@launchsecure/launch-kit 0.0.34 → 0.0.35

package/dist/server/cli.js

@@ -36689,6 +36689,7 @@ function parseArgs() {
   const args = process.argv.slice(2);
   let port = 0;
   let token = null;
+  let course = null;
   const subcommand = args[0] && !args[0].startsWith("--") ? args[0] : null;
   for (let i = 0; i < args.length; i++) {
     if (args[i].startsWith("--token=")) {
@@ -36699,6 +36700,10 @@ function parseArgs() {
       port = parseInt(args[i].slice("--port=".length), 10);
     } else if (args[i] === "--port" && args[i + 1]) {
       port = parseInt(args[++i], 10);
+    } else if (args[i].startsWith("--course=")) {
+      course = args[i].slice("--course=".length);
+    } else if (args[i] === "--course" && args[i + 1]) {
+      course = args[++i];
     }
   }
   if (!port) {
@@ -36715,7 +36720,7 @@ function parseArgs() {
     }
   }
   if (!port) port = 52718;
-  return { port, token, serverUrl: LAUNCHSECURE_URL, subcommand };
+  return { port, token, serverUrl: LAUNCHSECURE_URL, subcommand, course };
 }
 function tryListen(server, port, maxRetries = 10) {
   return new Promise((resolve6, reject) => {
@@ -37286,7 +37291,7 @@ if (parsedArgs.subcommand === "mcp:graph") {
 var __isMcpMode = parsedArgs.subcommand === "mcp:graph";
 var __isRadarMode = parsedArgs.subcommand === "radar";
 var radar = null;
-function readLaunchSecureMcpConfig() {
+function readLaunchSecureMcpConfig(courseOverride) {
   const fix = `Run \`npx @launchsecure/launch-kit@latest refresh\` to re-sync this project (or \`init\` if you haven't bootstrapped yet).`;
   const cred = readCredFile(REPO_ROOT);
   if (!cred) {
@@ -37296,9 +37301,12 @@ function readLaunchSecureMcpConfig() {
   if (!nested) {
     throw new Error(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl). ${fix}`);
   }
-  const profile = nested.profiles[nested.active];
+  const courseName = courseOverride || nested.active;
+  const profile = nested.profiles[courseName];
   if (!profile) {
-    throw new Error(`${CONFIG_FILENAME} active course "${nested.active}" not found in profiles. ${fix}`);
+    const available = Object.keys(nested.profiles).join(", ") || "(none)";
+    const why = courseOverride ? `course "${courseName}" (from --course) not found in profiles. Available: ${available}.` : `active course "${courseName}" not found in profiles. ${fix}`;
+    throw new Error(`${CONFIG_FILENAME} ${why}`);
   }
   const { pat, orgSlug, projectSlug, serverUrl } = profile;
   if (!pat || !pat.startsWith("ls_pat_")) {
@@ -37307,7 +37315,7 @@ function readLaunchSecureMcpConfig() {
   if (!orgSlug || !projectSlug || !serverUrl) {
     throw new Error(`${CONFIG_FILENAME} is missing required fields (orgSlug, projectSlug, serverUrl). ${fix}`);
   }
-  return { pat, orgSlug, projectSlug, serverUrl, source: `${CONFIG_FILENAME}[${nested.active}]` };
+  return { pat, orgSlug, projectSlug, serverUrl, source: `${CONFIG_FILENAME}[${courseName}]`, course: courseName };
 }
 if (!__isMcpMode) {
   let gracefulShutdown = function() {
@@ -37728,7 +37736,7 @@ if (!__isMcpMode) {
     if (__isRadarMode) {
       let cfg;
       try {
-        cfg = readLaunchSecureMcpConfig();
+        cfg = readLaunchSecureMcpConfig(parsedArgs.course);
       } catch (err2) {
