@launchsecure/launch-kit 0.0.34 → 0.0.36

package/dist/server/radar-docker-init-entry.js

@@ -21,13 +21,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/radar-docker-init-entry.ts
 var radar_docker_init_entry_exports = {};
 __export(radar_docker_init_entry_exports, {
+  maybeProvisionAccess: () => maybeProvisionAccess,
   maybeProvisionIngress: () => maybeProvisionIngress,
   spawnServiceGroup: () => spawnServiceGroup
 });
 module.exports = __toCommonJS(radar_docker_init_entry_exports);
 var import_node_child_process = require("node:child_process");
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path4 = require("node:path");
 
 // src/server/radar/mcp.ts
 var import_node_https = require("node:https");
@@ -152,17 +153,25 @@ var SHORTHANDS = {
   sequencer: { port: 3517, bin: "launch-sequencer", args: [] },
   chart: { port: 52819, bin: "launch-chart", args: ["serve"] },
   deck: { port: 52829, bin: "launch-deck", args: ["serve"] },
-  council: { port: 52839, bin: "launch-council", args: ["serve"] }
+  // Claude web terminal — exposes a viewable/drivable `claude` session at
+  // `bot.<baseDomain>`. Gated at the edge by CF Access → our OIDC IdP (#183);
+  // see GATED_SERVICES in radar-docker-init-entry.ts (bot = strict session).
+  bot: { port: 52849, bin: "launch-bot", args: ["serve"] }
 };
 var DNS_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 function defaultServices() {
   return [expandShorthand("radar")];
 }
 function expandShorthand(name) {
+  if (name === "preview") {
+    const raw = process.env.PREVIEW_PORT;
+    const port = raw && Number.isFinite(Number.parseInt(raw, 10)) ? Number.parseInt(raw, 10) : 3e3;
+    return { name: "preview", port, bin: "", args: [], skipSpawn: true };
+  }
   const def = SHORTHANDS[name];
   if (!def) {
     throw new Error(
-      `[launch-kit-services] unknown shorthand "${name}" \u2014 known: ${Object.keys(SHORTHANDS).join(", ")}. Use an object entry { name, port, bin, args } for custom services.`
+      `[launch-kit-services] unknown shorthand "${name}" \u2014 known: ${[...Object.keys(SHORTHANDS), "preview"].join(", ")}. Use an object entry { name, port, bin, args } for custom services.`
     );
   }
   return { name, port: def.port, bin: def.bin, args: [...def.args] };
@@ -243,13 +252,16 @@ function resolveServices(opts = {}) {
   }
   return validate(defaultServices());
 }
-var SHORTHAND_NAMES = Object.keys(SHORTHANDS);
+var SHORTHAND_NAMES = [...Object.keys(SHORTHANDS), "preview"];
 
 // src/server/cf-ingress.ts
 var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 var CF_API_BASE = "https://api.cloudflare.com/client/v4";
 var CF_ERR_DNS_RECORD_EXISTS = 81053;
+function serviceLabel(s) {
+  return s.label ?? s.name;
+}
 async function cf(opts) {
   const res = await fetch(`${CF_API_BASE}${opts.path}`, {
     method: opts.method,
@@ -329,7 +341,7 @@ async function fetchConnectorToken(input, tunnelId) {
 }
 async function setIngressConfig(input, tunnelId) {
   const ingress = input.services.map((s) => ({
-    hostname: `${s.name}.${input.zone.name}`,
+    hostname: `${serviceLabel(s)}.${input.zone.name}`,
     service: `http://localhost:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
@@ -344,7 +356,7 @@ async function setIngressConfig(input, tunnelId) {
   }
 }
 async function ensureDnsRecord(input, tunnelId, service) {
-  const fqdn = `${service.name}.${input.zone.name}`;
+  const fqdn = `${serviceLabel(service)}.${input.zone.name}`;
   const target = `${tunnelId}.cfargotunnel.com`;
   const existing = await cf({
     apiToken: input.apiToken,
@@ -388,10 +400,181 @@ async function provisionIngress(input) {
   await setIngressConfig(input, tunnelId);
   await Promise.all(input.services.map((s) => ensureDnsRecord(input, tunnelId, s)));
   const hostnames = {};
