@launchsecure/launch-kit 0.0.33 → 0.0.35

package/dist/server/init-entry.js

@@ -468,8 +468,281 @@ var init_mcp = __esm({
   }
 });
 
+// src/server/launch-kit-services.ts
+function defaultServices() {
+  return [expandShorthand("radar")];
+}
+function expandShorthand(name) {
+  if (name === "preview") {
+    const raw = process.env.PREVIEW_PORT;
+    const port = raw && Number.isFinite(Number.parseInt(raw, 10)) ? Number.parseInt(raw, 10) : 3e3;
+    return { name: "preview", port, bin: "", args: [], skipSpawn: true };
+  }
+  const def = SHORTHANDS[name];
+  if (!def) {
+    throw new Error(
+      `[launch-kit-services] unknown shorthand "${name}" \u2014 known: ${[...Object.keys(SHORTHANDS), "preview"].join(", ")}. Use an object entry { name, port, bin, args } for custom services.`
+    );
+  }
+  return { name, port: def.port, bin: def.bin, args: [...def.args] };
+}
+function coerceEntry(raw, index) {
+  if (typeof raw === "string") {
+    return expandShorthand(raw);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`[launch-kit-services] entry #${index} must be a string shorthand or an object`);
+  }
+  const r = raw;
+  if (typeof r.name !== "string" || typeof r.port !== "number" || typeof r.bin !== "string") {
+    throw new Error(`[launch-kit-services] entry #${index}: { name:string, port:number, bin:string } required`);
+  }
+  if (r.args !== void 0 && (!Array.isArray(r.args) || r.args.some((a) => typeof a !== "string"))) {
+    throw new Error(`[launch-kit-services] entry #${index}: args must be a string[]`);
+  }
+  return {
+    name: r.name,
+    port: r.port,
+    bin: r.bin,
+    args: r.args ?? []
+  };
+}
+function validate(services) {
+  if (services.length === 0) {
+    throw new Error(`[launch-kit-services] resolved an empty service list`);
+  }
+  const seenNames = /* @__PURE__ */ new Set();
+  const seenPorts = /* @__PURE__ */ new Set();
+  for (const s of services) {
+    if (!DNS_NAME_RE.test(s.name)) {
+      throw new Error(`[launch-kit-services] service name "${s.name}" is not DNS-safe (lowercase letters/digits/hyphens, \u226463 chars, no leading/trailing hyphen)`);
+    }
+    if (seenNames.has(s.name)) {
+      throw new Error(`[launch-kit-services] duplicate service name "${s.name}"`);
+    }
+    seenNames.add(s.name);
+    if (!Number.isInteger(s.port) || s.port < 1 || s.port > 65535) {
+      throw new Error(`[launch-kit-services] service "${s.name}" has invalid port ${s.port}`);
+    }
+    if (seenPorts.has(s.port)) {
+      throw new Error(`[launch-kit-services] duplicate port ${s.port} (services must each listen on a unique port)`);
+    }
+    seenPorts.add(s.port);
+  }
+  return services;
+}
+function resolveServices(opts = {}) {
+  const env = opts.env ?? process.env;
+  const cwd = opts.cwd ?? process.cwd();
+  const rawEnv = env.LAUNCHKIT_SERVICES?.trim();
+  if (rawEnv) {
+    let parsed;
+    try {
+      parsed = JSON.parse(rawEnv);
+    } catch (err) {
+      throw new Error(`[launch-kit-services] LAUNCHKIT_SERVICES is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!Array.isArray(parsed)) {
+      throw new Error(`[launch-kit-services] LAUNCHKIT_SERVICES must be a JSON array`);
+    }
+    return validate(parsed.map(coerceEntry));
+  }
+  const filePath = (0, import_node_path.join)(cwd, ".launchpod", "services.json");
+  if ((0, import_node_fs.existsSync)(filePath)) {
+    let parsed;
+    try {
+      parsed = JSON.parse((0, import_node_fs.readFileSync)(filePath, "utf8"));
+    } catch (err) {
+      throw new Error(`[launch-kit-services] ${filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!Array.isArray(parsed)) {
+      throw new Error(`[launch-kit-services] ${filePath} must be a JSON array`);
+    }
+    return validate(parsed.map(coerceEntry));
+  }
+  return validate(defaultServices());
+}
+var import_node_fs, import_node_path, SHORTHANDS, DNS_NAME_RE, SHORTHAND_NAMES;
+var init_launch_kit_services = __esm({
+  "src/server/launch-kit-services.ts"() {
+    "use strict";
+    import_node_fs = require("node:fs");
+    import_node_path = require("node:path");
+    SHORTHANDS = {
+      radar: { port: 3517, bin: "launch-radar", args: [] },
+      sequencer: { port: 3517, bin: "launch-sequencer", args: [] },
+      chart: { port: 52819, bin: "launch-chart", args: ["serve"] },
+      deck: { port: 52829, bin: "launch-deck", args: ["serve"] },
+      council: { port: 52839, bin: "launch-council", args: ["serve"] },
+      // Claude web terminal — exposes a viewable/drivable `claude` session at
+      // `bot.<baseDomain>`. NOTE: no auth gate yet (tracked as a separate
+      // high-priority rover-security work item); ships behind a plain link first.