         console.error(`[radar] ${err2 instanceof Error ? err2.message : String(err2)}`);
         process.exit(1);
@@ -37736,9 +37744,29 @@ if (!__isMcpMode) {
       const actualPort2 = await tryListen(server, PORT);
       PORT = actualPort2;
       const localUrl = `http://127.0.0.1:${PORT}`;
-      console.log(`LaunchPod radar \xB7 ${localUrl}`);
-      console.log(`  cloud:   ${cfg.serverUrl}  \xB7  source: ${cfg.source}`);
-      console.log(`  org:     ${cfg.orgSlug}  \xB7  project: ${cfg.projectSlug}`);
+      const dim = (s) => `\x1B[2m${s}\x1B[0m`;
+      const bold = (s) => `\x1B[1m${s}\x1B[0m`;
+      const cyan = (s) => `\x1B[36m${s}\x1B[0m`;
+      const COURSE_LABELS = {
+        prod: "Production",
+        production: "Production",
+        staging: "Staging",
+        stage: "Staging",
+        local: "Local",
+        dev: "Development",
+        development: "Development"
+      };
+      const courseLabel = COURSE_LABELS[cfg.course.toLowerCase()] ?? cfg.course.charAt(0).toUpperCase() + cfg.course.slice(1);
+      const row = (label, value) => `    ${dim(label.padEnd(11))}${value}`;
+      console.log("");
+      console.log(`  ${cyan("\u25C9")}  ${bold("LaunchPod Radar")}`);
+      console.log("");
+      const courseTail = parsedArgs.course ? dim(`\xB7 ${cfg.course} \xB7 --course override`) : dim(`\xB7 ${cfg.course}`);
+      console.log(row("Course", `${bold(courseLabel)} ${courseTail}`));
+      console.log(row("Cloud", cfg.serverUrl));
+      console.log(row("Project", `${cfg.orgSlug} ${dim("/")} ${cfg.projectSlug}`));
+      console.log(row("Active on", localUrl));
+      console.log("");
       try {
         radar = new Radar({
           projectRoot: PROJECT_DIR,

package/dist/server/init-entry.js

@@ -473,10 +473,15 @@ function defaultServices() {
   return [expandShorthand("radar")];
 }
 function expandShorthand(name) {
+  if (name === "preview") {
+    const raw = process.env.PREVIEW_PORT;
+    const port = raw && Number.isFinite(Number.parseInt(raw, 10)) ? Number.parseInt(raw, 10) : 3e3;
+    return { name: "preview", port, bin: "", args: [], skipSpawn: true };
+  }
   const def = SHORTHANDS[name];
   if (!def) {
     throw new Error(
-      `[launch-kit-services] unknown shorthand "${name}" \u2014 known: ${Object.keys(SHORTHANDS).join(", ")}. Use an object entry { name, port, bin, args } for custom services.`
+      `[launch-kit-services] unknown shorthand "${name}" \u2014 known: ${[...Object.keys(SHORTHANDS), "preview"].join(", ")}. Use an object entry { name, port, bin, args } for custom services.`
     );
   }
   return { name, port: def.port, bin: def.bin, args: [...def.args] };
@@ -568,10 +573,14 @@ var init_launch_kit_services = __esm({
       sequencer: { port: 3517, bin: "launch-sequencer", args: [] },
       chart: { port: 52819, bin: "launch-chart", args: ["serve"] },
       deck: { port: 52829, bin: "launch-deck", args: ["serve"] },
-      council: { port: 52839, bin: "launch-council", args: ["serve"] }
+      council: { port: 52839, bin: "launch-council", args: ["serve"] },
+      // Claude web terminal — exposes a viewable/drivable `claude` session at
+      // `bot.<baseDomain>`. NOTE: no auth gate yet (tracked as a separate
+      // high-priority rover-security work item); ships behind a plain link first.