-  for (const s of input.services) hostnames[s.name] = `${s.name}.${input.zone.name}`;
+  for (const s of input.services) hostnames[s.name] = `${serviceLabel(s)}.${input.zone.name}`;
   return { tunnelId, connectorToken, hostnames };
 }
 
+// src/server/cf-access.ts
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
+var CF_API_BASE2 = "https://api.cloudflare.com/client/v4";
+var IDP_NAME = "launch-kit-oidc";
+async function cf2(opts) {
+  const res = await fetch(`${CF_API_BASE2}${opts.path}`, {
+    method: opts.method,
+    headers: {
+      Authorization: `Bearer ${opts.apiToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": "launch-kit/cf-access"
+    },
+    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+    signal: AbortSignal.timeout(15e3)
+  });
+  const text = await res.text();
+  try {
+    return text ? JSON.parse(text) : { success: false };
+  } catch {
+    throw new Error(`[cf-access] ${opts.method} ${opts.path} \u2192 ${res.status}, non-JSON: ${text.slice(0, 200)}`);
+  }
+}
+function fail(env, what) {
+  throw new Error(`[cf-access] ${what} failed: ${JSON.stringify(env.errors)}`);
+}
+function loadState2(path) {
+  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    return typeof parsed?.accountId === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function saveState2(path, state) {
+  const dir = (0, import_node_path3.dirname)(path);
+  if (!(0, import_node_fs3.existsSync)(dir)) (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs3.writeFileSync)(path, JSON.stringify(state, null, 2));
+}
+async function getAccessAuthDomain(apiToken, accountId) {
+  const res = await cf2({
+    apiToken,
+    method: "GET",
+    path: `/accounts/${accountId}/access/organizations`
+  });
+  if (!res.success || !res.result?.auth_domain) {
+    fail(res, "GET access/organizations (is Zero Trust enabled on this account?)");
+  }
+  return res.result.auth_domain;
+}
+async function ensureAccessIdp(input) {
+  const config = {
+    client_id: input.clientId,
+    client_secret: input.clientSecret,
+    auth_url: `${input.issuer}/api/oidc/authorize`,
+    token_url: `${input.issuer}/api/oidc/token`,
+    certs_url: `${input.issuer}/.well-known/jwks.json`,
+    scopes: ["openid", "email", "profile"],
+    claims: ["org", "project_access", "roles", "email"],
+    email_claim_name: "email",
+    pkce_enabled: true
+  };
+  const body = { name: IDP_NAME, type: "oidc", config };
+  let idpId = input.knownIdpId;
+  if (!idpId) {
+    const list = await cf2({
+      apiToken: input.apiToken,
+      method: "GET",
+      path: `/accounts/${input.accountId}/access/identity_providers`
+    });
+    if (!list.success) fail(list, "list identity_providers");
+    idpId = (list.result ?? []).find((p) => p.name === IDP_NAME)?.id ?? null;
+  }
+  if (idpId) {
+    const upd = await cf2({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/identity_providers/${idpId}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, "update identity_provider");
+    return upd.result.id;
+  }
+  const created = await cf2({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/identity_providers`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, "create identity_provider");
+  return created.result.id;
+}
+async function ensureAccessApp(input) {
+  const policy = {
+    name: "launch-kit-org-allow",
+    decision: "allow",
+    include: [
+      {
+        oidc: {
+          identity_provider_id: input.idpId,
+          claim_name: "org",
+          claim_value: input.organizationId
+        }
+      }
+    ]
+  };
+  const body = {
+    name: `launch-kit ${input.service.hostname}`,
+    domain: input.service.hostname,
+    type: "self_hosted",
+    // Bot terminal = RCE surface → short session. Read portals = a workday.