+      bot: { port: 52849, bin: "launch-bot", args: ["serve"] }
+    };
+    DNS_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+    SHORTHAND_NAMES = [...Object.keys(SHORTHANDS), "preview"];
+  }
+});
+
+// src/server/cf-ingress.ts
+async function cf(opts) {
+  const res = await fetch(`${CF_API_BASE}${opts.path}`, {
+    method: opts.method,
+    headers: {
+      Authorization: `Bearer ${opts.apiToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": "launch-kit/cf-ingress"
+    },
+    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+    signal: AbortSignal.timeout(15e3)
+  });
+  const text = await res.text();
+  let parsed;
+  try {
+    parsed = text ? JSON.parse(text) : { success: false };
+  } catch {
+    throw new Error(`[cf] ${opts.method} ${opts.path} \u2192 ${res.status}, non-JSON body: ${text.slice(0, 200)}`);
+  }
+  return parsed;
+}
+function isNotFound(env) {
+  return !env.success && (env.errors ?? []).some((e) => e.code === 7003 || e.code === 1001 || e.code === 81044);
+}
+function loadState(path6) {
+  if (!(0, import_node_fs2.existsSync)(path6)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs2.readFileSync)(path6, "utf8"));
+    if (typeof parsed?.tunnelId === "string" && typeof parsed?.accountId === "string") {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function saveState(path6, state) {
+  const dir = (0, import_node_path2.dirname)(path6);
+  if (!(0, import_node_fs2.existsSync)(dir)) (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs2.writeFileSync)(path6, JSON.stringify(state, null, 2));
+}
+async function ensureTunnel(input, knownTunnelId) {
+  if (knownTunnelId) {
+    const got = await cf({
+      apiToken: input.apiToken,
+      method: "GET",
+      path: `/accounts/${input.accountId}/cfd_tunnel/${knownTunnelId}`
+    });
+    if (got.success && got.result && !got.result.deleted_at) {
+      return knownTunnelId;
+    }
+    if (!isNotFound(got) && !got.success) {
+      throw new Error(`[cf] tunnel GET failed: ${JSON.stringify(got.errors)}`);
+    }
+  }
+  const created = await cf({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/cfd_tunnel`,
+    body: { name: input.tunnelName, config_src: "cloudflare" }
+  });
+  if (!created.success || !created.result) {
+    throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
+  }
+  return created.result.id;
+}
+async function fetchConnectorToken(input, tunnelId) {
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/cfd_tunnel/${tunnelId}/token`
+  });
+  if (!res.success || typeof res.result !== "string") {
+    throw new Error(`[cf] connector-token fetch failed: ${JSON.stringify(res.errors)}`);
+  }
+  return res.result;
+}
+async function setIngressConfig(input, tunnelId) {
+  const ingress = input.services.map((s) => ({
+    hostname: `${s.name}.${input.zone.name}`,
+    service: `http://localhost:${s.port}`
+  }));
+  ingress.push({ service: "http_status:404" });
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "PUT",
+    path: `/accounts/${input.accountId}/cfd_tunnel/${tunnelId}/configurations`,
+    body: { config: { ingress } }
+  });
+  if (!res.success) {
+    throw new Error(`[cf] ingress config PUT failed: ${JSON.stringify(res.errors)}`);
+  }
+}
+async function ensureDnsRecord(input, tunnelId, service) {
+  const fqdn = `${service.name}.${input.zone.name}`;
+  const target = `${tunnelId}.cfargotunnel.com`;
+  const existing = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/zones/${input.zone.id}/dns_records?name=${encodeURIComponent(fqdn)}&type=CNAME`
+  });
+  if (existing.success && Array.isArray(existing.result) && existing.result.length > 0) {
+    const rec = existing.result[0];
+    if (rec.content === target) return;
+    const upd = await cf({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/zones/${input.zone.id}/dns_records/${rec.id}`,
+      body: { type: "CNAME", name: fqdn, content: target, proxied: true, ttl: 1 }
+    });
+    if (!upd.success) {
+      throw new Error(`[cf] DNS record update for ${fqdn} failed: ${JSON.stringify(upd.errors)}`);
+    }
+    return;
+  }
+  const created = await cf({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/zones/${input.zone.id}/dns_records`,
