@launchsecure/launch-kit 0.0.34 → 0.0.36

package/dist/server/rover-entry.js

@@ -34,6 +34,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/server/cf-ingress.ts
+function serviceLabel(s) {
+  return s.label ?? s.name;
+}
 async function cf(opts) {
   const res = await fetch(`${CF_API_BASE}${opts.path}`, {
     method: opts.method,
@@ -113,7 +116,7 @@ async function fetchConnectorToken(input, tunnelId) {
 }
 async function setIngressConfig(input, tunnelId) {
   const ingress = input.services.map((s) => ({
-    hostname: `${s.name}.${input.zone.name}`,
+    hostname: `${serviceLabel(s)}.${input.zone.name}`,
     service: `http://localhost:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
@@ -128,7 +131,7 @@ async function setIngressConfig(input, tunnelId) {
   }
 }
 async function ensureDnsRecord(input, tunnelId, service) {
-  const fqdn = `${service.name}.${input.zone.name}`;
+  const fqdn = `${serviceLabel(service)}.${input.zone.name}`;
   const target = `${tunnelId}.cfargotunnel.com`;
   const existing = await cf({
     apiToken: input.apiToken,
@@ -172,7 +175,7 @@ async function provisionIngress(input) {
   await setIngressConfig(input, tunnelId);
   await Promise.all(input.services.map((s) => ensureDnsRecord(input, tunnelId, s)));
   const hostnames = {};
-  for (const s of input.services) hostnames[s.name] = `${s.name}.${input.zone.name}`;
+  for (const s of input.services) hostnames[s.name] = `${serviceLabel(s)}.${input.zone.name}`;
   return { tunnelId, connectorToken, hostnames };
 }
 var import_node_fs, import_node_path, CF_API_BASE, CF_ERR_DNS_RECORD_EXISTS;
@@ -222,6 +225,17 @@ async function ensureDocker(opts = {}) {
   const initial = detectDocker();
   if (initial.daemonAlive) return initial;
   const platform = process.platform;
+  if (initial.cliPresent && canStartDaemon(platform)) {
+    if (await confirm(opts, "Docker is installed but its daemon isn't running. Start it now?")) {
+      const started = await startDockerDaemon(platform);
+      if (started.daemonAlive) return started;
+      console.log(
+        `
+Docker did not become ready within ${Math.round(DAEMON_START_TIMEOUT_MS / 1e3)}s. Open Docker manually and re-run setup.`
+      );
+      throw new Error("Docker daemon did not start in time.");
+    }
+  }
   if (!opts.autoInstall) {
     printManualInstructions(initial, platform);
     throw new Error("Docker is not ready. Install + start it, then re-run `launch-rover setup`.");
@@ -250,6 +264,40 @@ async function ensureDocker(opts = {}) {
     `Auto-install is not supported on ${platform}. Install Docker Desktop manually, then re-run setup.`
   );
 }
+function canStartDaemon(platform) {
+  if (platform === "darwin") return true;
+  if (platform === "linux") return commandExists("systemctl");
+  return false;
+}
+async function startDockerDaemon(platform) {
+  if (platform === "darwin") {
+    runAndPrint("open", ["-a", "Docker"]);
+  } else if (platform === "linux") {
+    runAndPrint("sudo", ["systemctl", "start", "docker"]);
+  } else {
+    throw new Error(`Cannot start the Docker daemon on ${platform}.`);
+  }
+  console.log("Waiting for the Docker daemon to come up\u2026");
+  const deadline = DAEMON_START_TIMEOUT_MS;
+  let waited = 0;
+  while (waited < deadline) {
+    await (0, import_promises2.setTimeout)(DAEMON_POLL_INTERVAL_MS);
+    waited += DAEMON_POLL_INTERVAL_MS;
+    const probe = detectDocker();
+    if (probe.daemonAlive) {
+      console.log(`Docker daemon is up (after ~${Math.round(waited / 1e3)}s).`);
+      return probe;
+    }
+  }
+  return detectDocker();
+}
+function commandExists(cmd) {
+  const probe = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [cmd], {
+    stdio: "ignore",
+    timeout: 1500
+  });
+  return probe.status === 0;
+}
 function printManualInstructions(detection, platform) {
   console.log("\n\u2500\u2500 Docker is required to run launch-rover \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (!detection.cliPresent) {
@@ -305,13 +353,16 @@ function runAndPrint(cmd, args) {
     throw new Error(`${cmd} exited with code ${result.status ?? "signal"}`);
   }
 }
-var import_node_child_process, import_promises, import_node_process;
+var import_node_child_process, import_promises, import_node_process, import_promises2, DAEMON_START_TIMEOUT_MS, DAEMON_POLL_INTERVAL_MS;
 var init_docker_install = __esm({
   "src/server/rover/docker-install.ts"() {
     "use strict";
     import_node_child_process = require("node:child_process");
     import_promises = require("node:readline/promises");
     import_node_process = require("node:process");
+    import_promises2 = require("node:timers/promises");
+    DAEMON_START_TIMEOUT_MS = 6e4;
+    DAEMON_POLL_INTERVAL_MS = 2e3;
   }
 });
 
@@ -439,18 +490,18 @@ var init_mcp_client = __esm({
 var state_exports = {};
 __export(state_exports, {
   clearRoverState: () => clearRoverState,
-  listRoverOrgs: () => listRoverOrgs,
+  listRoverIds: () => listRoverIds,
   loadRoverState: () => loadRoverState,
   saveRoverState: () => saveRoverState
 });
 function stateDir() {
   return (0, import_node_path2.join)((0, import_node_os.homedir)(), LAUNCHSECURE_DIR, "rover");
 }
-function statePath(orgSlug) {
-  return (0, import_node_path2.join)(stateDir(), `${orgSlug}.json`);
+function statePath(roverId) {
+  return (0, import_node_path2.join)(stateDir(), `${roverId}.json`);
 }
-function loadRoverState(orgSlug) {
-  const p = statePath(orgSlug);
+function loadRoverState(roverId) {
+  const p = statePath(roverId);
   if (!(0, import_node_fs2.existsSync)(p)) return null;
   try {
     const data = JSON.parse((0, import_node_fs2.readFileSync)(p, "utf-8"));
@@ -462,23 +513,23 @@ function loadRoverState(orgSlug) {
 }
 function saveRoverState(state) {
   (0, import_node_fs2.mkdirSync)(stateDir(), { recursive: true });
-  const final = statePath(state.orgSlug);
+  const final = statePath(state.roverId);
   const tmp = `${final}.tmp`;