+      bot: { port: 52849, bin: "launch-bot", args: ["serve"] }
     };
     DNS_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
-    SHORTHAND_NAMES = Object.keys(SHORTHANDS);
+    SHORTHAND_NAMES = [...Object.keys(SHORTHANDS), "preview"];
   }
 });
 
@@ -790,6 +799,23 @@ function setupClaudeCredentials() {
   cfg.lastOnboardingVersion = cfg.lastOnboardingVersion ?? "2.1.159";
   cfg.numStartups = (cfg.numStartups ?? 0) + 1;
   cfg.installMethod = cfg.installMethod ?? "global";
+  const PREAPPROVED_MCPS = [
+    "launch-secure",
+    "launch-chart",
+    "launch-deck",
+    "launch-orbit",
+    "launch-recall",
+    "launch-beacon",
+    "launch-sequencer"
+  ];
+  const projects = cfg.projects ?? {};
+  const wsKey = "/workspace";
+  const wsProject = projects[wsKey] ?? {};
+  const existingEnabled = Array.isArray(wsProject.enabledMcpjsonServers) ? wsProject.enabledMcpjsonServers : [];
+  const mergedEnabled = Array.from(/* @__PURE__ */ new Set([...existingEnabled, ...PREAPPROVED_MCPS]));
+  wsProject.enabledMcpjsonServers = mergedEnabled;
+  projects[wsKey] = wsProject;
+  cfg.projects = projects;
   (0, import_node_fs3.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
   (0, import_node_fs3.chmodSync)(configPath, 384);
 }
@@ -799,6 +825,27 @@ function setupGitAndGh() {
   const status = run2("launch-kit", ["setup-git", `--identity=${name} <${email}>`]);
   if (status !== 0) fail(`[entrypoint] launch-kit setup-git failed (status ${status})`);
 }
+function detectAndSetPreviewPort() {
+  if (process.env.PREVIEW_PORT) return;
+  try {
+    const pkgPath = "/workspace/package.json";
+    if (!(0, import_node_fs3.existsSync)(pkgPath)) return;
+    const pkg = JSON.parse((0, import_node_fs3.readFileSync)(pkgPath, "utf-8"));
+    const scripts = pkg.scripts ?? {};
+    const portRe = /(?:--port[= ]|-p\s+|\bPORT=)(\d{2,5})\b/;
+    for (const name of ["dev", "start", "serve"]) {
+      const script = scripts[name];
+      if (typeof script !== "string") continue;
+      const m = script.match(portRe);
+      if (m) {
+        process.env.PREVIEW_PORT = m[1];
+        console.log(`[entrypoint] preview port detected from package.json scripts.${name}: ${m[1]}`);
+        return;
+      }
+    }
+  } catch {
+  }
+}
 function initWorkspaceIfEmpty() {
   process.chdir("/workspace");
   if ((0, import_node_fs3.existsSync)(".git")) {
@@ -898,6 +945,10 @@ function spawnServiceGroup(services) {
     let exitedCount = 0;
     let firstFailure = null;
     for (const spec of services) {
+      if (spec.skipSpawn) {
+        console.log(`[entrypoint] ${spec.name} \u2192 ingress-only on port ${spec.port} (no spawn; user starts dev server here)`);
+        continue;
+      }
       const args = [...spec.args, "--port", String(spec.port)];
       console.log(`[entrypoint] starting ${spec.name}: ${spec.bin} ${args.join(" ")}`);
       const proc = (0, import_node_child_process2.spawn)(spec.bin, args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -934,6 +985,7 @@ async function main() {
   setupClaudeCredentials();
   setupGitAndGh();
   initWorkspaceIfEmpty();
+  detectAndSetPreviewPort();
   let services;
   try {
     services = resolveServices();
@@ -1007,10 +1059,28 @@ var import_node_child_process = require("node:child_process");
 function run(cmd, args, stdio = "inherit") {
   return (0, import_node_child_process.spawnSync)(cmd, args, { stdio }).status ?? 1;
 }
-function configureGitForBot(identity) {
-  if (process.env.GH_TOKEN) {
+function hasGh() {
+  return (0, import_node_child_process.spawnSync)("gh", ["--version"], { stdio: "ignore" }).status === 0;
+}
+function wireGitHubAuth() {
+  if (!process.env.GH_TOKEN) return false;
+  if (hasGh()) {
     run("gh", ["auth", "setup-git"]);
+    return true;
   }
+  const key = "credential.https://github.com.helper";
+  run("git", ["config", "--global", "--replace-all", key, ""]);
+  run("git", [
+    "config",
+    "--global",
+    "--add",
+    key,
+    `!f() { echo username=x-access-token; echo "password=$GH_TOKEN"; }; f`
+  ]);
+  return true;
+}
+function configureGitForBot(identity) {
+  wireGitHubAuth();
   run("git", ["config", "--global", "user.name", identity.name]);
   run("git", ["config", "--global", "user.email", identity.email]);
   run("git", ["config", "--global", "init.defaultBranch", "main"]);
@@ -1389,9 +1459,23 @@ What it does:
   Does NOT clone, re-install deps, re-prompt for PAT, or re-run the onboard
   script. Use \`init\` for those.
