify(s, null, 2) + "\n", "utf-8");
 }
 function readScaffold(name) {
-  const p = path3.resolve(__dirname, "..", "..", "scaffolds", "statusline", name);
-  return fs3.readFileSync(p, "utf-8");
+  const p = path4.resolve(__dirname, "..", "..", "scaffolds", "statusline", name);
+  return fs4.readFileSync(p, "utf-8");
 }
 function writeScripts() {
-  fs3.mkdirSync(LK_DIR, { recursive: true });
-  fs3.writeFileSync(WRAPPER_PATH, readScaffold("statusline-wrapper.sh"), { mode: 493 });
-  fs3.writeFileSync(CHIP_PATH, readScaffold("statusline-mcp.sh"), { mode: 493 });
+  fs4.mkdirSync(LK_DIR, { recursive: true });
+  fs4.writeFileSync(WRAPPER_PATH, readScaffold("statusline-wrapper.sh"), { mode: 493 });
+  fs4.writeFileSync(CHIP_PATH, readScaffold("statusline-mcp.sh"), { mode: 493 });
 }
 function wrapperCommand(opts) {
   const env = [];
@@ -115,103 +326,313 @@ function deactivateStatusline() {
   writeSettings(restored);
   for (const p of [WRAPPER_PATH, CHIP_PATH]) {
     try {
-      fs3.unlinkSync(p);
+      fs4.unlinkSync(p);
     } catch {
     }
   }
   return { ok: true, outcome: "deactivated", message: "restored original statusLine.command" };
 }
-var fs3, path3, import_node_os, LK_DIR, WRAPPER_PATH, CHIP_PATH, SETTINGS_PATH, ORIGINAL_KEY;
+var fs4, path4, import_node_os, LK_DIR, WRAPPER_PATH, CHIP_PATH, SETTINGS_PATH, ORIGINAL_KEY;
 var init_statusline_install = __esm({
   "src/server/statusline-install.ts"() {
     "use strict";
-    fs3 = __toESM(require("node:fs"));
-    path3 = __toESM(require("node:path"));
+    fs4 = __toESM(require("node:fs"));
+    path4 = __toESM(require("node:path"));
     import_node_os = require("node:os");
-    LK_DIR = path3.join((0, import_node_os.homedir)(), ".launchsecure");
-    WRAPPER_PATH = path3.join(LK_DIR, "statusline-wrapper.sh");
-    CHIP_PATH = path3.join(LK_DIR, "statusline-mcp.sh");
-    SETTINGS_PATH = path3.join((0, import_node_os.homedir)(), ".claude", "settings.json");
+    LK_DIR = path4.join((0, import_node_os.homedir)(), ".launchsecure");
+    WRAPPER_PATH = path4.join(LK_DIR, "statusline-wrapper.sh");
+    CHIP_PATH = path4.join(LK_DIR, "statusline-mcp.sh");
+    SETTINGS_PATH = path4.join((0, import_node_os.homedir)(), ".claude", "settings.json");
     ORIGINAL_KEY = "_launchKitStatuslineOriginal";
   }
 });
 
-// src/server/init-entry.ts
-var import_node_child_process = require("node:child_process");
-var crypto = __toESM(require("node:crypto"));
-var fs4 = __toESM(require("node:fs"));
-var import_node_http = require("node:http");
-var import_node_https = require("node:https");
-var path4 = __toESM(require("node:path"));
-var readline = __toESM(require("node:readline"));
-var import_node_url = require("node:url");
-
-// src/server/cred-shape.ts
-var fs = __toESM(require("node:fs"));
-var path = __toESM(require("node:path"));
-var CONFIG_FILENAME = ".launch-secure.cred.config";
-function inferCourseName(serverUrl) {
+// src/server/radar/mcp.ts
+function parseBody(text) {
+  if (!text) return {};
+  if (text.startsWith("event:") || text.includes("\ndata: ")) {
+    for (const line of text.split("\n")) {
+      if (line.startsWith("data: ")) {
+        try {
+          return JSON.parse(line.slice(6));
+        } catch {
+        }
+      }
+    }
+  }
   try {
-    const host = new URL(serverUrl).hostname.toLowerCase();
-    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
-    if (host.includes("staging")) return "staging";
-    if (host.endsWith(".vercel.app")) return "prod";
-    return host.split(".")[0] || "default";
+    return JSON.parse(text);
   } catch {
-    return "default";
+    return {};
   }
 }
-function toNested(cred) {
-  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
-    return { active: cred.active, profiles: cred.profiles };
-  }
-  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
-    return null;
-  }
-  const name = inferCourseName(cred.serverUrl);
-  return {
-    active: name,
-    profiles: {
-      [name]: {
-        pat: cred.pat,
-        orgSlug: cred.orgSlug,
-        projectSlug: cred.projectSlug,
-        serverUrl: cred.serverUrl
+var import_node_https2, import_node_http2, ProjectMcpClient;
+var init_mcp = __esm({
+  "src/server/radar/mcp.ts"() {
+    "use strict";
+    import_node_https2 = require("node:https");
+    import_node_http2 = require("node:http");
+    ProjectMcpClient = class {
+      constructor(opts) {
+        this.initialized = false;
+        this.callId = 1;
+        this.mcpUrl = new URL("/api/mcp/project", opts.serverUrl);
+        this.headers = {
+          "Content-Type": "application/json",
+          "Accept": "application/json, text/event-stream",
+          "Authorization": `Bearer ${opts.pat}`
+        };
+        if (opts.orgSlug) this.headers["X-Org-Slug"] = opts.orgSlug;
+        if (opts.projectSlug) this.headers["X-Project-Slug"] = opts.projectSlug;
       }
-    }
-  };
+      async call(toolName, args) {
+        await this.ensureInitialized();
+        const body = JSON.stringify({
+          jsonrpc: "2.0",
+          id: this.callId++,
+          method: "tools/call",
+          params: { name: toolName, arguments: args }
+        });
+        const resp = await this.send(body);
+        const parsed = parseBody(resp.body);
+        if (parsed.error) {
+          throw new Error(`MCP ${toolName} failed: ${parsed.error.message ?? JSON.stringify(parsed.error)}`);
+        }
+        const text = parsed.result?.content?.[0]?.text;
+        if (!text) return parsed.result;
+        if (text.startsWith("\u2500\u2500 Error")) {
+          const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
+          const reason = lines.find((l) => !l.startsWith("\u2500\u2500")) ?? text;
+          throw new Error(`MCP ${toolName} failed: ${reason}`);
+        }
+        try {
+          return JSON.parse(text);
+        } catch {
+          return text;
+        }
+      }
+      async ensureInitialized() {
+        if (this.initialized) return;
+        const initBody = JSON.stringify({
+          jsonrpc: "2.0",
+          id: this.callId++,
+          method: "initialize",
+          params: {
+            protocolVersion: "2025-03-26",
+            capabilities: {},
+            clientInfo: { name: "launchpod-feedback-agent", version: "0.0.1" }
+          }
+        });
+        const initResp = await this.send(initBody);
+        if (initResp.sessionId) this.sessionId = initResp.sessionId;
+        const notifBody = JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" });
+        await this.send(notifBody);
+        this.initialized = true;
+      }
+      send(body) {
+        return new Promise((resolve3, reject) => {
+          const headers = {
+            ...this.headers,
+            "Content-Length": String(Buffer.byteLength(body))
+          };
+          if (this.sessionId) headers["Mcp-Session-Id"] = this.sessionId;
+          const requester = this.mcpUrl.protocol === "https:" ? import_node_https2.request : import_node_http2.request;
+          const req = requester(
+            {
+              host: this.mcpUrl.hostname,
+              port: this.mcpUrl.port || (this.mcpUrl.protocol === "https:" ? 443 : 80),
+              path: this.mcpUrl.pathname + this.mcpUrl.search,
+              method: "POST",
+              headers
+            },
+            (res) => {
+              const chunks = [];
+              res.on("data", (c2) => chunks.push(c2));
+              res.on("end", () => {
+                const text = Buffer.concat(chunks).toString("utf-8");
+                if (res.statusCode && res.statusCode >= 400) {
+                  reject(new Error(`MCP HTTP ${res.statusCode}: ${text}`));
+                  return;
+                }
+                const sid = res.headers["mcp-session-id"];
+                resolve3({ body: text, sessionId: typeof sid === "string" ? sid : void 0 });
+              });
+            }
+          );
+          req.on("error", reject);
+          req.write(body);
+          req.end();
+        });
+      }
+    };
+  }
+});
+
+// src/server/radar-docker-init-entry.ts
+var radar_docker_init_entry_exports = {};
+function fail(message) {
+  console.error(message);
+  process.exit(1);
 }
-function upsertProfile(existing, name, profile) {
-  const base = existing ? toNested(existing) ?? { active: name, profiles: {} } : { active: name, profiles: {} };
-  return {
-    active: name,
-    profiles: { ...base.profiles, [name]: profile }
-  };
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) fail(`ERROR: ${name} is required but not set`);
+  return v;
 }
-function readCredFile(repoRoot) {
-  const p = path.join(repoRoot, CONFIG_FILENAME);
-  if (!fs.existsSync(p)) return null;
+function run2(cmd, args, stdio = "inherit") {
+  const r = (0, import_node_child_process2.spawnSync)(cmd, args, { stdio });
+  return r.status ?? 1;
+}
+async function setupFromCloud() {
