@launchsecure/launch-kit 0.0.35 → 0.0.36

package/dist/server/init-entry.js

@@ -121,6 +121,12 @@ async function runSecretsPull(opts) {
   }
   const envsRaw = await callMcp(profile, "environments_list", {});
   const envsResult = Array.isArray(envsRaw) ? { environments: envsRaw, defaultPullEnvSlug: null } : envsRaw;
+  if (!opts.envOverride && !process.env.LS_ENV && !envsResult.defaultPullEnvSlug && envsResult.environments.length !== 1) {
+    const list = envsResult.environments.map((e) => e.slug).join(", ") || "(none)";
+    throw new Error(
+      `No project-level default pull env set (defaultPullEnvSlug is unset) and no --env / $LS_ENV provided. Available: ${list}. Set the Default pull env at ${profile.serverUrl}/${profile.orgSlug}/projects/${profile.projectSlug}/settings.`
+    );
+  }
   const envSlug = resolveEnvSlug(opts.envOverride, envsResult);
   if (!envSlug) {
     const list = envsResult.environments.map((e) => e.slug).join(", ") || "(none)";
@@ -573,10 +579,9 @@ var init_launch_kit_services = __esm({
       sequencer: { port: 3517, bin: "launch-sequencer", args: [] },
       chart: { port: 52819, bin: "launch-chart", args: ["serve"] },
       deck: { port: 52829, bin: "launch-deck", args: ["serve"] },
-      council: { port: 52839, bin: "launch-council", args: ["serve"] },
       // Claude web terminal — exposes a viewable/drivable `claude` session at
-      // `bot.<baseDomain>`. NOTE: no auth gate yet (tracked as a separate
-      // high-priority rover-security work item); ships behind a plain link first.
+      // `bot.<baseDomain>`. Gated at the edge by CF Access → our OIDC IdP (#183);
+      // see GATED_SERVICES in radar-docker-init-entry.ts (bot = strict session).
       bot: { port: 52849, bin: "launch-bot", args: ["serve"] }
     };
     DNS_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -585,6 +590,9 @@ var init_launch_kit_services = __esm({
 });
 
 // src/server/cf-ingress.ts
+function serviceLabel(s) {
+  return s.label ?? s.name;
+}
 async function cf(opts) {
   const res = await fetch(`${CF_API_BASE}${opts.path}`, {
     method: opts.method,
@@ -664,7 +672,7 @@ async function fetchConnectorToken(input, tunnelId) {
 }
 async function setIngressConfig(input, tunnelId) {
   const ingress = input.services.map((s) => ({
-    hostname: `${s.name}.${input.zone.name}`,
+    hostname: `${serviceLabel(s)}.${input.zone.name}`,
     service: `http://localhost:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
@@ -679,7 +687,7 @@ async function setIngressConfig(input, tunnelId) {
   }
 }
 async function ensureDnsRecord(input, tunnelId, service) {
-  const fqdn = `${service.name}.${input.zone.name}`;
+  const fqdn = `${serviceLabel(service)}.${input.zone.name}`;
   const target = `${tunnelId}.cfargotunnel.com`;
   const existing = await cf({
     apiToken: input.apiToken,
@@ -723,7 +731,7 @@ async function provisionIngress(input) {
   await setIngressConfig(input, tunnelId);
   await Promise.all(input.services.map((s) => ensureDnsRecord(input, tunnelId, s)));
   const hostnames = {};
-  for (const s of input.services) hostnames[s.name] = `${s.name}.${input.zone.name}`;
+  for (const s of input.services) hostnames[s.name] = `${serviceLabel(s)}.${input.zone.name}`;
   return { tunnelId, connectorToken, hostnames };
 }
 var import_node_fs2, import_node_path2, CF_API_BASE, CF_ERR_DNS_RECORD_EXISTS;
@@ -737,19 +745,197 @@ var init_cf_ingress = __esm({
   }
 });
 
+// src/server/cf-access.ts
+async function cf2(opts) {
+  const res = await fetch(`${CF_API_BASE2}${opts.path}`, {
+    method: opts.method,
+    headers: {
+      Authorization: `Bearer ${opts.apiToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": "launch-kit/cf-access"
+    },
+    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+    signal: AbortSignal.timeout(15e3)
+  });
+  const text = await res.text();
+  try {
+    return text ? JSON.parse(text) : { success: false };
+  } catch {
+    throw new Error(`[cf-access] ${opts.method} ${opts.path} \u2192 ${res.status}, non-JSON: ${text.slice(0, 200)}`);
+  }
+}
+function fail(env, what) {
+  throw new Error(`[cf-access] ${what} failed: ${JSON.stringify(env.errors)}`);
+}
+function loadState2(path6) {