 
+  No cred yet? If the repo already exists here but was never init'd (e.g. the
+  repo was created by hand and connected in LS afterward), pass
+  --token/--org/--project and refresh will SEED the cred file, then proceed \u2014
+  no clone, no init required.
+
 Options:
   --dir=<path>             Target directory (default: cwd). Must contain a
-                           valid .launch-secure.cred.config.
+                           valid .launch-secure.cred.config, OR pass the
+                           --token/--org/--project flags below to seed one.
+  --token=<ls_pat_\u2026>       LaunchSecure PAT. Only needed to seed a cred when
+                           none exists yet (otherwise read from the cred file).
+  --org=<orgSlug>          Org slug for the seeded cred (with --token).
+  --project=<projectSlug>  Project slug for the seeded cred (with --token).
+  --url=<serverUrl>        LaunchSecure base URL for the seeded cred
+                           (default: ${DEFAULT_SERVER_URL}).
+  --course=<name>          Course/profile name for the seeded cred
+                           (default: inferred from --url).
   --no-migrate-safety      Skip refreshing the migrate-safety scaffold.
   --no-ls-marketplace      Skip refreshing the launch-secure marketplace.
   --no-recall-hook         Skip refreshing the recall-hook scaffold.
@@ -1453,9 +1537,13 @@ Options:
   --git-identity="N <e>"   Non-interactive git identity for service-account /
                            CI / Docker runs. Configures git user.name, user.email,
                            init.defaultBranch=main, pull.rebase=false; also
-                           wires GH_TOKEN into git's credential helper via
-                           \`gh auth setup-git\` when GH_TOKEN is set. Example:
+                           wires GH_TOKEN into git's credential helper (via
+                           \`gh auth setup-git\`, or a gh-less helper when the
+                           GitHub CLI is absent) when GH_TOKEN is set. Example:
                            --git-identity="Radar Bot <radar@launchpod.local>".
+                           Note: GH_TOKEN is wired for the clone even without
+                           --git-identity, so private-repo clones work on hosts
+                           with no \`gh\` as long as GH_TOKEN is set.
   --no-install             Skip dependency install step (also skips the onboard
                            script \u2014 install is its prerequisite).
   --no-onboard             Skip the onboard script even when install runs.
@@ -1557,9 +1645,9 @@ function preflight() {
   const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
   if (nodeMajor < 18) fail2(`Node.js >= 18 required (current: ${process.versions.node}).`);
   if (!which("git")) fail2("git not found in PATH. Install git: https://git-scm.com/downloads");
-  const hasGh = which("gh") !== null;
-  ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh ? ", gh present" : ", gh not found (will use git for clone)"}`);
-  return { hasGh };
+  const hasGh2 = which("gh") !== null;
+  ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh2 ? ", gh present" : ", gh not found (will use git for clone)"}`);
+  return { hasGh: hasGh2 };
 }
 var PROJECT_INFO_TIMEOUT_MS = 3e4;
 var PROJECT_INFO_MAX_ATTEMPTS = 3;
@@ -1712,11 +1800,11 @@ function dirIsEmpty(dir) {
   if (!fs5.existsSync(dir)) return true;
   return fs5.readdirSync(dir).length === 0;
 }
-function cloneRepo(repoUrl, targetDir, hasGh) {
+function cloneRepo(repoUrl, targetDir, hasGh2) {
   const isGithub = /github\.com/i.test(repoUrl);
   let cmd;
   let args;
-  if (hasGh && isGithub) {
+  if (hasGh2 && isGithub) {
     cmd = "gh";
     args = ["repo", "clone", repoUrl, targetDir];
     info(`cloning via gh: ${repoUrl} \u2192 ${targetDir}`);
@@ -1732,7 +1820,7 @@ function cloneRepo(repoUrl, targetDir, hasGh) {
   const res = (0, import_node_child_process3.spawnSync)(cmd, args, { stdio: "inherit" });
   if (res.status !== 0) {
     fail2(
-      `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\` or an SSH key on your GitHub account.`
+      `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\`, set GH_TOKEN=<a PAT with repo scope> before re-running (works without the GitHub CLI), or add an SSH key to your GitHub account.`
     );
   }
   if (!fs5.existsSync(path5.join(targetDir, ".git"))) {
@@ -2383,9 +2471,26 @@ async function mainRefresh(args) {
       ok(`wrote ${CONFIG_FILENAME} (course: ${courseName})`);
     }
   }
+  if (!cred && args.token && args.orgSlug && args.projectSlug) {
+    const courseName = args.course ?? inferCourseName(args.serverUrl);
+    const seedCfg = {
+      pat: args.token,
+      orgSlug: args.orgSlug,
+      projectSlug: args.projectSlug,
+      serverUrl: args.serverUrl
+    };
+    info(`no ${CONFIG_FILENAME} found \u2014 seeding it from --token/--org/--project (course: ${courseName})`);
+    writeConfigFile(targetDir, seedCfg, courseName);
+    cred = { active: courseName, profiles: { [courseName]: seedCfg } };
+  }
   if (!cred) {
     fail2(
-      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json. Refresh requires an existing cred or a hardcoded launch-secure MCP entry \u2014 run \`npx @launchsecure/launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}\` first.`
+      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json.