   (0, import_node_fs2.writeFileSync)(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
   (0, import_node_fs2.renameSync)(tmp, final);
 }
-function clearRoverState(orgSlug) {
+function clearRoverState(roverId) {
   try {
-    (0, import_node_fs2.unlinkSync)(statePath(orgSlug));
+    (0, import_node_fs2.unlinkSync)(statePath(roverId));
   } catch {
   }
 }
-function listRoverOrgs() {
+function listRoverIds() {
   const dir = stateDir();
   if (!(0, import_node_fs2.existsSync)(dir)) return [];
   try {
     const fs = require("node:fs");
-    return fs.readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5));
+    return fs.readdirSync(dir).filter((f) => f.endsWith(".json") && !f.includes(".tunnel.")).map((f) => f.slice(0, -5));
   } catch {
     return [];
   }
@@ -514,7 +565,8 @@ async function registerOrRefresh(params) {
     secret,
     tunnelUrl: params.tunnelUrl,
     installedAt: params.existing?.installedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    daemonPort: params.daemonPort
+    daemonPort: params.daemonPort,
+    installPat: params.installPat
   };
   saveRoverState(state);
   return {
@@ -530,6 +582,139 @@ var init_registration = __esm({
   }
 });
 
+// package.json
+var require_package = __commonJS({
+  "package.json"(exports2, module2) {
+    module2.exports = {
+      name: "@launchsecure/launch-kit",
+      version: "0.0.36",
+      description: "LaunchSecure toolkit \u2014 launch-sequencer (pipeline runner + terminal bridge), launch-radar (feedback webhook receiver), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup). launch-pod is the container image these run inside.",
+      license: "MIT",
+      author: "LaunchSecure - AutomateWithUs",
+      homepage: "https://automatewith.us",
+      repository: {
+        type: "git",
+        url: "https://github.com/launchsecure/launchsecure-v2",
+        directory: "packages/cli"
+      },
+      keywords: [
+        "launchsecure",
+        "launch-kit",
+        "launch-chart",
+        "launch-pod",
+        "project-graph",
+        "launch-deck",
+        "launch-kit-beacon",
+        "feedback",
+        "bug-report",
+        "screenshot",
+        "web-component",
+        "launch-recall",
+        "playground",
+        "visual",
+        "mcp",
+        "pipeline",
+        "ai",
+        "cli",
+        "file-watcher",
+        "backup",
+        "recovery"
+      ],
+      exports: {
+        "./beacon": {
+          types: "./dist/beacon/types/index.d.ts",
+          import: "./dist/beacon/beacon.mjs",
+          require: "./dist/beacon/beacon.umd.js"
+        }
+      },
+      engines: {
+        node: ">=18.0.0"
+      },
+      publishConfig: {
+        access: "public"
+      },
+      bin: {
+        "launch-kit": "./dist/server/init-entry.js",
+        "launch-sequencer": "./dist/server/cli.js",
+        "launch-radar": "./dist/server/launch-radar-entry.js",
+        "launch-chart": "./dist/server/graph-mcp-entry.js",
+        "launch-deck": "./dist/server/deck-mcp-entry.js",
+        "launch-recall": "./dist/server/recall-entry.js",
+        "launch-orbit": "./dist/server/orbit-entry.js",
+        "launch-course": "./dist/server/course-entry.js",
+        "launch-beacon": "./dist/server/beacon-monitor-entry.js",
+        "launch-rover": "./dist/server/rover-entry.js",
+        "launch-bot": "./dist/server/launch-bot-entry.js"
+      },
+      scripts: {
+        build: "pnpm build:client && pnpm build:chart-client && pnpm build:deck-client && pnpm build:council-client && pnpm build:beacon && pnpm build:server",
+        "build:beacon": "vite build --config vite.beacon.config.ts && tsc -p tsconfig.beacon.json --emitDeclarationOnly --outDir dist/beacon/types",
+        "test:beacon": "vitest run --config vite.beacon.config.ts",
+        "test:radar": "vitest run --config vite.radar.config.ts",
+        "test:chart": "vitest run --config vite.chart.test.config.ts",
+        "build:deck-client": "vite build --config vite.deck.config.ts",
+        "build:council-client": "vite build --config vite.council.config.ts",
+        "build:client": "vite build",
+        "build:chart-client": "vite build --config vite.chart.config.ts",
+        "build:server": "esbuild src/server/cli.ts src/server/fb-wizard.ts src/server/graph-mcp-entry.ts src/server/chart-serve.ts src/server/deck-mcp-entry.ts src/server/deck-serve.ts src/server/council-entry.ts src/server/council-serve.ts src/server/recall-entry.ts src/server/init-entry.ts src/server/orbit-entry.ts src/server/course-entry.ts src/server/beacon-monitor-entry.ts src/server/parse-worker-entry.ts src/server/radar-teardown-entry.ts src/server/radar-docker-init-entry.ts src/server/launch-radar-entry.ts src/server/rover-entry.ts src/server/launch-bot-entry.ts --bundle --platform=node --target=node18 --outdir=dist/server --external:node-pty --external:ws --external:typescript --external:web-tree-sitter --external:tree-sitter-typescript --external:cloudflared --external:pg --external:pg-native --external:pgsql-parser --external:libpg-query && rm -rf dist/server/public && cp -r ../claude-code-web/src/public dist/server/public && rm -rf dist/server/graph/queries && mkdir -p dist/server/graph && cp -r src/server/graph/queries dist/server/graph/queries",
+        "dev:client": "vite",
+        "dev:deck-serve": "cd ../.. && tsx watch packages/cli/src/server/deck-mcp-entry.ts serve",
+        "dev:chart": "pnpm build:server && pnpm build:chart-client && node dist/server/graph-mcp-entry.js serve",
+        "dev:server": "pnpm build:server && node dist/server/cli.js",
+        dev: 'pnpm build:server && concurrently -k -n client,server -c cyan,magenta "vite" "node dist/server/cli.js"',
+        prepublishOnly: "pnpm build"
+      },
+      files: [
+        "dist",
+        "prompts",
+        "scaffolds"
+      ],
+      dependencies: {
+        "cacheable-lookup": "^7.0.0",
+        cloudflared: "^0.7.1",