+  if (!(0, import_node_fs3.existsSync)(path6)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(path6, "utf8"));
+    return typeof parsed?.accountId === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function saveState2(path6, state) {
+  const dir = (0, import_node_path3.dirname)(path6);
+  if (!(0, import_node_fs3.existsSync)(dir)) (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs3.writeFileSync)(path6, JSON.stringify(state, null, 2));
+}
+async function getAccessAuthDomain(apiToken, accountId) {
+  const res = await cf2({
+    apiToken,
+    method: "GET",
+    path: `/accounts/${accountId}/access/organizations`
+  });
+  if (!res.success || !res.result?.auth_domain) {
+    fail(res, "GET access/organizations (is Zero Trust enabled on this account?)");
+  }
+  return res.result.auth_domain;
+}
+async function ensureAccessIdp(input) {
+  const config = {
+    client_id: input.clientId,
+    client_secret: input.clientSecret,
+    auth_url: `${input.issuer}/api/oidc/authorize`,
+    token_url: `${input.issuer}/api/oidc/token`,
+    certs_url: `${input.issuer}/.well-known/jwks.json`,
+    scopes: ["openid", "email", "profile"],
+    claims: ["org", "project_access", "roles", "email"],
+    email_claim_name: "email",
+    pkce_enabled: true
+  };
+  const body = { name: IDP_NAME, type: "oidc", config };
+  let idpId = input.knownIdpId;
+  if (!idpId) {
+    const list = await cf2({
+      apiToken: input.apiToken,
+      method: "GET",
+      path: `/accounts/${input.accountId}/access/identity_providers`
+    });
+    if (!list.success) fail(list, "list identity_providers");
+    idpId = (list.result ?? []).find((p) => p.name === IDP_NAME)?.id ?? null;
+  }
+  if (idpId) {
+    const upd = await cf2({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/identity_providers/${idpId}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, "update identity_provider");
+    return upd.result.id;
+  }
+  const created = await cf2({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/identity_providers`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, "create identity_provider");
+  return created.result.id;
+}
+async function ensureAccessApp(input) {
+  const policy = {
+    name: "launch-kit-org-allow",
+    decision: "allow",
+    include: [
+      {
+        oidc: {
+          identity_provider_id: input.idpId,
+          claim_name: "org",
+          claim_value: input.organizationId
+        }
+      }
+    ]
+  };
+  const body = {
+    name: `launch-kit ${input.service.hostname}`,
+    domain: input.service.hostname,
+    type: "self_hosted",
+    // Bot terminal = RCE surface → short session. Read portals = a workday.
+    session_duration: input.service.strict ? "30m" : "24h",
+    allowed_idps: [input.idpId],
+    auto_redirect_to_identity: true,
+    policies: [policy]
+  };
+  const list = await cf2({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/access/apps`
+  });
+  if (!list.success) fail(list, "list access apps");
+  const existing = (list.result ?? []).find((a) => a.domain === input.service.hostname);
+  if (existing) {
+    const upd = await cf2({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, `update access app ${input.service.hostname}`);
+    return upd.result.id;
+  }
+  const created = await cf2({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/apps`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, `create access app ${input.service.hostname}`);
+  return created.result.id;
+}
+async function provisionAccess(input) {
+  const authDomain = await getAccessAuthDomain(input.apiToken, input.accountId);
+  const callbackUrl = `https://${authDomain}/cdn-cgi/access/callback`;
+  const { clientId, clientSecret, organizationId } = await input.registerClient([callbackUrl]);
+  const prior = loadState2(input.stateFile);
+  const idpId = await ensureAccessIdp({
+    apiToken: input.apiToken,
+    accountId: input.accountId,
+    issuer: input.issuer,
+    clientId,
+    clientSecret,
+    knownIdpId: prior?.idpId ?? null
+  });
+  saveState2(input.stateFile, { idpId, accountId: input.accountId });
+  const appIds = {};
+  for (const service of input.services) {
+    appIds[service.hostname] = await ensureAccessApp({
+      apiToken: input.apiToken,
+      accountId: input.accountId,
