@launchsecure/launch-kit 0.0.32 → 0.0.34

package/dist/server/init-entry.js

@@ -30,6 +30,217 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/server/cred-shape.ts
+function inferCourseName(serverUrl) {
+  try {
+    const host = new URL(serverUrl).hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
+    if (host.includes("staging")) return "staging";
+    if (host.endsWith(".vercel.app")) return "prod";
+    return host.split(".")[0] || "default";
+  } catch {
+    return "default";
+  }
+}
+function toNested(cred) {
+  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
+    return { active: cred.active, profiles: cred.profiles };
+  }
+  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
+    return null;
+  }
+  const name = inferCourseName(cred.serverUrl);
+  return {
+    active: name,
+    profiles: {
+      [name]: {
+        pat: cred.pat,
+        orgSlug: cred.orgSlug,
+        projectSlug: cred.projectSlug,
+        serverUrl: cred.serverUrl
+      }
+    }
+  };
+}
+function upsertProfile(existing, name, profile) {
+  const base = existing ? toNested(existing) ?? { active: name, profiles: {} } : { active: name, profiles: {} };
+  return {
+    active: name,
+    profiles: { ...base.profiles, [name]: profile }
+  };
+}
+function readCredFile(repoRoot) {
+  const p = path.join(repoRoot, CONFIG_FILENAME);
+  if (!fs.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function writeJsonAtomic(absPath, value, mode) {
+  const tmp = `${absPath}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
+  if (mode !== void 0) {
+    try {
+      fs.chmodSync(tmp, mode);
+    } catch {
+    }
+  }
+  fs.renameSync(tmp, absPath);
+}
+var fs, path, CONFIG_FILENAME;
+var init_cred_shape = __esm({
+  "src/server/cred-shape.ts"() {
+    "use strict";
+    fs = __toESM(require("node:fs"));
+    path = __toESM(require("node:path"));
+    CONFIG_FILENAME = ".launch-secure.cred.config";
+  }
+});
+
+// src/server/secrets-pull.ts
+var secrets_pull_exports = {};
+__export(secrets_pull_exports, {
+  runSecretsPull: () => runSecretsPull
+});
+async function runSecretsPull(opts) {
+  const cred = readCredFile(opts.targetDir);
+  if (!cred) {
+    throw new Error(
+      `No ${CONFIG_FILENAME} found in ${opts.targetDir}. Run \`launch-kit init\` first.`
+    );
+  }
+  const nested = toNested(cred);
+  if (!nested) {
+    throw new Error(`${CONFIG_FILENAME} is missing required fields (pat, orgSlug, projectSlug, serverUrl).`);
+  }
+  const profile = nested.profiles[nested.active];
+  if (!profile) {
+    throw new Error(`Active profile "${nested.active}" not found in ${CONFIG_FILENAME}.`);
+  }
+  const envsRaw = await callMcp(profile, "environments_list", {});
+  const envsResult = Array.isArray(envsRaw) ? { environments: envsRaw, defaultPullEnvSlug: null } : envsRaw;
+  const envSlug = resolveEnvSlug(opts.envOverride, envsResult);
+  if (!envSlug) {
+    const list = envsResult.environments.map((e) => e.slug).join(", ") || "(none)";
+    throw new Error(
+      `No env specified and no default set. Available: ${list}. Pass --env=<slug>, set $LS_ENV, or set a project-level default at ${profile.serverUrl}/${profile.orgSlug}/projects/${profile.projectSlug}/settings.`
+    );
+  }
+  const pullResult = await callMcp(profile, "secrets_pull_env", { env_slug: envSlug });
+  const filePath = path3.join(opts.targetDir, opts.fileName);
+  writeEnvFile(filePath, pullResult.vars);
+  console.log(
+    `\u2714 wrote ${pullResult.vars.length} secrets from "${pullResult.env.slug}" \u2192 ${path3.relative(opts.targetDir, filePath) || opts.fileName}`
+  );
+}
+function resolveEnvSlug(override, envs) {
+  if (override) return override;
+  if (process.env.LS_ENV) return process.env.LS_ENV;
+  if (envs.defaultPullEnvSlug) return envs.defaultPullEnvSlug;
+  if (envs.environments.length === 1) return envs.environments[0].slug;
+  return null;
+}
+function writeEnvFile(filePath, vars) {
+  const lines = vars.map((v) => `${v.key}=${formatValue(v.value)}`);
+  fs3.writeFileSync(filePath, lines.join("\n") + "\n", "utf-8");
+  try {
+    fs3.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function formatValue(v) {
+  if (v === "") return "";
+  if (/[\s"'\\$`#=]/.test(v)) {
+    return `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n")}"`;
+  }
+  return v;
+}
+async function callMcp(profile, toolName, args) {
+  return new Promise((resolve3, reject) => {
+    const mcpUrl = new import_node_url.URL("/api/mcp/project", profile.serverUrl);
+    const body = JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "tools/call",
+      params: { name: toolName, arguments: args }
+    });
+    const requester = mcpUrl.protocol === "https:" ? import_node_https.request : import_node_http.request;
+    const req = requester(
+      {
+        host: mcpUrl.hostname,
+        port: mcpUrl.port || (mcpUrl.protocol === "https:" ? 443 : 80),
+        path: mcpUrl.pathname,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json, text/event-stream",
+          "Content-Length": String(Buffer.byteLength(body)),
+          "Authorization": `Bearer ${profile.pat}`,
+          "X-Org-Slug": profile.orgSlug,
+          "X-Project-Slug": profile.projectSlug
+        }
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c2) => chunks.push(c2));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          if (res.statusCode === 401) {
+            return reject(new Error(`PAT rejected (401). Regenerate at ${profile.serverUrl}/settings/tokens.`));
+          }
+          if (res.statusCode === 403) {
+            return reject(new Error(`Access denied (403). PAT lacks the scope required for ${toolName}.`));
+          }
+          if (res.statusCode && res.statusCode >= 400) {
+            return reject(new Error(`LaunchSecure ${res.statusCode}: ${text.slice(0, 300)}`));
+          }
+          let json = text;
+          if (text.startsWith("event:") || text.includes("\ndata: ")) {
+            for (const line of text.split("\n")) {
+              if (line.startsWith("data: ")) {
+                json = line.slice(6);
+                break;
+              }
+            }
+          }
+          try {
+            const parsed = JSON.parse(json);
+            if (parsed.error) return reject(new Error(`${toolName}: ${parsed.error.message ?? "unknown"}`));
+            const inner = parsed.result?.content?.[0]?.text;
+            if (!inner) return reject(new Error(`${toolName} returned no content`));
+            if (inner.startsWith("\u2500\u2500 Error")) {
+              const firstLine = inner.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("\u2500\u2500"))[0];
+              return reject(new Error(`${toolName}: ${firstLine ?? inner}`));
+            }
+            resolve3(JSON.parse(inner));
+          } catch (err) {
+            reject(new Error(`Could not parse ${toolName} response: ${err instanceof Error ? err.message : String(err)}`));
+          }
+        });
+      }
+    );
+    req.setTimeout(TIMEOUT_MS, () => req.destroy(new Error(`${toolName} timed out after ${TIMEOUT_MS / 1e3}s`)));
+    req.on("error", reject);
+    req.write(body);
+    req.end();
+  });
+}
+var fs3, path3, import_node_http, import_node_https, import_node_url, TIMEOUT_MS;
+var init_secrets_pull = __esm({
+  "src/server/secrets-pull.ts"() {
+    "use strict";
+    fs3 = __toESM(require("node:fs"));
+    path3 = __toESM(require("node:path"));
+    import_node_http = require("node:http");
+    import_node_https = require("node:https");
+    import_node_url = require("node:url");
+    init_cred_shape();
+    TIMEOUT_MS = 15e3;
+  }
+});
+
 // src/server/statusline-install.ts
 var statusline_install_exports = {};
 __export(statusline_install_exports, {
@@ -37,25 +248,25 @@ __export(statusline_install_exports, {
   deactivateStatusline: () => deactivateStatusline
 });
 function readSettings() {
-  if (!fs3.existsSync(SETTINGS_PATH)) return null;
+  if (!fs4.existsSync(SETTINGS_PATH)) return null;
   try {
-    return JSON.parse(fs3.readFileSync(SETTINGS_PATH, "utf-8"));
+    return JSON.parse(fs4.readFileSync(SETTINGS_PATH, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeSettings(s) {
-  fs3.mkdirSync(path3.dirname(SETTINGS_PATH), { recursive: true });
-  fs3.writeFileSync(SETTINGS_PATH, JSON.stringify(s, null, 2) + "\n", "utf-8");
+  fs4.mkdirSync(path4.dirname(SETTINGS_PATH), { recursive: true });
+  fs4.writeFileSync(SETTINGS_PATH, JSON.stringify(s, null, 2) + "\n", "utf-8");
 }
 function readScaffold(name) {
-  const p = path3.resolve(__dirname, "..", "..", "scaffolds", "statusline", name);
-  return fs3.readFileSync(p, "utf-8");
+  const p = path4.resolve(__dirname, "..", "..", "scaffolds", "statusline", name);
+  return fs4.readFileSync(p, "utf-8");
 }
 function writeScripts() {
-  fs3.mkdirSync(LK_DIR, { recursive: true });
-  fs3.writeFileSync(WRAPPER_PATH, readScaffold("statusline-wrapper.sh"), { mode: 493 });
-  fs3.writeFileSync(CHIP_PATH, readScaffold("statusline-mcp.sh"), { mode: 493 });
+  fs4.mkdirSync(LK_DIR, { recursive: true });
+  fs4.writeFileSync(WRAPPER_PATH, readScaffold("statusline-wrapper.sh"), { mode: 493 });
+  fs4.writeFileSync(CHIP_PATH, readScaffold("statusline-mcp.sh"), { mode: 493 });
 }
 function wrapperCommand(opts) {
   const env = [];
@@ -115,103 +326,708 @@ function deactivateStatusline() {
   writeSettings(restored);
   for (const p of [WRAPPER_PATH, CHIP_PATH]) {
     try {
-      fs3.unlinkSync(p);
+      fs4.unlinkSync(p);
     } catch {
     }
   }
   return { ok: true, outcome: "deactivated", message: "restored original statusLine.command" };
 }
-var fs3, path3, import_node_os, LK_DIR, WRAPPER_PATH, CHIP_PATH, SETTINGS_PATH, ORIGINAL_KEY;
+var fs4, path4, import_node_os, LK_DIR, WRAPPER_PATH, CHIP_PATH, SETTINGS_PATH, ORIGINAL_KEY;
 var init_statusline_install = __esm({
   "src/server/statusline-install.ts"() {
     "use strict";
-    fs3 = __toESM(require("node:fs"));
-    path3 = __toESM(require("node:path"));
+    fs4 = __toESM(require("node:fs"));
+    path4 = __toESM(require("node:path"));
     import_node_os = require("node:os");
-    LK_DIR = path3.join((0, import_node_os.homedir)(), ".launchsecure");
-    WRAPPER_PATH = path3.join(LK_DIR, "statusline-wrapper.sh");
-    CHIP_PATH = path3.join(LK_DIR, "statusline-mcp.sh");