+        "html-to-image": "^1.11.13",
+        "node-pty": "^1.2.0-beta.12",
+        pg: "^8.13.0",
+        "pgsql-parser": "^17.9.15",
+        "tree-sitter": "^0.21.1",
+        "tree-sitter-typescript": "^0.23.2",
+        typescript: "^5.5.0",
+        undici: "^6.25.0",
+        "web-tree-sitter": "^0.24.7",
+        ws: "^8.18.0"
+      },
+      devDependencies: {
+        "@launchsecure/claude-code-web": "workspace:*",
+        "@launchsecure/ui": "workspace:*",
+        "@types/node": "^20.0.0",
+        "@types/pg": "^8.11.10",
+        "@types/react": "^18.3.12",
+        "@types/react-dom": "^18.3.1",
+        "@types/ws": "^8.5.10",
+        "@vitejs/plugin-react": "^4.3.4",
+        "@xterm/addon-fit": "^0.10.0",
+        "@xterm/addon-web-links": "^0.11.0",
+        "@xterm/xterm": "^5.5.0",
+        "@xyflow/react": "^12.10.2",
+        autoprefixer: "^10.4.27",
+        concurrently: "^9.2.1",
+        esbuild: "^0.28.0",
+        "happy-dom": "^20.8.8",
+        marked: "^15.0.0",
+        mermaid: "^11.4.0",
+        postcss: "^8.5.8",
+        react: "^18.3.1",
+        "react-dom": "^18.3.1",
+        "react-force-graph-2d": "^1.25.5",
+        "react-router-dom": "^6.28.0",
+        tailwindcss: "^3.4.19",
+        vite: "^5.4.11",
+        vitest: "^1.6.0"
+      }
+    };
+  }
+});
+
 // ../../node_modules/.pnpm/cacheable-lookup@7.0.0/node_modules/cacheable-lookup/source/index.js
 var import_node_dns, import_node_util, import_node_os2, AsyncResolver, kCacheableLookupCreateConnection, kCacheableLookupInstance, kExpires, supportsALL, verifyAgent, map4to6, getIfaceInfo, isIterable, ignoreNoResultErrors, ttl, all, all4, all6, CacheableLookup;
 var init_source = __esm({
@@ -11455,7 +11640,7 @@ var require_mock_interceptor = __commonJS({
 var require_mock_client = __commonJS({
   "../../node_modules/.pnpm/undici@6.25.0/node_modules/undici/lib/mock/mock-client.js"(exports2, module2) {
     "use strict";
-    var { promisify: promisify2 } = require("node:util");
+    var { promisify: promisify3 } = require("node:util");
     var Client = require_client();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -11495,7 +11680,7 @@ var require_mock_client = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -11508,7 +11693,7 @@ var require_mock_client = __commonJS({
 var require_mock_pool = __commonJS({
   "../../node_modules/.pnpm/undici@6.25.0/node_modules/undici/lib/mock/mock-pool.js"(exports2, module2) {
     "use strict";
-    var { promisify: promisify2 } = require("node:util");
+    var { promisify: promisify3 } = require("node:util");
     var Pool = require_pool();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -11548,7 +11733,7 @@ var require_mock_pool = __commonJS({
         return new MockInterceptor(opts, this[kDispatches]);
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -19288,17 +19473,17 @@ function createTunnel(opts) {
   const exhaustive = opts.provider;
   throw new Error(`[tunnel] unknown provider: ${String(exhaustive)}`);
 }
-var import_node_fs3, import_node_events, import_promises2, import_undici, import_cloudflared, dnsResolver, dnsCache, dnsResilientDispatcher, BACKOFF_MIN_MS, BACKOFF_MAX_MS, SELFTEST_INTERVAL_MS, SELFTEST_TIMEOUT_MS, NAMED_FATAL_PATTERNS, CloudflaredTunnel;
+var import_node_fs3, import_node_events, import_promises3, import_undici, import_cloudflared, dnsResolver, dnsCache, dnsResilientDispatcher, BACKOFF_MIN_MS, BACKOFF_MAX_MS, SELFTEST_INTERVAL_MS, SELFTEST_TIMEOUT_MS, NAMED_FATAL_PATTERNS, CloudflaredTunnel;
 var init_tunnel = __esm({
   "src/server/tunnel/index.ts"() {
     "use strict";
     import_node_fs3 = require("node:fs");
     import_node_events = require("node:events");
-    import_promises2 = require("node:dns/promises");
+    import_promises3 = require("node:dns/promises");
     init_source();
     import_undici = __toESM(require_undici());
     import_cloudflared = require("cloudflared");
-    dnsResolver = new import_promises2.Resolver();
+    dnsResolver = new import_promises3.Resolver();
     dnsResolver.setServers(["1.1.1.1", "8.8.8.8"]);
     dnsCache = new CacheableLookup({ resolver: dnsResolver });
     dnsResilientDispatcher = new import_undici.Agent({
@@ -19530,6 +19715,262 @@ var init_hmac = __esm({
   }
 });
 
+// src/server/rover/pods.ts
+async function podsUp(state, body) {
+  if (!state.installPat) {
+    throw new PodError(
+      "rover state is missing the install PAT \u2014 re-run `launch-rover setup` to refresh.",
+      500
+    );
+  }
+  if (!body || typeof body !== "object") {
+    throw new PodError("body must be a JSON object");
+  }
+  if (typeof body.projectSlug !== "string" || !DNS_SLUG_RE.test(body.projectSlug)) {
+    throw new PodError("projectSlug must be a DNS-safe string (a-z, 0-9, -)");
+  }
+  if (typeof body.claudeCredentialsB64 !== "string" || body.claudeCredentialsB64.length < 16) {
+    throw new PodError("claudeCredentialsB64 is required (base64-encoded Claude credentials JSON)");
+  }
+  const image = body.image ?? DEFAULT_IMAGE;
+  const containerName = POD_NAME_PREFIX + body.projectSlug;
+  const workspaceVol = `${VOLUME_PREFIX}${body.projectSlug}-workspace`;
+  const claudeVol = `${VOLUME_PREFIX}${body.projectSlug}-claude`;
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  await stopAndRemove(containerName);
+  const dockerConfigDir = body.skipPull ? null : setupDockerConfig();
+  try {
+    if (!body.skipPull) {
+      await dockerRun(
+        ["pull", image],
+        dockerConfigDir ? { DOCKER_CONFIG: dockerConfigDir } : {}
+      );
+    }
+    const runArgs = [
+      "run",
+      "-d",
+      "--name",
+      containerName,
+      "--restart",
+      "unless-stopped",
+      // Lets the container reach the host's loopback. Built-in on Docker
+      // Desktop (macOS/Windows); explicit on Linux. Required when LS runs
+      // on the host as a dev server (LS_SERVER_URL=http://localhost:…).