+      idpId,
+      organizationId,
+      service
+    });
+  }
+  return { idpId, authDomain, appIds };
+}
+var import_node_fs3, import_node_path3, CF_API_BASE2, IDP_NAME;
+var init_cf_access = __esm({
+  "src/server/cf-access.ts"() {
+    "use strict";
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
+    CF_API_BASE2 = "https://api.cloudflare.com/client/v4";
+    IDP_NAME = "launch-kit-oidc";
+  }
+});
+
 // src/server/radar-docker-init-entry.ts
 var radar_docker_init_entry_exports = {};
 __export(radar_docker_init_entry_exports, {
+  maybeProvisionAccess: () => maybeProvisionAccess,
   maybeProvisionIngress: () => maybeProvisionIngress,
   spawnServiceGroup: () => spawnServiceGroup
 });
-function fail(message) {
+function fail2(message) {
   console.error(message);
   process.exit(1);
 }
 function requireEnv(name) {
   const v = process.env[name];
-  if (!v) fail(`ERROR: ${name} is required but not set`);
+  if (!v) fail2(`ERROR: ${name} is required but not set`);
   return v;
 }
 function run2(cmd, args, stdio = "inherit") {
@@ -766,13 +952,16 @@ async function setupFromCloud() {
   try {
     bundle = await mcp.call("radar_bootstrap_get", {});
   } catch (err) {
-    fail(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
+    fail2(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
   }
   if (!process.env.GIT_USER_NAME) process.env.GIT_USER_NAME = bundle.gitName;
   if (!process.env.GIT_USER_EMAIL) process.env.GIT_USER_EMAIL = bundle.gitEmail;
   if (!process.env.GH_TOKEN && bundle.githubToken) process.env.GH_TOKEN = bundle.githubToken;
+  if (!process.env.RADAR_RULES && Array.isArray(bundle.radarRules) && bundle.radarRules.length > 0) {
+    process.env.RADAR_RULES = JSON.stringify(bundle.radarRules);
+  }
   if (!process.env.GH_TOKEN) {
-    fail(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
+    fail2(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
   }
   const cfNote = bundle.cloudflareToken ? "cloudflare=connected" : "cloudflare=none";
   console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
@@ -780,17 +969,17 @@ async function setupFromCloud() {
 }
 function setupClaudeCredentials() {
   const home = process.env.HOME ?? "/home/launchpod";
-  const claudeDir = (0, import_node_path3.join)(home, ".claude");
-  (0, import_node_fs3.mkdirSync)(claudeDir, { recursive: true });
+  const claudeDir = (0, import_node_path4.join)(home, ".claude");
+  (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
   const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
-  const credsPath = (0, import_node_path3.join)(claudeDir, ".credentials.json");
-  (0, import_node_fs3.writeFileSync)(credsPath, decoded);
-  (0, import_node_fs3.chmodSync)(credsPath, 384);
-  const configPath = (0, import_node_path3.join)(home, ".claude.json");
+  const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
+  (0, import_node_fs4.writeFileSync)(credsPath, decoded);
+  (0, import_node_fs4.chmodSync)(credsPath, 384);
+  const configPath = (0, import_node_path4.join)(home, ".claude.json");
   let cfg = {};
-  if ((0, import_node_fs3.existsSync)(configPath)) {
+  if ((0, import_node_fs4.existsSync)(configPath)) {
     try {
-      cfg = JSON.parse((0, import_node_fs3.readFileSync)(configPath, "utf8"));
+      cfg = JSON.parse((0, import_node_fs4.readFileSync)(configPath, "utf8"));
     } catch {
       cfg = {};
     }
@@ -816,21 +1005,21 @@ function setupClaudeCredentials() {
   wsProject.enabledMcpjsonServers = mergedEnabled;
   projects[wsKey] = wsProject;
   cfg.projects = projects;
-  (0, import_node_fs3.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
-  (0, import_node_fs3.chmodSync)(configPath, 384);
+  (0, import_node_fs4.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
+  (0, import_node_fs4.chmodSync)(configPath, 384);
 }
 function setupGitAndGh() {
   const name = process.env.GIT_USER_NAME ?? "Radar Bot";
   const email = process.env.GIT_USER_EMAIL ?? "radar@launchpod.local";
   const status = run2("launch-kit", ["setup-git", `--identity=${name} <${email}>`]);
-  if (status !== 0) fail(`[entrypoint] launch-kit setup-git failed (status ${status})`);
+  if (status !== 0) fail2(`[entrypoint] launch-kit setup-git failed (status ${status})`);
 }
