@launchsecure/launch-kit 0.0.31 → 0.0.33

package/dist/server/radar-teardown-entry.js

@@ -0,0 +1,477 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/server/radar-teardown-entry.ts
+var import_node_child_process = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+
+// src/server/recall/config.ts
+var DEFAULT_CONFIG = {
+  debounce: 3e3,
+  ignore: [
+    "node_modules",
+    ".next",
+    "dist",
+    "build",
+    ".turbo",
+    ".git",
+    ".recall",
+    "coverage",
+    ".pnpm-store",
+    ".launchsecure/graphs",
+    ".claude/settings.local.json"
+  ],
+  retention: {
+    keepLast: 5e3,
+    maxAgeDays: 30
+  }
+};
+
+// src/server/radar/mcp.ts
+var import_node_https = require("node:https");
+var import_node_http = require("node:http");
+var ProjectMcpClient = class {
+  constructor(opts) {
+    this.initialized = false;
+    this.callId = 1;
+    this.mcpUrl = new URL("/api/mcp/project", opts.serverUrl);
+    this.headers = {
+      "Content-Type": "application/json",
+      "Accept": "application/json, text/event-stream",
+      "Authorization": `Bearer ${opts.pat}`
+    };
+    if (opts.orgSlug) this.headers["X-Org-Slug"] = opts.orgSlug;
+    if (opts.projectSlug) this.headers["X-Project-Slug"] = opts.projectSlug;
+  }
+  async call(toolName, args) {
+    await this.ensureInitialized();
+    const body = JSON.stringify({
+      jsonrpc: "2.0",
+      id: this.callId++,
+      method: "tools/call",
+      params: { name: toolName, arguments: args }
+    });
+    const resp = await this.send(body);
+    const parsed = parseBody(resp.body);
+    if (parsed.error) {
+      throw new Error(`MCP ${toolName} failed: ${parsed.error.message ?? JSON.stringify(parsed.error)}`);
+    }
+    const text = parsed.result?.content?.[0]?.text;
+    if (!text) return parsed.result;
+    if (text.startsWith("\u2500\u2500 Error")) {
+      const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
+      const reason = lines.find((l) => !l.startsWith("\u2500\u2500")) ?? text;
+      throw new Error(`MCP ${toolName} failed: ${reason}`);
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  async ensureInitialized() {
+    if (this.initialized) return;
+    const initBody = JSON.stringify({
+      jsonrpc: "2.0",
+      id: this.callId++,
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-03-26",
+        capabilities: {},
+        clientInfo: { name: "launchpod-feedback-agent", version: "0.0.1" }
+      }
+    });
+    const initResp = await this.send(initBody);
+    if (initResp.sessionId) this.sessionId = initResp.sessionId;
+    const notifBody = JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" });
+    await this.send(notifBody);
+    this.initialized = true;
+  }
+  send(body) {
+    return new Promise((resolve2, reject) => {
+      const headers = {
+        ...this.headers,
+        "Content-Length": String(Buffer.byteLength(body))
+      };
+      if (this.sessionId) headers["Mcp-Session-Id"] = this.sessionId;
+      const requester = this.mcpUrl.protocol === "https:" ? import_node_https.request : import_node_http.request;
+      const req = requester(
+        {
+          host: this.mcpUrl.hostname,
+          port: this.mcpUrl.port || (this.mcpUrl.protocol === "https:" ? 443 : 80),
+          path: this.mcpUrl.pathname + this.mcpUrl.search,
+          method: "POST",
+          headers
+        },
+        (res) => {
+          const chunks = [];
+          res.on("data", (c) => chunks.push(c));