-    SETTINGS_PATH = path3.join((0, import_node_os.homedir)(), ".claude", "settings.json");
+    LK_DIR = path4.join((0, import_node_os.homedir)(), ".launchsecure");
+    WRAPPER_PATH = path4.join(LK_DIR, "statusline-wrapper.sh");
+    CHIP_PATH = path4.join(LK_DIR, "statusline-mcp.sh");
+    SETTINGS_PATH = path4.join((0, import_node_os.homedir)(), ".claude", "settings.json");
     ORIGINAL_KEY = "_launchKitStatuslineOriginal";
   }
 });
 
-// src/server/init-entry.ts
-var import_node_child_process = require("node:child_process");
-var crypto = __toESM(require("node:crypto"));
-var fs4 = __toESM(require("node:fs"));
-var import_node_http = require("node:http");
-var import_node_https = require("node:https");
-var path4 = __toESM(require("node:path"));
-var readline = __toESM(require("node:readline"));
-var import_node_url = require("node:url");
-
-// src/server/cred-shape.ts
-var fs = __toESM(require("node:fs"));
-var path = __toESM(require("node:path"));
-var CONFIG_FILENAME = ".launch-secure.cred.config";
-function inferCourseName(serverUrl) {
+// src/server/radar/mcp.ts
+function parseBody(text) {
+  if (!text) return {};
+  if (text.startsWith("event:") || text.includes("\ndata: ")) {
+    for (const line of text.split("\n")) {
+      if (line.startsWith("data: ")) {
+        try {
+          return JSON.parse(line.slice(6));
+        } catch {
+        }
+      }
+    }
+  }
   try {
-    const host = new URL(serverUrl).hostname.toLowerCase();
-    if (host === "localhost" || host === "127.0.0.1" || host.endsWith(".local")) return "local";
-    if (host.includes("staging")) return "staging";
-    if (host.endsWith(".vercel.app")) return "prod";
-    return host.split(".")[0] || "default";
+    return JSON.parse(text);
   } catch {
-    return "default";
+    return {};
   }
 }
-function toNested(cred) {
-  if (cred.profiles && cred.active && cred.profiles[cred.active]) {
-    return { active: cred.active, profiles: cred.profiles };
+var import_node_https2, import_node_http2, ProjectMcpClient;
+var init_mcp = __esm({
+  "src/server/radar/mcp.ts"() {
+    "use strict";
+    import_node_https2 = require("node:https");
+    import_node_http2 = require("node:http");
+    ProjectMcpClient = class {
+      constructor(opts) {
+        this.initialized = false;
+        this.callId = 1;
+        this.mcpUrl = new URL("/api/mcp/project", opts.serverUrl);
+        this.headers = {
+          "Content-Type": "application/json",
+          "Accept": "application/json, text/event-stream",
+          "Authorization": `Bearer ${opts.pat}`
+        };
+        if (opts.orgSlug) this.headers["X-Org-Slug"] = opts.orgSlug;
+        if (opts.projectSlug) this.headers["X-Project-Slug"] = opts.projectSlug;
+      }
+      async call(toolName, args) {
+        await this.ensureInitialized();
+        const body = JSON.stringify({
+          jsonrpc: "2.0",
+          id: this.callId++,
+          method: "tools/call",
+          params: { name: toolName, arguments: args }
+        });
+        const resp = await this.send(body);
+        const parsed = parseBody(resp.body);
+        if (parsed.error) {
+          throw new Error(`MCP ${toolName} failed: ${parsed.error.message ?? JSON.stringify(parsed.error)}`);
+        }
+        const text = parsed.result?.content?.[0]?.text;
+        if (!text) return parsed.result;
+        if (text.startsWith("\u2500\u2500 Error")) {
+          const lines = text.split("\n").map((l) => l.trim()).filter(Boolean);
+          const reason = lines.find((l) => !l.startsWith("\u2500\u2500")) ?? text;
+          throw new Error(`MCP ${toolName} failed: ${reason}`);
+        }
+        try {
+          return JSON.parse(text);
+        } catch {
+          return text;
+        }
+      }
+      async ensureInitialized() {
+        if (this.initialized) return;
+        const initBody = JSON.stringify({
+          jsonrpc: "2.0",
+          id: this.callId++,
+          method: "initialize",
+          params: {
+            protocolVersion: "2025-03-26",
+            capabilities: {},
+            clientInfo: { name: "launchpod-feedback-agent", version: "0.0.1" }
+          }
+        });
+        const initResp = await this.send(initBody);
+        if (initResp.sessionId) this.sessionId = initResp.sessionId;
+        const notifBody = JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" });
+        await this.send(notifBody);
+        this.initialized = true;
+      }
+      send(body) {
+        return new Promise((resolve3, reject) => {
+          const headers = {
+            ...this.headers,
+            "Content-Length": String(Buffer.byteLength(body))
+          };
+          if (this.sessionId) headers["Mcp-Session-Id"] = this.sessionId;
+          const requester = this.mcpUrl.protocol === "https:" ? import_node_https2.request : import_node_http2.request;
+          const req = requester(
+            {
+              host: this.mcpUrl.hostname,
+              port: this.mcpUrl.port || (this.mcpUrl.protocol === "https:" ? 443 : 80),
+              path: this.mcpUrl.pathname + this.mcpUrl.search,
+              method: "POST",
+              headers
+            },
+            (res) => {
+              const chunks = [];
+              res.on("data", (c2) => chunks.push(c2));
+              res.on("end", () => {
+                const text = Buffer.concat(chunks).toString("utf-8");
+                if (res.statusCode && res.statusCode >= 400) {
+                  reject(new Error(`MCP HTTP ${res.statusCode}: ${text}`));
+                  return;
+                }
+                const sid = res.headers["mcp-session-id"];
+                resolve3({ body: text, sessionId: typeof sid === "string" ? sid : void 0 });
+              });
+            }
+          );
+          req.on("error", reject);
+          req.write(body);
+          req.end();
+        });
+      }
+    };
   }
-  if (!cred.pat || !cred.orgSlug || !cred.projectSlug || !cred.serverUrl) {
-    return null;
+});
+
+// src/server/launch-kit-services.ts
+function defaultServices() {
+  return [expandShorthand("radar")];
+}
+function expandShorthand(name) {
+  const def = SHORTHANDS[name];
+  if (!def) {
+    throw new Error(
+      `[launch-kit-services] unknown shorthand "${name}" \u2014 known: ${Object.keys(SHORTHANDS).join(", ")}. Use an object entry { name, port, bin, args } for custom services.`
+    );
+  }
+  return { name, port: def.port, bin: def.bin, args: [...def.args] };
+}
+function coerceEntry(raw, index) {
+  if (typeof raw === "string") {
+    return expandShorthand(raw);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`[launch-kit-services] entry #${index} must be a string shorthand or an object`);
+  }
+  const r = raw;
+  if (typeof r.name !== "string" || typeof r.port !== "number" || typeof r.bin !== "string") {
+    throw new Error(`[launch-kit-services] entry #${index}: { name:string, port:number, bin:string } required`);
+  }
+  if (r.args !== void 0 && (!Array.isArray(r.args) || r.args.some((a) => typeof a !== "string"))) {
+    throw new Error(`[launch-kit-services] entry #${index}: args must be a string[]`);
   }
-  const name = inferCourseName(cred.serverUrl);
   return {
-    active: name,
-    profiles: {
-      [name]: {
-        pat: cred.pat,
-        orgSlug: cred.orgSlug,
-        projectSlug: cred.projectSlug,
-        serverUrl: cred.serverUrl
+    name: r.name,
+    port: r.port,
+    bin: r.bin,
+    args: r.args ?? []
+  };
+}
+function validate(services) {
+  if (services.length === 0) {
+    throw new Error(`[launch-kit-services] resolved an empty service list`);
+  }
+  const seenNames = /* @__PURE__ */ new Set();
+  const seenPorts = /* @__PURE__ */ new Set();
+  for (const s of services) {
+    if (!DNS_NAME_RE.test(s.name)) {
+      throw new Error(`[launch-kit-services] service name "${s.name}" is not DNS-safe (lowercase letters/digits/hyphens, \u226463 chars, no leading/trailing hyphen)`);
+    }
+    if (seenNames.has(s.name)) {
+      throw new Error(`[launch-kit-services] duplicate service name "${s.name}"`);
+    }
+    seenNames.add(s.name);
+    if (!Number.isInteger(s.port) || s.port < 1 || s.port > 65535) {
+      throw new Error(`[launch-kit-services] service "${s.name}" has invalid port ${s.port}`);
+    }
+    if (seenPorts.has(s.port)) {
+      throw new Error(`[launch-kit-services] duplicate port ${s.port} (services must each listen on a unique port)`);
+    }
+    seenPorts.add(s.port);
+  }
+  return services;
+}
+function resolveServices(opts = {}) {
+  const env = opts.env ?? process.env;
+  const cwd = opts.cwd ?? process.cwd();
+  const rawEnv = env.LAUNCHKIT_SERVICES?.trim();
+  if (rawEnv) {
+    let parsed;
+    try {
+      parsed = JSON.parse(rawEnv);
+    } catch (err) {
+      throw new Error(`[launch-kit-services] LAUNCHKIT_SERVICES is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!Array.isArray(parsed)) {
+      throw new Error(`[launch-kit-services] LAUNCHKIT_SERVICES must be a JSON array`);
+    }
+    return validate(parsed.map(coerceEntry));
+  }
+  const filePath = (0, import_node_path.join)(cwd, ".launchpod", "services.json");
+  if ((0, import_node_fs.existsSync)(filePath)) {
+    let parsed;
+    try {
+      parsed = JSON.parse((0, import_node_fs.readFileSync)(filePath, "utf8"));
+    } catch (err) {
+      throw new Error(`[launch-kit-services] ${filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!Array.isArray(parsed)) {
+      throw new Error(`[launch-kit-services] ${filePath} must be a JSON array`);
+    }
+    return validate(parsed.map(coerceEntry));
+  }
+  return validate(defaultServices());
+}
+var import_node_fs, import_node_path, SHORTHANDS, DNS_NAME_RE, SHORTHAND_NAMES;
+var init_launch_kit_services = __esm({
+  "src/server/launch-kit-services.ts"() {
+    "use strict";
+    import_node_fs = require("node:fs");
+    import_node_path = require("node:path");
+    SHORTHANDS = {
+      radar: { port: 3517, bin: "launch-radar", args: [] },
+      sequencer: { port: 3517, bin: "launch-sequencer", args: [] },
+      chart: { port: 52819, bin: "launch-chart", args: ["serve"] },
+      deck: { port: 52829, bin: "launch-deck", args: ["serve"] },
+      council: { port: 52839, bin: "launch-council", args: ["serve"] }
+    };