+    session_duration: input.service.strict ? "30m" : "24h",
+    allowed_idps: [input.idpId],
+    auto_redirect_to_identity: true,
+    policies: [policy]
+  };
+  const list = await cf2({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/access/apps`
+  });
+  if (!list.success) fail(list, "list access apps");
+  const existing = (list.result ?? []).find((a) => a.domain === input.service.hostname);
+  if (existing) {
+    const upd = await cf2({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, `update access app ${input.service.hostname}`);
+    return upd.result.id;
+  }
+  const created = await cf2({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/apps`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, `create access app ${input.service.hostname}`);
+  return created.result.id;
+}
+async function provisionAccess(input) {
+  const authDomain = await getAccessAuthDomain(input.apiToken, input.accountId);
+  const callbackUrl = `https://${authDomain}/cdn-cgi/access/callback`;
+  const { clientId, clientSecret, organizationId } = await input.registerClient([callbackUrl]);
+  const prior = loadState2(input.stateFile);
+  const idpId = await ensureAccessIdp({
+    apiToken: input.apiToken,
+    accountId: input.accountId,
+    issuer: input.issuer,
+    clientId,
+    clientSecret,
+    knownIdpId: prior?.idpId ?? null
+  });
+  saveState2(input.stateFile, { idpId, accountId: input.accountId });
+  const appIds = {};
+  for (const service of input.services) {
+    appIds[service.hostname] = await ensureAccessApp({
+      apiToken: input.apiToken,
+      accountId: input.accountId,
+      idpId,
+      organizationId,
+      service
+    });
+  }
+  return { idpId, authDomain, appIds };
+}
+
 // src/server/radar-docker-init-entry.ts
 var REQUIRED_ENV = [
   "CLAUDE_CREDENTIALS_B64",
@@ -399,13 +582,13 @@ var REQUIRED_ENV = [
   "LS_ORG_SLUG",
   "LS_PROJECT_SLUG"
 ];
-function fail(message) {
+function fail2(message) {
   console.error(message);
   process.exit(1);
 }
 function requireEnv(name) {
   const v = process.env[name];
-  if (!v) fail(`ERROR: ${name} is required but not set`);
+  if (!v) fail2(`ERROR: ${name} is required but not set`);
   return v;
 }
 function run(cmd, args, stdio = "inherit") {
@@ -422,13 +605,16 @@ async function setupFromCloud() {
   try {
     bundle = await mcp.call("radar_bootstrap_get", {});
   } catch (err) {
-    fail(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
+    fail2(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
   }
   if (!process.env.GIT_USER_NAME) process.env.GIT_USER_NAME = bundle.gitName;
   if (!process.env.GIT_USER_EMAIL) process.env.GIT_USER_EMAIL = bundle.gitEmail;
   if (!process.env.GH_TOKEN && bundle.githubToken) process.env.GH_TOKEN = bundle.githubToken;
+  if (!process.env.RADAR_RULES && Array.isArray(bundle.radarRules) && bundle.radarRules.length > 0) {
+    process.env.RADAR_RULES = JSON.stringify(bundle.radarRules);
+  }
   if (!process.env.GH_TOKEN) {
-    fail(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
+    fail2(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
   }
   const cfNote = bundle.cloudflareToken ? "cloudflare=connected" : "cloudflare=none";
   console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
@@ -436,17 +622,17 @@ async function setupFromCloud() {
 }
 function setupClaudeCredentials() {
   const home = process.env.HOME ?? "/home/launchpod";
-  const claudeDir = (0, import_node_path3.join)(home, ".claude");
-  (0, import_node_fs3.mkdirSync)(claudeDir, { recursive: true });
+  const claudeDir = (0, import_node_path4.join)(home, ".claude");
+  (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
   const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
-  const credsPath = (0, import_node_path3.join)(claudeDir, ".credentials.json");
-  (0, import_node_fs3.writeFileSync)(credsPath, decoded);
-  (0, import_node_fs3.chmodSync)(credsPath, 384);
-  const configPath = (0, import_node_path3.join)(home, ".claude.json");
+  const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
+  (0, import_node_fs4.writeFileSync)(credsPath, decoded);
+  (0, import_node_fs4.chmodSync)(credsPath, 384);
+  const configPath = (0, import_node_path4.join)(home, ".claude.json");
   let cfg = {};
-  if ((0, import_node_fs3.existsSync)(configPath)) {
+  if ((0, import_node_fs4.existsSync)(configPath)) {
     try {
-      cfg = JSON.parse((0, import_node_fs3.readFileSync)(configPath, "utf8"));
+      cfg = JSON.parse((0, import_node_fs4.readFileSync)(configPath, "utf8"));
     } catch {
       cfg = {};
     }
@@ -455,18 +641,56 @@ function setupClaudeCredentials() {
   cfg.lastOnboardingVersion = cfg.lastOnboardingVersion ?? "2.1.159";
   cfg.numStartups = (cfg.numStartups ?? 0) + 1;
   cfg.installMethod = cfg.installMethod ?? "global";
-  (0, import_node_fs3.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