+          res.on("end", () => {
+            const text = Buffer.concat(chunks).toString("utf-8");
+            if (res.statusCode && res.statusCode >= 400) {
+              reject(new Error(`MCP HTTP ${res.statusCode}: ${text}`));
+              return;
+            }
+            const sid = res.headers["mcp-session-id"];
+            resolve2({ body: text, sessionId: typeof sid === "string" ? sid : void 0 });
+          });
+        }
+      );
+      req.on("error", reject);
+      req.write(body);
+      req.end();
+    });
+  }
+};
+function parseBody(text) {
+  if (!text) return {};
+  if (text.startsWith("event:") || text.includes("\ndata: ")) {
+    for (const line of text.split("\n")) {
+      if (line.startsWith("data: ")) {
+        try {
+          return JSON.parse(line.slice(6));
+        } catch {
+        }
+      }
+    }
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return {};
+  }
+}
+
+// src/server/radar-teardown-entry.ts
+var COMPOSE_FILE = (0, import_node_path.resolve)(process.cwd(), "docker-compose.yml");
+var RADAR_DIR = (0, import_node_path.dirname)(COMPOSE_FILE);
+var COMPOSE_BASE = ["compose", "-f", COMPOSE_FILE];
+var ENV_PATH = (0, import_node_path.join)(RADAR_DIR, ".env");
+function ensureRadarCompose() {
+  if (!(0, import_node_fs.existsSync)(COMPOSE_FILE)) {
+    console.error(`[teardown] aborting \u2014 no docker-compose.yml at ${COMPOSE_FILE}`);
+    console.error(`[teardown] run from packages/cli/docker/radar/ (the directory holding the radar compose).`);
+    process.exit(1);
+  }
+  const text = (0, import_node_fs.readFileSync)(COMPOSE_FILE, "utf-8");
+  const hasServices = /(^|\n)services:\s*(\n|$)/.test(text);
+  const hasRadar = /\n[ \t]+radar:/.test(text);
+  if (!hasServices || !hasRadar) {
+    console.error(`[teardown] aborting \u2014 ${COMPOSE_FILE} does not define a 'radar' service.`);
+    console.error(`[teardown] this command is only for the launch-pod radar container; refusing to touch this compose project.`);
+    process.exit(1);
+  }
+}
+function parseArgs(argv) {
+  const out = { force: false, removeEnv: false, removeImage: false, help: false };
+  for (const a of argv) {
+    switch (a) {
+      case "--force":
+        out.force = true;
+        break;
+      case "--remove-env":
+        out.removeEnv = true;
+        break;
+      case "--remove-image":
+        out.removeImage = true;
+        break;
+      case "-h":
+      case "--help":
+        out.help = true;
+        break;
+      default:
+        console.error(`unknown flag: ${a}`);
+        process.exit(1);
+    }
+  }
+  return out;
+}
+function printHelp() {
+  console.log("usage: launch-pod radar:teardown [--remove-env] [--remove-image] [--force]");
+  console.log("");
+  console.log("  --remove-env     also delete .env (default: keep \u2014 contains live creds)");
+  console.log("  --remove-image   also remove launchpod-radar:local image");
+  console.log("  --force          skip the workspace-safety preflight (discards");
+  console.log("                   uncommitted changes / unpushed commits / in-flight");
+  console.log("                   analyzer sessions without warning)");
+}
+function sh(cmd, args, opts = {}) {
+  const r = (0, import_node_child_process.spawnSync)(cmd, args, { encoding: "utf8", ...opts });
+  return {
+    status: r.status ?? 1,
+    stdout: typeof r.stdout === "string" ? r.stdout : "",
+    stderr: typeof r.stderr === "string" ? r.stderr : ""
+  };
+}
+function workspaceSh(command) {