+  const pat = requireEnv("LS_PAT");
+  const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
+  const orgSlug = process.env.LS_ORG_SLUG;
+  const projectSlug = process.env.LS_PROJECT_SLUG;
+  const mcp = new ProjectMcpClient({ serverUrl, pat, orgSlug, projectSlug });
+  let bundle;
   try {
-    return JSON.parse(fs.readFileSync(p, "utf-8"));
+    bundle = await mcp.call("radar_bootstrap_get", {});
   } catch (err) {
-    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+    fail(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and is scoped to the right org/project.`);
   }
+  if (!process.env.LS_ORG_SLUG) process.env.LS_ORG_SLUG = bundle.orgSlug;
+  if (!process.env.LS_PROJECT_SLUG) process.env.LS_PROJECT_SLUG = bundle.projectSlug;
+  if (!process.env.GIT_USER_NAME) process.env.GIT_USER_NAME = bundle.gitName;
+  if (!process.env.GIT_USER_EMAIL) process.env.GIT_USER_EMAIL = bundle.gitEmail;
+  if (!process.env.GH_TOKEN && bundle.githubToken) process.env.GH_TOKEN = bundle.githubToken;
+  if (!process.env.GH_TOKEN) {
+    fail(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
+  }
+  console.log(`[entrypoint] bundle from cloud: org=${process.env.LS_ORG_SLUG} project=${process.env.LS_PROJECT_SLUG} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()}`);
 }
-function writeJsonAtomic(absPath, value, mode) {
-  const tmp = `${absPath}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
-  if (mode !== void 0) {
+function setupClaudeCredentials() {
+  const home = process.env.HOME ?? "/home/launchpod";
+  const claudeDir = (0, import_node_path.join)(home, ".claude");
+  (0, import_node_fs.mkdirSync)(claudeDir, { recursive: true });
+  const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
+  const credsPath = (0, import_node_path.join)(claudeDir, ".credentials.json");
+  (0, import_node_fs.writeFileSync)(credsPath, decoded);
+  (0, import_node_fs.chmodSync)(credsPath, 384);
+  const configPath = (0, import_node_path.join)(home, ".claude.json");
+  let cfg = {};
+  if ((0, import_node_fs.existsSync)(configPath)) {
     try {
-      fs.chmodSync(tmp, mode);
+      cfg = JSON.parse((0, import_node_fs.readFileSync)(configPath, "utf8"));
     } catch {
+      cfg = {};
     }
   }
-  fs.renameSync(tmp, absPath);
+  cfg.hasCompletedOnboarding = true;
+  cfg.lastOnboardingVersion = cfg.lastOnboardingVersion ?? "2.1.159";
+  cfg.numStartups = (cfg.numStartups ?? 0) + 1;
+  cfg.installMethod = cfg.installMethod ?? "global";
+  (0, import_node_fs.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
+  (0, import_node_fs.chmodSync)(configPath, 384);
+}
+function setupGitAndGh() {
+  const name = process.env.GIT_USER_NAME ?? "Radar Bot";
+  const email = process.env.GIT_USER_EMAIL ?? "radar@launchpod.local";
+  const status = run2("launch-kit", ["setup-git", `--identity=${name} <${email}>`]);
+  if (status !== 0) fail(`[entrypoint] launch-kit setup-git failed (status ${status})`);
+}
+function initWorkspaceIfEmpty() {
+  process.chdir("/workspace");
+  if ((0, import_node_fs.existsSync)(".git")) {
+    console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
+    return;
+  }
+  console.log("[entrypoint] /workspace is empty \u2014 running launch-kit init");
+  const status = run2("launch-kit", [
+    "init",
+    `--token=${requireEnv("LS_PAT")}`,
+    `--org=${requireEnv("LS_ORG_SLUG")}`,
+    `--project=${requireEnv("LS_PROJECT_SLUG")}`,
+    `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
+    `--dir=/workspace`
+  ]);
+  if (status !== 0) fail(`[entrypoint] launch-kit init failed (status ${status})`);
+}
+function execLaunchPodRadar() {
+  console.log("[entrypoint] starting launch-pod radar");
+  const child = (0, import_node_child_process2.spawn)("launch-pod", ["radar"], { stdio: "inherit" });
+  const forward = (sig) => () => {
+    try {
+      child.kill(sig);
+    } catch {
+    }
+  };
+  process.on("SIGTERM", forward("SIGTERM"));
+  process.on("SIGINT", forward("SIGINT"));
+  process.on("SIGHUP", forward("SIGHUP"));
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+}
+async function main() {
+  for (const k of REQUIRED_ENV) requireEnv(k);
+  await setupFromCloud();
+  setupClaudeCredentials();
+  setupGitAndGh();
+  initWorkspaceIfEmpty();
+  execLaunchPodRadar();
+}
+var import_node_child_process2, import_node_fs, import_node_path, REQUIRED_ENV;
+var init_radar_docker_init_entry = __esm({
+  "src/server/radar-docker-init-entry.ts"() {
+    "use strict";
+    import_node_child_process2 = require("node:child_process");
+    import_node_fs = require("node:fs");
+    import_node_path = require("node:path");
+    init_mcp();
+    REQUIRED_ENV = [
+      "CLAUDE_CREDENTIALS_B64",
+      "LS_PAT"
+    ];
+    main().catch((err) => {
+      console.error(`[entrypoint] fatal: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    });
+  }
+});
+
+// src/server/init-entry.ts
+var import_node_child_process3 = require("node:child_process");
+var crypto = __toESM(require("node:crypto"));
+var fs5 = __toESM(require("node:fs"));
+var import_node_http3 = require("node:http");
+var import_node_https3 = require("node:https");
+var path5 = __toESM(require("node:path"));
+var readline = __toESM(require("node:readline"));
+var import_node_url2 = require("node:url");
+init_cred_shape();
+
+// src/server/git-bot-config.ts
+var import_node_child_process = require("node:child_process");
+function run(cmd, args, stdio = "inherit") {
+  return (0, import_node_child_process.spawnSync)(cmd, args, { stdio }).status ?? 1;
+}
+function configureGitForBot(identity) {
+  if (process.env.GH_TOKEN) {
+    run("gh", ["auth", "setup-git"]);
+  }
+  run("git", ["config", "--global", "user.name", identity.name]);
+  run("git", ["config", "--global", "user.email", identity.email]);
+  run("git", ["config", "--global", "init.defaultBranch", "main"]);
+  run("git", ["config", "--global", "pull.rebase", "false"]);
+}
+function parseGitIdentityFlag(value, flagName = "--git-identity") {
+  const m = value.match(/^\s*(.+?)\s*<\s*([^>]+?)\s*>\s*$/);
+  if (!m) {
+    throw new Error(`${flagName} must be in the form "Name <email>" (got: ${value})`);
+  }
+  return { name: m[1], email: m[2] };
 }
 
 // src/server/cred-recovery.ts
 var fs2 = __toESM(require("node:fs"));
 var path2 = __toESM(require("node:path"));
+init_cred_shape();
 var LEGACY_CONFIG_FILENAME = ".launch-secure.config";
 function migrateLegacyCredFile(targetDir, opts) {
   const legacy = path2.join(targetDir, LEGACY_CONFIG_FILENAME);
@@ -292,9 +713,54 @@ function recoverCred(targetDir, opts) {
 }
 
 // src/server/init-entry.ts
+init_secrets_pull();
 init_statusline_install();
 var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
 var ONBOARD_SCRIPT_NAME = "onboard";
+var TTY = process.stdout.isTTY === true && process.env.NO_COLOR !== "1";
+var c = {
+  dim: (s) => TTY ? `\x1B[2m${s}\x1B[0m` : s,
+  bold: (s) => TTY ? `\x1B[1m${s}\x1B[0m` : s,
+  cyan: (s) => TTY ? `\x1B[36m${s}\x1B[0m` : s,
+  green: (s) => TTY ? `\x1B[32m${s}\x1B[0m` : s,
+  yellow: (s) => TTY ? `\x1B[33m${s}\x1B[0m` : s,
+  red: (s) => TTY ? `\x1B[31m${s}\x1B[0m` : s
+};
+var PHASE_NAME_COL = 16;
+var HEADER_WIDTH = 64;
+function header(title, kv) {
+  if (VERBOSE) return;
+  const dashes = "\u2500".repeat(Math.max(3, HEADER_WIDTH - title.length - 5));
+  console.log("");
+  console.log(c.cyan(`\u2500\u2500\u2500 ${c.bold(title)} ${dashes}`));
+  if (kv.length > 0) {
+    const labelWidth = Math.max(...kv.map(([k]) => k.length));
+    for (const [k, v] of kv) console.log(`    ${c.dim(k.padEnd(labelWidth))}  ${v}`);
+  }
+  console.log("");
+}
+function phase(name, result) {
+  if (VERBOSE) return;
+  const mark = result.status === "ok" ? c.green("\u2713") : result.status === "in-sync" ? c.dim("\xB7") : result.status === "skipped" ? c.dim("\u2212") : c.yellow("\u26A0");
+  const summary = result.status === "in-sync" || result.status === "skipped" ? c.dim(result.summary) : result.summary;
+  const label = name.padEnd(PHASE_NAME_COL);
+  console.log(`  ${result.status === "warn" ? c.yellow(label) : label} ${mark} ${summary}`);
+}
+function section(title) {
+  if (VERBOSE) return;
+  console.log("");
+  console.log(`  ${c.dim("\u2500 " + title + " \u2500")}`);
+}
+function footer(msg, hints = []) {
+  if (VERBOSE) return;
+  console.log("");
+  console.log(`  ${c.bold(msg)}`);
+  for (const h of hints) console.log(`  ${c.dim(h)}`);
+  console.log("");
+}
+function warn(msg) {
+  console.log(`  ${c.yellow("\u26A0")} ${msg}`);
+}
 var LAUNCH_KIT_PKG = "@launchsecure/launch-kit";
 var LAUNCH_KIT_TOOLS_GUIDE_STATIC_HEAD = `
 Wired in Claude Code (.mcp.json):
@@ -319,12 +785,12 @@ var LAUNCH_KIT_TOOLS_GUIDE_STATIC_TAIL = `
 `;
 function listEntries(dir, kind) {
   if (kind === "commands") {
-    return fs4.readdirSync(dir).filter((f) => f.endsWith(".md")).sort().map((f) => ({ name: f.replace(/\.md$/, ""), file: path4.join(dir, f) }));