+    body: { type: "CNAME", name: fqdn, content: target, proxied: true, ttl: 1 }
+  });
+  if (created.success) return;
+  if ((created.errors ?? []).some((e) => e.code === CF_ERR_DNS_RECORD_EXISTS)) return;
+  throw new Error(`[cf] DNS record create for ${fqdn} failed: ${JSON.stringify(created.errors)}`);
+}
+async function provisionIngress(input) {
+  const prior = loadState(input.stateFile);
+  const tunnelId = await ensureTunnel(input, prior?.tunnelId ?? null);
+  saveState(input.stateFile, {
+    tunnelId,
+    accountId: input.accountId,
+    tunnelName: input.tunnelName,
+    zoneId: input.zone.id
+  });
+  const connectorToken = await fetchConnectorToken(input, tunnelId);
+  await setIngressConfig(input, tunnelId);
+  await Promise.all(input.services.map((s) => ensureDnsRecord(input, tunnelId, s)));
+  const hostnames = {};
+  for (const s of input.services) hostnames[s.name] = `${s.name}.${input.zone.name}`;
+  return { tunnelId, connectorToken, hostnames };
+}
+var import_node_fs2, import_node_path2, CF_API_BASE, CF_ERR_DNS_RECORD_EXISTS;
+var init_cf_ingress = __esm({
+  "src/server/cf-ingress.ts"() {
+    "use strict";
+    import_node_fs2 = require("node:fs");
+    import_node_path2 = require("node:path");
+    CF_API_BASE = "https://api.cloudflare.com/client/v4";
+    CF_ERR_DNS_RECORD_EXISTS = 81053;
+  }
+});
+
 // src/server/radar-docker-init-entry.ts
 var radar_docker_init_entry_exports = {};
+__export(radar_docker_init_entry_exports, {
+  maybeProvisionIngress: () => maybeProvisionIngress,
+  spawnServiceGroup: () => spawnServiceGroup
+});
 function fail(message) {
   console.error(message);
   process.exit(1);
@@ -485,39 +758,39 @@ function run2(cmd, args, stdio = "inherit") {
 }
 async function setupFromCloud() {
   const pat = requireEnv("LS_PAT");
+  const orgSlug = requireEnv("LS_ORG_SLUG");
+  const projectSlug = requireEnv("LS_PROJECT_SLUG");
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
-  const orgSlug = process.env.LS_ORG_SLUG;
-  const projectSlug = process.env.LS_PROJECT_SLUG;
   const mcp = new ProjectMcpClient({ serverUrl, pat, orgSlug, projectSlug });
   let bundle;
   try {
     bundle = await mcp.call("radar_bootstrap_get", {});
   } catch (err) {
-    fail(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and is scoped to the right org/project.`);
+    fail(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
   }
-  if (!process.env.LS_ORG_SLUG) process.env.LS_ORG_SLUG = bundle.orgSlug;
-  if (!process.env.LS_PROJECT_SLUG) process.env.LS_PROJECT_SLUG = bundle.projectSlug;
   if (!process.env.GIT_USER_NAME) process.env.GIT_USER_NAME = bundle.gitName;
   if (!process.env.GIT_USER_EMAIL) process.env.GIT_USER_EMAIL = bundle.gitEmail;
   if (!process.env.GH_TOKEN && bundle.githubToken) process.env.GH_TOKEN = bundle.githubToken;
   if (!process.env.GH_TOKEN) {
     fail(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
   }
-  console.log(`[entrypoint] bundle from cloud: org=${process.env.LS_ORG_SLUG} project=${process.env.LS_PROJECT_SLUG} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()}`);
+  const cfNote = bundle.cloudflareToken ? "cloudflare=connected" : "cloudflare=none";
+  console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
+  return bundle;
 }
 function setupClaudeCredentials() {
   const home = process.env.HOME ?? "/home/launchpod";
-  const claudeDir = (0, import_node_path.join)(home, ".claude");
-  (0, import_node_fs.mkdirSync)(claudeDir, { recursive: true });
+  const claudeDir = (0, import_node_path3.join)(home, ".claude");
+  (0, import_node_fs3.mkdirSync)(claudeDir, { recursive: true });
   const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
-  const credsPath = (0, import_node_path.join)(claudeDir, ".credentials.json");
-  (0, import_node_fs.writeFileSync)(credsPath, decoded);
-  (0, import_node_fs.chmodSync)(credsPath, 384);
-  const configPath = (0, import_node_path.join)(home, ".claude.json");
+  const credsPath = (0, import_node_path3.join)(claudeDir, ".credentials.json");
+  (0, import_node_fs3.writeFileSync)(credsPath, decoded);
+  (0, import_node_fs3.chmodSync)(credsPath, 384);
+  const configPath = (0, import_node_path3.join)(home, ".claude.json");
   let cfg = {};