+  const psQ = sh("docker", [...COMPOSE_BASE, "ps", "-q", "radar"]);
+  if (psQ.status === 0 && psQ.stdout.trim()) {
+    return sh("docker", [...COMPOSE_BASE, "exec", "-T", "radar", "sh", "-c", command]).stdout;
+  }
+  return sh("docker", [...COMPOSE_BASE, "run", "--rm", "--no-deps", "--entrypoint", "sh", "radar", "-c", command]).stdout;
+}
+function loadIgnoreSegs() {
+  const json = workspaceSh("cat /workspace/.recall/config.json 2>/dev/null");
+  if (json.trim()) {
+    try {
+      const j = JSON.parse(json);
+      if (Array.isArray(j.ignore) && j.ignore.every((s) => typeof s === "string")) {
+        return j.ignore;
+      }
+    } catch {
+    }
+  }
+  return [...DEFAULT_CONFIG.ignore];
+}
+function pathIsNoise(p, segs) {
+  for (const seg of segs) {
+    if (p === seg) return true;
+    if (p.startsWith(seg + "/")) return true;
+    if (p.endsWith("/" + seg)) return true;
+    if (p.includes("/" + seg + "/")) return true;
+  }
+  return false;
+}
+var SCAFFOLDED_MCP_PATHS = [
+  "mcpServers.launch-secure.url"
+];
+function collectDiffPaths(a, b, prefix, out) {
+  if (a === b) return;
+  const aIsPrim = a === null || typeof a !== "object";
+  const bIsPrim = b === null || typeof b !== "object";
+  if (aIsPrim || bIsPrim) {
+    if (a !== b) out.push(prefix || "$");
+    return;
+  }
+  const aIsArr = Array.isArray(a);
+  const bIsArr = Array.isArray(b);
+  if (aIsArr || bIsArr) {
+    if (!aIsArr || !bIsArr || a.length !== b.length) {
+      out.push(prefix || "$");
+      return;
+    }
+    const aa = a;
+    const bb = b;
+    for (let i = 0; i < aa.length; i++) {
+      collectDiffPaths(aa[i], bb[i], prefix ? `${prefix}[${i}]` : `[${i}]`, out);
+    }
+    return;
+  }
+  const ao = a;
+  const bo = b;
+  for (const k of /* @__PURE__ */ new Set([...Object.keys(ao), ...Object.keys(bo)])) {
+    const child = prefix ? `${prefix}.${k}` : k;
+    if (!(k in ao) || !(k in bo)) {
+      out.push(child);
+      continue;
+    }
+    collectDiffPaths(ao[k], bo[k], child, out);
+  }
+}
+function mcpJsonOnlyScaffoldedDiff() {
+  const headJson = workspaceSh("git -C /workspace show HEAD:.mcp.json 2>/dev/null");
+  const wtJson = workspaceSh("cat /workspace/.mcp.json 2>/dev/null");
+  if (!headJson.trim() || !wtJson.trim()) return false;
+  let head, wt;
+  try {
+    head = JSON.parse(headJson);
+    wt = JSON.parse(wtJson);
+  } catch {
+    return false;
+  }
+  const diffs = [];
+  collectDiffPaths(head, wt, "", diffs);
+  if (diffs.length === 0) return false;
+  return diffs.every((d) => SCAFFOLDED_MCP_PATHS.some((s) => d === s || d.startsWith(s + ".")));
+}
+function filterStatusSignal(raw, modeOnly, segs, scaffoldClean) {
+  const out = [];
+  for (const rawLine of raw.split("\n")) {
+    const line = rawLine.replace(/\r$/, "");
+    if (line.length < 3) continue;
+    let p = line.slice(3);
+    if (line.startsWith("R") || line.startsWith("C")) {
+      const arrow = p.indexOf(" -> ");
+      if (arrow >= 0) p = p.slice(arrow + 4);
+    }
+    if (pathIsNoise(p, segs)) continue;
+    if (modeOnly.has(p)) continue;
+    if (scaffoldClean.has(p)) continue;
+    out.push(line);
+  }
+  return out;
+}
+function probeDocker() {
+  const containerRunning = sh("docker", [...COMPOSE_BASE, "ps", "-q", "radar"]).stdout.trim().length > 0;
+  const projectName = (sh("docker", [...COMPOSE_BASE, "config", "--format", "json"]).stdout.match(/"name"\s*:\s*"([^"]+)"/) ?? [])[1] ?? "";
+  let workspaceVolumeExists = false;