+    DNS_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+    SHORTHAND_NAMES = Object.keys(SHORTHANDS);
+  }
+});
+
+// src/server/cf-ingress.ts
+async function cf(opts) {
+  const res = await fetch(`${CF_API_BASE}${opts.path}`, {
+    method: opts.method,
+    headers: {
+      Authorization: `Bearer ${opts.apiToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": "launch-kit/cf-ingress"
+    },
+    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+    signal: AbortSignal.timeout(15e3)
+  });
+  const text = await res.text();
+  let parsed;
+  try {
+    parsed = text ? JSON.parse(text) : { success: false };
+  } catch {
+    throw new Error(`[cf] ${opts.method} ${opts.path} \u2192 ${res.status}, non-JSON body: ${text.slice(0, 200)}`);
+  }
+  return parsed;
+}
+function isNotFound(env) {
+  return !env.success && (env.errors ?? []).some((e) => e.code === 7003 || e.code === 1001 || e.code === 81044);
+}
+function loadState(path6) {
+  if (!(0, import_node_fs2.existsSync)(path6)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs2.readFileSync)(path6, "utf8"));
+    if (typeof parsed?.tunnelId === "string" && typeof parsed?.accountId === "string") {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function saveState(path6, state) {
+  const dir = (0, import_node_path2.dirname)(path6);
+  if (!(0, import_node_fs2.existsSync)(dir)) (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs2.writeFileSync)(path6, JSON.stringify(state, null, 2));
+}
+async function ensureTunnel(input, knownTunnelId) {
+  if (knownTunnelId) {
+    const got = await cf({
+      apiToken: input.apiToken,
+      method: "GET",
+      path: `/accounts/${input.accountId}/cfd_tunnel/${knownTunnelId}`
+    });
+    if (got.success && got.result && !got.result.deleted_at) {
+      return knownTunnelId;
+    }
+    if (!isNotFound(got) && !got.success) {
+      throw new Error(`[cf] tunnel GET failed: ${JSON.stringify(got.errors)}`);
+    }
+  }
+  const created = await cf({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/cfd_tunnel`,
+    body: { name: input.tunnelName, config_src: "cloudflare" }
+  });
+  if (!created.success || !created.result) {
+    throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
+  }
+  return created.result.id;
+}
+async function fetchConnectorToken(input, tunnelId) {
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/cfd_tunnel/${tunnelId}/token`
+  });
+  if (!res.success || typeof res.result !== "string") {
+    throw new Error(`[cf] connector-token fetch failed: ${JSON.stringify(res.errors)}`);
+  }
+  return res.result;
+}
+async function setIngressConfig(input, tunnelId) {
+  const ingress = input.services.map((s) => ({
+    hostname: `${s.name}.${input.zone.name}`,
+    service: `http://localhost:${s.port}`
+  }));
+  ingress.push({ service: "http_status:404" });
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "PUT",
+    path: `/accounts/${input.accountId}/cfd_tunnel/${tunnelId}/configurations`,
+    body: { config: { ingress } }
+  });
+  if (!res.success) {
+    throw new Error(`[cf] ingress config PUT failed: ${JSON.stringify(res.errors)}`);
+  }
+}
+async function ensureDnsRecord(input, tunnelId, service) {
+  const fqdn = `${service.name}.${input.zone.name}`;
+  const target = `${tunnelId}.cfargotunnel.com`;
+  const existing = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/zones/${input.zone.id}/dns_records?name=${encodeURIComponent(fqdn)}&type=CNAME`
+  });
+  if (existing.success && Array.isArray(existing.result) && existing.result.length > 0) {
+    const rec = existing.result[0];
+    if (rec.content === target) return;
+    const upd = await cf({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/zones/${input.zone.id}/dns_records/${rec.id}`,
+      body: { type: "CNAME", name: fqdn, content: target, proxied: true, ttl: 1 }
+    });
+    if (!upd.success) {
+      throw new Error(`[cf] DNS record update for ${fqdn} failed: ${JSON.stringify(upd.errors)}`);
+    }
+    return;
+  }
+  const created = await cf({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/zones/${input.zone.id}/dns_records`,
+    body: { type: "CNAME", name: fqdn, content: target, proxied: true, ttl: 1 }
+  });
+  if (created.success) return;
+  if ((created.errors ?? []).some((e) => e.code === CF_ERR_DNS_RECORD_EXISTS)) return;
+  throw new Error(`[cf] DNS record create for ${fqdn} failed: ${JSON.stringify(created.errors)}`);
+}
+async function provisionIngress(input) {
+  const prior = loadState(input.stateFile);
+  const tunnelId = await ensureTunnel(input, prior?.tunnelId ?? null);
+  saveState(input.stateFile, {
+    tunnelId,
+    accountId: input.accountId,
+    tunnelName: input.tunnelName,
+    zoneId: input.zone.id
+  });
+  const connectorToken = await fetchConnectorToken(input, tunnelId);
+  await setIngressConfig(input, tunnelId);
+  await Promise.all(input.services.map((s) => ensureDnsRecord(input, tunnelId, s)));
+  const hostnames = {};
+  for (const s of input.services) hostnames[s.name] = `${s.name}.${input.zone.name}`;
+  return { tunnelId, connectorToken, hostnames };
+}
+var import_node_fs2, import_node_path2, CF_API_BASE, CF_ERR_DNS_RECORD_EXISTS;
+var init_cf_ingress = __esm({
+  "src/server/cf-ingress.ts"() {
+    "use strict";
+    import_node_fs2 = require("node:fs");
+    import_node_path2 = require("node:path");
+    CF_API_BASE = "https://api.cloudflare.com/client/v4";
+    CF_ERR_DNS_RECORD_EXISTS = 81053;
+  }
+});
+
+// src/server/radar-docker-init-entry.ts
+var radar_docker_init_entry_exports = {};
+__export(radar_docker_init_entry_exports, {
+  maybeProvisionIngress: () => maybeProvisionIngress,
+  spawnServiceGroup: () => spawnServiceGroup
+});
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+function requireEnv(name) {
+  const v = process.env[name];
+  if (!v) fail(`ERROR: ${name} is required but not set`);
+  return v;
+}
+function run2(cmd, args, stdio = "inherit") {
+  const r = (0, import_node_child_process2.spawnSync)(cmd, args, { stdio });
+  return r.status ?? 1;
+}
+async function setupFromCloud() {
+  const pat = requireEnv("LS_PAT");
+  const orgSlug = requireEnv("LS_ORG_SLUG");
+  const projectSlug = requireEnv("LS_PROJECT_SLUG");
+  const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
+  const mcp = new ProjectMcpClient({ serverUrl, pat, orgSlug, projectSlug });
+  let bundle;
+  try {
+    bundle = await mcp.call("radar_bootstrap_get", {});
+  } catch (err) {
+    fail(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
+  }
+  if (!process.env.GIT_USER_NAME) process.env.GIT_USER_NAME = bundle.gitName;
+  if (!process.env.GIT_USER_EMAIL) process.env.GIT_USER_EMAIL = bundle.gitEmail;
+  if (!process.env.GH_TOKEN && bundle.githubToken) process.env.GH_TOKEN = bundle.githubToken;
+  if (!process.env.GH_TOKEN) {
+    fail(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
+  }
+  const cfNote = bundle.cloudflareToken ? "cloudflare=connected" : "cloudflare=none";
+  console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
+  return bundle;
+}
+function setupClaudeCredentials() {
+  const home = process.env.HOME ?? "/home/launchpod";
+  const claudeDir = (0, import_node_path3.join)(home, ".claude");
+  (0, import_node_fs3.mkdirSync)(claudeDir, { recursive: true });
+  const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
+  const credsPath = (0, import_node_path3.join)(claudeDir, ".credentials.json");
+  (0, import_node_fs3.writeFileSync)(credsPath, decoded);
+  (0, import_node_fs3.chmodSync)(credsPath, 384);
+  const configPath = (0, import_node_path3.join)(home, ".claude.json");
+  let cfg = {};
+  if ((0, import_node_fs3.existsSync)(configPath)) {
+    try {
+      cfg = JSON.parse((0, import_node_fs3.readFileSync)(configPath, "utf8"));
+    } catch {
+      cfg = {};
+    }
+  }
+  cfg.hasCompletedOnboarding = true;
+  cfg.lastOnboardingVersion = cfg.lastOnboardingVersion ?? "2.1.159";
+  cfg.numStartups = (cfg.numStartups ?? 0) + 1;
+  cfg.installMethod = cfg.installMethod ?? "global";
+  (0, import_node_fs3.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
+  (0, import_node_fs3.chmodSync)(configPath, 384);
+}
+function setupGitAndGh() {
+  const name = process.env.GIT_USER_NAME ?? "Radar Bot";
+  const email = process.env.GIT_USER_EMAIL ?? "radar@launchpod.local";
+  const status = run2("launch-kit", ["setup-git", `--identity=${name} <${email}>`]);
+  if (status !== 0) fail(`[entrypoint] launch-kit setup-git failed (status ${status})`);
+}
+function initWorkspaceIfEmpty() {
+  process.chdir("/workspace");
+  if ((0, import_node_fs3.existsSync)(".git")) {
+    console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
+    return;
+  }
+  console.log("[entrypoint] /workspace is empty \u2014 running launch-kit init");
+  const status = run2("launch-kit", [
+    "init",
+    `--token=${requireEnv("LS_PAT")}`,
+    `--org=${requireEnv("LS_ORG_SLUG")}`,
+    `--project=${requireEnv("LS_PROJECT_SLUG")}`,
+    `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
+    `--dir=/workspace`
+  ]);
+  if (status !== 0) fail(`[entrypoint] launch-kit init failed (status ${status})`);
+}
+async function maybeProvisionIngress(bundle, services, projectSlug) {
+  const token = bundle.cloudflareToken ?? null;
+  const accountId = bundle.cloudflareAccountId ?? null;
+  const zones = bundle.cloudflareZones ?? [];
+  if (!token && !accountId && zones.length === 0) return null;
+  if (!token || !accountId) {
+    fail(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
+  }
+  const baseDomain = process.env.LAUNCHKIT_CF_BASE_DOMAIN?.trim();
+  let chosen = null;
+  if (baseDomain) {
+    chosen = zones.find((z) => z.name === baseDomain) ?? null;
+    if (!chosen) {
+      fail(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
+    }
+  } else if (zones.length === 1) {
+    chosen = { id: zones[0].id, name: zones[0].name };
+  } else {
+    fail(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
+  }
+  const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
+  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => s.name).join(",")}`);
+  const result = await provisionIngress({
+    apiToken: token,
+    accountId,
+    zone: chosen,
+    tunnelName: `launch-kit-${projectSlug}`,
+    services: services.map((s) => ({ name: s.name, port: s.port })),
+    stateFile
+  });