-  if ((0, import_node_fs.existsSync)(configPath)) {
+  if ((0, import_node_fs3.existsSync)(configPath)) {
     try {
-      cfg = JSON.parse((0, import_node_fs.readFileSync)(configPath, "utf8"));
+      cfg = JSON.parse((0, import_node_fs3.readFileSync)(configPath, "utf8"));
     } catch {
       cfg = {};
     }
@@ -526,8 +799,25 @@ function setupClaudeCredentials() {
   cfg.lastOnboardingVersion = cfg.lastOnboardingVersion ?? "2.1.159";
   cfg.numStartups = (cfg.numStartups ?? 0) + 1;
   cfg.installMethod = cfg.installMethod ?? "global";
-  (0, import_node_fs.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
-  (0, import_node_fs.chmodSync)(configPath, 384);
+  const PREAPPROVED_MCPS = [
+    "launch-secure",
+    "launch-chart",
+    "launch-deck",
+    "launch-orbit",
+    "launch-recall",
+    "launch-beacon",
+    "launch-sequencer"
+  ];
+  const projects = cfg.projects ?? {};
+  const wsKey = "/workspace";
+  const wsProject = projects[wsKey] ?? {};
+  const existingEnabled = Array.isArray(wsProject.enabledMcpjsonServers) ? wsProject.enabledMcpjsonServers : [];
+  const mergedEnabled = Array.from(/* @__PURE__ */ new Set([...existingEnabled, ...PREAPPROVED_MCPS]));
+  wsProject.enabledMcpjsonServers = mergedEnabled;
+  projects[wsKey] = wsProject;
+  cfg.projects = projects;
+  (0, import_node_fs3.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
+  (0, import_node_fs3.chmodSync)(configPath, 384);
 }
 function setupGitAndGh() {
   const name = process.env.GIT_USER_NAME ?? "Radar Bot";
@@ -535,9 +825,30 @@ function setupGitAndGh() {
   const status = run2("launch-kit", ["setup-git", `--identity=${name} <${email}>`]);
   if (status !== 0) fail(`[entrypoint] launch-kit setup-git failed (status ${status})`);
 }
+function detectAndSetPreviewPort() {
+  if (process.env.PREVIEW_PORT) return;
+  try {
+    const pkgPath = "/workspace/package.json";
+    if (!(0, import_node_fs3.existsSync)(pkgPath)) return;
+    const pkg = JSON.parse((0, import_node_fs3.readFileSync)(pkgPath, "utf-8"));
+    const scripts = pkg.scripts ?? {};
+    const portRe = /(?:--port[= ]|-p\s+|\bPORT=)(\d{2,5})\b/;
+    for (const name of ["dev", "start", "serve"]) {
+      const script = scripts[name];
+      if (typeof script !== "string") continue;
+      const m = script.match(portRe);
+      if (m) {
+        process.env.PREVIEW_PORT = m[1];
+        console.log(`[entrypoint] preview port detected from package.json scripts.${name}: ${m[1]}`);
+        return;
+      }
+    }
+  } catch {
+  }
+}
 function initWorkspaceIfEmpty() {
   process.chdir("/workspace");
-  if ((0, import_node_fs.existsSync)(".git")) {
+  if ((0, import_node_fs3.existsSync)(".git")) {
     console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
     return;
   }
@@ -552,47 +863,183 @@ function initWorkspaceIfEmpty() {
   ]);
   if (status !== 0) fail(`[entrypoint] launch-kit init failed (status ${status})`);
 }
-function execLaunchPodRadar() {
-  console.log("[entrypoint] starting launch-pod radar");
-  const child = (0, import_node_child_process2.spawn)("launch-pod", ["radar"], { stdio: "inherit" });
-  const forward = (sig) => () => {
-    try {
-      child.kill(sig);
-    } catch {
+async function maybeProvisionIngress(bundle, services, projectSlug) {
+  const token = bundle.cloudflareToken ?? null;
+  const accountId = bundle.cloudflareAccountId ?? null;
+  const zones = bundle.cloudflareZones ?? [];
+  if (!token && !accountId && zones.length === 0) return null;
+  if (!token || !accountId) {
+    fail(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
+  }
+  const baseDomain = process.env.LAUNCHKIT_CF_BASE_DOMAIN?.trim();
+  let chosen = null;
+  if (baseDomain) {
+    chosen = zones.find((z) => z.name === baseDomain) ?? null;
+    if (!chosen) {
+      fail(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
     }
-  };
-  process.on("SIGTERM", forward("SIGTERM"));
-  process.on("SIGINT", forward("SIGINT"));
-  process.on("SIGHUP", forward("SIGHUP"));
-  child.on("exit", (code, signal) => {
-    if (signal) process.kill(process.pid, signal);
-    else process.exit(code ?? 0);
+  } else if (zones.length === 1) {
+    chosen = { id: zones[0].id, name: zones[0].name };
+  } else {