+  if (projectName) {
+    const vols = sh("docker", ["volume", "ls", "-q", "--filter", `name=^${projectName}_workspace$`]);
+    workspaceVolumeExists = vols.status === 0 && vols.stdout.trim().length > 0;
+  }
+  return { containerRunning, workspaceVolumeExists };
+}
+function preflightWorkspace(args) {
+  if (args.force) {
+    console.log("[teardown] --force given \u2014 skipping workspace-safety preflight");
+    return;
+  }
+  const state = probeDocker();
+  if (!state.containerRunning && !state.workspaceVolumeExists) {
+    console.log("[teardown] no radar container or workspace volume present \u2014 nothing to check");
+    return;
+  }
+  console.log("[teardown] checking workspace for unsaved work\u2026");
+  const segs = loadIgnoreSegs();
+  const numstatRaw = workspaceSh("git -C /workspace diff --numstat 2>/dev/null");
+  const modeOnly = /* @__PURE__ */ new Set();
+  for (const line of numstatRaw.split("\n")) {
+    const parts = line.split("	");
+    if (parts.length >= 3 && parts[0] === "0" && parts[1] === "0") {
+      modeOnly.add(parts[2]);
+    }
+  }
+  const rawDirty = workspaceSh("git -C /workspace status --porcelain 2>/dev/null | head -200");
+  const scaffoldClean = /* @__PURE__ */ new Set();
+  if (mcpJsonOnlyScaffoldedDiff()) scaffoldClean.add(".mcp.json");
+  const dirty = filterStatusSignal(rawDirty, modeOnly, segs, scaffoldClean);
+  const unpushedRaw = workspaceSh("git -C /workspace rev-list --count @{u}..HEAD 2>/dev/null || echo 0").trim();
+  const unpushed = parseInt(unpushedRaw || "0", 10);
+  const inflightRaw = workspaceSh(`grep -oE '"state":[[:space:]]*"(analyzing|queued)"' /workspace/.launchpod/radar-pings.json 2>/dev/null | wc -l | tr -d ' '`).trim();
+  const inflight = parseInt(inflightRaw || "0", 10);
+  let blocked = false;
+  if (dirty.length > 0) {
+    console.log("[teardown] \u2717 uncommitted changes in /workspace (after recall-ignore filter):");
+    for (const line of dirty) console.log("    " + line);
+    blocked = true;
+  }
+  if (unpushed > 0) {
+    console.log(`[teardown] \u2717 ${unpushed} unpushed commit(s) ahead of upstream`);
+    blocked = true;
+  }
+  if (inflight > 0) {
+    console.log(`[teardown] \u2717 ${inflight} in-flight or queued analyzer session(s) \u2014 output will be lost`);
+    blocked = true;
+  }
+  if (blocked) {
+    console.log("");
+    console.log("[teardown] aborting \u2014 workspace has unsaved work.");
+    console.log("  \u2022 commit + push from inside the container (docker compose exec radar sh), then re-run, OR");
+    console.log("  \u2022 re-run with --force to discard the work and tear down anyway.");
+    process.exit(2);
+  }
+  console.log("[teardown] \u2713 workspace is clean (only recall-ignored noise present) \u2014 safe to tear down");
+}
+function parseEnvFile(path) {
+  const env = {};
+  for (const raw of (0, import_node_fs.readFileSync)(path, "utf8").split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq < 0) continue;
+    const key = line.slice(0, eq).trim();
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) env[key] = value;
+  }
+  return env;
+}
+async function releaseWebhook() {
+  const psQ = sh("docker", [...COMPOSE_BASE, "ps", "-q", "radar"]);
+  if (psQ.status !== 0 || !psQ.stdout.trim()) {
+    console.log("[teardown] container not running \u2014 skipping webhook release");
+    console.log("[teardown] (any prior registration is now orphaned \u2014 clean up via cloud LS settings UI)");