+  for (const [name, fqdn] of Object.entries(result.hostnames)) {
+    console.log(`[entrypoint]   ${name} \u2192 https://${fqdn}`);
+  }
+  return result;
+}
+function spawnServiceGroup(services) {
+  const children = [];
+  let shuttingDown = false;
+  const killAll = (signal = "SIGTERM") => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    for (const c2 of children) {
+      try {
+        c2.proc.kill(signal);
+      } catch {
       }
     }
   };
-}
-function upsertProfile(existing, name, profile) {
-  const base = existing ? toNested(existing) ?? { active: name, profiles: {} } : { active: name, profiles: {} };
-  return {
-    active: name,
-    profiles: { ...base.profiles, [name]: profile }
+  const prefixStream = (name, stream, sink) => {
+    let buf = "";
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+      buf += chunk;
+      const lines = buf.split("\n");
+      buf = lines.pop() ?? "";
+      for (const line of lines) sink.write(`[${name}] ${line}
+`);
+    });
+    stream.on("end", () => {
+      if (buf) sink.write(`[${name}] ${buf}
+`);
+    });
+  };
+  const signalHandlers = [];
+  const installSignals = () => {
+    for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+      const fn = () => {
+        console.log(`[entrypoint] received ${sig} \u2014 forwarding to ${children.length} child process(es)`);
+        killAll(sig);
+      };
+      process.on(sig, fn);
+      signalHandlers.push({ sig, fn });
+    }
+  };
+  const removeSignals = () => {
+    for (const h of signalHandlers) process.off(h.sig, h.fn);
+    signalHandlers.length = 0;
   };
+  return new Promise((resolve3, reject) => {
+    let exitedCount = 0;
+    let firstFailure = null;
+    for (const spec of services) {
+      const args = [...spec.args, "--port", String(spec.port)];
+      console.log(`[entrypoint] starting ${spec.name}: ${spec.bin} ${args.join(" ")}`);
+      const proc = (0, import_node_child_process2.spawn)(spec.bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+      children.push({ spec, proc });
+      if (proc.stdout) prefixStream(spec.name, proc.stdout, process.stdout);
+      if (proc.stderr) prefixStream(spec.name, proc.stderr, process.stderr);
+      proc.on("exit", (code, signal) => {
+        exitedCount += 1;
+        const label = `[${spec.name}] exited code=${code ?? "?"} signal=${signal ?? "-"}`;
+        if (!shuttingDown && code !== 0) {
+          console.error(`[entrypoint] ${label} \u2014 bringing the group down`);
+          if (!firstFailure) firstFailure = { name: spec.name, code, signal };
+          killAll();
+        } else {
+          console.log(`[entrypoint] ${label}`);
+        }
+        if (exitedCount === children.length) {
+          if (firstFailure) reject(new Error(`service "${firstFailure.name}" exited code=${firstFailure.code ?? "?"}`));
+          else resolve3();
+        }
+      });
+      proc.on("error", (err) => {
+        console.error(`[entrypoint] [${spec.name}] spawn error: ${err.message}`);
+        if (!firstFailure) firstFailure = { name: spec.name, code: null, signal: null };
+        killAll();
+      });
+    }
+    installSignals();
+  }).finally(removeSignals);
 }
-function readCredFile(repoRoot) {
-  const p = path.join(repoRoot, CONFIG_FILENAME);
-  if (!fs.existsSync(p)) return null;
+async function main() {
+  for (const k of REQUIRED_ENV) requireEnv(k);
+  const bundle = await setupFromCloud();
+  setupClaudeCredentials();
+  setupGitAndGh();
+  initWorkspaceIfEmpty();
+  let services;
   try {
-    return JSON.parse(fs.readFileSync(p, "utf-8"));
+    services = resolveServices();
   } catch (err) {
-    throw new Error(`could not parse ${CONFIG_FILENAME}: ${err instanceof Error ? err.message : String(err)}`);
+    fail(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
+  }
+  console.log(`[entrypoint] services: ${services.map((s) => `${s.name}@${s.port}`).join(", ")}`);
+  const ingress = await maybeProvisionIngress(bundle, services, requireEnv("LS_PROJECT_SLUG"));
+  if (ingress) {
+    process.env.RADAR_CF_TUNNEL_TOKEN = ingress.connectorToken;
+    const radarFqdn = ingress.hostnames.radar;
+    if (radarFqdn) process.env.RADAR_CF_TUNNEL_HOSTNAME = radarFqdn;
+    else if (services.some((s) => s.name === "radar")) {
+      fail(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
+    }
+  } else if (services.length > 1) {
+    const first = services[0];
+    console.warn(
+      `[entrypoint] \u26A0 quick mode \u2014 only the first service "${first.name}" (port ${first.port}) will be exposed via the ephemeral *.trycloudflare.com URL. Other service(s) [${services.slice(1).map((s) => s.name).join(", ")}] will run on localhost inside the container only. Connect a Cloudflare provider in LS and set LAUNCHKIT_CF_BASE_DOMAIN to expose all services with stable subdomains.`
+    );
+    if (first.name !== "radar") {
+      console.warn(`[entrypoint] \u26A0 first service is "${first.name}", not "radar" \u2014 quick tunneling is owned by the radar agent today, so NO external URL will be available.`);
+    }
+  }
+  try {
+    await spawnServiceGroup(services);
+    process.exit(0);
+  } catch (err) {
+    console.error(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
   }
 }
-function writeJsonAtomic(absPath, value, mode) {
-  const tmp = `${absPath}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", "utf-8");
-  if (mode !== void 0) {
-    try {
-      fs.chmodSync(tmp, mode);
-    } catch {
+var import_node_child_process2, import_node_fs3, import_node_path3, REQUIRED_ENV;
+var init_radar_docker_init_entry = __esm({
+  "src/server/radar-docker-init-entry.ts"() {
+    "use strict";
+    import_node_child_process2 = require("node:child_process");
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
+    init_mcp();
+    init_launch_kit_services();
+    init_cf_ingress();
+    REQUIRED_ENV = [
+      "CLAUDE_CREDENTIALS_B64",
+      "LS_PAT",
+      "LS_ORG_SLUG",
+      "LS_PROJECT_SLUG"
+    ];
+    if (!process.env.VITEST) {
+      main().catch((err) => {
+        console.error(`[entrypoint] fatal: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      });
     }
   }
-  fs.renameSync(tmp, absPath);
+});
+
+// src/server/init-entry.ts
+var import_node_child_process3 = require("node:child_process");
+var crypto = __toESM(require("node:crypto"));
+var fs5 = __toESM(require("node:fs"));
+var import_node_http3 = require("node:http");
+var import_node_https3 = require("node:https");
+var path5 = __toESM(require("node:path"));
+var readline = __toESM(require("node:readline"));
+var import_node_url2 = require("node:url");
+init_cred_shape();
+
+// src/server/git-bot-config.ts
+var import_node_child_process = require("node:child_process");
+function run(cmd, args, stdio = "inherit") {
+  return (0, import_node_child_process.spawnSync)(cmd, args, { stdio }).status ?? 1;
+}
+function configureGitForBot(identity) {
+  if (process.env.GH_TOKEN) {
+    run("gh", ["auth", "setup-git"]);
+  }
+  run("git", ["config", "--global", "user.name", identity.name]);
+  run("git", ["config", "--global", "user.email", identity.email]);
+  run("git", ["config", "--global", "init.defaultBranch", "main"]);
+  run("git", ["config", "--global", "pull.rebase", "false"]);
+}
+function parseGitIdentityFlag(value, flagName = "--git-identity") {
+  const m = value.match(/^\s*(.+?)\s*<\s*([^>]+?)\s*>\s*$/);
+  if (!m) {
+    throw new Error(`${flagName} must be in the form "Name <email>" (got: ${value})`);
+  }
+  return { name: m[1], email: m[2] };
 }
 
 // src/server/cred-recovery.ts
 var fs2 = __toESM(require("node:fs"));
 var path2 = __toESM(require("node:path"));
+init_cred_shape();
 var LEGACY_CONFIG_FILENAME = ".launch-secure.config";
 function migrateLegacyCredFile(targetDir, opts) {
   const legacy = path2.join(targetDir, LEGACY_CONFIG_FILENAME);
@@ -292,6 +1108,7 @@ function recoverCred(targetDir, opts) {
 }
 
 // src/server/init-entry.ts
+init_secrets_pull();
 init_statusline_install();
 var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
 var ONBOARD_SCRIPT_NAME = "onboard";
@@ -349,8 +1166,8 @@ Wired in Claude Code (.mcp.json):
   launch-recall   \u2014 restore deleted/modified files from shadow git
 
 Other tools (run on demand via npx):
-  npx launch-pod radar       \u2014 webhook listener (LS pings \u2192 terminal/UI)
-  npx launch-pod             \u2014 full pipeline UI (separate launch-pod login)
+  npx launch-radar           \u2014 webhook listener (LS pings \u2192 terminal/UI)
+  npx launch-sequencer       \u2014 full pipeline UI (separate sequencer login)
   npx launch-beacon monitor  \u2014 local HTTP receiver for the launch-kit-beacon
                                in-browser monitor. Paste the printed URL into
                                the beacon debug panel; events stream to
@@ -363,12 +1180,12 @@ var LAUNCH_KIT_TOOLS_GUIDE_STATIC_TAIL = `
 `;
 function listEntries(dir, kind) {
   if (kind === "commands") {
-    return fs4.readdirSync(dir).filter((f) => f.endsWith(".md")).sort().map((f) => ({ name: f.replace(/\.md$/, ""), file: path4.join(dir, f) }));
+    return fs5.readdirSync(dir).filter((f) => f.endsWith(".md")).sort().map((f) => ({ name: f.replace(/\.md$/, ""), file: path5.join(dir, f) }));
   }
-  return fs4.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && fs4.existsSync(path4.join(dir, e.name, "SKILL.md"))).map((e) => e.name).sort().map((name) => ({ name, file: path4.join(dir, name, "SKILL.md") }));
+  return fs5.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() && fs5.existsSync(path5.join(dir, e.name, "SKILL.md"))).map((e) => e.name).sort().map((name) => ({ name, file: path5.join(dir, name, "SKILL.md") }));
 }
 function renderEntries(dir, kind) {
-  if (!fs4.existsSync(dir)) return `
+  if (!fs5.existsSync(dir)) return `
 LS slash ${kind}: (scaffold dir not bundled \u2014 this is a packaging bug)
 `;
   const entries = listEntries(dir, kind);
@@ -378,7 +1195,7 @@ LS slash ${kind}: (none defined)
   const names = entries.map((e) => `/${PLUGIN_ID}:${e.name}`);
   const colWidth = Math.max(26, ...names.map((n) => n.length + 2));
   const lines = entries.map((entry, i) => {
-    const text = fs4.readFileSync(entry.file, "utf-8");
+    const text = fs5.readFileSync(entry.file, "utf-8");
     const fmMatch = text.match(/^---\r?\n([\s\S]*?)\r?\n---/);