+    return fs5.readdirSync(dir).filter((f) => f.endsWith(".md")).sort().map((f) => ({ name: f.replace(/\.md$/, ""), file: path5.join(dir, f) }));
   }
-  return fs4.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && fs4.existsSync(path4.join(dir, e.name, "SKILL.md"))).map((e) => e.name).sort().map((name) => ({ name, file: path4.join(dir, name, "SKILL.md") }));
+  return fs5.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && fs5.existsSync(path5.join(dir, e.name, "SKILL.md"))).map((e) => e.name).sort().map((name) => ({ name, file: path5.join(dir, name, "SKILL.md") }));
 }
 function renderEntries(dir, kind) {
-  if (!fs4.existsSync(dir)) return `
+  if (!fs5.existsSync(dir)) return `
 LS slash ${kind}: (scaffold dir not bundled \u2014 this is a packaging bug)
 `;
   const entries = listEntries(dir, kind);
@@ -334,7 +800,7 @@ LS slash ${kind}: (none defined)
   const names = entries.map((e) => `/${PLUGIN_ID}:${e.name}`);
   const colWidth = Math.max(26, ...names.map((n) => n.length + 2));
   const lines = entries.map((entry, i) => {
-    const text = fs4.readFileSync(entry.file, "utf-8");
+    const text = fs5.readFileSync(entry.file, "utf-8");
     const fmMatch = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     const desc = fmMatch?.[1].match(/^description:\s*(.+)$/m)?.[1]?.trim() ?? "";
     return `  ${names[i].padEnd(colWidth)} \u2014 ${desc}`;
@@ -345,8 +811,8 @@ ${lines.join("\n")}
 `;
 }
 function renderLsCommandsSection() {
-  const base = path4.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace", "plugins", "kit");
-  return renderEntries(path4.join(base, "commands"), "commands") + renderEntries(path4.join(base, "skills"), "skills");
+  const base = path5.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace", "plugins", "kit");
+  return renderEntries(path5.join(base, "commands"), "commands") + renderEntries(path5.join(base, "skills"), "skills");
 }
 function getLaunchKitToolsGuide() {
   return `${LAUNCH_KIT_TOOLS_GUIDE_STATIC_HEAD}${renderLsCommandsSection()}${LAUNCH_KIT_TOOLS_GUIDE_STATIC_TAIL}`;
@@ -369,9 +835,12 @@ var KNOWN_BOOL_FLAGS = /* @__PURE__ */ new Set([
   "--refresh-scaffolds",
   "--quiet",
   "--force",
-  "--dry-run"
+  "--dry-run",
+  "--verbose",
+  "--guide",
+  "--no-guide"
 ]);
-var KNOWN_KV_KEYS = /* @__PURE__ */ new Set(["token", "org", "project", "url", "dir", "course"]);
+var KNOWN_KV_KEYS = /* @__PURE__ */ new Set(["token", "org", "project", "url", "dir", "course", "git-identity"]);
 function parseArgs(argv) {
   const args = {
     token: process.env.LS_PAT ?? null,
@@ -379,6 +848,7 @@ function parseArgs(argv) {
     projectSlug: null,
     serverUrl: DEFAULT_SERVER_URL,
     targetDir: null,
+    gitIdentity: null,
     course: null,
     noInstall: false,
     noOnboard: false,
@@ -390,6 +860,8 @@ function parseArgs(argv) {
     quiet: false,
     force: false,
     dryRun: false,
+    verbose: false,
+    guide: null,
     help: false
   };
   const unknown = [];
@@ -440,6 +912,18 @@ function parseArgs(argv) {
       args.dryRun = true;
       continue;
     }
+    if (raw === "--verbose") {
+      args.verbose = true;
+      continue;
+    }
+    if (raw === "--guide") {
+      args.guide = true;
+      continue;
+    }
+    if (raw === "--no-guide") {
+      args.guide = false;
+      continue;
+    }
     const eq = raw.indexOf("=");
     if (raw.startsWith("--") && eq > 0) {
       const key = raw.slice(2, eq);
@@ -468,6 +952,14 @@ function parseArgs(argv) {
         args.course = val;
         continue;
       }
+      if (key === "git-identity") {
+        try {
+          args.gitIdentity = parseGitIdentityFlag(val);
+        } catch (err) {
+          fail2(err instanceof Error ? err.message : String(err));
+        }
+        continue;
+      }
       unknown.push(raw);
       continue;
     }
@@ -480,7 +972,7 @@ function parseArgs(argv) {
   if (unknown.length > 0) {
     const knownBool = [...KNOWN_BOOL_FLAGS].join(", ");
     const knownKv = [...KNOWN_KV_KEYS].map((k) => `--${k}=<value>`).join(", ");
-    fail(`Unknown argument(s): ${unknown.join(" ")}
+    fail2(`Unknown argument(s): ${unknown.join(" ")}
   Known boolean flags: ${knownBool}
   Known key=value flags: ${knownKv}`);
   }
@@ -511,8 +1003,15 @@ Options:
   --refresh-scaffolds      Force-overwrite migrate-safety files (default is to
                            preserve user edits). Use this to pull updates
                            published to @launchsecure/launch-kit.
-  --quiet                  Suppress the post-run tools guide.
+  --verbose                Print the legacy per-line debug log instead of the
+                           default compact phase summary. Useful when refresh
+                           reports a warn-status phase and you want detail.
+  --guide                  Print the trailing tools guide (MCP table + every
+                           /kit:* command). Off by default on refresh.
+  --quiet                  Suppress the tools guide and the next-steps hint.
+                           Overrides --guide.
   --dry-run                Preview every file write without making changes.
+                           Implies --verbose.
   --help                   Show this help.
 
 Tip: prefix the command with @latest (\`launch-kit@latest refresh\`) to force
@@ -526,6 +1025,12 @@ Subcommands:
   init                  Bootstrap a new project (clone, cred file, MCP, scaffolds, install)
   refresh               Re-apply scaffolds + MCP entries in an already-initialized project
                         (no clone, no install, no PAT prompt \u2014 see \`launch-kit refresh --help\`)
+  setup-git             Configure git identity + gh credential helper in one
+                        shot. Use in containers / CI where init isn't needed.
+                        \`launch-kit setup-git --identity="Name <email>"\`.
+  secrets pull          Fetch decrypted secrets from cloud LS and write a .env file.
+                        Env resolved from --env \u2192 $LS_ENV \u2192 server-side project default \u2192
+                        single-env auto-pick. See \`launch-kit secrets --help\`.
   statusline activate   Wrap ~/.claude/settings.json's statusLine.command so MCP daemon
                         chips (recall, chart, deck, council) get appended. Refuses to
                         create one if none exists \u2014 additive only.
@@ -550,6 +1055,12 @@ Options:
                            becomes active; re-run with a different --course
                            and --url to add another (e.g. local + staging).
                            Use \`launch-course set <name>\` to switch later.
+  --git-identity="N <e>"   Non-interactive git identity for service-account /
+                           CI / Docker runs. Configures git user.name, user.email,
+                           init.defaultBranch=main, pull.rebase=false; also
+                           wires GH_TOKEN into git's credential helper via
+                           \`gh auth setup-git\` when GH_TOKEN is set. Example:
+                           --git-identity="Radar Bot <radar@launchpod.local>".
   --no-install             Skip dependency install step (also skips the onboard
                            script \u2014 install is its prerequisite).
   --no-onboard             Skip the onboard script even when install runs.
@@ -570,9 +1081,17 @@ Options:
                            user edits; use this to pull updates published to
                            @launchsecure/launch-kit (e.g., a newer
                            migrate-with-backup.sh).
-  --quiet                  Suppress the post-run tools guide (the long block
-                           listing /kit:* commands and wired MCPs). Useful for
-                           idempotent re-runs in CI or scripts.
+  --verbose                Print the legacy per-line debug log instead of the
+                           default compact phase summary. Useful when a phase
+                           reports a warn status and you want per-file detail.
+  --guide                  Print the trailing tools guide (MCP table + every
+                           /kit:* command). On by default for init; pair with
+                           --no-guide to suppress.
+  --no-guide               Suppress the trailing tools guide (handy after the
+                           first init, when you don't need the catalog again).
+  --quiet                  Suppress the post-run tools guide AND the next-steps
+                           hint. Useful for idempotent re-runs in CI or scripts.
+                           Overrides --guide.
   --force                  Skip the auto-delegate-to-refresh check. By default
                            init detects an existing bootstrap (cred file +
                            launch-secure MCP entry) and runs refresh instead.