+      "--add-host",
+      "host.docker.internal:host-gateway",
+      "--label",
+      `${MANAGED_LABEL}=true`,
+      "--label",
+      `launch-rover.projectSlug=${body.projectSlug}`,
+      "--label",
+      `launch-rover.createdAt=${createdAt}`,
+      "-v",
+      `${workspaceVol}:/workspace`,
+      "-v",
+      `${claudeVol}:/home/launchpod/.claude`
+    ];
+    if (body.podId) runArgs.push("--label", `launch-rover.podId=${body.podId}`);
+    if (body.name) runArgs.push("--label", `launch-rover.name=${body.name}`);
+    const envVars = {
+      CLAUDE_CREDENTIALS_B64: body.claudeCredentialsB64,
+      LS_PAT: state.installPat,
+      LS_ORG_SLUG: state.orgSlug,
+      LS_PROJECT_SLUG: body.projectSlug,
+      LS_SERVER_URL: rewriteLocalhostForContainer(state.serverUrl)
+    };
+    if (body.services && Array.isArray(body.services)) {
+      envVars.LAUNCHKIT_SERVICES = JSON.stringify(body.services);
+    }
+    if (body.cfBaseDomain) envVars.LAUNCHKIT_CF_BASE_DOMAIN = body.cfBaseDomain;
+    if (body.env && typeof body.env === "object") {
+      for (const [k, v] of Object.entries(body.env)) {
+        if (typeof v === "string") envVars[k] = v;
+      }
+    }
+    for (const [k, v] of Object.entries(envVars)) {
+      runArgs.push("-e", `${k}=${v}`);
+    }
+    runArgs.push(image);
+    const containerId = (await dockerRun(runArgs)).stdout.trim();
+    return { podId: body.podId ?? null, projectSlug: body.projectSlug, containerId, image, createdAt };
+  } finally {
+    if (dockerConfigDir) (0, import_node_fs4.rmSync)(dockerConfigDir, { recursive: true, force: true });
+  }
+}
+async function podsDown(_state, body) {
+  if (!body || typeof body !== "object") {
+    throw new PodError("body must be a JSON object");
+  }
+  if (typeof body.projectSlug !== "string" || !DNS_SLUG_RE.test(body.projectSlug)) {
+    throw new PodError("projectSlug must be a DNS-safe string (a-z, 0-9, -)");
+  }
+  const mode = body.mode ?? "stop";
+  if (mode !== "stop" && mode !== "remove" && mode !== "purge") {
+    throw new PodError(`mode must be "stop" | "remove" | "purge" (got "${mode}")`);
+  }
+  const containerName = POD_NAME_PREFIX + body.projectSlug;
+  const stopped = await dockerStopIfExists(containerName);
+  let removed = false;
+  let volumesRemoved = false;
+  if (mode === "remove" || mode === "purge") {
+    removed = await dockerRmIfExists(containerName);
+  }
+  if (mode === "purge") {
+    const workspaceVol = `${VOLUME_PREFIX}${body.projectSlug}-workspace`;
+    const claudeVol = `${VOLUME_PREFIX}${body.projectSlug}-claude`;
+    const a = await dockerVolumeRmIfExists(workspaceVol);
+    const b = await dockerVolumeRmIfExists(claudeVol);
+    volumesRemoved = a || b;
+  }
+  return { projectSlug: body.projectSlug, mode, stopped, removed, volumesRemoved };
+}
+async function podsList(_state) {
+  const { stdout: stdout2 } = await dockerRun([
+    "ps",
+    "-a",
+    "--filter",
+    `label=${MANAGED_LABEL}=true`,
+    "--format",
+    "{{json .}}"
+  ]);
+  const pods = [];
+  for (const line of stdout2.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let row;
+    try {
+      row = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    pods.push(parsePsRow(row));
+  }
+  return { pods };
+}
+async function stopAndRemove(containerName) {
+  await dockerStopIfExists(containerName);
+  await dockerRmIfExists(containerName);
+}
+async function dockerStopIfExists(containerName) {
+  try {
+    await dockerRun(["stop", containerName]);
+    return true;
+  } catch (err) {
+    if (isNoSuchContainer(err)) return false;
+    throw err;
+  }
+}
+async function dockerRmIfExists(containerName) {
+  try {
+    await dockerRun(["rm", containerName]);
+    return true;
+  } catch (err) {
+    if (isNoSuchContainer(err)) return false;
+    throw err;
+  }
+}
+async function dockerVolumeRmIfExists(volumeName) {
+  try {
+    await dockerRun(["volume", "rm", volumeName]);
+    return true;
+  } catch (err) {
+    if (isNoSuchVolume(err)) return false;
+    throw err;
+  }
+}
+function isNoSuchContainer(err) {
+  const e = err;
+  const text = `${e?.stderr ?? ""}${e?.message ?? ""}`.toLowerCase();
+  return text.includes("no such container");
+}
+function isNoSuchVolume(err) {
+  const e = err;
+  const text = `${e?.stderr ?? ""}${e?.message ?? ""}`.toLowerCase();
+  return text.includes("no such volume") || text.includes("get no such volume");
+}
+async function dockerRun(args, envOverlay = {}) {
+  try {
+    const { stdout: stdout2, stderr } = await execFileAsync("docker", args, {
+      env: { ...process.env, ...envOverlay },
+      maxBuffer: 32 * 1024 * 1024
+    });
+    return { stdout: stdout2, stderr };
+  } catch (err) {
+    const e = err;
+    throw new PodError(
+      `docker ${args[0]} failed: ${(e.stderr || e.message || "").trim()}`,
+      502
+    );
+  }
+}
+function setupDockerConfig() {
+  const token = process.env.GHCR_PULL_TOKEN;
+  if (!token) {
+    console.log(
+      "[rover] no GHCR_PULL_TOKEN set \u2014 pulling image anonymously (succeeds only if the image is public)"
+    );
+    return null;
+  }
+  const dir = (0, import_node_fs4.mkdtempSync)((0, import_node_path3.join)((0, import_node_os3.tmpdir)(), "launch-rover-docker-"));
+  const auth = Buffer.from(`${GHCR_USERNAME}:${token}`, "utf-8").toString("base64");
+  const config = { auths: { [GHCR_REGISTRY]: { auth } } };
+  (0, import_node_fs4.writeFileSync)((0, import_node_path3.join)(dir, "config.json"), JSON.stringify(config), { mode: 384 });
+  return dir;
+}
+function parsePsRow(row) {
+  const labels = parseLabels(row.Labels);
+  return {
+    podId: labels["launch-rover.podId"] ?? null,
+    projectSlug: labels["launch-rover.projectSlug"] ?? null,
+    name: labels["launch-rover.name"] ?? null,
+    containerName: row.Names ?? "",
+    containerId: row.ID ?? "",
+    image: row.Image ?? "",
+    state: row.State ?? "",
+    status: row.Status ?? "",
+    createdAt: labels["launch-rover.createdAt"] ?? row.CreatedAt ?? null
+  };
+}