+    fail(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
+  }
+  const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
+  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => s.name).join(",")}`);
+  const result = await provisionIngress({
+    apiToken: token,
+    accountId,
+    zone: chosen,
+    tunnelName: `launch-kit-${projectSlug}`,
+    services: services.map((s) => ({ name: s.name, port: s.port })),
+    stateFile
   });
+  for (const [name, fqdn] of Object.entries(result.hostnames)) {
+    console.log(`[entrypoint]   ${name} \u2192 https://${fqdn}`);
+  }
+  return result;
+}
+function spawnServiceGroup(services) {
+  const children = [];
+  let shuttingDown = false;
+  const killAll = (signal = "SIGTERM") => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    for (const c2 of children) {
+      try {
+        c2.proc.kill(signal);
+      } catch {
+      }
+    }
+  };
+  const prefixStream = (name, stream, sink) => {
+    let buf = "";
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+      buf += chunk;
+      const lines = buf.split("\n");
+      buf = lines.pop() ?? "";
+      for (const line of lines) sink.write(`[${name}] ${line}
+`);
+    });
+    stream.on("end", () => {
+      if (buf) sink.write(`[${name}] ${buf}
+`);
+    });
+  };
+  const signalHandlers = [];
+  const installSignals = () => {
+    for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+      const fn = () => {
+        console.log(`[entrypoint] received ${sig} \u2014 forwarding to ${children.length} child process(es)`);
+        killAll(sig);
+      };
+      process.on(sig, fn);
+      signalHandlers.push({ sig, fn });
+    }
+  };
+  const removeSignals = () => {
+    for (const h of signalHandlers) process.off(h.sig, h.fn);
+    signalHandlers.length = 0;
+  };
+  return new Promise((resolve3, reject) => {
+    let exitedCount = 0;
+    let firstFailure = null;
+    for (const spec of services) {
+      if (spec.skipSpawn) {
+        console.log(`[entrypoint] ${spec.name} \u2192 ingress-only on port ${spec.port} (no spawn; user starts dev server here)`);
+        continue;
+      }
+      const args = [...spec.args, "--port", String(spec.port)];
+      console.log(`[entrypoint] starting ${spec.name}: ${spec.bin} ${args.join(" ")}`);
+      const proc = (0, import_node_child_process2.spawn)(spec.bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+      children.push({ spec, proc });
+      if (proc.stdout) prefixStream(spec.name, proc.stdout, process.stdout);
+      if (proc.stderr) prefixStream(spec.name, proc.stderr, process.stderr);
+      proc.on("exit", (code, signal) => {
+        exitedCount += 1;
+        const label = `[${spec.name}] exited code=${code ?? "?"} signal=${signal ?? "-"}`;
+        if (!shuttingDown && code !== 0) {
+          console.error(`[entrypoint] ${label} \u2014 bringing the group down`);
+          if (!firstFailure) firstFailure = { name: spec.name, code, signal };
+          killAll();
+        } else {
+          console.log(`[entrypoint] ${label}`);
+        }
+        if (exitedCount === children.length) {
+          if (firstFailure) reject(new Error(`service "${firstFailure.name}" exited code=${firstFailure.code ?? "?"}`));
+          else resolve3();
+        }
+      });
+      proc.on("error", (err) => {
+        console.error(`[entrypoint] [${spec.name}] spawn error: ${err.message}`);
+        if (!firstFailure) firstFailure = { name: spec.name, code: null, signal: null };
+        killAll();
+      });
+    }
+    installSignals();
+  }).finally(removeSignals);
 }
 async function main() {
   for (const k of REQUIRED_ENV) requireEnv(k);
-  await setupFromCloud();
+  const bundle = await setupFromCloud();
   setupClaudeCredentials();
   setupGitAndGh();
   initWorkspaceIfEmpty();
-  execLaunchPodRadar();
+  detectAndSetPreviewPort();
+  let services;
+  try {
+    services = resolveServices();
+  } catch (err) {
+    fail(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
+  }
+  console.log(`[entrypoint] services: ${services.map((s) => `${s.name}@${s.port}`).join(", ")}`);
+  const ingress = await maybeProvisionIngress(bundle, services, requireEnv("LS_PROJECT_SLUG"));
+  if (ingress) {
+    process.env.RADAR_CF_TUNNEL_TOKEN = ingress.connectorToken;