@@ -619,29 +1138,30 @@ async function prompt(question) {
     resolve3(answer.trim());
   }));
 }
-function fail(msg) {
+function fail2(msg) {
   console.error(`[launch-kit] \u2717 ${msg}`);
   process.exit(1);
 }
+var VERBOSE = false;
 function info(msg) {
-  console.log(`[launch-kit] ${msg}`);
+  if (VERBOSE) console.log(`[launch-kit] ${msg}`);
 }
 function ok(msg) {
-  console.log(`[launch-kit] \u2713 ${msg}`);
+  if (VERBOSE) console.log(`[launch-kit] \u2713 ${msg}`);
 }
 var DRY_RUN = false;
 function dryNote(msg) {
   console.log(`[launch-kit] (dry-run) ${msg}`);
 }
 function which(bin) {
-  const res = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
+  const res = (0, import_node_child_process3.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
   if (res.status !== 0) return null;
   return res.stdout.split(/\r?\n/)[0]?.trim() || null;
 }
 function preflight() {
   const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
-  if (nodeMajor < 18) fail(`Node.js >= 18 required (current: ${process.versions.node}).`);
-  if (!which("git")) fail("git not found in PATH. Install git: https://git-scm.com/downloads");
+  if (nodeMajor < 18) fail2(`Node.js >= 18 required (current: ${process.versions.node}).`);
+  if (!which("git")) fail2("git not found in PATH. Install git: https://git-scm.com/downloads");
   const hasGh = which("gh") !== null;
   ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh ? ", gh present" : ", gh not found (will use git for clone)"}`);
   return { hasGh };
@@ -657,7 +1177,7 @@ var ProjectInfoHttpError = class extends Error {
 };
 function attemptProjectInfo(args) {
   return new Promise((resolve3, reject) => {
-    const mcpUrl = new import_node_url.URL("/api/mcp/project", args.serverUrl);
+    const mcpUrl = new import_node_url2.URL("/api/mcp/project", args.serverUrl);
     const body = JSON.stringify({
       jsonrpc: "2.0",
       id: 1,
@@ -667,7 +1187,7 @@ function attemptProjectInfo(args) {
         arguments: { org_slug: args.orgSlug, project_slug: args.projectSlug }
       }
     });
-    const requester = mcpUrl.protocol === "https:" ? import_node_https.request : import_node_http.request;
+    const requester = mcpUrl.protocol === "https:" ? import_node_https3.request : import_node_http3.request;
     const req = requester(
       {
         host: mcpUrl.hostname,
@@ -685,7 +1205,7 @@ function attemptProjectInfo(args) {
       },
       (res) => {
         const chunks = [];
-        res.on("data", (c) => chunks.push(c));
+        res.on("data", (c2) => chunks.push(c2));
         res.on("end", () => {
           const text = Buffer.concat(chunks).toString("utf-8");
           if (res.statusCode === 401) {
@@ -775,7 +1295,7 @@ async function callProjectInfo(args) {
   throw lastErr;
 }
 function gitRemoteUrl(dir) {
-  const res = (0, import_node_child_process.spawnSync)("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf-8" });
+  const res = (0, import_node_child_process3.spawnSync)("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf-8" });
   if (res.status !== 0) return null;
   return res.stdout.trim() || null;
 }
@@ -784,18 +1304,18 @@ function normalizeRepoUrl(url) {
   const sshMatch = u.match(/^git@([^:]+):(.+)$/);
   if (sshMatch) u = `https://${sshMatch[1]}/${sshMatch[2]}`;
   try {
-    const parsed = new import_node_url.URL(u);
+    const parsed = new import_node_url2.URL(u);
     return `${parsed.protocol}//${parsed.host.toLowerCase()}${parsed.pathname}`;
   } catch {
     return u;
   }
 }
 function isGitRepo(dir) {
-  return fs4.existsSync(path4.join(dir, ".git"));
+  return fs5.existsSync(path5.join(dir, ".git"));
 }
 function dirIsEmpty(dir) {
-  if (!fs4.existsSync(dir)) return true;
-  return fs4.readdirSync(dir).length === 0;
+  if (!fs5.existsSync(dir)) return true;
+  return fs5.readdirSync(dir).length === 0;
 }
 function cloneRepo(repoUrl, targetDir, hasGh) {
   const isGithub = /github\.com/i.test(repoUrl);
@@ -814,20 +1334,20 @@ function cloneRepo(repoUrl, targetDir, hasGh) {
     dryNote(`would run: ${cmd} ${args.join(" ")}`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(cmd, args, { stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(cmd, args, { stdio: "inherit" });
   if (res.status !== 0) {
-    fail(
+    fail2(
       `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\` or an SSH key on your GitHub account.`
     );
   }
-  if (!fs4.existsSync(path4.join(targetDir, ".git"))) {
-    fail(`Clone reported success but .git is missing at ${targetDir}. Possible partial clone, filesystem issue, or sandboxing \u2014 investigate manually.`);
+  if (!fs5.existsSync(path5.join(targetDir, ".git"))) {
+    fail2(`Clone reported success but .git is missing at ${targetDir}. Possible partial clone, filesystem issue, or sandboxing \u2014 investigate manually.`);
   }
   ok(`cloned to ${targetDir}`);
 }
 function writeConfigFile(targetDir, cfg, courseName) {
   recoverCred(targetDir, getRecoveryOptions());
-  const p = path4.join(targetDir, CONFIG_FILENAME);
+  const p = path5.join(targetDir, CONFIG_FILENAME);
   const existing = readCredFile(targetDir);
   const isNew = existing === null;
   const isUpdate = !isNew && Boolean(existing?.profiles?.[courseName]);
@@ -846,15 +1366,15 @@ function getRecoveryOptions() {
   return { dryRun: DRY_RUN, log: recoveryLog };
 }
 function detectExistingBootstrap(targetDir) {
-  if (!fs4.existsSync(path4.join(targetDir, CONFIG_FILENAME))) {
+  if (!fs5.existsSync(path5.join(targetDir, CONFIG_FILENAME))) {
     return { bootstrapped: false };
   }
-  const mcpPath = path4.join(targetDir, ".mcp.json");
-  if (!fs4.existsSync(mcpPath)) {
+  const mcpPath = path5.join(targetDir, ".mcp.json");
+  if (!fs5.existsSync(mcpPath)) {
     return { bootstrapped: false };
   }
   try {
-    const mcp = JSON.parse(fs4.readFileSync(mcpPath, "utf-8"));
+    const mcp = JSON.parse(fs5.readFileSync(mcpPath, "utf-8"));
     if (mcp.mcpServers?.["launch-secure"]) {
       return { bootstrapped: true, reason: `${CONFIG_FILENAME} present + launch-secure MCP entry in .mcp.json` };
     }
@@ -872,13 +1392,7 @@ function buildLaunchKitMcpEntries(cfg) {
     },
     "launch-chart": {
       command: "npx",
-      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"],
-      // Tells launch-chart to also start its HTTP UI alongside the MCP, so
-      // users can open the chart viewer at localhost:<port> while queries
-      // hit the MCP. Without this, the MCP runs passively (queries work,
-      // no UI). I4 deep-merge preserves user-added env keys; this default
-      // ensures the auto-serve UX ships out of the box.
-      env: { LAUNCH_CHART_AUTOSERVE: "1" }
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"]
     },
     "launch-deck": {
       command: "npx",
@@ -911,14 +1425,14 @@ function mergeMcpEntry(existing, ours) {
   return merged;
 }
 function mergeMcpFile(targetDir, launchKitEntries) {
-  const p = path4.join(targetDir, ".mcp.json");
-  const hadExisting = fs4.existsSync(p);
+  const p = path5.join(targetDir, ".mcp.json");
+  const hadExisting = fs5.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail2(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const existingServerCount = Object.keys(existing.mcpServers ?? {}).length;
@@ -936,19 +1450,21 @@ function mergeMcpFile(targetDir, launchKitEntries) {
     }
   }
   if (DRY_RUN) {
-    const action2 = hadExisting && existingServerCount > 0 ? "would merge into" : "would write";
-    dryNote(`${action2} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}]`);
-    return;
-  }
-  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
-  const action = hadExisting && existingServerCount > 0 ? "merged into" : "wrote";
-  ok(`${action} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
+    const action = hadExisting && existingServerCount > 0 ? "would merge into" : "would write";
+    dryNote(`${action} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}]`);
+    return { status: "skipped", summary: "(dry-run)" };
+  }
+  fs5.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  const verb = hadExisting && existingServerCount > 0 ? "merged" : "wrote";
+  ok(`${verb === "merged" ? "merged into" : "wrote"} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
+  const total = Object.keys(launchKitEntries).length;
+  return { status: "ok", summary: `${verb} ${total} entries` };
 }
 function detectPackageManager(repoDir) {
-  const pkgPath = path4.join(repoDir, "package.json");
-  if (!fs4.existsSync(pkgPath)) return null;
+  const pkgPath = path5.join(repoDir, "package.json");
+  if (!fs5.existsSync(pkgPath)) return null;
   try {
-    const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
     if (typeof pkg.packageManager === "string") {
       const name = pkg.packageManager.split("@")[0];
       const match = PACKAGE_MANAGERS.find((p) => p.name === name);
@@ -957,7 +1473,7 @@ function detectPackageManager(repoDir) {
     }
   } catch {
   }
-  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs4.existsSync(path4.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
+  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs5.existsSync(path5.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
   if (matches.length === 1) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile}` };
   }
@@ -966,8 +1482,8 @@ function detectPackageManager(repoDir) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile} (multiple present)` };
   }
   for (const pm of PACKAGE_MANAGERS) {
-    if (pm.workspaceFiles?.some((wf) => fs4.existsSync(path4.join(repoDir, wf)))) {
-      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs4.existsSync(path4.join(repoDir, wf)))})` };
+    if (pm.workspaceFiles?.some((wf) => fs5.existsSync(path5.join(repoDir, wf)))) {
+      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs5.existsSync(path5.join(repoDir, wf)))})` };
     }
   }
   const npm = PACKAGE_MANAGERS.find((p) => p.name === "npm");
@@ -976,8 +1492,8 @@ function detectPackageManager(repoDir) {
 function runInstall(repoDir, detected) {
   const { pm } = detected;
   if (!which(pm.binary)) {
-    fail(
-      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path4.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+    fail2(
+      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path5.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
     );
   }
   info(`running ${pm.binary} ${pm.installArgs.join(" ")} \u2026`);
@@ -985,24 +1501,24 @@ function runInstall(repoDir, detected) {
     dryNote(`would run: ${pm.binary} ${pm.installArgs.join(" ")} (cwd: ${repoDir})`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    fail(
+    fail2(
       `${pm.name} install failed (exit ${res.status}).