+function rewriteLocalhostForContainer(url) {
+  return url.replace(/^(https?:\/\/)(localhost|127\.0\.0\.1)(?=[:\/]|$)/i, "$1host.docker.internal");
+}
+function parseLabels(raw) {
+  const out = {};
+  if (!raw) return out;
+  for (const pair of raw.split(",")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) continue;
+    out[pair.slice(0, eq).trim()] = pair.slice(eq + 1).trim();
+  }
+  return out;
+}
+var import_node_child_process2, import_node_fs4, import_node_os3, import_node_path3, import_node_util2, execFileAsync, DEFAULT_IMAGE, GHCR_REGISTRY, GHCR_USERNAME, MANAGED_LABEL, POD_NAME_PREFIX, VOLUME_PREFIX, DNS_SLUG_RE, PodError;
+var init_pods = __esm({
+  "src/server/rover/pods.ts"() {
+    "use strict";
+    import_node_child_process2 = require("node:child_process");
+    import_node_fs4 = require("node:fs");
+    import_node_os3 = require("node:os");
+    import_node_path3 = require("node:path");
+    import_node_util2 = require("node:util");
+    execFileAsync = (0, import_node_util2.promisify)(import_node_child_process2.execFile);
+    DEFAULT_IMAGE = "ghcr.io/launchsecure/launch-pod:latest";
+    GHCR_REGISTRY = "ghcr.io";
+    GHCR_USERNAME = process.env.GHCR_PULL_USERNAME ?? "ghcr-pull";
+    MANAGED_LABEL = "launch-rover.managed";
+    POD_NAME_PREFIX = "launch-pod-";
+    VOLUME_PREFIX = "lp-";
+    DNS_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+    PodError = class extends Error {
+      constructor(message, httpStatus = 400) {
+        super(message);
+        this.name = "PodError";
+        this.httpStatus = httpStatus;
+      }
+    };
+  }
+});
+
 // src/server/rover/daemon.ts
 var daemon_exports = {};
 __export(daemon_exports, {
@@ -19537,33 +19978,33 @@ __export(daemon_exports, {
   startDaemon: () => startDaemon
 });
 function lockPath() {
-  return (0, import_node_path3.join)((0, import_node_os3.homedir)(), LAUNCHSECURE_DIR, ROVER_LOCK_FILENAME);
+  return (0, import_node_path4.join)((0, import_node_os4.homedir)(), LAUNCHSECURE_DIR, ROVER_LOCK_FILENAME);
 }
 function readRoverLock() {
   const p = lockPath();
-  if (!(0, import_node_fs4.existsSync)(p)) return null;
+  if (!(0, import_node_fs5.existsSync)(p)) return null;
   try {
-    return JSON.parse((0, import_node_fs4.readFileSync)(p, "utf-8"));
+    return JSON.parse((0, import_node_fs5.readFileSync)(p, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeLock(lock) {
-  const dir = (0, import_node_path3.join)((0, import_node_os3.homedir)(), LAUNCHSECURE_DIR);
-  (0, import_node_fs4.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs4.writeFileSync)(lockPath(), JSON.stringify(lock, null, 2) + "\n", "utf-8");
+  const dir = (0, import_node_path4.join)((0, import_node_os4.homedir)(), LAUNCHSECURE_DIR);
+  (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs5.writeFileSync)(lockPath(), JSON.stringify(lock, null, 2) + "\n", "utf-8");
 }
 function clearLock() {
   try {
-    (0, import_node_fs4.unlinkSync)(lockPath());
+    (0, import_node_fs5.unlinkSync)(lockPath());
   } catch {
   }
 }
 async function startDaemon(opts) {
-  const state = loadRoverState(opts.orgSlug);
+  const state = loadRoverState(opts.roverId);
   if (!state) {
     throw new Error(
-      `No rover state for org "${opts.orgSlug}". Run \`launch-rover setup\` first.`
+      `No rover state for id "${opts.roverId}". Run \`launch-rover setup\` first.`
     );
   }
   const port = opts.port ?? state.daemonPort;
@@ -19588,7 +20029,8 @@ async function startDaemon(opts) {
     cwd: process.cwd(),
     url: state.tunnelUrl,
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    orgSlug: opts.orgSlug
+    roverId: state.roverId,
+    orgSlug: state.orgSlug
   };
   writeLock(lock);
   console.log(`[rover] listening on 0.0.0.0:${port} (tunnel: ${state.tunnelUrl})`);
@@ -19633,7 +20075,33 @@ async function handleRequest(req, res, state) {
       console.warn(`[rover] ${method} ${path} \u2192 401 (${failure})`);
       return json(res, 401, { error: "invalid_signature" });
     }
-    return json(res, 501, { error: "not_implemented", path });
+    let parsed = {};
+    if (rawBody.length > 0) {
+      try {
+        parsed = JSON.parse(rawBody);
+      } catch {
+        return json(res, 400, { error: "malformed_json" });
+      }
+    }
+    try {
+      if (path === "/pods/up") {
+        const result2 = await podsUp(state, parsed);
+        return json(res, 200, result2);
+      }
+      if (path === "/pods/down") {
+        const result2 = await podsDown(state, parsed);
+        return json(res, 200, result2);
+      }
+      const result = await podsList(state);
+      return json(res, 200, result);
+    } catch (err) {
+      if (err instanceof PodError) {
+        console.warn(`[rover] ${method} ${path} \u2192 ${err.httpStatus} (${err.message})`);
+        return json(res, err.httpStatus, { error: err.message });
+      }
+      console.error(`[rover] ${method} ${path} crashed:`, err);
+      return json(res, 500, { error: err instanceof Error ? err.message : "internal_error" });
+    }
   }
   return json(res, 404, { error: "not_found", path });
 }
@@ -19651,7 +20119,7 @@ function readBody(req) {
   });
 }
 async function sendHeartbeat(state) {
-  const payload = JSON.stringify({ organizationId: state.organizationId });
+  const payload = JSON.stringify({ roverId: state.roverId });
   const { header } = buildSignatureHeader(state.secret, payload);
   const url = new URL("/api/rover/heartbeat", state.serverUrl);
   await postJson(url, payload, { "X-LS-Signature": header });
@@ -19690,18 +20158,19 @@ function postJson(url, body, extra) {
     req.end();
   });
 }
-var import_node_fs4, import_node_http2, import_node_http3, import_node_https2, import_node_os3, import_node_path3, ROVER_LOCK_FILENAME;
+var import_node_fs5, import_node_http2, import_node_http3, import_node_https2, import_node_os4, import_node_path4, ROVER_LOCK_FILENAME;
 var init_daemon = __esm({
   "src/server/rover/daemon.ts"() {
     "use strict";
-    import_node_fs4 = require("node:fs");