+    return;
+  }
+  const radarJson = workspaceSh("cat /workspace/.launchpod/radar.json 2>/dev/null");
+  let endpointId = "";
+  try {
+    const j = JSON.parse(radarJson);
+    endpointId = j.endpointId ?? j.registration?.endpointId ?? j.webhook?.endpointId ?? "";
+  } catch {
+  }
+  if (!endpointId) {
+    console.log("[teardown] no endpoint_id found in /workspace/.launchpod/radar.json \u2014 skipping release");
+    return;
+  }
+  if (!(0, import_node_fs.existsSync)(ENV_PATH)) {
+    console.log(`[teardown] no .env found at ${ENV_PATH} \u2014 can't release webhook (manual cleanup needed)`);
+    return;
+  }
+  const env = parseEnvFile(ENV_PATH);
+  const pat = env.LS_PAT;
+  const orgSlug = env.LS_ORG_SLUG;
+  const projectSlug = env.LS_PROJECT_SLUG;
+  const serverUrl = env.LS_SERVER_URL || "https://launchsecure-v2.vercel.app";
+  if (!pat || !orgSlug || !projectSlug) {
+    console.log("[teardown] .env is missing LS_PAT / LS_ORG_SLUG / LS_PROJECT_SLUG \u2014 skipping release");
+    return;
+  }
+  console.log(`[teardown] releasing endpoint ${endpointId} from ${serverUrl}`);
+  try {
+    const mcp = new ProjectMcpClient({ serverUrl, pat, orgSlug, projectSlug });
+    await mcp.call("launchpod_webhook_release", { endpoint_id: endpointId });
+    console.log("[teardown] \u2713 webhook released");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.log(`[teardown] \u26A0 webhook release failed (${msg}) \u2014 delete manually at:`);
+    console.log(`           ${serverUrl}/${orgSlug}/projects/${projectSlug}/settings`);
+  }
+}
+function dockerComposeDown() {
+  console.log(`[teardown] docker compose -f ${COMPOSE_FILE} down -v`);
+  const down = (0, import_node_child_process.spawnSync)("docker", [...COMPOSE_BASE, "down", "-v"], { encoding: "utf8" });
+  const combined = (down.stdout || "") + (down.stderr || "");
+  for (const line of combined.split("\n")) {
+    if (/Removing|Removed|Stopping|Stopped/.test(line)) console.log("  " + line.trim());
+  }
+  if (down.status !== 0) {
+    console.error(`[teardown] docker compose down -v failed (status ${down.status})`);
+    process.exit(down.status ?? 1);
+  }
+}
+function cleanupLocalArtifacts(args) {
+  if (args.removeImage) {
+    console.log("[teardown] removing image launchpod-radar:local");
+    const rmi = sh("docker", ["rmi", "launchpod-radar:local"]);
+    console.log(rmi.status === 0 ? "  removed" : "  not present");
+  }
+  for (const f of (0, import_node_fs.readdirSync)(RADAR_DIR)) {
+    if (f.startsWith("launchsecure-launch-kit-") && f.endsWith(".tgz")) {
+      console.log("[teardown] removing launch-kit tarball(s)");
+      try {
+        (0, import_node_fs.unlinkSync)((0, import_node_path.join)(RADAR_DIR, f));
+      } catch {
+      }
+    }
+  }
+  if (args.removeEnv && (0, import_node_fs.existsSync)(ENV_PATH)) {
+    console.log("[teardown] removing .env (--remove-env)");
+    try {
+      (0, import_node_fs.unlinkSync)(ENV_PATH);
+    } catch {
+    }
+  } else if ((0, import_node_fs.existsSync)(ENV_PATH)) {
+    console.log("[teardown] keeping .env (use --remove-env to delete it next time)");
+  }
+}
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    printHelp();
+    return;
+  }
+  ensureRadarCompose();
+  preflightWorkspace(args);
+  await releaseWebhook();
+  dockerComposeDown();
+  cleanupLocalArtifacts(args);
+  console.log("[teardown] done.");
+}
+main().catch((err) => {
+  console.error("[teardown] fatal:", err);
+  process.exit(1);
+});