 
 Half-init state \u2014 install didn't complete, but these files ARE on disk:
-  - ${path4.join(repoDir, CONFIG_FILENAME)} (cred file)
-  - ${path4.join(repoDir, ".mcp.json")} (5 launch-kit MCP entries merged)
-  - ${path4.join(repoDir, ".gitignore")} (cred line appended)
+  - ${path5.join(repoDir, CONFIG_FILENAME)} (cred file)
+  - ${path5.join(repoDir, ".mcp.json")} (5 launch-kit MCP entries merged)
+  - ${path5.join(repoDir, ".gitignore")} (cred line appended)
   - clone at ${repoDir}
 
 Scaffolds (recall, migrate-safety, marketplace, recall-hook) were NOT yet written.
 
 To retry install only:
-  cd ${path4.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}
+  cd ${path5.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}
 
 To re-run init after fixing the install error:
-  cd ${path4.basename(repoDir)} && npx @launchsecure/launch-kit init --dir=.
+  cd ${path5.basename(repoDir)} && npx @launchsecure/launch-kit init --dir=.
 
 To fully reset: delete the files listed above and the clone, then re-init.`
     );
@@ -1010,10 +1526,10 @@ To fully reset: delete the files listed above and the clone, then re-init.`
   ok(`${pm.name} install complete`);
 }
 function hasOnboardScript(repoDir) {
-  const pkgPath = path4.join(repoDir, "package.json");
-  if (!fs4.existsSync(pkgPath)) return false;
+  const pkgPath = path5.join(repoDir, "package.json");
+  if (!fs5.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
     return typeof pkg.scripts?.[ONBOARD_SCRIPT_NAME] === "string";
   } catch {
     return false;
@@ -1021,17 +1537,17 @@ function hasOnboardScript(repoDir) {
 }
 function runRecallInit(repoDir) {
   info(`scaffolding launch-recall (shadow git backup) \u2026`);
-  const recallEntry = path4.resolve(__dirname, "recall-entry.js");
-  const useSibling = fs4.existsSync(recallEntry);
+  const recallEntry = path5.resolve(__dirname, "recall-entry.js");
+  const useSibling = fs5.existsSync(recallEntry);
   const cmd = useSibling ? process.execPath : "npx";
   const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "init"];
   if (DRY_RUN) {
     dryNote(`would run launch-recall init: ${cmd} ${args.join(" ")} (cwd: ${repoDir})`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path4.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
+    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path5.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
     return;
   }
   ok(`launch-recall ready (shadow git initialized)`);
@@ -1042,17 +1558,17 @@ function runOnboard(repoDir, pm) {
     dryNote(`would run: ${pm.binary} run ${ONBOARD_SCRIPT_NAME} (cwd: ${repoDir})`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    fail(
-      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path4.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
+    fail2(
+      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path5.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
     );
   }
   ok(`${ONBOARD_SCRIPT_NAME} script complete`);
 }
 function ensureGitignoreLine(targetDir, line) {
-  const p = path4.join(targetDir, ".gitignore");
-  let content = fs4.existsSync(p) ? fs4.readFileSync(p, "utf-8") : "";
+  const p = path5.join(targetDir, ".gitignore");
+  let content = fs5.existsSync(p) ? fs5.readFileSync(p, "utf-8") : "";
   const lines = content.split(/\r?\n/);
   if (lines.some((l) => l.trim() === line)) return;
   if (content.length && !content.endsWith("\n")) content += "\n";
@@ -1062,28 +1578,28 @@ function ensureGitignoreLine(targetDir, line) {
     dryNote(`would append "${line}" to .gitignore`);
     return;
   }
-  fs4.writeFileSync(p, content, "utf-8");
+  fs5.writeFileSync(p, content, "utf-8");
   ok(`appended ${line} to .gitignore`);
 }
 function copyScaffoldDirAlways(srcDir, destDir, labelPrefix) {
-  if (!fs4.existsSync(srcDir)) return;
-  for (const entry of fs4.readdirSync(srcDir, { withFileTypes: true })) {
-    const srcPath = path4.join(srcDir, entry.name);
-    const destPath = path4.join(destDir, entry.name);
+  if (!fs5.existsSync(srcDir)) return;
+  for (const entry of fs5.readdirSync(srcDir, { withFileTypes: true })) {
+    const srcPath = path5.join(srcDir, entry.name);
+    const destPath = path5.join(destDir, entry.name);
     const label = labelPrefix ? `${labelPrefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
       copyScaffoldDirAlways(srcPath, destPath, label);
     } else if (entry.isFile()) {
-      const existed = fs4.existsSync(destPath);
+      const existed = fs5.existsSync(destPath);
       if (DRY_RUN) {
         dryNote(`would ${existed ? "refresh" : "write"} ${label}`);
         continue;
       }
-      fs4.mkdirSync(path4.dirname(destPath), { recursive: true });
-      fs4.copyFileSync(srcPath, destPath);
+      fs5.mkdirSync(path5.dirname(destPath), { recursive: true });
+      fs5.copyFileSync(srcPath, destPath);
       try {
-        const srcMode = fs4.statSync(srcPath).mode;
-        fs4.chmodSync(destPath, srcMode);
+        const srcMode = fs5.statSync(srcPath).mode;
+        fs5.chmodSync(destPath, srcMode);
       } catch {
       }
       ok(`${existed ? "refreshed" : "wrote"} ${label}`);
@@ -1091,54 +1607,78 @@ function copyScaffoldDirAlways(srcDir, destDir, labelPrefix) {
   }
 }
 function scaffoldMigrateSafety(targetDir, refreshScaffolds = false) {
-  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
-  if (!fs4.existsSync(scaffoldsRoot)) {
-    info(`\u26A0 migrate-safety scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
-    return;
+  const scaffoldsRoot = path5.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
+  if (!fs5.existsSync(scaffoldsRoot)) {
+    warn(`migrate-safety scaffolds missing at ${scaffoldsRoot} \u2014 packaging bug; main onboarding unaffected`);
+    return { status: "warn", summary: "scaffolds missing (packaging bug)" };
   }
   const files = [
     {
-      src: path4.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
-      dest: path4.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
+      src: path5.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
+      dest: path5.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
       label: ".github/workflows/backup-on-migration.yml"
     },
     {
-      src: path4.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
-      dest: path4.join(targetDir, "scripts", "migrate-with-backup.sh"),
+      src: path5.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
+      dest: path5.join(targetDir, "scripts", "migrate-with-backup.sh"),
       label: "scripts/migrate-with-backup.sh"
     },
     {
-      src: path4.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
-      dest: path4.join(targetDir, "docs", "migrations-runbook.md"),
+      src: path5.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
+      dest: path5.join(targetDir, "docs", "migrations-runbook.md"),
       label: "docs/migrations-runbook.md"
     }
   ];
   info(`scaffolding migrate-safety (pg_dump wrapper + GHA backup workflow + runbook)${refreshScaffolds ? " \u2014 --refresh-scaffolds active" : ""} \u2026`);
-  for (const f of files) copyScaffoldDriftAware(f.src, f.dest, f.label, refreshScaffolds);
+  const counts = { wrote: 0, inSync: 0, drifted: 0, refreshed: 0, missing: 0 };
+  for (const f of files) {
+    const r = copyScaffoldDriftAware(f.src, f.dest, f.label, refreshScaffolds);
+    if (r === "wrote") counts.wrote++;
+    else if (r === "in-sync") counts.inSync++;
+    else if (r === "drifted-preserved") counts.drifted++;
+    else if (r === "drifted-refreshed") counts.refreshed++;
+    else counts.missing++;
+  }
   ensureGitignoreLine(targetDir, ".backups/");
   ok("migrate-safety ready \u2014 see docs/migrations-runbook.md for db:migrate wiring + PROD_DATABASE_URL secret setup");
+  return summarizeFileCounts(counts);
+}
+function summarizeFileCounts(counts) {
+  const total = counts.wrote + counts.inSync + counts.drifted + counts.refreshed + counts.missing;
+  const parts = [];
+  if (counts.wrote) parts.push(`${counts.wrote} written`);
+  if (counts.refreshed) parts.push(`${counts.refreshed} refreshed`);
+  if (counts.drifted) parts.push(`${counts.drifted} drifted (preserved \u2014 pass --refresh-scaffolds to update)`);
+  if (counts.inSync && (counts.wrote || counts.refreshed || counts.drifted)) parts.push(`${counts.inSync} in sync`);
+  if (counts.missing) parts.push(`${counts.missing} missing scaffold src`);
+  if (parts.length === 0) parts.push(`in sync (${total} file${total === 1 ? "" : "s"})`);
+  else if (!counts.wrote && !counts.refreshed && !counts.drifted && counts.inSync === total) {
+    return { status: "in-sync", summary: `in sync (${total} file${total === 1 ? "" : "s"})` };
+  }
+  const status = counts.drifted || counts.missing ? "warn" : counts.wrote || counts.refreshed ? "ok" : "in-sync";
+  return { status, summary: parts.join(", ") };
 }
 function hashFile(p) {
   try {
-    return crypto.createHash("sha256").update(fs4.readFileSync(p)).digest("hex");
+    return crypto.createHash("sha256").update(fs5.readFileSync(p)).digest("hex");
   } catch {