 function detectAndSetPreviewPort() {
   if (process.env.PREVIEW_PORT) return;
   try {
     const pkgPath = "/workspace/package.json";
-    if (!(0, import_node_fs3.existsSync)(pkgPath)) return;
-    const pkg = JSON.parse((0, import_node_fs3.readFileSync)(pkgPath, "utf-8"));
+    if (!(0, import_node_fs4.existsSync)(pkgPath)) return;
+    const pkg = JSON.parse((0, import_node_fs4.readFileSync)(pkgPath, "utf-8"));
     const scripts = pkg.scripts ?? {};
     const portRe = /(?:--port[= ]|-p\s+|\bPORT=)(\d{2,5})\b/;
     for (const name of ["dev", "start", "serve"]) {
@@ -848,7 +1037,7 @@ function detectAndSetPreviewPort() {
 }
 function initWorkspaceIfEmpty() {
   process.chdir("/workspace");
-  if ((0, import_node_fs3.existsSync)(".git")) {
+  if ((0, import_node_fs4.existsSync)(".git")) {
     console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
     return;
   }
@@ -861,7 +1050,7 @@ function initWorkspaceIfEmpty() {
     `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
     `--dir=/workspace`
   ]);
-  if (status !== 0) fail(`[entrypoint] launch-kit init failed (status ${status})`);
+  if (status !== 0) fail2(`[entrypoint] launch-kit init failed (status ${status})`);
 }
 async function maybeProvisionIngress(bundle, services, projectSlug) {
   const token = bundle.cloudflareToken ?? null;
@@ -869,28 +1058,36 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   const zones = bundle.cloudflareZones ?? [];
   if (!token && !accountId && zones.length === 0) return null;
   if (!token || !accountId) {
-    fail(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
+    fail2(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
   }
   const baseDomain = process.env.LAUNCHKIT_CF_BASE_DOMAIN?.trim();
   let chosen = null;
   if (baseDomain) {
     chosen = zones.find((z) => z.name === baseDomain) ?? null;
     if (!chosen) {
-      fail(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
+      fail2(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
     }
   } else if (zones.length === 1) {
     chosen = { id: zones[0].id, name: zones[0].name };
   } else {
-    fail(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
+    fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
   const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
-  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => s.name).join(",")}`);
+  const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+  for (const s of services) {
+    const label = `${slugLabel}-${s.name}`;
+    if (!DNS_LABEL_RE.test(label)) {
+      fail2(`[entrypoint] hostname label "${label}" (${label.length} chars) is not a valid DNS label \u2014 must be 1\u201363 chars of [a-z0-9-] with no leading/trailing hyphen. Shorten the project slug ("${projectSlug}") or the service name ("${s.name}").`);
+    }
+  }
+  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => `${slugLabel}-${s.name}`).join(",")}`);
   const result = await provisionIngress({
     apiToken: token,
     accountId,
     zone: chosen,
     tunnelName: `launch-kit-${projectSlug}`,
-    services: services.map((s) => ({ name: s.name, port: s.port })),
+    services: services.map((s) => ({ name: s.name, label: `${slugLabel}-${s.name}`, port: s.port })),
     stateFile
   });
   for (const [name, fqdn] of Object.entries(result.hostnames)) {
@@ -898,6 +1095,55 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   }
   return result;
 }
+async function registerOidcClient(serverUrl, pat, redirectUris) {
+  const res = await fetch(new URL("/api/rover/oidc-client", serverUrl), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${pat}`,
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    },
+    body: JSON.stringify({ redirectUris }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.success || !body.data) {
+    fail2(`[entrypoint] OIDC client provisioning failed (HTTP ${res.status}): ${body?.error ?? "unexpected response"}`);
+  }
+  return body.data;
+}
+async function maybeProvisionAccess(bundle, ingress) {
+  const token = bundle.cloudflareToken ?? null;
+  const accountId = bundle.cloudflareAccountId ?? null;
+  if (!token || !accountId) return;
+  const services = [];
+  const skipped = [];
+  for (const [name, hostname] of Object.entries(ingress.hostnames)) {