+    import_node_fs5 = require("node:fs");
     import_node_http2 = require("node:http");
     import_node_http3 = require("node:http");
     import_node_https2 = require("node:https");
-    import_node_os3 = require("node:os");
-    import_node_path3 = require("node:path");
+    import_node_os4 = require("node:os");
+    import_node_path4 = require("node:path");
     init_launch_kit_paths();
     init_hmac();
+    init_pods();
     init_state();
     ROVER_LOCK_FILENAME = "launch-rover.lock";
   }
@@ -19748,7 +20217,7 @@ function printUsage() {
       "Usage: launch-rover setup --pat=<PAT> --org=<orgSlug> [options]",
       "",
       "Required:",
-      "  --pat=<ls_pat_...>     Setup PAT issued by LS (mcp:rover:setup scope)",
+      "  --pat=<ls_pat_...>     Setup PAT issued by LS (rover:setup scope)",
       "  --org=<slug>           Organization slug the rover belongs to",
       "",
       "Optional:",
@@ -19756,15 +20225,27 @@ function printUsage() {
       "  --name=<host-name>     Human-readable rover name (default: hostname)",
       "  --port=<n>             Local daemon port (default: 52749)",
       "  --auto-install         Allow setup to install Docker via brew / get-docker.sh",
-      "  --yes / -y             Skip confirmation prompts (assume yes)",
+      "  --yes / -y             Skip confirmation prompts (assume yes). Also auto-starts",
+      "                         an installed-but-stopped Docker daemon without prompting.",
       "  --detach               Spawn the daemon as a detached process and exit",
       ""
     ].join("\n")
   );
 }
+function ensureNodeVersion() {
+  const raw = process.versions.node;
+  const major = Number.parseInt(raw.split(".")[0] ?? "", 10);
+  if (!Number.isFinite(major) || major < MIN_NODE_MAJOR) {
+    throw new Error(
+      `launch-rover requires Node >= ${MIN_NODE_MAJOR} (running ${raw}). Upgrade Node, then re-run \`launch-rover setup\`.`
+    );
+  }
+  console.log(`[rover] node ok: v${raw}`);
+}
 async function runSetup(argv) {
   const args = parseArgs(argv);
   console.log(`[rover] setup org=${args.orgSlug} server=${args.serverUrl}`);
+  ensureNodeVersion();
   await ensureDocker({ autoInstall: args.autoInstall, yes: args.yes });
   const dockerInfo = detectDocker();
   console.log(`[rover] docker ready: ${dockerInfo.version ?? "unknown"}`);
@@ -19773,26 +20254,33 @@ async function runSetup(argv) {
     pat: args.pat,
     orgSlug: args.orgSlug
   });
-  console.log("[rover] fetching CF config from LS\u2026");
+  console.log("[rover] fetching rover config from LS\u2026");
   const lsConfig = await mcp.call("rover_get_config", {});
-  if (!lsConfig.cfApiToken || !lsConfig.cfAccountId || !lsConfig.cfZoneId) {
+  if (!lsConfig.id) {
     throw new Error(
-      "LS rover config is missing Cloudflare credentials. Edit the rover in LS Org Settings \u2192 Rover and fill in the CF fields."
+      "LS rover config did not return an id. PAT may not be bound to a specific rover \u2014 create the rover in LS Organization \u2192 Rovers and re-issue the install command."
     );
   }
-  console.log(`[rover] LS rover "${lsConfig.name}" (status: ${lsConfig.status})`);
-  const zoneName = await fetchZoneName(lsConfig.cfApiToken, lsConfig.cfZoneId);
-  console.log(`[rover] resolved CF zone: ${zoneName}`);
-  const stateDir2 = (0, import_node_path4.join)((0, import_node_os4.homedir)(), LAUNCHSECURE_DIR, "rover");
-  (0, import_node_fs5.mkdirSync)(stateDir2, { recursive: true });
-  const tunnelStateFile = (0, import_node_path4.join)(stateDir2, `${args.orgSlug}.tunnel.json`);
-  const subdomain = `rover-${args.orgSlug.replace(/[^a-z0-9-]/gi, "-").toLowerCase().slice(0, 50)}`;
-  const tunnelName = `launch-rover-${args.orgSlug}`;
-  console.log(`[rover] provisioning CF tunnel ${tunnelName} \u2192 ${subdomain}.${zoneName}`);
+  if (!lsConfig.cfApiToken || !lsConfig.cfDomainName) {
+    throw new Error(
+      "LS rover config is missing Cloudflare credentials. Connect a Cloudflare integration and set the rover's domain in LS Organization \u2192 Rovers."
+    );
+  }
+  console.log(`[rover] LS rover "${lsConfig.name}" (id: ${lsConfig.id}, status: ${lsConfig.status})`);
+  const roverId = lsConfig.id;
+  const zone = await resolveZone(lsConfig.cfApiToken, lsConfig.cfDomainName);
+  console.log(`[rover] resolved CF zone: ${zone.name} (account ${zone.accountId})`);
+  const stateDir2 = (0, import_node_path5.join)((0, import_node_os5.homedir)(), LAUNCHSECURE_DIR, "rover");
+  (0, import_node_fs6.mkdirSync)(stateDir2, { recursive: true });
+  const tunnelStateFile = (0, import_node_path5.join)(stateDir2, `${roverId}.tunnel.json`);
+  const idSuffix = roverId.replace(/[^a-z0-9]/gi, "").toLowerCase().slice(-8);
+  const subdomain = `rover-${args.orgSlug.replace(/[^a-z0-9-]/gi, "-").toLowerCase().slice(0, 30)}-${idSuffix}`;
+  const tunnelName = `launch-rover-${roverId}`;
+  console.log(`[rover] provisioning CF tunnel ${tunnelName} \u2192 ${subdomain}.${zone.name}`);
   const ingress = await provisionIngress({
     apiToken: lsConfig.cfApiToken,
-    accountId: lsConfig.cfAccountId,
-    zone: { id: lsConfig.cfZoneId, name: zoneName },
+    accountId: zone.accountId,
+    zone: { id: zone.id, name: zone.name },
     tunnelName,
     services: [{ name: subdomain, port: args.port }],
     stateFile: tunnelStateFile
@@ -19803,18 +20291,19 @@ async function runSetup(argv) {
   }
   const tunnelUrl = `https://${hostname}`;
   console.log(`[rover] tunnel public URL: ${tunnelUrl}`);
-  const existing = loadRoverState(args.orgSlug);
+  const existing = loadRoverState(roverId);
   const outcome = await registerOrRefresh({
     mcp,
     orgSlug: args.orgSlug,
     serverUrl: args.serverUrl,
     tunnelUrl,
     daemonPort: args.port,
+    installPat: args.pat,
     hostInfo: {
-      platform: (0, import_node_os4.platform)(),
-      hostname: args.name ?? (0, import_node_os4.hostname)(),
+      platform: (0, import_node_os5.platform)(),
+      hostname: args.name ?? (0, import_node_os5.hostname)(),