     const desc = fmMatch?.[1].match(/^description:\s*(.+)$/m)?.[1]?.trim() ?? "";
     return `  ${names[i].padEnd(colWidth)} \u2014 ${desc}`;
@@ -389,8 +1206,8 @@ ${lines.join("\n")}
 `;
 }
 function renderLsCommandsSection() {
-  const base = path4.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace", "plugins", "kit");
-  return renderEntries(path4.join(base, "commands"), "commands") + renderEntries(path4.join(base, "skills"), "skills");
+  const base = path5.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace", "plugins", "kit");
+  return renderEntries(path5.join(base, "commands"), "commands") + renderEntries(path5.join(base, "skills"), "skills");
 }
 function getLaunchKitToolsGuide() {
   return `${LAUNCH_KIT_TOOLS_GUIDE_STATIC_HEAD}${renderLsCommandsSection()}${LAUNCH_KIT_TOOLS_GUIDE_STATIC_TAIL}`;
@@ -418,7 +1235,7 @@ var KNOWN_BOOL_FLAGS = /* @__PURE__ */ new Set([
   "--guide",
   "--no-guide"
 ]);
-var KNOWN_KV_KEYS = /* @__PURE__ */ new Set(["token", "org", "project", "url", "dir", "course"]);
+var KNOWN_KV_KEYS = /* @__PURE__ */ new Set(["token", "org", "project", "url", "dir", "course", "git-identity"]);
 function parseArgs(argv) {
   const args = {
     token: process.env.LS_PAT ?? null,
@@ -426,6 +1243,7 @@ function parseArgs(argv) {
     projectSlug: null,
     serverUrl: DEFAULT_SERVER_URL,
     targetDir: null,
+    gitIdentity: null,
     course: null,
     noInstall: false,
     noOnboard: false,
@@ -529,6 +1347,14 @@ function parseArgs(argv) {
         args.course = val;
         continue;
       }
+      if (key === "git-identity") {
+        try {
+          args.gitIdentity = parseGitIdentityFlag(val);
+        } catch (err) {
+          fail2(err instanceof Error ? err.message : String(err));
+        }
+        continue;
+      }
       unknown.push(raw);
       continue;
     }
@@ -541,7 +1367,7 @@ function parseArgs(argv) {
   if (unknown.length > 0) {
     const knownBool = [...KNOWN_BOOL_FLAGS].join(", ");
     const knownKv = [...KNOWN_KV_KEYS].map((k) => `--${k}=<value>`).join(", ");
-    fail(`Unknown argument(s): ${unknown.join(" ")}
+    fail2(`Unknown argument(s): ${unknown.join(" ")}
   Known boolean flags: ${knownBool}
   Known key=value flags: ${knownKv}`);
   }
@@ -594,6 +1420,12 @@ Subcommands:
   init                  Bootstrap a new project (clone, cred file, MCP, scaffolds, install)
   refresh               Re-apply scaffolds + MCP entries in an already-initialized project
                         (no clone, no install, no PAT prompt \u2014 see \`launch-kit refresh --help\`)
+  setup-git             Configure git identity + gh credential helper in one
+                        shot. Use in containers / CI where init isn't needed.
+                        \`launch-kit setup-git --identity="Name <email>"\`.
+  secrets pull          Fetch decrypted secrets from cloud LS and write a .env file.
+                        Env resolved from --env \u2192 $LS_ENV \u2192 server-side project default \u2192
+                        single-env auto-pick. See \`launch-kit secrets --help\`.
   statusline activate   Wrap ~/.claude/settings.json's statusLine.command so MCP daemon
                         chips (recall, chart, deck, council) get appended. Refuses to
                         create one if none exists \u2014 additive only.
@@ -618,6 +1450,12 @@ Options:
                            becomes active; re-run with a different --course
                            and --url to add another (e.g. local + staging).
                            Use \`launch-course set <name>\` to switch later.
+  --git-identity="N <e>"   Non-interactive git identity for service-account /
+                           CI / Docker runs. Configures git user.name, user.email,
+                           init.defaultBranch=main, pull.rebase=false; also
+                           wires GH_TOKEN into git's credential helper via
+                           \`gh auth setup-git\` when GH_TOKEN is set. Example:
+                           --git-identity="Radar Bot <radar@launchpod.local>".
   --no-install             Skip dependency install step (also skips the onboard
                            script \u2014 install is its prerequisite).
   --no-onboard             Skip the onboard script even when install runs.
@@ -695,7 +1533,7 @@ async function prompt(question) {
     resolve3(answer.trim());
   }));
 }
-function fail(msg) {
+function fail2(msg) {
   console.error(`[launch-kit] \u2717 ${msg}`);
   process.exit(1);
 }
@@ -711,14 +1549,14 @@ function dryNote(msg) {
   console.log(`[launch-kit] (dry-run) ${msg}`);
 }
 function which(bin) {
-  const res = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
+  const res = (0, import_node_child_process3.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
   if (res.status !== 0) return null;
   return res.stdout.split(/\r?\n/)[0]?.trim() || null;
 }
 function preflight() {
   const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
-  if (nodeMajor < 18) fail(`Node.js >= 18 required (current: ${process.versions.node}).`);
-  if (!which("git")) fail("git not found in PATH. Install git: https://git-scm.com/downloads");
+  if (nodeMajor < 18) fail2(`Node.js >= 18 required (current: ${process.versions.node}).`);
+  if (!which("git")) fail2("git not found in PATH. Install git: https://git-scm.com/downloads");
   const hasGh = which("gh") !== null;
   ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh ? ", gh present" : ", gh not found (will use git for clone)"}`);
   return { hasGh };
@@ -734,7 +1572,7 @@ var ProjectInfoHttpError = class extends Error {
 };
 function attemptProjectInfo(args) {
   return new Promise((resolve3, reject) => {
-    const mcpUrl = new import_node_url.URL("/api/mcp/project", args.serverUrl);
+    const mcpUrl = new import_node_url2.URL("/api/mcp/project", args.serverUrl);
     const body = JSON.stringify({
       jsonrpc: "2.0",
       id: 1,
@@ -744,7 +1582,7 @@ function attemptProjectInfo(args) {
         arguments: { org_slug: args.orgSlug, project_slug: args.projectSlug }
       }
     });
-    const requester = mcpUrl.protocol === "https:" ? import_node_https.request : import_node_http.request;
+    const requester = mcpUrl.protocol === "https:" ? import_node_https3.request : import_node_http3.request;
     const req = requester(
       {
         host: mcpUrl.hostname,
@@ -852,7 +1690,7 @@ async function callProjectInfo(args) {
   throw lastErr;
 }
 function gitRemoteUrl(dir) {
-  const res = (0, import_node_child_process.spawnSync)("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf-8" });
+  const res = (0, import_node_child_process3.spawnSync)("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf-8" });
   if (res.status !== 0) return null;
   return res.stdout.trim() || null;
 }
@@ -861,18 +1699,18 @@ function normalizeRepoUrl(url) {
   const sshMatch = u.match(/^git@([^:]+):(.+)$/);
   if (sshMatch) u = `https://${sshMatch[1]}/${sshMatch[2]}`;
   try {
-    const parsed = new import_node_url.URL(u);
+    const parsed = new import_node_url2.URL(u);
     return `${parsed.protocol}//${parsed.host.toLowerCase()}${parsed.pathname}`;
   } catch {
     return u;
   }
 }
 function isGitRepo(dir) {
-  return fs4.existsSync(path4.join(dir, ".git"));
+  return fs5.existsSync(path5.join(dir, ".git"));
 }
 function dirIsEmpty(dir) {
-  if (!fs4.existsSync(dir)) return true;
-  return fs4.readdirSync(dir).length === 0;
+  if (!fs5.existsSync(dir)) return true;
+  return fs5.readdirSync(dir).length === 0;
 }
 function cloneRepo(repoUrl, targetDir, hasGh) {
   const isGithub = /github\.com/i.test(repoUrl);
@@ -891,20 +1729,20 @@ function cloneRepo(repoUrl, targetDir, hasGh) {
     dryNote(`would run: ${cmd} ${args.join(" ")}`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(cmd, args, { stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(cmd, args, { stdio: "inherit" });
   if (res.status !== 0) {
-    fail(
+    fail2(
       `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\` or an SSH key on your GitHub account.`
     );
   }
-  if (!fs4.existsSync(path4.join(targetDir, ".git"))) {
-    fail(`Clone reported success but .git is missing at ${targetDir}. Possible partial clone, filesystem issue, or sandboxing \u2014 investigate manually.`);
+  if (!fs5.existsSync(path5.join(targetDir, ".git"))) {
+    fail2(`Clone reported success but .git is missing at ${targetDir}. Possible partial clone, filesystem issue, or sandboxing \u2014 investigate manually.`);
   }
   ok(`cloned to ${targetDir}`);
 }
 function writeConfigFile(targetDir, cfg, courseName) {
   recoverCred(targetDir, getRecoveryOptions());
-  const p = path4.join(targetDir, CONFIG_FILENAME);
+  const p = path5.join(targetDir, CONFIG_FILENAME);
   const existing = readCredFile(targetDir);
   const isNew = existing === null;
   const isUpdate = !isNew && Boolean(existing?.profiles?.[courseName]);
@@ -923,15 +1761,15 @@ function getRecoveryOptions() {
   return { dryRun: DRY_RUN, log: recoveryLog };
 }
 function detectExistingBootstrap(targetDir) {
-  if (!fs4.existsSync(path4.join(targetDir, CONFIG_FILENAME))) {
+  if (!fs5.existsSync(path5.join(targetDir, CONFIG_FILENAME))) {
     return { bootstrapped: false };
   }
-  const mcpPath = path4.join(targetDir, ".mcp.json");
-  if (!fs4.existsSync(mcpPath)) {
+  const mcpPath = path5.join(targetDir, ".mcp.json");
+  if (!fs5.existsSync(mcpPath)) {
     return { bootstrapped: false };
   }
   try {
-    const mcp = JSON.parse(fs4.readFileSync(mcpPath, "utf-8"));
+    const mcp = JSON.parse(fs5.readFileSync(mcpPath, "utf-8"));
     if (mcp.mcpServers?.["launch-secure"]) {
       return { bootstrapped: true, reason: `${CONFIG_FILENAME} present + launch-secure MCP entry in .mcp.json` };
     }
@@ -949,13 +1787,7 @@ function buildLaunchKitMcpEntries(cfg) {
     },
     "launch-chart": {
       command: "npx",
-      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"],
-      // Tells launch-chart to also start its HTTP UI alongside the MCP, so
-      // users can open the chart viewer at localhost:<port> while queries
-      // hit the MCP. Without this, the MCP runs passively (queries work,
-      // no UI). I4 deep-merge preserves user-added env keys; this default
-      // ensures the auto-serve UX ships out of the box.