package/dist/server/recall-entry.js

@@ -167,7 +167,10 @@ var init_config = __esm({
         ".turbo",
         ".git",
         ".recall",
-        "coverage"
+        "coverage",
+        ".pnpm-store",
+        ".launchsecure/graphs",
+        ".claude/settings.local.json"
       ],
       retention: {
         keepLast: 5e3,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchsecure/launch-kit",
-  "version": "0.0.31",
+  "version": "0.0.33",
   "description": "LaunchSecure toolkit — launch-pod (pipeline), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup).",
   "license": "MIT",
   "author": "LaunchSecure - AutomateWithUs",
@@ -56,24 +56,6 @@
     "launch-course": "./dist/server/course-entry.js",
     "launch-beacon": "./dist/server/beacon-monitor-entry.js"
   },
-  "scripts": {
-    "build": "pnpm build:client && pnpm build:chart-client && pnpm build:deck-client && pnpm build:council-client && pnpm build:beacon && pnpm build:server",
-    "build:beacon": "vite build --config vite.beacon.config.ts && tsc -p tsconfig.beacon.json --emitDeclarationOnly --outDir dist/beacon/types",
-    "test:beacon": "vitest run --config vite.beacon.config.ts",
-    "test:radar": "vitest run --config vite.radar.config.ts",
-    "test:chart": "vitest run --config vite.chart.test.config.ts",
-    "build:deck-client": "vite build --config vite.deck.config.ts",
-    "build:council-client": "vite build --config vite.council.config.ts",
-    "build:client": "vite build",
-    "build:chart-client": "vite build --config vite.chart.config.ts",
-    "build:server": "esbuild src/server/cli.ts src/server/fb-wizard.ts src/server/graph-mcp-entry.ts src/server/chart-serve.ts src/server/deck-mcp-entry.ts src/server/deck-serve.ts src/server/council-entry.ts src/server/council-serve.ts src/server/recall-entry.ts src/server/init-entry.ts src/server/orbit-entry.ts src/server/course-entry.ts src/server/beacon-monitor-entry.ts src/server/parse-worker-entry.ts --bundle --platform=node --target=node18 --outdir=dist/server --external:node-pty --external:ws --external:typescript --external:web-tree-sitter --external:tree-sitter-typescript --external:cloudflared --external:pg --external:pg-native --external:pgsql-parser --external:libpg-query && rm -rf dist/server/public && cp -r ../claude-code-web/src/public dist/server/public && rm -rf dist/server/graph/queries && mkdir -p dist/server/graph && cp -r src/server/graph/queries dist/server/graph/queries",
-    "dev:client": "vite",
-    "dev:deck-serve": "cd ../.. && tsx watch packages/cli/src/server/deck-mcp-entry.ts serve",
-    "dev:chart": "pnpm build:server && pnpm build:chart-client && node dist/server/graph-mcp-entry.js serve",
-    "dev:server": "pnpm build:server && node dist/server/cli.js",
-    "dev": "pnpm build:server && concurrently -k -n client,server -c cyan,magenta \"vite\" \"node dist/server/cli.js\"",
-    "prepublishOnly": "pnpm build"
-  },
   "files": [
     "dist",
     "prompts",
@@ -94,8 +76,6 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@launchsecure/claude-code-web": "workspace:*",
-    "@launchsecure/ui": "workspace:*",
     "@types/node": "^20.0.0",
     "@types/pg": "^8.11.10",
     "@types/react": "^18.3.12",
@@ -119,6 +99,25 @@
     "react-router-dom": "^6.28.0",
     "tailwindcss": "^3.4.19",
     "vite": "^5.4.11",
-    "vitest": "^1.6.0"
+    "vitest": "^1.6.0",
+    "@launchsecure/claude-code-web": "0.0.1",
+    "@launchsecure/ui": "0.0.1"
+  },
+  "scripts": {
+    "build": "pnpm build:client && pnpm build:chart-client && pnpm build:deck-client && pnpm build:council-client && pnpm build:beacon && pnpm build:server",
+    "build:beacon": "vite build --config vite.beacon.config.ts && tsc -p tsconfig.beacon.json --emitDeclarationOnly --outDir dist/beacon/types",
+    "test:beacon": "vitest run --config vite.beacon.config.ts",
+    "test:radar": "vitest run --config vite.radar.config.ts",
+    "test:chart": "vitest run --config vite.chart.test.config.ts",
+    "build:deck-client": "vite build --config vite.deck.config.ts",
+    "build:council-client": "vite build --config vite.council.config.ts",
+    "build:client": "vite build",
+    "build:chart-client": "vite build --config vite.chart.config.ts",
+    "build:server": "esbuild src/server/cli.ts src/server/fb-wizard.ts src/server/graph-mcp-entry.ts src/server/chart-serve.ts src/server/deck-mcp-entry.ts src/server/deck-serve.ts src/server/council-entry.ts src/server/council-serve.ts src/server/recall-entry.ts src/server/init-entry.ts src/server/orbit-entry.ts src/server/course-entry.ts src/server/beacon-monitor-entry.ts src/server/parse-worker-entry.ts src/server/radar-teardown-entry.ts src/server/radar-docker-init-entry.ts --bundle --platform=node --target=node18 --outdir=dist/server --external:node-pty --external:ws --external:typescript --external:web-tree-sitter --external:tree-sitter-typescript --external:cloudflared --external:pg --external:pg-native --external:pgsql-parser --external:libpg-query && rm -rf dist/server/public && cp -r ../claude-code-web/src/public dist/server/public && rm -rf dist/server/graph/queries && mkdir -p dist/server/graph && cp -r src/server/graph/queries dist/server/graph/queries",
+    "dev:client": "vite",
+    "dev:deck-serve": "cd ../.. && tsx watch packages/cli/src/server/deck-mcp-entry.ts serve",
+    "dev:chart": "pnpm build:server && pnpm build:chart-client && node dist/server/graph-mcp-entry.js serve",
+    "dev:server": "pnpm build:server && node dist/server/cli.js",
+    "dev": "pnpm build:server && concurrently -k -n client,server -c cyan,magenta \"vite\" \"node dist/server/cli.js\""
   }
-}
+}