+    const radarFqdn = ingress.hostnames.radar;
+    if (radarFqdn) process.env.RADAR_CF_TUNNEL_HOSTNAME = radarFqdn;
+    else if (services.some((s) => s.name === "radar")) {
+      fail(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
+    }
+  } else if (services.length > 1) {
+    const first = services[0];
+    console.warn(
+      `[entrypoint] \u26A0 quick mode \u2014 only the first service "${first.name}" (port ${first.port}) will be exposed via the ephemeral *.trycloudflare.com URL. Other service(s) [${services.slice(1).map((s) => s.name).join(", ")}] will run on localhost inside the container only. Connect a Cloudflare provider in LS and set LAUNCHKIT_CF_BASE_DOMAIN to expose all services with stable subdomains.`
+    );
+    if (first.name !== "radar") {
+      console.warn(`[entrypoint] \u26A0 first service is "${first.name}", not "radar" \u2014 quick tunneling is owned by the radar agent today, so NO external URL will be available.`);
+    }
+  }
+  try {
+    await spawnServiceGroup(services);
+    process.exit(0);
+  } catch (err) {
+    console.error(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
 }
-var import_node_child_process2, import_node_fs, import_node_path, REQUIRED_ENV;
+var import_node_child_process2, import_node_fs3, import_node_path3, REQUIRED_ENV;
 var init_radar_docker_init_entry = __esm({
   "src/server/radar-docker-init-entry.ts"() {
     "use strict";
     import_node_child_process2 = require("node:child_process");
-    import_node_fs = require("node:fs");
-    import_node_path = require("node:path");
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
     init_mcp();
+    init_launch_kit_services();
+    init_cf_ingress();
     REQUIRED_ENV = [
       "CLAUDE_CREDENTIALS_B64",
-      "LS_PAT"
+      "LS_PAT",
+      "LS_ORG_SLUG",
+      "LS_PROJECT_SLUG"
     ];
-    main().catch((err) => {
-      console.error(`[entrypoint] fatal: ${err instanceof Error ? err.message : String(err)}`);
-      process.exit(1);
-    });
+    if (!process.env.VITEST) {
+      main().catch((err) => {
+        console.error(`[entrypoint] fatal: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      });
+    }
   }
 });
 
@@ -612,10 +1059,28 @@ var import_node_child_process = require("node:child_process");
 function run(cmd, args, stdio = "inherit") {
   return (0, import_node_child_process.spawnSync)(cmd, args, { stdio }).status ?? 1;
 }
-function configureGitForBot(identity) {
-  if (process.env.GH_TOKEN) {
+function hasGh() {
+  return (0, import_node_child_process.spawnSync)("gh", ["--version"], { stdio: "ignore" }).status === 0;
+}
+function wireGitHubAuth() {
+  if (!process.env.GH_TOKEN) return false;
+  if (hasGh()) {
     run("gh", ["auth", "setup-git"]);
+    return true;
   }
+  const key = "credential.https://github.com.helper";
+  run("git", ["config", "--global", "--replace-all", key, ""]);
+  run("git", [
+    "config",
+    "--global",
+    "--add",
+    key,
+    `!f() { echo username=x-access-token; echo "password=$GH_TOKEN"; }; f`
+  ]);
+  return true;
+}
+function configureGitForBot(identity) {
+  wireGitHubAuth();
   run("git", ["config", "--global", "user.name", identity.name]);
   run("git", ["config", "--global", "user.email", identity.email]);
   run("git", ["config", "--global", "init.defaultBranch", "main"]);
@@ -771,8 +1236,8 @@ Wired in Claude Code (.mcp.json):
   launch-recall   \u2014 restore deleted/modified files from shadow git
 
 Other tools (run on demand via npx):
-  npx launch-pod radar       \u2014 webhook listener (LS pings \u2192 terminal/UI)
-  npx launch-pod             \u2014 full pipeline UI (separate launch-pod login)
+  npx launch-radar           \u2014 webhook listener (LS pings \u2192 terminal/UI)
+  npx launch-sequencer       \u2014 full pipeline UI (separate sequencer login)
   npx launch-beacon monitor  \u2014 local HTTP receiver for the launch-kit-beacon
                                in-browser monitor. Paste the printed URL into
                                the beacon debug panel; events stream to
@@ -994,9 +1459,23 @@ What it does:
   Does NOT clone, re-install deps, re-prompt for PAT, or re-run the onboard
   script. Use \`init\` for those.