-      env: { LAUNCH_CHART_AUTOSERVE: "1" }
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"]
     },
     "launch-deck": {
       command: "npx",
@@ -988,14 +1820,14 @@ function mergeMcpEntry(existing, ours) {
   return merged;
 }
 function mergeMcpFile(targetDir, launchKitEntries) {
-  const p = path4.join(targetDir, ".mcp.json");
-  const hadExisting = fs4.existsSync(p);
+  const p = path5.join(targetDir, ".mcp.json");
+  const hadExisting = fs5.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail2(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const existingServerCount = Object.keys(existing.mcpServers ?? {}).length;
@@ -1017,17 +1849,17 @@ function mergeMcpFile(targetDir, launchKitEntries) {
     dryNote(`${action} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}]`);
     return { status: "skipped", summary: "(dry-run)" };
   }
-  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs5.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   const verb = hadExisting && existingServerCount > 0 ? "merged" : "wrote";
   ok(`${verb === "merged" ? "merged into" : "wrote"} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
   const total = Object.keys(launchKitEntries).length;
   return { status: "ok", summary: `${verb} ${total} entries` };
 }
 function detectPackageManager(repoDir) {
-  const pkgPath = path4.join(repoDir, "package.json");
-  if (!fs4.existsSync(pkgPath)) return null;
+  const pkgPath = path5.join(repoDir, "package.json");
+  if (!fs5.existsSync(pkgPath)) return null;
   try {
-    const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
     if (typeof pkg.packageManager === "string") {
       const name = pkg.packageManager.split("@")[0];
       const match = PACKAGE_MANAGERS.find((p) => p.name === name);
@@ -1036,7 +1868,7 @@ function detectPackageManager(repoDir) {
     }
   } catch {
   }
-  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs4.existsSync(path4.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
+  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs5.existsSync(path5.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
   if (matches.length === 1) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile}` };
   }
@@ -1045,8 +1877,8 @@ function detectPackageManager(repoDir) {
     return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile} (multiple present)` };
   }
   for (const pm of PACKAGE_MANAGERS) {
-    if (pm.workspaceFiles?.some((wf) => fs4.existsSync(path4.join(repoDir, wf)))) {
-      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs4.existsSync(path4.join(repoDir, wf)))})` };
+    if (pm.workspaceFiles?.some((wf) => fs5.existsSync(path5.join(repoDir, wf)))) {
+      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs5.existsSync(path5.join(repoDir, wf)))})` };
     }
   }
   const npm = PACKAGE_MANAGERS.find((p) => p.name === "npm");
@@ -1055,8 +1887,8 @@ function detectPackageManager(repoDir) {
 function runInstall(repoDir, detected) {
   const { pm } = detected;
   if (!which(pm.binary)) {
-    fail(
-      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path4.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+    fail2(
+      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path5.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
     );
   }
   info(`running ${pm.binary} ${pm.installArgs.join(" ")} \u2026`);
@@ -1064,24 +1896,24 @@ function runInstall(repoDir, detected) {
     dryNote(`would run: ${pm.binary} ${pm.installArgs.join(" ")} (cwd: ${repoDir})`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    fail(
+    fail2(
       `${pm.name} install failed (exit ${res.status}).
 
 Half-init state \u2014 install didn't complete, but these files ARE on disk:
-  - ${path4.join(repoDir, CONFIG_FILENAME)} (cred file)
-  - ${path4.join(repoDir, ".mcp.json")} (5 launch-kit MCP entries merged)
-  - ${path4.join(repoDir, ".gitignore")} (cred line appended)
+  - ${path5.join(repoDir, CONFIG_FILENAME)} (cred file)
+  - ${path5.join(repoDir, ".mcp.json")} (5 launch-kit MCP entries merged)
+  - ${path5.join(repoDir, ".gitignore")} (cred line appended)
   - clone at ${repoDir}
 
 Scaffolds (recall, migrate-safety, marketplace, recall-hook) were NOT yet written.
 
 To retry install only:
-  cd ${path4.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}
+  cd ${path5.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}
 
 To re-run init after fixing the install error:
-  cd ${path4.basename(repoDir)} && npx @launchsecure/launch-kit init --dir=.
+  cd ${path5.basename(repoDir)} && npx @launchsecure/launch-kit init --dir=.
 
 To fully reset: delete the files listed above and the clone, then re-init.`
     );
@@ -1089,10 +1921,10 @@ To fully reset: delete the files listed above and the clone, then re-init.`
   ok(`${pm.name} install complete`);
 }
 function hasOnboardScript(repoDir) {
-  const pkgPath = path4.join(repoDir, "package.json");
-  if (!fs4.existsSync(pkgPath)) return false;
+  const pkgPath = path5.join(repoDir, "package.json");
+  if (!fs5.existsSync(pkgPath)) return false;
   try {
-    const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
     return typeof pkg.scripts?.[ONBOARD_SCRIPT_NAME] === "string";
   } catch {
     return false;
@@ -1100,17 +1932,17 @@ function hasOnboardScript(repoDir) {
 }
 function runRecallInit(repoDir) {
   info(`scaffolding launch-recall (shadow git backup) \u2026`);
-  const recallEntry = path4.resolve(__dirname, "recall-entry.js");
-  const useSibling = fs4.existsSync(recallEntry);
+  const recallEntry = path5.resolve(__dirname, "recall-entry.js");
+  const useSibling = fs5.existsSync(recallEntry);
   const cmd = useSibling ? process.execPath : "npx";
   const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "init"];
   if (DRY_RUN) {
     dryNote(`would run launch-recall init: ${cmd} ${args.join(" ")} (cwd: ${repoDir})`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path4.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
+    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path5.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
     return;
   }
   ok(`launch-recall ready (shadow git initialized)`);
@@ -1121,17 +1953,17 @@ function runOnboard(repoDir, pm) {
     dryNote(`would run: ${pm.binary} run ${ONBOARD_SCRIPT_NAME} (cwd: ${repoDir})`);
     return;
   }
-  const res = (0, import_node_child_process.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
+  const res = (0, import_node_child_process3.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    fail(
-      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path4.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
+    fail2(
+      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path5.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
     );
   }
   ok(`${ONBOARD_SCRIPT_NAME} script complete`);
 }
 function ensureGitignoreLine(targetDir, line) {
-  const p = path4.join(targetDir, ".gitignore");
-  let content = fs4.existsSync(p) ? fs4.readFileSync(p, "utf-8") : "";
+  const p = path5.join(targetDir, ".gitignore");
+  let content = fs5.existsSync(p) ? fs5.readFileSync(p, "utf-8") : "";
   const lines = content.split(/\r?\n/);
   if (lines.some((l) => l.trim() === line)) return;
   if (content.length && !content.endsWith("\n")) content += "\n";
@@ -1141,28 +1973,28 @@ function ensureGitignoreLine(targetDir, line) {
     dryNote(`would append "${line}" to .gitignore`);
     return;
   }
-  fs4.writeFileSync(p, content, "utf-8");
+  fs5.writeFileSync(p, content, "utf-8");
   ok(`appended ${line} to .gitignore`);
 }
 function copyScaffoldDirAlways(srcDir, destDir, labelPrefix) {
-  if (!fs4.existsSync(srcDir)) return;
-  for (const entry of fs4.readdirSync(srcDir, { withFileTypes: true })) {
-    const srcPath = path4.join(srcDir, entry.name);
-    const destPath = path4.join(destDir, entry.name);
+  if (!fs5.existsSync(srcDir)) return;
+  for (const entry of fs5.readdirSync(srcDir, { withFileTypes: true })) {
+    const srcPath = path5.join(srcDir, entry.name);
+    const destPath = path5.join(destDir, entry.name);
     const label = labelPrefix ? `${labelPrefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
       copyScaffoldDirAlways(srcPath, destPath, label);
     } else if (entry.isFile()) {
-      const existed = fs4.existsSync(destPath);
+      const existed = fs5.existsSync(destPath);
       if (DRY_RUN) {
         dryNote(`would ${existed ? "refresh" : "write"} ${label}`);
         continue;
       }
-      fs4.mkdirSync(path4.dirname(destPath), { recursive: true });
-      fs4.copyFileSync(srcPath, destPath);
+      fs5.mkdirSync(path5.dirname(destPath), { recursive: true });
+      fs5.copyFileSync(srcPath, destPath);
       try {
-        const srcMode = fs4.statSync(srcPath).mode;
-        fs4.chmodSync(destPath, srcMode);
+        const srcMode = fs5.statSync(srcPath).mode;
+        fs5.chmodSync(destPath, srcMode);
       } catch {
       }
       ok(`${existed ? "refreshed" : "wrote"} ${label}`);
@@ -1170,25 +2002,25 @@ function copyScaffoldDirAlways(srcDir, destDir, labelPrefix) {
   }
 }
 function scaffoldMigrateSafety(targetDir, refreshScaffolds = false) {
-  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
-  if (!fs4.existsSync(scaffoldsRoot)) {
+  const scaffoldsRoot = path5.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
+  if (!fs5.existsSync(scaffoldsRoot)) {
     warn(`migrate-safety scaffolds missing at ${scaffoldsRoot} \u2014 packaging bug; main onboarding unaffected`);
     return { status: "warn", summary: "scaffolds missing (packaging bug)" };
   }
   const files = [
     {
-      src: path4.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
-      dest: path4.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
+      src: path5.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
+      dest: path5.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
       label: ".github/workflows/backup-on-migration.yml"
     },
     {
-      src: path4.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
-      dest: path4.join(targetDir, "scripts", "migrate-with-backup.sh"),
+      src: path5.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
+      dest: path5.join(targetDir, "scripts", "migrate-with-backup.sh"),
       label: "scripts/migrate-with-backup.sh"
     },
     {
-      src: path4.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
-      dest: path4.join(targetDir, "docs", "migrations-runbook.md"),
+      src: path5.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
+      dest: path5.join(targetDir, "docs", "migrations-runbook.md"),