+Refresh re-applies configs to an already-wired checkout, so it needs a cred. Two ways forward:
+  \u2022 Seed it inline (you already have the repo): re-run refresh with credentials \u2014
+      launch-kit refresh --dir=${path5.relative(cwd, targetDir) || "."} --token=<pat> --org=<org> --project=<project>
+  \u2022 Or run a full init in place \u2014 it detects this existing repo and skips the clone:
+      launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}`
     );
   }
   const nested = toNested(cred);
@@ -2471,11 +2576,13 @@ async function mainInit(args) {
     ["project", args.projectSlug],
     ["server", args.serverUrl]
   ]);
-  const { hasGh } = preflight();
-  phase("preflight", { status: "ok", summary: `node ${process.versions.node}${hasGh ? " \xB7 git \xB7 gh" : " \xB7 git (gh not found \u2014 will use git for clone)"}` });
+  const { hasGh: hasGh2 } = preflight();
+  phase("preflight", { status: "ok", summary: `node ${process.versions.node}${hasGh2 ? " \xB7 git \xB7 gh" : " \xB7 git (gh not found \u2014 will use git for clone)"}` });
   if (args.gitIdentity) {
     configureGitForBot(args.gitIdentity);
-    phase("git identity", { status: "ok", summary: `${args.gitIdentity.name} <${args.gitIdentity.email}>${process.env.GH_TOKEN ? " \xB7 gh credential helper wired" : ""}` });
+    phase("git identity", { status: "ok", summary: `${args.gitIdentity.name} <${args.gitIdentity.email}>${process.env.GH_TOKEN ? " \xB7 git credential helper wired" : ""}` });
+  } else if (wireGitHubAuth()) {
+    phase("git auth", { status: "ok", summary: hasGh2 ? "GH_TOKEN \u2192 gh credential helper" : "GH_TOKEN \u2192 git credential helper (gh not found)" });
   }
   info(`resolving project ${args.orgSlug}/${args.projectSlug} on ${args.serverUrl} \u2026`);
   let resolved;
@@ -2500,7 +2607,8 @@ async function mainInit(args) {
     if (isGitRepo(targetDir)) {
       const existingRemote = gitRemoteUrl(targetDir);
       if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
-        ok(`${targetDir} is already a clone of ${repoUrl} \u2014 skipping clone, refreshing configs only`);
+        ok(`${targetDir} is already a clone of ${repoUrl} \u2014 wiring this existing repo (skipping clone, no GitHub auth needed)`);
+        info(`tip: once wired, use \`launch-kit refresh\` here to re-apply configs without re-running init`);
         skipClone = true;
       } else {
         fail2(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
@@ -2512,7 +2620,7 @@ async function mainInit(args) {
   const relTarget = path5.relative(cwd, targetDir) || ".";
   if (!skipClone) {
     section(`Cloning ${repoUrl}`);
-    cloneRepo(repoUrl, targetDir, hasGh);
+    cloneRepo(repoUrl, targetDir, hasGh2);
     phase("clone", { status: "ok", summary: `\u2192 ${relTarget}` });
   } else {
     phase("clone", { status: "in-sync", summary: `${relTarget} (already a clone of this repo)` });