     return null;
   }
 }
 function copyScaffoldDriftAware(srcPath, destPath, label, refreshScaffolds) {
-  if (!fs4.existsSync(srcPath)) {
+  if (!fs5.existsSync(srcPath)) {
     info(`\u26A0 scaffold src missing for ${label} \u2014 skipping (packaging bug)`);
     return "missing-src";
   }
-  if (!fs4.existsSync(destPath)) {
+  if (!fs5.existsSync(destPath)) {
     if (DRY_RUN) {
       dryNote(`would write ${label}`);
       return "wrote";
     }
-    fs4.mkdirSync(path4.dirname(destPath), { recursive: true });
-    fs4.copyFileSync(srcPath, destPath);
+    fs5.mkdirSync(path5.dirname(destPath), { recursive: true });
+    fs5.copyFileSync(srcPath, destPath);
     try {
-      fs4.chmodSync(destPath, fs4.statSync(srcPath).mode);
+      fs5.chmodSync(destPath, fs5.statSync(srcPath).mode);
     } catch {
     }
     ok(`wrote ${label}`);
@@ -1156,9 +1696,9 @@ function copyScaffoldDriftAware(srcPath, destPath, label, refreshScaffolds) {
       dryNote(`would refresh ${label} (overrides local edits)`);
       return "drifted-refreshed";
     }
-    fs4.copyFileSync(srcPath, destPath);
+    fs5.copyFileSync(srcPath, destPath);
     try {
-      fs4.chmodSync(destPath, fs4.statSync(srcPath).mode);
+      fs5.chmodSync(destPath, fs5.statSync(srcPath).mode);
     } catch {
     }
     ok(`refreshed ${label} (overrode local edits \u2014 drift detected before write)`);
@@ -1170,10 +1710,10 @@ function copyScaffoldDriftAware(srcPath, destPath, label, refreshScaffolds) {
 var MARKETPLACE_ID = "launch-secure";
 var PLUGIN_ID = "kit";
 function isDogfoodMarketplace(targetDir) {
-  const p = path4.join(targetDir, ".claude", "settings.json");
-  if (!fs4.existsSync(p)) return { isDogfood: false };
+  const p = path5.join(targetDir, ".claude", "settings.json");
+  if (!fs5.existsSync(p)) return { isDogfood: false };
   try {
-    const settings = JSON.parse(fs4.readFileSync(p, "utf-8"));
+    const settings = JSON.parse(fs5.readFileSync(p, "utf-8"));
     const existingPath = settings.extraKnownMarketplaces?.[MARKETPLACE_ID]?.source?.path;
     if (existingPath && existingPath !== "./.claude/marketplace") {
       return { isDogfood: true, existingPath };
@@ -1184,33 +1724,34 @@ function isDogfoodMarketplace(targetDir) {
   }
 }
 function scaffoldLsMarketplace(targetDir) {
-  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace");
-  if (!fs4.existsSync(scaffoldsRoot)) {
-    info(`\u26A0 ls-marketplace scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
-    return;
+  const scaffoldsRoot = path5.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace");
+  if (!fs5.existsSync(scaffoldsRoot)) {
+    warn(`ls-marketplace scaffolds missing at ${scaffoldsRoot} \u2014 packaging bug`);
+    return { status: "warn", summary: "scaffolds missing (packaging bug)" };
   }
   const dogfood = isDogfoodMarketplace(targetDir);
   if (dogfood.isDogfood) {
     info(`dogfood marketplace pointer detected (${dogfood.existingPath}) \u2014 skipping copy, only refreshing enabledPlugins`);
     wireLsSettings(targetDir);
     ok(`launch-secure marketplace (dogfood) \u2014 Claude Code loads commands from ${dogfood.existingPath}`);
-    return;
+    return { status: "ok", summary: `dogfood pointer (${dogfood.existingPath})` };
   }
-  const marketplaceRoot = path4.join(targetDir, ".claude", "marketplace");
+  const marketplaceRoot = path5.join(targetDir, ".claude", "marketplace");
   info("scaffolding launch-secure marketplace (Claude Code /kit: namespace \u2014 refreshes every /kit:* command found in the scaffold) \u2026");
   copyScaffoldDirAlways(scaffoldsRoot, marketplaceRoot, ".claude/marketplace");
   wireLsSettings(targetDir);
   ok(`launch-secure marketplace ready \u2014 open this repo in Claude Code, approve the "${MARKETPLACE_ID}" marketplace prompt, then try /kit:activate-beacon, /kit:standup, or /kit:show-mcp-status`);
+  return { status: "ok", summary: "marketplace tree + settings refreshed" };
 }
 function wireLsSettings(targetDir) {
-  const p = path4.join(targetDir, ".claude", "settings.json");
-  const hadExisting = fs4.existsSync(p);
+  const p = path5.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs5.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail2(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const merged = { ...existing };
@@ -1238,32 +1779,33 @@ function wireLsSettings(targetDir) {
     dryNote(`would ${hadExisting ? "merge into" : "write"} .claude/settings.json (set extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${PLUGIN_ID}@${MARKETPLACE_ID}; preserves every other key)`);
     return;
   }
-  fs4.mkdirSync(path4.dirname(p), { recursive: true });
-  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs5.mkdirSync(path5.dirname(p), { recursive: true });
+  fs5.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   ok(`${hadExisting ? "merged into" : "wrote"} .claude/settings.json (extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${PLUGIN_ID}@${MARKETPLACE_ID})`);
 }
 var RECALL_HOOK_SIGNATURE = "ensure-recall.sh";
 var RECALL_HOOK_COMMAND = 'bash "${CLAUDE_PROJECT_DIR:-$PWD}/scripts/ensure-recall.sh"';
 function scaffoldRecallHook(targetDir) {
-  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "recall-hook");
-  if (!fs4.existsSync(scaffoldsRoot)) {
-    info(`\u26A0 recall-hook scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
-    return;
+  const scaffoldsRoot = path5.resolve(__dirname, "..", "..", "scaffolds", "recall-hook");
+  if (!fs5.existsSync(scaffoldsRoot)) {
+    warn(`recall-hook scaffolds missing at ${scaffoldsRoot} \u2014 packaging bug`);
+    return { status: "warn", summary: "scaffolds missing (packaging bug)" };
   }
   info("scaffolding recall-hook (SessionStart watcher-respawn hook + ensure-recall.sh) \u2026");
   copyScaffoldDirAlways(scaffoldsRoot, targetDir, "");
-  wireRecallHook(targetDir);
+  const wired = wireRecallHook(targetDir);
   ok("recall-hook ready \u2014 opens with Claude Code will respawn the launch-recall watcher if it died between sessions");
+  return wired ? { status: "ok", summary: "ensure-recall.sh refreshed + SessionStart hook appended" } : { status: "ok", summary: "ensure-recall.sh refreshed (hook already wired)" };
 }
 function wireRecallHook(targetDir) {
-  const p = path4.join(targetDir, ".claude", "settings.json");
-  const hadExisting = fs4.existsSync(p);
+  const p = path5.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs5.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail2(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const hooks = existing.hooks ?? {};
@@ -1273,7 +1815,7 @@ function wireRecallHook(targetDir) {
   );
   if (alreadyWired) {
     info(".claude/settings.json SessionStart hook already references ensure-recall.sh \u2014 leaving alone");
-    return;
+    return false;
   }
   const newGroup = {
     hooks: [{ type: "command", command: RECALL_HOOK_COMMAND }]
@@ -1287,26 +1829,58 @@ function wireRecallHook(targetDir) {
   };
   if (DRY_RUN) {
     dryNote(`would append SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh; preserves every other key + existing hooks)`);
-    return;
+    return true;
   }
-  fs4.mkdirSync(path4.dirname(p), { recursive: true });
-  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs5.mkdirSync(path5.dirname(p), { recursive: true });
+  fs5.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   ok(`appended SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh)`);
+  return true;
 }
 function tryActivateStatusline() {
   if (DRY_RUN) {
     dryNote(`would wrap ~/.claude/settings.json statusLine.command with launch-kit's MCP chip wrapper (skips silently if no statusline configured)`);
-    return;
+    return { status: "skipped", summary: "(dry-run)" };
   }
   const res = activateStatusline();
   if (res.ok && res.outcome === "activated") {
     ok(`statusline wrapped \u2014 MCP chips will render alongside your existing statusline next session`);
-  } else if (res.ok && res.outcome === "refreshed") {
+    return { status: "ok", summary: "wrapped \u2014 MCP chips render next session" };
+  }
+  if (res.ok && res.outcome === "refreshed") {
     info(`statusline already wrapped \u2014 refreshed chip scripts`);
+    return { status: "ok", summary: "chip scripts refreshed" };
   }
+  return null;
 }
-async function main() {
+async function main2() {
   const subcommand = process.argv[2];
+  if (subcommand === "radar-docker-init") {
+    await Promise.resolve().then(() => (init_radar_docker_init_entry(), radar_docker_init_entry_exports));
+    return;
+  }
+  if (subcommand === "setup-git") {
+    if (process.argv[3] === "--help" || process.argv[3] === "-h") {
+      console.log('usage: launch-kit setup-git --identity="Name <email>"');
+      console.log("");
+      console.log("  Runs `gh auth setup-git` when GH_TOKEN is set, then sets the");
+      console.log("  global git user.name, user.email, init.defaultBranch=main, and");
+      console.log("  pull.rebase=false. Idempotent; safe to re-run.");
+      return;
+    }
+    let identityVal = null;
+    for (const a of process.argv.slice(3)) {