       label: "docs/migrations-runbook.md"
     }
   ];
@@ -1223,25 +2055,25 @@ function summarizeFileCounts(counts) {
 }
 function hashFile(p) {
   try {
-    return crypto.createHash("sha256").update(fs4.readFileSync(p)).digest("hex");
+    return crypto.createHash("sha256").update(fs5.readFileSync(p)).digest("hex");
   } catch {
     return null;
   }
 }
 function copyScaffoldDriftAware(srcPath, destPath, label, refreshScaffolds) {
-  if (!fs4.existsSync(srcPath)) {
+  if (!fs5.existsSync(srcPath)) {
     info(`\u26A0 scaffold src missing for ${label} \u2014 skipping (packaging bug)`);
     return "missing-src";
   }
-  if (!fs4.existsSync(destPath)) {
+  if (!fs5.existsSync(destPath)) {
     if (DRY_RUN) {
       dryNote(`would write ${label}`);
       return "wrote";
     }
-    fs4.mkdirSync(path4.dirname(destPath), { recursive: true });
-    fs4.copyFileSync(srcPath, destPath);
+    fs5.mkdirSync(path5.dirname(destPath), { recursive: true });
+    fs5.copyFileSync(srcPath, destPath);
     try {
-      fs4.chmodSync(destPath, fs4.statSync(srcPath).mode);
+      fs5.chmodSync(destPath, fs5.statSync(srcPath).mode);
     } catch {
     }
     ok(`wrote ${label}`);
@@ -1259,9 +2091,9 @@ function copyScaffoldDriftAware(srcPath, destPath, label, refreshScaffolds) {
       dryNote(`would refresh ${label} (overrides local edits)`);
       return "drifted-refreshed";
     }
-    fs4.copyFileSync(srcPath, destPath);
+    fs5.copyFileSync(srcPath, destPath);
     try {
-      fs4.chmodSync(destPath, fs4.statSync(srcPath).mode);
+      fs5.chmodSync(destPath, fs5.statSync(srcPath).mode);
     } catch {
     }
     ok(`refreshed ${label} (overrode local edits \u2014 drift detected before write)`);
@@ -1273,10 +2105,10 @@ function copyScaffoldDriftAware(srcPath, destPath, label, refreshScaffolds) {
 var MARKETPLACE_ID = "launch-secure";
 var PLUGIN_ID = "kit";
 function isDogfoodMarketplace(targetDir) {
-  const p = path4.join(targetDir, ".claude", "settings.json");
-  if (!fs4.existsSync(p)) return { isDogfood: false };
+  const p = path5.join(targetDir, ".claude", "settings.json");
+  if (!fs5.existsSync(p)) return { isDogfood: false };
   try {
-    const settings = JSON.parse(fs4.readFileSync(p, "utf-8"));
+    const settings = JSON.parse(fs5.readFileSync(p, "utf-8"));
     const existingPath = settings.extraKnownMarketplaces?.[MARKETPLACE_ID]?.source?.path;
     if (existingPath && existingPath !== "./.claude/marketplace") {
       return { isDogfood: true, existingPath };
@@ -1287,8 +2119,8 @@ function isDogfoodMarketplace(targetDir) {
   }
 }
 function scaffoldLsMarketplace(targetDir) {
-  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace");
-  if (!fs4.existsSync(scaffoldsRoot)) {
+  const scaffoldsRoot = path5.resolve(__dirname, "..", "..", "scaffolds", "ls-marketplace");
+  if (!fs5.existsSync(scaffoldsRoot)) {
     warn(`ls-marketplace scaffolds missing at ${scaffoldsRoot} \u2014 packaging bug`);
     return { status: "warn", summary: "scaffolds missing (packaging bug)" };
   }
@@ -1299,7 +2131,7 @@ function scaffoldLsMarketplace(targetDir) {
     ok(`launch-secure marketplace (dogfood) \u2014 Claude Code loads commands from ${dogfood.existingPath}`);
     return { status: "ok", summary: `dogfood pointer (${dogfood.existingPath})` };
   }
-  const marketplaceRoot = path4.join(targetDir, ".claude", "marketplace");
+  const marketplaceRoot = path5.join(targetDir, ".claude", "marketplace");
   info("scaffolding launch-secure marketplace (Claude Code /kit: namespace \u2014 refreshes every /kit:* command found in the scaffold) \u2026");
   copyScaffoldDirAlways(scaffoldsRoot, marketplaceRoot, ".claude/marketplace");
   wireLsSettings(targetDir);
@@ -1307,14 +2139,14 @@ function scaffoldLsMarketplace(targetDir) {
   return { status: "ok", summary: "marketplace tree + settings refreshed" };
 }
 function wireLsSettings(targetDir) {
-  const p = path4.join(targetDir, ".claude", "settings.json");
-  const hadExisting = fs4.existsSync(p);
+  const p = path5.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs5.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail2(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const merged = { ...existing };
@@ -1342,15 +2174,15 @@ function wireLsSettings(targetDir) {
     dryNote(`would ${hadExisting ? "merge into" : "write"} .claude/settings.json (set extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${PLUGIN_ID}@${MARKETPLACE_ID}; preserves every other key)`);
     return;
   }
-  fs4.mkdirSync(path4.dirname(p), { recursive: true });
-  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs5.mkdirSync(path5.dirname(p), { recursive: true });
+  fs5.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   ok(`${hadExisting ? "merged into" : "wrote"} .claude/settings.json (extraKnownMarketplaces.${MARKETPLACE_ID} + enabledPlugins.${PLUGIN_ID}@${MARKETPLACE_ID})`);
 }
 var RECALL_HOOK_SIGNATURE = "ensure-recall.sh";
 var RECALL_HOOK_COMMAND = 'bash "${CLAUDE_PROJECT_DIR:-$PWD}/scripts/ensure-recall.sh"';
 function scaffoldRecallHook(targetDir) {
-  const scaffoldsRoot = path4.resolve(__dirname, "..", "..", "scaffolds", "recall-hook");
-  if (!fs4.existsSync(scaffoldsRoot)) {
+  const scaffoldsRoot = path5.resolve(__dirname, "..", "..", "scaffolds", "recall-hook");
+  if (!fs5.existsSync(scaffoldsRoot)) {
     warn(`recall-hook scaffolds missing at ${scaffoldsRoot} \u2014 packaging bug`);
     return { status: "warn", summary: "scaffolds missing (packaging bug)" };
   }
@@ -1361,14 +2193,14 @@ function scaffoldRecallHook(targetDir) {
   return wired ? { status: "ok", summary: "ensure-recall.sh refreshed + SessionStart hook appended" } : { status: "ok", summary: "ensure-recall.sh refreshed (hook already wired)" };
 }
 function wireRecallHook(targetDir) {
-  const p = path4.join(targetDir, ".claude", "settings.json");
-  const hadExisting = fs4.existsSync(p);
+  const p = path5.join(targetDir, ".claude", "settings.json");
+  const hadExisting = fs5.existsSync(p);
   let existing = {};
   if (hadExisting) {
     try {
-      existing = JSON.parse(fs4.readFileSync(p, "utf-8"));
+      existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail2(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const hooks = existing.hooks ?? {};
@@ -1394,8 +2226,8 @@ function wireRecallHook(targetDir) {
     dryNote(`would append SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh; preserves every other key + existing hooks)`);
     return true;
   }
-  fs4.mkdirSync(path4.dirname(p), { recursive: true });
-  fs4.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs5.mkdirSync(path5.dirname(p), { recursive: true });
+  fs5.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
   ok(`appended SessionStart hook to .claude/settings.json (bash scripts/ensure-recall.sh)`);
   return true;
 }
@@ -1415,8 +2247,35 @@ function tryActivateStatusline() {
   }
   return null;
 }
-async function main() {
+async function main2() {
   const subcommand = process.argv[2];
+  if (subcommand === "radar-docker-init") {
+    await Promise.resolve().then(() => (init_radar_docker_init_entry(), radar_docker_init_entry_exports));
+    return;
+  }
+  if (subcommand === "setup-git") {
+    if (process.argv[3] === "--help" || process.argv[3] === "-h") {
+      console.log('usage: launch-kit setup-git --identity="Name <email>"');
+      console.log("");
+      console.log("  Runs `gh auth setup-git` when GH_TOKEN is set, then sets the");
+      console.log("  global git user.name, user.email, init.defaultBranch=main, and");
+      console.log("  pull.rebase=false. Idempotent; safe to re-run.");
+      return;
+    }
+    let identityVal = null;
+    for (const a of process.argv.slice(3)) {
+      if (a.startsWith("--identity=")) identityVal = a.slice("--identity=".length);
+      else fail2(`Unknown setup-git flag: "${a}". Supported: --identity="Name <email>".`);
+    }
+    if (!identityVal) fail2(`launch-kit setup-git requires --identity="Name <email>".`);
+    try {
+      const identity = parseGitIdentityFlag(identityVal, "--identity");
+      configureGitForBot(identity);
+    } catch (err) {
+      fail2(err instanceof Error ? err.message : String(err));
+    }
+    return;
+  }
   if (subcommand === "statusline") {
     const action = process.argv[3];
     if (!action || action === "--help" || action === "-h") {
@@ -1433,17 +2292,50 @@ async function main() {
     for (const a of process.argv.slice(4)) {
       if (a.startsWith("--show=")) showArg = a.slice("--show=".length);
       else if (a === "--compact") compactArg = true;
-      else fail(`Unknown statusline flag: "${a}". Supported: --show=<csv>, --compact.`);
+      else fail2(`Unknown statusline flag: "${a}". Supported: --show=<csv>, --compact.`);
     }
     const { activateStatusline: activateStatusline2, deactivateStatusline: deactivateStatusline2 } = await Promise.resolve().then(() => (init_statusline_install(), statusline_install_exports));
     let res;
     if (action === "activate") res = activateStatusline2({ show: showArg, compact: compactArg });
     else if (action === "deactivate") res = deactivateStatusline2();
-    else fail(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
+    else fail2(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
     if (res.ok) ok(`statusline ${res.outcome} \u2014 ${res.message}`);
     else info(`statusline ${res.outcome} \u2014 ${res.message}`);
     return;
   }
+  if (subcommand === "secrets") {
+    const action = process.argv[3];
+    if (!action || action === "--help" || action === "-h") {
+      console.log("usage: launch-kit secrets pull [--env=<slug>] [--dir=<path>] [--file=<name>]");
+      console.log("");
+      console.log("  --env=<slug>   env to pull from. Overrides $LS_ENV and the project-level default.");
+      console.log("  --dir=<path>   project root (default: cwd). Must contain a launch-kit cred file.");
+      console.log("  --file=<name>  output file relative to --dir (default: .env.local).");
+      console.log("");
+      console.log("  Resolution order: --env \u2192 $LS_ENV \u2192 server-side default \u2192 single-env auto-pick.");
+      return;
+    }
+    if (action !== "pull") {
+      fail2(`Unknown secrets action: "${action}". Supported: pull.`);
+    }
+    let envOverride = null;
+    let dirArg = null;
+    let fileArg = ".env.local";
+    for (const a of process.argv.slice(4)) {
+      if (a.startsWith("--env=")) envOverride = a.slice("--env=".length);
+      else if (a.startsWith("--dir=")) dirArg = a.slice("--dir=".length);
+      else if (a.startsWith("--file=")) fileArg = a.slice("--file=".length);