       dockerVersion: dockerInfo.version ?? void 0,
-      kitVersion: process.env.npm_package_version
+      kitVersion: KIT_VERSION
     },
     existing
   });
@@ -19825,30 +20314,39 @@ async function runSetup(argv) {
   console.log("");
   if (outcome.approvalStatus === "pending_approval") {
     console.log("\u2713 Rover is live and registered, awaiting admin approval in LS.");
-    console.log(`  ${args.serverUrl}/${args.orgSlug}/settings/rover`);
+    console.log(`  ${args.serverUrl}/${args.orgSlug}/rovers`);
   } else if (outcome.approvalStatus === "approved") {
     console.log("\u2713 Rover is live and already approved. Heartbeats will start within 60s.");
   } else {
     console.log(`! Rover state: ${outcome.approvalStatus}.`);
   }
 }
-async function fetchZoneName(apiToken, zoneId) {
-  const res = await fetch(`https://api.cloudflare.com/client/v4/zones/${zoneId}`, {
-    headers: {
-      Authorization: `Bearer ${apiToken}`,
-      Accept: "application/json"
-    },
-    signal: AbortSignal.timeout(1e4)
-  });
+async function resolveZone(apiToken, domainName) {
+  const res = await fetch(
+    `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(domainName)}`,
+    {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: "application/json"
+      },
+      signal: AbortSignal.timeout(1e4)
+    }
+  );
   if (!res.ok) {
     throw new Error(`CF zone lookup failed: HTTP ${res.status}`);
   }
   const body = await res.json();
-  if (!body.success || !body.result?.name) {
+  if (!body.success) {
     const reason = body.errors?.[0]?.message ?? "unknown";
     throw new Error(`CF zone lookup failed: ${reason}`);
   }
-  return body.result.name;
+  const zone = body.result?.[0];
+  if (!zone?.id || !zone.account?.id) {
+    throw new Error(
+      `No Cloudflare zone found for "${domainName}". The API token may lack Zone:Read, or the domain isn't on this Cloudflare account.`
+    );
+  }
+  return { id: zone.id, name: zone.name, accountId: zone.account.id };
 }
 async function launchDaemon(args, ingress, state) {
   if (!args.detach) {
@@ -19863,11 +20361,11 @@ async function launchDaemon(args, ingress, state) {
     });
     void tunnel.start();
     const { startDaemon: startDaemon2 } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
-    await startDaemon2({ orgSlug: args.orgSlug, port: args.port });
+    await startDaemon2({ roverId: state.roverId, port: args.port });
     return;
   }
   const argv0 = process.argv[1] ?? "launch-rover";
-  const child = (0, import_node_child_process2.spawn)(process.execPath, [argv0, "serve", `--org=${args.orgSlug}`], {
+  const child = (0, import_node_child_process3.spawn)(process.execPath, [argv0, "serve", `--rover=${state.roverId}`], {
     detached: true,
     stdio: "ignore",
     env: {
@@ -19879,25 +20377,27 @@ async function launchDaemon(args, ingress, state) {
   child.unref();
   console.log(`[rover] daemon spawned (pid ${child.pid}, detached)`);
 }
-function runSetupReset(orgSlug) {
-  clearRoverState(orgSlug);
+function runSetupReset(roverId) {
+  clearRoverState(roverId);
 }
-var import_node_os4, import_node_child_process2, import_node_path4, import_node_fs5, DEFAULT_SERVER, DEFAULT_DAEMON_PORT;
+var import_node_os5, import_node_child_process3, import_node_path5, import_node_fs6, KIT_VERSION, DEFAULT_SERVER, DEFAULT_DAEMON_PORT, MIN_NODE_MAJOR;
 var init_setup = __esm({
   "src/server/rover/setup.ts"() {
     "use strict";
-    import_node_os4 = require("node:os");
-    import_node_child_process2 = require("node:child_process");
-    import_node_path4 = require("node:path");
-    import_node_fs5 = require("node:fs");
+    import_node_os5 = require("node:os");
+    import_node_child_process3 = require("node:child_process");
+    import_node_path5 = require("node:path");
+    import_node_fs6 = require("node:fs");
     init_cf_ingress();
     init_launch_kit_paths();
     init_docker_install();
     init_mcp_client();
     init_registration();
     init_state();
+    KIT_VERSION = require_package().version;
     DEFAULT_SERVER = "https://launchsecure-v2.vercel.app";
     DEFAULT_DAEMON_PORT = 52749;
+    MIN_NODE_MAJOR = 18;
   }
 });
 
@@ -19907,41 +20407,41 @@ __export(teardown_exports, {
   runStatus: () => runStatus,
   runTeardown: () => runTeardown
 });
-function parseArgs2(argv, requireOrg = true) {
-  let orgSlug;
+function parseArgs2(argv, requireRover = true) {
+  let roverId;
   let force = false;
   for (const arg of argv) {
-    if (arg.startsWith("--org=")) orgSlug = arg.slice("--org=".length);
+    if (arg.startsWith("--rover=")) roverId = arg.slice("--rover=".length);
     else if (arg === "--force" || arg === "-f") force = true;
     else if (arg === "--help" || arg === "-h") return null;
     else throw new Error(`Unknown argument: ${arg}`);
   }
-  if (!orgSlug) {
-    const known = listRoverOrgs();
+  if (!roverId) {
+    const known = listRoverIds();
     if (known.length === 1) {
-      orgSlug = known[0];
-    } else if (requireOrg) {
+      roverId = known[0];
+    } else if (requireRover) {
       const hint = known.length === 0 ? "no rovers found" : `multiple rovers found: ${known.join(", ")}`;
-      throw new Error(`--org=<slug> is required (${hint})`);
+      throw new Error(`--rover=<id> is required (${hint})`);
     } else {
       return null;
     }
   }
-  return { orgSlug, force };
+  return { roverId, force };
 }
 async function runTeardown(argv) {
   const parsed = parseArgs2(argv);
   if (!parsed) {
-    console.log("Usage: launch-rover teardown --org=<slug> [--force]");
+    console.log("Usage: launch-rover teardown --rover=<id> [--force]");
     return;
   }
-  const state = loadRoverState(parsed.orgSlug);
+  const state = loadRoverState(parsed.roverId);
   if (!state) {
-    console.log(`[rover] no local state for org "${parsed.orgSlug}" \u2014 nothing to tear down.`);
+    console.log(`[rover] no local state for rover "${parsed.roverId}" \u2014 nothing to tear down.`);
     return;
   }
   const lock = readRoverLock();