-  (0, import_node_fs3.chmodSync)(configPath, 384);
+  const PREAPPROVED_MCPS = [
+    "launch-secure",
+    "launch-chart",
+    "launch-deck",
+    "launch-orbit",
+    "launch-recall",
+    "launch-beacon",
+    "launch-sequencer"
+  ];
+  const projects = cfg.projects ?? {};
+  const wsKey = "/workspace";
+  const wsProject = projects[wsKey] ?? {};
+  const existingEnabled = Array.isArray(wsProject.enabledMcpjsonServers) ? wsProject.enabledMcpjsonServers : [];
+  const mergedEnabled = Array.from(/* @__PURE__ */ new Set([...existingEnabled, ...PREAPPROVED_MCPS]));
+  wsProject.enabledMcpjsonServers = mergedEnabled;
+  projects[wsKey] = wsProject;
+  cfg.projects = projects;
+  (0, import_node_fs4.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
+  (0, import_node_fs4.chmodSync)(configPath, 384);
 }
 function setupGitAndGh() {
   const name = process.env.GIT_USER_NAME ?? "Radar Bot";
   const email = process.env.GIT_USER_EMAIL ?? "radar@launchpod.local";
   const status = run("launch-kit", ["setup-git", `--identity=${name} <${email}>`]);
-  if (status !== 0) fail(`[entrypoint] launch-kit setup-git failed (status ${status})`);
+  if (status !== 0) fail2(`[entrypoint] launch-kit setup-git failed (status ${status})`);
+}
+function detectAndSetPreviewPort() {
+  if (process.env.PREVIEW_PORT) return;
+  try {
+    const pkgPath = "/workspace/package.json";
+    if (!(0, import_node_fs4.existsSync)(pkgPath)) return;
+    const pkg = JSON.parse((0, import_node_fs4.readFileSync)(pkgPath, "utf-8"));
+    const scripts = pkg.scripts ?? {};
+    const portRe = /(?:--port[= ]|-p\s+|\bPORT=)(\d{2,5})\b/;
+    for (const name of ["dev", "start", "serve"]) {
+      const script = scripts[name];
+      if (typeof script !== "string") continue;
+      const m = script.match(portRe);
+      if (m) {
+        process.env.PREVIEW_PORT = m[1];
+        console.log(`[entrypoint] preview port detected from package.json scripts.${name}: ${m[1]}`);
+        return;
+      }
+    }
+  } catch {
+  }
 }
 function initWorkspaceIfEmpty() {
   process.chdir("/workspace");
-  if ((0, import_node_fs3.existsSync)(".git")) {
+  if ((0, import_node_fs4.existsSync)(".git")) {
     console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
     return;
   }
@@ -479,7 +703,7 @@ function initWorkspaceIfEmpty() {
     `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
     `--dir=/workspace`
   ]);
-  if (status !== 0) fail(`[entrypoint] launch-kit init failed (status ${status})`);
+  if (status !== 0) fail2(`[entrypoint] launch-kit init failed (status ${status})`);
 }
 async function maybeProvisionIngress(bundle, services, projectSlug) {
   const token = bundle.cloudflareToken ?? null;
@@ -487,28 +711,36 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   const zones = bundle.cloudflareZones ?? [];
   if (!token && !accountId && zones.length === 0) return null;
   if (!token || !accountId) {
-    fail(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
+    fail2(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
   }
   const baseDomain = process.env.LAUNCHKIT_CF_BASE_DOMAIN?.trim();
   let chosen = null;
   if (baseDomain) {
     chosen = zones.find((z) => z.name === baseDomain) ?? null;
     if (!chosen) {
-      fail(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
+      fail2(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
     }
   } else if (zones.length === 1) {
     chosen = { id: zones[0].id, name: zones[0].name };
   } else {
-    fail(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
+    fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
   const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
-  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => s.name).join(",")}`);
+  const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+  for (const s of services) {
+    const label = `${slugLabel}-${s.name}`;
+    if (!DNS_LABEL_RE.test(label)) {
+      fail2(`[entrypoint] hostname label "${label}" (${label.length} chars) is not a valid DNS label \u2014 must be 1\u201363 chars of [a-z0-9-] with no leading/trailing hyphen. Shorten the project slug ("${projectSlug}") or the service name ("${s.name}").`);
+    }
+  }
+  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => `${slugLabel}-${s.name}`).join(",")}`);
   const result = await provisionIngress({
     apiToken: token,
     accountId,
     zone: chosen,
     tunnelName: `launch-kit-${projectSlug}`,
-    services: services.map((s) => ({ name: s.name, port: s.port })),
+    services: services.map((s) => ({ name: s.name, label: `${slugLabel}-${s.name}`, port: s.port })),
     stateFile
   });
   for (const [name, fqdn] of Object.entries(result.hostnames)) {
@@ -516,6 +748,61 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   }
   return result;
 }
+var GATED_SERVICES = {
+  // Claude web terminal — live drivable shell ⇒ RCE surface ⇒ short session.