+      else fail2(`Unknown secrets pull flag: "${a}". Supported: --env, --dir, --file.`);
+    }
+    const targetDir = path5.resolve(dirArg ?? process.cwd());
+    const { runSecretsPull: runSecretsPull2 } = await Promise.resolve().then(() => (init_secrets_pull(), secrets_pull_exports));
+    try {
+      await runSecretsPull2({ targetDir, envOverride, fileName: fileArg });
+    } catch (err) {
+      fail2(err instanceof Error ? err.message : String(err));
+    }
+    return;
+  }
   const args = parseArgs(process.argv.slice(2));
   if (args.help) {
     if (subcommand === "refresh") printRefreshHelp();
@@ -1451,10 +2343,10 @@ async function main() {
     return;
   }
   if (!subcommand || subcommand.startsWith("--")) {
-    fail(`missing subcommand. Usage: launch-kit <init|refresh|statusline> [options]. Run with --help.`);
+    fail2(`missing subcommand. Usage: launch-kit <init|refresh|statusline|secrets> [options]. Run with --help.`);
   }
   if (subcommand !== "init" && subcommand !== "refresh") {
-    fail(`Unknown subcommand "${subcommand}". Supported: init, refresh, statusline. Run with --help for usage.`);
+    fail2(`Unknown subcommand "${subcommand}". Supported: init, refresh, statusline, secrets. Run with --help for usage.`);
   }
   DRY_RUN = args.dryRun;
   VERBOSE = args.verbose || DRY_RUN;
@@ -1469,8 +2361,8 @@ async function main() {
 }
 async function mainRefresh(args) {
   const cwd = process.cwd();
-  const targetDir = path4.resolve(args.targetDir ?? cwd);
-  if (!fs4.existsSync(targetDir)) fail(`target dir does not exist: ${targetDir}`);
+  const targetDir = path5.resolve(args.targetDir ?? cwd);
+  if (!fs5.existsSync(targetDir)) fail2(`target dir does not exist: ${targetDir}`);
   let cred;
   let source;
   try {
@@ -1478,7 +2370,7 @@ async function mainRefresh(args) {
     cred = recovery.cred;
     source = recovery.source;
   } catch (err) {
-    fail(err instanceof Error ? err.message : String(err));
+    fail2(err instanceof Error ? err.message : String(err));
   }
   if (cred && source === "mcp") {
     info(`recovered cred from .mcp.json launch-secure headers (PAT + org + project + url)`);
@@ -1487,24 +2379,24 @@ async function mainRefresh(args) {
     if (DRY_RUN) {
       dryNote(`would write ${CONFIG_FILENAME} from recovered .mcp.json cred (course: ${courseName})`);
     } else {
-      writeJsonAtomic(path4.join(targetDir, CONFIG_FILENAME), nested2, 384);
+      writeJsonAtomic(path5.join(targetDir, CONFIG_FILENAME), nested2, 384);
       ok(`wrote ${CONFIG_FILENAME} (course: ${courseName})`);
     }
   }
   if (!cred) {
-    fail(
-      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json. Refresh requires an existing cred or a hardcoded launch-secure MCP entry \u2014 run \`npx @launchsecure/launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path4.relative(cwd, targetDir) || "."}\` first.`
+    fail2(
+      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json. Refresh requires an existing cred or a hardcoded launch-secure MCP entry \u2014 run \`npx @launchsecure/launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}\` first.`
     );
   }
   const nested = toNested(cred);
-  if (!nested) fail(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl).`);
+  if (!nested) fail2(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl).`);
   const active = nested.profiles[nested.active];
-  if (!active) fail(`${CONFIG_FILENAME} active profile "${nested.active}" is not present in profiles.`);
+  if (!active) fail2(`${CONFIG_FILENAME} active profile "${nested.active}" is not present in profiles.`);
   info(`refreshing launch-kit in ${targetDir} (course: ${nested.active}, project: ${active.orgSlug}/${active.projectSlug}) \u2026`);
   header("launch-kit refresh", [
     ["course", nested.active],
     ["project", `${active.orgSlug}/${active.projectSlug}`],
-    ["dir", path4.relative(cwd, targetDir) || "."]
+    ["dir", path5.relative(cwd, targetDir) || "."]
   ]);
   const cfg = { pat: active.pat, orgSlug: active.orgSlug, projectSlug: active.projectSlug, serverUrl: active.serverUrl };
   phase(".mcp.json", mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg)));
@@ -1532,8 +2424,8 @@ async function mainRefresh(args) {
   }
 }
 async function mainInit(args) {
-  const probeDir = path4.resolve(args.targetDir ?? process.cwd());
-  if (!args.force && fs4.existsSync(probeDir)) {
+  const probeDir = path5.resolve(args.targetDir ?? process.cwd());
+  if (!args.force && fs5.existsSync(probeDir)) {
     const detection = detectExistingBootstrap(probeDir);
     if (detection.bootstrapped) {
       info(`detected existing bootstrap at ${probeDir} (${detection.reason})`);
@@ -1542,8 +2434,8 @@ async function mainInit(args) {
     }
   }
   if (!args.token || !args.orgSlug || !args.projectSlug) {
-    const recoveryDir = path4.resolve(args.targetDir ?? process.cwd());
-    if (fs4.existsSync(recoveryDir)) {
+    const recoveryDir = path5.resolve(args.targetDir ?? process.cwd());
+    if (fs5.existsSync(recoveryDir)) {
       const { cred } = recoverCred(recoveryDir, getRecoveryOptions());
       const nested = cred ? toNested(cred) : null;
       const recovered = nested ? nested.profiles[nested.active] : cred;
@@ -1570,10 +2462,10 @@ async function mainInit(args) {
     const t = await prompt("LaunchSecure PAT (ls_pat_\u2026): ");
     args.token = t || null;
   }
-  if (!args.token) fail("--token (or LS_PAT env) is required.");
-  if (!/^ls_pat_/.test(args.token)) fail("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
-  if (!args.orgSlug) fail("--org=<orgSlug> is required.");
-  if (!args.projectSlug) fail("--project=<projectSlug> is required.");
+  if (!args.token) fail2("--token (or LS_PAT env) is required.");
+  if (!/^ls_pat_/.test(args.token)) fail2("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
+  if (!args.orgSlug) fail2("--org=<orgSlug> is required.");
+  if (!args.projectSlug) fail2("--project=<projectSlug> is required.");
   header("launch-kit init", [
     ["org", args.orgSlug],
     ["project", args.projectSlug],
@@ -1581,39 +2473,43 @@ async function mainInit(args) {
   ]);
   const { hasGh } = preflight();
   phase("preflight", { status: "ok", summary: `node ${process.versions.node}${hasGh ? " \xB7 git \xB7 gh" : " \xB7 git (gh not found \u2014 will use git for clone)"}` });
+  if (args.gitIdentity) {
+    configureGitForBot(args.gitIdentity);
+    phase("git identity", { status: "ok", summary: `${args.gitIdentity.name} <${args.gitIdentity.email}>${process.env.GH_TOKEN ? " \xB7 gh credential helper wired" : ""}` });
+  }
   info(`resolving project ${args.orgSlug}/${args.projectSlug} on ${args.serverUrl} \u2026`);
   let resolved;
   try {
     resolved = await callProjectInfo(args);
   } catch (err) {
-    fail(err instanceof Error ? err.message : String(err));
+    fail2(err instanceof Error ? err.message : String(err));
   }
   ok(`resolved "${resolved.projectName}"`);
   phase("project_info", { status: "ok", summary: `"${resolved.projectName}"` });
   if (!resolved.repositoryUrl) {
-    fail(
+    fail2(
       `Project "${resolved.projectSlug}" has no GitHub repository configured. Connect GitHub at ${args.serverUrl}/${resolved.orgSlug}/projects/${resolved.projectSlug}/settings/integrations, then re-run init.`
     );
   }
   const repoUrl = resolved.repositoryUrl;
   const cwd = process.cwd();
-  const targetDir = path4.resolve(args.targetDir ?? path4.join(cwd, resolved.projectSlug));
+  const targetDir = path5.resolve(args.targetDir ?? path5.join(cwd, resolved.projectSlug));
   const normalizedRemote = normalizeRepoUrl(repoUrl);
   let skipClone = false;
-  if (fs4.existsSync(targetDir)) {
+  if (fs5.existsSync(targetDir)) {
     if (isGitRepo(targetDir)) {
       const existingRemote = gitRemoteUrl(targetDir);
       if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
         ok(`${targetDir} is already a clone of ${repoUrl} \u2014 skipping clone, refreshing configs only`);
         skipClone = true;
       } else {
-        fail(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
+        fail2(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
       }
     } else if (!dirIsEmpty(targetDir)) {
-      fail(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
+      fail2(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
     }
   }
-  const relTarget = path4.relative(cwd, targetDir) || ".";
+  const relTarget = path5.relative(cwd, targetDir) || ".";
   if (!skipClone) {
     section(`Cloning ${repoUrl}`);
     cloneRepo(repoUrl, targetDir, hasGh);
@@ -1643,10 +2539,28 @@ async function mainInit(args) {
     section(`Installing dependencies (${detected.pm.name})`);
     runInstall(targetDir, detected);
     phase("install", { status: "ok", summary: `${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` });
-    if (!args.noOnboard && hasOnboardScript(targetDir)) {
-      section(`Running ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}`);
-      runOnboard(targetDir, detected.pm);
-      phase("onboard", { status: "ok", summary: `${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}` });
+    if (!args.noOnboard) {
+      if (hasOnboardScript(targetDir)) {
+        section(`Running ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}`);
+        runOnboard(targetDir, detected.pm);
+        phase("onboard", { status: "ok", summary: `${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}` });
+      } else {
+        section("Pulling environment secrets");
+        info("running launch-kit secrets pull \u2026");
+        if (DRY_RUN) {
+          dryNote(`would run: launch-kit secrets pull --dir=${path5.relative(cwd, targetDir) || "."}`);
+          phase("secrets pull", { status: "skipped", summary: "(dry-run)" });
+        } else {
+          try {
+            await runSecretsPull({ targetDir, envOverride: null, fileName: ".env.local" });
+            phase("secrets pull", { status: "ok", summary: ".env.local from cloud LS" });
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            warn(`secrets pull skipped \u2014 ${msg}`);
+            phase("secrets pull", { status: "warn", summary: "pull manually with `launch-kit secrets pull`" });
+          }
+        }
+      }
     }
   }
   const hasOnboard = hasOnboardScript(targetDir);
@@ -1686,7 +2600,7 @@ async function mainInit(args) {
   ]);
   if (showGuide) console.log(getLaunchKitToolsGuide());
 }
-main().catch((err) => {
+main2().catch((err) => {
   console.error(`[launch-kit] unexpected error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
   process.exit(1);
 });