-  if (lock && lock.orgSlug === parsed.orgSlug) {
+  if (lock && lock.roverId === parsed.roverId) {
     if (isPidAlive(lock.pid)) {
       console.log(`[rover] stopping daemon (pid ${lock.pid})\u2026`);
       try {
@@ -19950,7 +20450,7 @@ async function runTeardown(argv) {
       }
       const deadline = Date.now() + 3e3;
       while (Date.now() < deadline && isPidAlive(lock.pid)) {
-        await sleep(100);
+        await sleep2(100);
       }
       if (isPidAlive(lock.pid) && parsed.force) {
         console.log("[rover] daemon did not exit, sending SIGKILL");
@@ -19961,44 +20461,43 @@ async function runTeardown(argv) {
       }
     }
   }
-  clearRoverState(parsed.orgSlug);
-  const tunnelStateFile = (0, import_node_path5.join)(
-    (0, import_node_os5.homedir)(),
+  clearRoverState(parsed.roverId);
+  const tunnelStateFile = (0, import_node_path6.join)(
+    (0, import_node_os6.homedir)(),
     LAUNCHSECURE_DIR,
     "rover",
-    `${parsed.orgSlug}.tunnel.json`
+    `${parsed.roverId}.tunnel.json`
   );
-  if ((0, import_node_fs6.existsSync)(tunnelStateFile)) {
+  if ((0, import_node_fs7.existsSync)(tunnelStateFile)) {
     try {
-      (0, import_node_fs6.unlinkSync)(tunnelStateFile);
+      (0, import_node_fs7.unlinkSync)(tunnelStateFile);
     } catch {
     }
   }
-  console.log(`[rover] teardown complete for org "${parsed.orgSlug}".`);
+  console.log(`[rover] teardown complete for rover "${parsed.roverId}".`);
   console.log("  \u2192 To fully reset on the LS side (revoke install PAT, allow re-create), use the");
-  console.log(`    "Reset" button at ${state.serverUrl}/${parsed.orgSlug}/settings/rover`);
+  console.log(`    "Reset" button at ${state.serverUrl}/${state.orgSlug}/rovers`);
 }
 function runStatus(argv) {
   const parsed = parseArgs2(
     argv,
-    /* requireOrg */
+    /* requireRover */
     false
   );
-  const orgs = parsed ? [parsed.orgSlug] : listRoverOrgs();
-  if (orgs.length === 0) {
+  const rovers = parsed ? [parsed.roverId] : listRoverIds();
+  if (rovers.length === 0) {
     console.log("[rover] no rovers configured on this host.");
     return;
   }
-  for (const orgSlug of orgs) {
-    const state = loadRoverState(orgSlug);
+  for (const roverId of rovers) {
+    const state = loadRoverState(roverId);
     if (!state) {
-      console.log(`[rover] ${orgSlug}: no state file`);
+      console.log(`[rover] ${roverId}: no state file`);
       continue;
     }
     const lock = readRoverLock();
-    const live = lock && lock.orgSlug === orgSlug && isPidAlive(lock.pid);
-    console.log(`\u2500\u2500 ${orgSlug} \u2500\u2500`);
-    console.log(`  rover id:    ${state.roverId}`);
+    const live = lock && lock.roverId === roverId && isPidAlive(lock.pid);
+    console.log(`\u2500\u2500 ${roverId} (${state.orgSlug}) \u2500\u2500`);
     console.log(`  org id:      ${state.organizationId}`);
     console.log(`  server:      ${state.serverUrl}`);
     console.log(`  tunnel url:  ${state.tunnelUrl}`);
@@ -20019,16 +20518,16 @@ function isPidAlive(pid) {
     return false;
   }
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-var import_node_fs6, import_node_os5, import_node_path5;
+var import_node_fs7, import_node_os6, import_node_path6;
 var init_teardown = __esm({
   "src/server/rover/teardown.ts"() {
     "use strict";
-    import_node_fs6 = require("node:fs");
-    import_node_os5 = require("node:os");
-    import_node_path5 = require("node:path");
+    import_node_fs7 = require("node:fs");
+    import_node_os6 = require("node:os");
+    import_node_path6 = require("node:path");
     init_launch_kit_paths();
     init_daemon();
     init_state();
@@ -20049,9 +20548,10 @@ function printUsage2() {
       "  setup --pat=<PAT> --org=<slug> [options]",
       "                            install Docker, provision CF tunnel,",
       "                            register with LaunchSecure, start daemon",
-      "  serve [--org=<slug>]      start the rover HTTP daemon (foreground)",
-      "  status [--org=<slug>]     print state + daemon liveness",
-      "  teardown --org=<slug>     stop daemon and clear local state",
+      "  serve [--rover=<id>]      start the rover HTTP daemon (foreground).",
+      "                            With one local rover, --rover is optional.",
+      "  status [--rover=<id>]     print state + daemon liveness",
+      "  teardown --rover=<id>     stop daemon and clear local state",
       "                            (does NOT delete the LS RoverInstance \u2014 use",
       "                             the Reset button in LS for that)",
       "",
@@ -20074,21 +20574,21 @@ async function main() {
       return;
     }
     case "serve": {
-      const orgSlug = argv.find((a) => a.startsWith("--org="))?.slice("--org=".length);
-      if (!orgSlug) {
-        const { listRoverOrgs: listRoverOrgs2 } = await Promise.resolve().then(() => (init_state(), state_exports));
-        const known = listRoverOrgs2();
+      const roverId = argv.find((a) => a.startsWith("--rover="))?.slice("--rover=".length);
+      if (!roverId) {
+        const { listRoverIds: listRoverIds2 } = await Promise.resolve().then(() => (init_state(), state_exports));
+        const known = listRoverIds2();
         if (known.length !== 1) {
           throw new Error(
-            `serve needs --org=<slug>${known.length ? ` (known: ${known.join(", ")})` : " (no rovers configured)"}`
+            `serve needs --rover=<id>${known.length ? ` (known: ${known.join(", ")})` : " (no rovers configured)"}`
           );
         }
         const { startDaemon: startDaemon3 } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
-        await startDaemon3({ orgSlug: known[0] });
+        await startDaemon3({ roverId: known[0] });
         return;
       }
       const { startDaemon: startDaemon2 } = await Promise.resolve().then(() => (init_daemon(), daemon_exports));
-      await startDaemon2({ orgSlug });
+      await startDaemon2({ roverId });
       return;
     }
     case "status": {