package/scaffolds/ls-marketplace/plugins/kit/commands/activate-statusline.md

@@ -1,5 +1,5 @@
 ---
-description: Wire launch-kit's MCP daemon chips into the user's existing Claude Code statusline. Additive — does not create or replace an existing statusline, only appends colored chips (recall/chart/deck/council) showing each daemon's liveness + last-activity age. Idempotent. Run /kit:deactivate-statusline to undo.
+description: Wire launch-kit's MCP chips into the user's existing Claude Code statusline. Additive — does not create or replace an existing statusline, only appends colored chips (recall/chart/deck/council/secure) showing each daemon's liveness + last-activity age, plus a reachability probe for the hosted launch-secure MCP. Idempotent. Run /kit:deactivate-statusline to undo.
 ---
 
 # /kit:activate-statusline
@@ -21,12 +21,12 @@ Extends the user's existing `~/.claude/settings.json` statusline so MCP daemon h
 Shell out to the kit binary:
 
 ```bash
-launch-kit statusline activate                                    # all chips
-launch-kit statusline activate --show=recall,chart                # only these
-launch-kit statusline activate --show=recall,chart,deck,council   # explicit all
+launch-kit statusline activate                                          # all chips
+launch-kit statusline activate --show=recall,chart                      # only these
+launch-kit statusline activate --show=recall,chart,deck,council,secure  # explicit all
 ```
 
-The `--show` flag accepts any comma-separated subset of `recall,chart,deck,council`. Omitting it shows all four. Re-running activate with a different `--show` updates the chip set in place — no need to deactivate first.
+The `--show` flag accepts any comma-separated subset of `recall,chart,deck,council,secure`. Omitting it shows all five. `secure` is a reachability probe (curl, cached ~30s) against the active LaunchSecure profile's `serverUrl` — green when the host responds, red on transport failure, orange when the cred config or curl is missing. The chip label shows the active profile (e.g. `secure(prod)`). Re-running activate with a different `--show` updates the chip set in place — no need to deactivate first.
 
 If the published bin isn't on PATH (dev repo, monorepo), fall back to:
 

package/scaffolds/ls-marketplace/plugins/kit/skills/diagram/SKILL.md

@@ -31,7 +31,7 @@ Parse `$ARGUMENTS`:
 - **--scope=<filter>** — for ERDs, limit to one module or table set (e.g. `--scope=auth` or `--scope=User,Org,Membership`). Default: all tables.
 - **--session=<id>** — deck session name. Default `diagram-<kind>-<subject-slug>`.
 - **--dsl=<raw-mermaid>** — bypass auto-generation; push the user's DSL verbatim.
-- **--feedback** — push in feedback mode and await response.
+- **--no-feedback** — skip feedback round-trip (rare; only when the caller has already validated the DSL).
 
 Examples:
 - `/kit:diagram flowchart user login flow`
@@ -97,18 +97,38 @@ Rules:
 - `read_graph(layer: "db")` returns 0 nodes
 - the chart shows tables but `inspect_node` returns no `columns` (parser misconfiguration)
 
-## Push to deck
+## Push to deck — feedback mode is the default
+
+**Always use `mode: "feedback"` for diagrams.** Mermaid DSL frequently fails on the first attempt (syntax pitfalls below), and the deck server's auto-error poll is racy (1500ms timeout in `deck-mcp.ts`). Feedback mode gives you two backstops: a synchronous render-error capture *and* explicit user confirmation. Skip only when `--no-feedback` was passed.
 