 
+  No cred yet? If the repo already exists here but was never init'd (e.g. the
+  repo was created by hand and connected in LS afterward), pass
+  --token/--org/--project and refresh will SEED the cred file, then proceed \u2014
+  no clone, no init required.
+
 Options:
   --dir=<path>             Target directory (default: cwd). Must contain a
-                           valid .launch-secure.cred.config.
+                           valid .launch-secure.cred.config, OR pass the
+                           --token/--org/--project flags below to seed one.
+  --token=<ls_pat_\u2026>       LaunchSecure PAT. Only needed to seed a cred when
+                           none exists yet (otherwise read from the cred file).
+  --org=<orgSlug>          Org slug for the seeded cred (with --token).
+  --project=<projectSlug>  Project slug for the seeded cred (with --token).
+  --url=<serverUrl>        LaunchSecure base URL for the seeded cred
+                           (default: ${DEFAULT_SERVER_URL}).
+  --course=<name>          Course/profile name for the seeded cred
+                           (default: inferred from --url).
   --no-migrate-safety      Skip refreshing the migrate-safety scaffold.
   --no-ls-marketplace      Skip refreshing the launch-secure marketplace.
   --no-recall-hook         Skip refreshing the recall-hook scaffold.
@@ -1058,9 +1537,13 @@ Options:
   --git-identity="N <e>"   Non-interactive git identity for service-account /
                            CI / Docker runs. Configures git user.name, user.email,
                            init.defaultBranch=main, pull.rebase=false; also
-                           wires GH_TOKEN into git's credential helper via
-                           \`gh auth setup-git\` when GH_TOKEN is set. Example:
+                           wires GH_TOKEN into git's credential helper (via
+                           \`gh auth setup-git\`, or a gh-less helper when the
+                           GitHub CLI is absent) when GH_TOKEN is set. Example:
                            --git-identity="Radar Bot <radar@launchpod.local>".
+                           Note: GH_TOKEN is wired for the clone even without
+                           --git-identity, so private-repo clones work on hosts
+                           with no \`gh\` as long as GH_TOKEN is set.
   --no-install             Skip dependency install step (also skips the onboard
                            script \u2014 install is its prerequisite).
   --no-onboard             Skip the onboard script even when install runs.
@@ -1162,9 +1645,9 @@ function preflight() {
   const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
   if (nodeMajor < 18) fail2(`Node.js >= 18 required (current: ${process.versions.node}).`);
   if (!which("git")) fail2("git not found in PATH. Install git: https://git-scm.com/downloads");
-  const hasGh = which("gh") !== null;
-  ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh ? ", gh present" : ", gh not found (will use git for clone)"}`);
-  return { hasGh };
+  const hasGh2 = which("gh") !== null;
+  ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh2 ? ", gh present" : ", gh not found (will use git for clone)"}`);
+  return { hasGh: hasGh2 };
 }
 var PROJECT_INFO_TIMEOUT_MS = 3e4;
 var PROJECT_INFO_MAX_ATTEMPTS = 3;
@@ -1317,11 +1800,11 @@ function dirIsEmpty(dir) {
   if (!fs5.existsSync(dir)) return true;
   return fs5.readdirSync(dir).length === 0;
 }
-function cloneRepo(repoUrl, targetDir, hasGh) {
+function cloneRepo(repoUrl, targetDir, hasGh2) {
   const isGithub = /github\.com/i.test(repoUrl);
   let cmd;
   let args;
-  if (hasGh && isGithub) {
+  if (hasGh2 && isGithub) {
     cmd = "gh";
     args = ["repo", "clone", repoUrl, targetDir];
     info(`cloning via gh: ${repoUrl} \u2192 ${targetDir}`);
@@ -1337,7 +1820,7 @@ function cloneRepo(repoUrl, targetDir, hasGh) {
   const res = (0, import_node_child_process3.spawnSync)(cmd, args, { stdio: "inherit" });
   if (res.status !== 0) {
     fail2(
-      `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\` or an SSH key on your GitHub account.`