+      if (a.startsWith("--identity=")) identityVal = a.slice("--identity=".length);
+      else fail2(`Unknown setup-git flag: "${a}". Supported: --identity="Name <email>".`);
+    }
+    if (!identityVal) fail2(`launch-kit setup-git requires --identity="Name <email>".`);
+    try {
+      const identity = parseGitIdentityFlag(identityVal, "--identity");
+      configureGitForBot(identity);
+    } catch (err) {
+      fail2(err instanceof Error ? err.message : String(err));
+    }
+    return;
+  }
   if (subcommand === "statusline") {
     const action = process.argv[3];
     if (!action || action === "--help" || action === "-h") {
@@ -1323,17 +1897,50 @@ async function main() {
     for (const a of process.argv.slice(4)) {
       if (a.startsWith("--show=")) showArg = a.slice("--show=".length);
       else if (a === "--compact") compactArg = true;
-      else fail(`Unknown statusline flag: "${a}". Supported: --show=<csv>, --compact.`);
+      else fail2(`Unknown statusline flag: "${a}". Supported: --show=<csv>, --compact.`);
     }
     const { activateStatusline: activateStatusline2, deactivateStatusline: deactivateStatusline2 } = await Promise.resolve().then(() => (init_statusline_install(), statusline_install_exports));
     let res;
     if (action === "activate") res = activateStatusline2({ show: showArg, compact: compactArg });
     else if (action === "deactivate") res = deactivateStatusline2();
-    else fail(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
+    else fail2(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
     if (res.ok) ok(`statusline ${res.outcome} \u2014 ${res.message}`);
     else info(`statusline ${res.outcome} \u2014 ${res.message}`);
     return;
   }
+  if (subcommand === "secrets") {
+    const action = process.argv[3];
+    if (!action || action === "--help" || action === "-h") {
+      console.log("usage: launch-kit secrets pull [--env=<slug>] [--dir=<path>] [--file=<name>]");
+      console.log("");
+      console.log("  --env=<slug>   env to pull from. Overrides $LS_ENV and the project-level default.");
+      console.log("  --dir=<path>   project root (default: cwd). Must contain a launch-kit cred file.");
+      console.log("  --file=<name>  output file relative to --dir (default: .env.local).");
+      console.log("");
+      console.log("  Resolution order: --env \u2192 $LS_ENV \u2192 server-side default \u2192 single-env auto-pick.");
+      return;
+    }
+    if (action !== "pull") {
+      fail2(`Unknown secrets action: "${action}". Supported: pull.`);
+    }
+    let envOverride = null;
+    let dirArg = null;
+    let fileArg = ".env.local";
+    for (const a of process.argv.slice(4)) {
+      if (a.startsWith("--env=")) envOverride = a.slice("--env=".length);
+      else if (a.startsWith("--dir=")) dirArg = a.slice("--dir=".length);
+      else if (a.startsWith("--file=")) fileArg = a.slice("--file=".length);
+      else fail2(`Unknown secrets pull flag: "${a}". Supported: --env, --dir, --file.`);
+    }
+    const targetDir = path5.resolve(dirArg ?? process.cwd());
+    const { runSecretsPull: runSecretsPull2 } = await Promise.resolve().then(() => (init_secrets_pull(), secrets_pull_exports));
+    try {
+      await runSecretsPull2({ targetDir, envOverride, fileName: fileArg });
+    } catch (err) {
+      fail2(err instanceof Error ? err.message : String(err));
+    }
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   if (args.help) {
     if (subcommand === "refresh") printRefreshHelp();
@@ -1341,25 +1948,26 @@ async function main() {
     return;
   }
   if (!subcommand || subcommand.startsWith("--")) {
-    fail(`missing subcommand. Usage: launch-kit <init|refresh|statusline> [options]. Run with --help.`);
+    fail2(`missing subcommand. Usage: launch-kit <init|refresh|statusline|secrets> [options]. Run with --help.`);
   }
   if (subcommand !== "init" && subcommand !== "refresh") {
-    fail(`Unknown subcommand "${subcommand}". Supported: init, refresh, statusline. Run with --help for usage.`);
+    fail2(`Unknown subcommand "${subcommand}". Supported: init, refresh, statusline, secrets. Run with --help for usage.`);
   }
   DRY_RUN = args.dryRun;
+  VERBOSE = args.verbose || DRY_RUN;
   if (DRY_RUN) {
-    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    info("DRY RUN \u2014 no files will be written, no commands will run.");
-    info("Lines tagged (dry-run) show what would happen.");
-    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(c.bold("DRY RUN") + c.dim(" \u2014 no files will be written, no commands will run."));
+    console.log(c.dim("Lines tagged (dry-run) show what would happen."));
+    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   }
   if (subcommand === "refresh") return mainRefresh(args);
   return mainInit(args);
 }
 async function mainRefresh(args) {
   const cwd = process.cwd();
-  const targetDir = path4.resolve(args.targetDir ?? cwd);
-  if (!fs4.existsSync(targetDir)) fail(`target dir does not exist: ${targetDir}`);
+  const targetDir = path5.resolve(args.targetDir ?? cwd);
+  if (!fs5.existsSync(targetDir)) fail2(`target dir does not exist: ${targetDir}`);
   let cred;
   let source;
   try {
@@ -1367,7 +1975,7 @@ async function mainRefresh(args) {
     cred = recovery.cred;
     source = recovery.source;
   } catch (err) {
-    fail(err instanceof Error ? err.message : String(err));
+    fail2(err instanceof Error ? err.message : String(err));
   }
   if (cred && source === "mcp") {
     info(`recovered cred from .mcp.json launch-secure headers (PAT + org + project + url)`);
@@ -1376,44 +1984,53 @@ async function mainRefresh(args) {
     if (DRY_RUN) {
       dryNote(`would write ${CONFIG_FILENAME} from recovered .mcp.json cred (course: ${courseName})`);
     } else {
-      writeJsonAtomic(path4.join(targetDir, CONFIG_FILENAME), nested2, 384);
+      writeJsonAtomic(path5.join(targetDir, CONFIG_FILENAME), nested2, 384);
       ok(`wrote ${CONFIG_FILENAME} (course: ${courseName})`);
     }
   }
   if (!cred) {
-    fail(
-      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json. Refresh requires an existing cred or a hardcoded launch-secure MCP entry \u2014 run \`npx @launchsecure/launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path4.relative(cwd, targetDir) || "."}\` first.`
+    fail2(
+      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json. Refresh requires an existing cred or a hardcoded launch-secure MCP entry \u2014 run \`npx @launchsecure/launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}\` first.`
     );
   }
   const nested = toNested(cred);
-  if (!nested) fail(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl).`);
+  if (!nested) fail2(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl).`);
   const active = nested.profiles[nested.active];
-  if (!active) fail(`${CONFIG_FILENAME} active profile "${nested.active}" is not present in profiles.`);
+  if (!active) fail2(`${CONFIG_FILENAME} active profile "${nested.active}" is not present in profiles.`);
   info(`refreshing launch-kit in ${targetDir} (course: ${nested.active}, project: ${active.orgSlug}/${active.projectSlug}) \u2026`);
+  header("launch-kit refresh", [
+    ["course", nested.active],
+    ["project", `${active.orgSlug}/${active.projectSlug}`],
+    ["dir", path5.relative(cwd, targetDir) || "."]
+  ]);
   const cfg = { pat: active.pat, orgSlug: active.orgSlug, projectSlug: active.projectSlug, serverUrl: active.serverUrl };
-  mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg));
+  phase(".mcp.json", mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg)));
   ensureGitignoreLine(targetDir, CONFIG_FILENAME);
-  if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir, args.refreshScaffolds);
-  if (!args.noLsMarketplace) scaffoldLsMarketplace(targetDir);
-  if (!args.noRecallHook) scaffoldRecallHook(targetDir);
-  tryActivateStatusline();
-  console.log("");
+  if (!args.noMigrateSafety) phase("migrate-safety", scaffoldMigrateSafety(targetDir, args.refreshScaffolds));
+  if (!args.noLsMarketplace) phase("ls-marketplace", scaffoldLsMarketplace(targetDir));
+  if (!args.noRecallHook) phase("recall-hook", scaffoldRecallHook(targetDir));
+  const slR = tryActivateStatusline();
+  if (slR) phase("statusline", slR);
   if (DRY_RUN) {
-    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    info(`DRY RUN COMPLETE \u2014 refresh would have applied the above; no files modified.`);
-    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("");
+    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(c.bold("DRY RUN COMPLETE") + c.dim(" \u2014 refresh would have applied the above; no files modified."));
+    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     return;
   }
   ok(`refresh complete \u2014 restart Claude Code to pick up any new /kit:* commands`);
-  if (!args.quiet) {
-    console.log(`
-Skipped (refresh never runs these): clone, dependency install, onboard script, launch-recall init. Use \`npx @launchsecure/launch-kit init\` for a full bootstrap.