 Call `mcp__launch-deck__deck` with:
 - `session: <session>`
-- `mode: "show"` or `"feedback"` (+ `prompt: "Does this match the schema you expected?"` for ERDs)
+- `mode: "feedback"`
+- `prompt: "Diagram render OK? Reply 'ok' to accept, or paste the error / describe what's wrong."` (ERDs: append "Does this match the schema you expected?")
 - `blocks: [{ type: "mermaid", label: <kind>-<subject>, content: <mermaid-dsl> }]`
 
-If `--feedback`, call `await_feedback` and surface the response.
+### Render-error retry loop
+
+The deck MCP catches mermaid parse/render errors via the browser's `onMermaidError` → `/api/render-errors` channel and surfaces them on the `deck` tool response. Handle both signal paths:
+
+1. **Synchronous render error** — if the `deck` response is `{ok: false, mermaid_error, failed_source, ...}`, inspect `failed_source` first:
+   - If `failed_source` matches the DSL you just pushed → real error. Fix the DSL based on `mermaid_error` and re-push immediately (same session — the tab is already open). Cap at 2 auto-retries before surfacing to the user.
+   - If `failed_source` does NOT match what you just pushed → **stale error**. The deck server's `lastRenderError` is a module-level pop register (`consumeRenderError` in `deck-serve.ts`) populated via WebSocket from the browser; if the previous push's render error arrived AFTER its 1500ms MCP poll, it leaks into this push's response. Ignore it and proceed to `await_feedback`.
+2. **User feedback** — if `deck` returned `ok: true`, call `mcp__launch-deck__await_feedback({ session })`. If the reply is positive ("ok", "looks good", thumbs up), you're done. Otherwise treat the reply as a correction (syntax error pasted, "missing X", "wrong direction") and regenerate. Cap at 2 user-feedback retries before stopping and asking for a clearer instruction.
+
+### Common Mermaid pitfalls (avoid on first attempt)
+
+- **No `<br/>` in participant aliases.** `participant Pod as LaunchPod CLI<br/>(agent)` breaks the parser in many Mermaid builds. Use one-line names or a trailing parenthetical.
+- **Multi-line notes are fragile.** `Note over X: line1<br/>line2` is risky inside `rect` blocks. Keep notes one-line, or chain two `Note` statements.
+- **Multiple `else` branches.** `alt … else … else … else … end` works in current Mermaid but failure modes are noisy; prefer 2-branch alts or split into separate alt blocks.
+- **`rect rgb(...)`** uses **space-separated** values, not commas: `rect rgb(230 240 255)` — not `rect rgb(230,240,255)`. Comma form errors silently in some builds.
+- **Special chars in labels** — wrap in double quotes when using `:`, `(`, `,`, or unicode arrows: `A->>B: "step (1): start"`.
+- **Reserved keywords as actor names** — avoid `end`, `note`, `loop`, `alt`, `opt` as participant ids.
+- **ERD column types** must be one word: `string`, `int`, `datetime`, `enum`. No spaces, no parens.
 
 ## Open in browser
 
-After the push (and after `await_feedback` if `--feedback`), open the per-session URL so the user lands directly on this diagram:
+After the final successful push (and after `await_feedback` returns positive), open the per-session URL so the user lands directly on this diagram:
 
 ```
 open "<deck-url>/#<session>"          # macOS
@@ -150,3 +170,5 @@ Then fall back: render a `flowchart` placeholder explaining "DB layer not availa
 - **Cap entities at 25.** Past that, Mermaid wraps unreadably; ask the user to narrow scope.
 - **Mermaid only.** This skill does not draw raster images — Mermaid DSL is the deliverable.
 - **One block per push.**
+- **Feedback mode by default.** Never push a diagram with `mode: "show"` unless `--no-feedback` was explicitly passed. Diagrams are validated artifacts, not fire-and-forget output.
+- **Retry caps.** 2 auto-retries on synchronous render error + 2 user-feedback retries. Beyond that, hand the broken DSL back to the user with the last error message and stop.