+      `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\`, set GH_TOKEN=<a PAT with repo scope> before re-running (works without the GitHub CLI), or add an SSH key to your GitHub account.`
     );
   }
   if (!fs5.existsSync(path5.join(targetDir, ".git"))) {
@@ -1988,9 +2471,26 @@ async function mainRefresh(args) {
       ok(`wrote ${CONFIG_FILENAME} (course: ${courseName})`);
     }
   }
+  if (!cred && args.token && args.orgSlug && args.projectSlug) {
+    const courseName = args.course ?? inferCourseName(args.serverUrl);
+    const seedCfg = {
+      pat: args.token,
+      orgSlug: args.orgSlug,
+      projectSlug: args.projectSlug,
+      serverUrl: args.serverUrl
+    };
+    info(`no ${CONFIG_FILENAME} found \u2014 seeding it from --token/--org/--project (course: ${courseName})`);
+    writeConfigFile(targetDir, seedCfg, courseName);
+    cred = { active: courseName, profiles: { [courseName]: seedCfg } };
+  }
   if (!cred) {
     fail2(
-      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json. Refresh requires an existing cred or a hardcoded launch-secure MCP entry \u2014 run \`npx @launchsecure/launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}\` first.`
+      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json.
+Refresh re-applies configs to an already-wired checkout, so it needs a cred. Two ways forward:
+  \u2022 Seed it inline (you already have the repo): re-run refresh with credentials \u2014
+      launch-kit refresh --dir=${path5.relative(cwd, targetDir) || "."} --token=<pat> --org=<org> --project=<project>
+  \u2022 Or run a full init in place \u2014 it detects this existing repo and skips the clone:
+      launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}`
     );
   }
   const nested = toNested(cred);
@@ -2076,11 +2576,13 @@ async function mainInit(args) {
     ["project", args.projectSlug],
     ["server", args.serverUrl]
   ]);
-  const { hasGh } = preflight();
-  phase("preflight", { status: "ok", summary: `node ${process.versions.node}${hasGh ? " \xB7 git \xB7 gh" : " \xB7 git (gh not found \u2014 will use git for clone)"}` });
+  const { hasGh: hasGh2 } = preflight();
+  phase("preflight", { status: "ok", summary: `node ${process.versions.node}${hasGh2 ? " \xB7 git \xB7 gh" : " \xB7 git (gh not found \u2014 will use git for clone)"}` });
   if (args.gitIdentity) {
     configureGitForBot(args.gitIdentity);
-    phase("git identity", { status: "ok", summary: `${args.gitIdentity.name} <${args.gitIdentity.email}>${process.env.GH_TOKEN ? " \xB7 gh credential helper wired" : ""}` });
+    phase("git identity", { status: "ok", summary: `${args.gitIdentity.name} <${args.gitIdentity.email}>${process.env.GH_TOKEN ? " \xB7 git credential helper wired" : ""}` });
+  } else if (wireGitHubAuth()) {
+    phase("git auth", { status: "ok", summary: hasGh2 ? "GH_TOKEN \u2192 gh credential helper" : "GH_TOKEN \u2192 git credential helper (gh not found)" });
   }
   info(`resolving project ${args.orgSlug}/${args.projectSlug} on ${args.serverUrl} \u2026`);
   let resolved;
@@ -2105,7 +2607,8 @@ async function mainInit(args) {
     if (isGitRepo(targetDir)) {
       const existingRemote = gitRemoteUrl(targetDir);
       if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
-        ok(`${targetDir} is already a clone of ${repoUrl} \u2014 skipping clone, refreshing configs only`);
+        ok(`${targetDir} is already a clone of ${repoUrl} \u2014 wiring this existing repo (skipping clone, no GitHub auth needed)`);
+        info(`tip: once wired, use \`launch-kit refresh\` here to re-apply configs without re-running init`);
         skipClone = true;
       } else {
         fail2(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
@@ -2117,7 +2620,7 @@ async function mainInit(args) {
   const relTarget = path5.relative(cwd, targetDir) || ".";
   if (!skipClone) {
     section(`Cloning ${repoUrl}`);
-    cloneRepo(repoUrl, targetDir, hasGh);
+    cloneRepo(repoUrl, targetDir, hasGh2);
     phase("clone", { status: "ok", summary: `\u2192 ${relTarget}` });
   } else {
     phase("clone", { status: "in-sync", summary: `${relTarget} (already a clone of this repo)` });