-${getLaunchKitToolsGuide()}`);
+  const showGuide = args.quiet ? false : args.guide === true;
+  const hints = ["Restart Claude Code to pick up any new /kit:* commands."];
+  if (!showGuide && !args.quiet) hints.push("Run with --guide to print the full MCP + slash-command catalog. --verbose for per-file detail.");
+  footer("Refresh complete.", hints);
+  if (showGuide) {
+    console.log(c.dim(`(refresh never runs these: clone, dependency install, onboard script, launch-recall init \u2014 use \`launch-kit init\` for a full bootstrap)`));
+    console.log(getLaunchKitToolsGuide());
   }
 }
 async function mainInit(args) {
-  const probeDir = path4.resolve(args.targetDir ?? process.cwd());
-  if (!args.force && fs4.existsSync(probeDir)) {
+  const probeDir = path5.resolve(args.targetDir ?? process.cwd());
+  if (!args.force && fs5.existsSync(probeDir)) {
     const detection = detectExistingBootstrap(probeDir);
     if (detection.bootstrapped) {
       info(`detected existing bootstrap at ${probeDir} (${detection.reason})`);
@@ -1422,8 +2039,8 @@ async function mainInit(args) {
     }
   }
   if (!args.token || !args.orgSlug || !args.projectSlug) {
-    const recoveryDir = path4.resolve(args.targetDir ?? process.cwd());
-    if (fs4.existsSync(recoveryDir)) {
+    const recoveryDir = path5.resolve(args.targetDir ?? process.cwd());
+    if (fs5.existsSync(recoveryDir)) {
       const { cred } = recoverCred(recoveryDir, getRecoveryOptions());
       const nested = cred ? toNested(cred) : null;
       const recovered = nested ? nested.profiles[nested.active] : cred;
@@ -1450,43 +2067,61 @@ async function mainInit(args) {
     const t = await prompt("LaunchSecure PAT (ls_pat_\u2026): ");
     args.token = t || null;
   }
-  if (!args.token) fail("--token (or LS_PAT env) is required.");
-  if (!/^ls_pat_/.test(args.token)) fail("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
-  if (!args.orgSlug) fail("--org=<orgSlug> is required.");
-  if (!args.projectSlug) fail("--project=<projectSlug> is required.");
+  if (!args.token) fail2("--token (or LS_PAT env) is required.");
+  if (!/^ls_pat_/.test(args.token)) fail2("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
+  if (!args.orgSlug) fail2("--org=<orgSlug> is required.");
+  if (!args.projectSlug) fail2("--project=<projectSlug> is required.");
+  header("launch-kit init", [
+    ["org", args.orgSlug],
+    ["project", args.projectSlug],
+    ["server", args.serverUrl]
+  ]);
   const { hasGh } = preflight();
+  phase("preflight", { status: "ok", summary: `node ${process.versions.node}${hasGh ? " \xB7 git \xB7 gh" : " \xB7 git (gh not found \u2014 will use git for clone)"}` });
+  if (args.gitIdentity) {
+    configureGitForBot(args.gitIdentity);
+    phase("git identity", { status: "ok", summary: `${args.gitIdentity.name} <${args.gitIdentity.email}>${process.env.GH_TOKEN ? " \xB7 gh credential helper wired" : ""}` });
+  }
   info(`resolving project ${args.orgSlug}/${args.projectSlug} on ${args.serverUrl} \u2026`);
   let resolved;
   try {
     resolved = await callProjectInfo(args);
   } catch (err) {
-    fail(err instanceof Error ? err.message : String(err));
+    fail2(err instanceof Error ? err.message : String(err));
   }
   ok(`resolved "${resolved.projectName}"`);
+  phase("project_info", { status: "ok", summary: `"${resolved.projectName}"` });
   if (!resolved.repositoryUrl) {
-    fail(
+    fail2(
       `Project "${resolved.projectSlug}" has no GitHub repository configured. Connect GitHub at ${args.serverUrl}/${resolved.orgSlug}/projects/${resolved.projectSlug}/settings/integrations, then re-run init.`
     );
   }
   const repoUrl = resolved.repositoryUrl;
   const cwd = process.cwd();
-  const targetDir = path4.resolve(args.targetDir ?? path4.join(cwd, resolved.projectSlug));
+  const targetDir = path5.resolve(args.targetDir ?? path5.join(cwd, resolved.projectSlug));
   const normalizedRemote = normalizeRepoUrl(repoUrl);
   let skipClone = false;
-  if (fs4.existsSync(targetDir)) {
+  if (fs5.existsSync(targetDir)) {
     if (isGitRepo(targetDir)) {
       const existingRemote = gitRemoteUrl(targetDir);
       if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
         ok(`${targetDir} is already a clone of ${repoUrl} \u2014 skipping clone, refreshing configs only`);
         skipClone = true;
       } else {
-        fail(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
+        fail2(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
       }
     } else if (!dirIsEmpty(targetDir)) {
-      fail(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
+      fail2(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
     }
   }
-  if (!skipClone) cloneRepo(repoUrl, targetDir, hasGh);
+  const relTarget = path5.relative(cwd, targetDir) || ".";
+  if (!skipClone) {
+    section(`Cloning ${repoUrl}`);
+    cloneRepo(repoUrl, targetDir, hasGh);
+    phase("clone", { status: "ok", summary: `\u2192 ${relTarget}` });
+  } else {
+    phase("clone", { status: "in-sync", summary: `${relTarget} (already a clone of this repo)` });
+  }
   const cfg = {
     pat: args.token,
     orgSlug: resolved.orgSlug,
@@ -1495,7 +2130,8 @@ async function mainInit(args) {
   };
   const courseName = args.course ?? inferCourseName(cfg.serverUrl);
   writeConfigFile(targetDir, cfg, courseName);
-  mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg));
+  phase("cred file", { status: "ok", summary: `course=${courseName}, active` });
+  phase(".mcp.json", mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg)));
   ensureGitignoreLine(targetDir, CONFIG_FILENAME);
   let installSkippedReason = null;
   const detected = detectPackageManager(targetDir);
@@ -1505,45 +2141,71 @@ async function mainInit(args) {
   } else if (!detected) {
     installSkippedReason = "no package.json found";
   } else {
+    section(`Installing dependencies (${detected.pm.name})`);
     runInstall(targetDir, detected);
-    if (!args.noOnboard && hasOnboardScript(targetDir)) runOnboard(targetDir, detected.pm);
+    phase("install", { status: "ok", summary: `${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` });
+    if (!args.noOnboard) {
+      if (hasOnboardScript(targetDir)) {
+        section(`Running ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}`);
+        runOnboard(targetDir, detected.pm);
+        phase("onboard", { status: "ok", summary: `${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}` });
+      } else {
+        section("Pulling environment secrets");
+        info("running launch-kit secrets pull \u2026");
+        if (DRY_RUN) {
+          dryNote(`would run: launch-kit secrets pull --dir=${path5.relative(cwd, targetDir) || "."}`);
+          phase("secrets pull", { status: "skipped", summary: "(dry-run)" });
+        } else {
+          try {
+            await runSecretsPull({ targetDir, envOverride: null, fileName: ".env.local" });
+            phase("secrets pull", { status: "ok", summary: ".env.local from cloud LS" });
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            warn(`secrets pull skipped \u2014 ${msg}`);
+            phase("secrets pull", { status: "warn", summary: "pull manually with `launch-kit secrets pull`" });
+          }
+        }
+      }
+    }
   }
   const hasOnboard = hasOnboardScript(targetDir);
-  if (!args.noRecall) runRecallInit(targetDir);
-  if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir, args.refreshScaffolds);
-  if (!args.noLsMarketplace) scaffoldLsMarketplace(targetDir);
-  if (!args.noRecallHook) scaffoldRecallHook(targetDir);
-  tryActivateStatusline();
-  const relTarget = path4.relative(cwd, targetDir) || ".";
-  console.log("");
+  if (installSkippedReason) phase("install", { status: "skipped", summary: installSkippedReason });
+  if (!args.noRecall) {
+    section("Initializing launch-recall (shadow git backup)");
+    runRecallInit(targetDir);
+    phase("launch-recall", { status: "ok", summary: "shadow git ready" });
+  }
+  if (!args.noMigrateSafety) phase("migrate-safety", scaffoldMigrateSafety(targetDir, args.refreshScaffolds));
+  if (!args.noLsMarketplace) phase("ls-marketplace", scaffoldLsMarketplace(targetDir));
+  if (!args.noRecallHook) phase("recall-hook", scaffoldRecallHook(targetDir));
+  const slR = tryActivateStatusline();
+  if (slR) phase("statusline", slR);
   if (DRY_RUN) {
-    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    info(`DRY RUN COMPLETE \u2014 no files were modified, no commands ran.`);
-    info(`Target: ${targetDir}`);
-    info(`Re-run without --dry-run to apply the changes shown above.`);
-    info("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    console.log("");
+    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(c.bold("DRY RUN COMPLETE") + c.dim(` \u2014 no files were modified, no commands ran.`));
+    console.log(c.dim(`Target: ${targetDir}`));
+    console.log(c.dim(`Re-run without --dry-run to apply the changes shown above.`));
+    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     return;
   }
   ok(`done \u2014 ${resolved.projectName} is ready at ${targetDir}`);
+  const showGuide = args.quiet ? false : args.guide ?? true;
+  const nextSteps = [`cd ${relTarget}`];
   if (installSkippedReason) {
-    const installLine = detected ? `  ${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` : `  npm install              # or your package manager of choice`;
-    const onboardLine = hasOnboard && detected && !args.noOnboard ? `
-  ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}      # project setup hook` : "";
-    console.log(`
-Next steps (install skipped: ${installSkippedReason}):
-  cd ${relTarget}
-${installLine}${onboardLine}
-  claude                   # launch Claude Code (5 MCPs wired)${args.quiet ? "" : `
-${getLaunchKitToolsGuide()}`}`);
-  } else if (!args.quiet) {
-    console.log(`
-Next steps:
-  cd ${relTarget}
-  claude                   # launch Claude Code (5 MCPs wired)
-${getLaunchKitToolsGuide()}`);
-  }
-}
-main().catch((err) => {
+    nextSteps.push(detected ? `${detected.pm.binary} ${detected.pm.installArgs.join(" ")}     # install skipped: ${installSkippedReason}` : `npm install                                                   # install skipped: ${installSkippedReason}`);
+    if (hasOnboard && detected && !args.noOnboard) {
+      nextSteps.push(`${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}     # project setup hook`);
+    }
+  }
+  nextSteps.push("claude                                                   # launch Claude Code (5 MCPs wired)");
+  footer(`${resolved.projectName} is ready at ${relTarget}.`, [
+    "Next:",
+    ...nextSteps.map((s) => "  " + s)
+  ]);
+  if (showGuide) console.log(getLaunchKitToolsGuide());
+}
+main2().catch((err) => {
   console.error(`[launch-kit] unexpected error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
   process.exit(1);
 });