+  bot: { strict: true },
+  // The user's own dev/preview server — a workday-length session is fine.
+  preview: { strict: false }
+};
+async function registerOidcClient(serverUrl, pat, redirectUris) {
+  const res = await fetch(new URL("/api/rover/oidc-client", serverUrl), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${pat}`,
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    },
+    body: JSON.stringify({ redirectUris }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.success || !body.data) {
+    fail2(`[entrypoint] OIDC client provisioning failed (HTTP ${res.status}): ${body?.error ?? "unexpected response"}`);
+  }
+  return body.data;
+}
+async function maybeProvisionAccess(bundle, ingress) {
+  const token = bundle.cloudflareToken ?? null;
+  const accountId = bundle.cloudflareAccountId ?? null;
+  if (!token || !accountId) return;
+  const services = [];
+  const skipped = [];
+  for (const [name, hostname] of Object.entries(ingress.hostnames)) {
+    const cfg = GATED_SERVICES[name];
+    if (cfg) services.push({ hostname, strict: cfg.strict });
+    else skipped.push(name);
+  }
+  if (skipped.length > 0) {
+    console.log(`[entrypoint] CF Access: leaving machine surface(s) ungated: ${skipped.join(", ")}`);
+  }
+  if (services.length === 0) {
+    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview not provisioned)");
+    return;
+  }
+  const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
+  const pat = requireEnv("LS_PAT");
+  const stateFile = "/workspace/.launchpod/launch-kit-access.json";
+  console.log(`[entrypoint] gating ${services.map((s) => s.hostname).join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  const result = await provisionAccess({
+    apiToken: token,
+    accountId,
+    issuer: serverUrl,
+    services,
+    stateFile,
+    registerClient: (redirectUris) => registerOidcClient(serverUrl, pat, redirectUris)
+  });
+  console.log(`[entrypoint] CF Access gate live \u2014 IdP ${result.idpId}, auth domain ${result.authDomain}`);
+}
 function spawnServiceGroup(services) {
   const children = [];
   let shuttingDown = false;
@@ -563,6 +850,10 @@ function spawnServiceGroup(services) {
     let exitedCount = 0;
     let firstFailure = null;
     for (const spec of services) {
+      if (spec.skipSpawn) {
+        console.log(`[entrypoint] ${spec.name} \u2192 ingress-only on port ${spec.port} (no spawn; user starts dev server here)`);
+        continue;
+      }
       const args = [...spec.args, "--port", String(spec.port)];
       console.log(`[entrypoint] starting ${spec.name}: ${spec.bin} ${args.join(" ")}`);
       const proc = (0, import_node_child_process.spawn)(spec.bin, args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -599,11 +890,12 @@ async function main() {
   setupClaudeCredentials();
   setupGitAndGh();
   initWorkspaceIfEmpty();
+  detectAndSetPreviewPort();
   let services;
   try {
     services = resolveServices();
   } catch (err) {
-    fail(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
+    fail2(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
   }
   console.log(`[entrypoint] services: ${services.map((s) => `${s.name}@${s.port}`).join(", ")}`);
   const ingress = await maybeProvisionIngress(bundle, services, requireEnv("LS_PROJECT_SLUG"));
@@ -612,8 +904,9 @@ async function main() {
     const radarFqdn = ingress.hostnames.radar;
     if (radarFqdn) process.env.RADAR_CF_TUNNEL_HOSTNAME = radarFqdn;
     else if (services.some((s) => s.name === "radar")) {
-      fail(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
+      fail2(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
     }
+    await maybeProvisionAccess(bundle, ingress);
   } else if (services.length > 1) {
     const first = services[0];
     console.warn(
@@ -639,6 +932,7 @@ if (!process.env.VITEST) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  maybeProvisionAccess,
   maybeProvisionIngress,
   spawnServiceGroup
 });