+    const cfg = GATED_SERVICES[name];
+    if (cfg) services.push({ hostname, strict: cfg.strict });
+    else skipped.push(name);
+  }
+  if (skipped.length > 0) {
+    console.log(`[entrypoint] CF Access: leaving machine surface(s) ungated: ${skipped.join(", ")}`);
+  }
+  if (services.length === 0) {
+    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview not provisioned)");
+    return;
+  }
+  const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
+  const pat = requireEnv("LS_PAT");
+  const stateFile = "/workspace/.launchpod/launch-kit-access.json";
+  console.log(`[entrypoint] gating ${services.map((s) => s.hostname).join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  const result = await provisionAccess({
+    apiToken: token,
+    accountId,
+    issuer: serverUrl,
+    services,
+    stateFile,
+    registerClient: (redirectUris) => registerOidcClient(serverUrl, pat, redirectUris)
+  });
+  console.log(`[entrypoint] CF Access gate live \u2014 IdP ${result.idpId}, auth domain ${result.authDomain}`);
+}
 function spawnServiceGroup(services) {
   const children = [];
   let shuttingDown = false;
@@ -990,7 +1236,7 @@ async function main() {
   try {
     services = resolveServices();
   } catch (err) {
-    fail(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
+    fail2(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
   }
   console.log(`[entrypoint] services: ${services.map((s) => `${s.name}@${s.port}`).join(", ")}`);
   const ingress = await maybeProvisionIngress(bundle, services, requireEnv("LS_PROJECT_SLUG"));
@@ -999,8 +1245,9 @@ async function main() {
     const radarFqdn = ingress.hostnames.radar;
     if (radarFqdn) process.env.RADAR_CF_TUNNEL_HOSTNAME = radarFqdn;
     else if (services.some((s) => s.name === "radar")) {
-      fail(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
+      fail2(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
     }
+    await maybeProvisionAccess(bundle, ingress);
   } else if (services.length > 1) {
     const first = services[0];
     console.warn(
@@ -1018,22 +1265,29 @@ async function main() {
     process.exit(1);
   }
 }
-var import_node_child_process2, import_node_fs3, import_node_path3, REQUIRED_ENV;
+var import_node_child_process2, import_node_fs4, import_node_path4, REQUIRED_ENV, GATED_SERVICES;
 var init_radar_docker_init_entry = __esm({
   "src/server/radar-docker-init-entry.ts"() {
     "use strict";
     import_node_child_process2 = require("node:child_process");
-    import_node_fs3 = require("node:fs");
-    import_node_path3 = require("node:path");
+    import_node_fs4 = require("node:fs");
+    import_node_path4 = require("node:path");
     init_mcp();
     init_launch_kit_services();
     init_cf_ingress();
+    init_cf_access();
     REQUIRED_ENV = [
       "CLAUDE_CREDENTIALS_B64",
       "LS_PAT",
       "LS_ORG_SLUG",
       "LS_PROJECT_SLUG"
     ];
+    GATED_SERVICES = {
+      // Claude web terminal — live drivable shell ⇒ RCE surface ⇒ short session.
+      bot: { strict: true },
+      // The user's own dev/preview server — a workday-length session is fine.
+      preview: { strict: false }
+    };
     if (!process.env.VITEST) {
       main().catch((err) => {
         console.error(`[entrypoint] fatal: ${err instanceof Error ? err.message : String(err)}`);
@@ -1226,6 +1480,24 @@ function footer(msg, hints = []) {
 function warn(msg) {
   console.log(`  ${c.yellow("\u26A0")} ${msg}`);
 }
+var ALL_STEP_IDS = [
+  "resolve",
+  "clone",
+  "cred",
+  "mcp",
+  "gitignore",
+  "install",
+  "onboard",
+  "recall",
+  "migrate-safety",
+  "ls-marketplace",
+  "recall-hook",
+  "statusline"
+];
+var PRESETS = {
+  init: [],
+  refresh: ["resolve", "clone", "install", "onboard", "recall"]
+};
 var LAUNCH_KIT_PKG = "@launchsecure/launch-kit";
 var LAUNCH_KIT_TOOLS_GUIDE_STATIC_HEAD = `
 Wired in Claude Code (.mcp.json):
@@ -1305,7 +1577,16 @@ var KNOWN_BOOL_FLAGS = /* @__PURE__ */ new Set([
   "--guide",
   "--no-guide"
 ]);
-var KNOWN_KV_KEYS = /* @__PURE__ */ new Set(["token", "org", "project", "url", "dir", "course", "git-identity"]);
+var KNOWN_KV_KEYS = /* @__PURE__ */ new Set(["token", "org", "project", "url", "dir", "course", "git-identity", "preset", "skip", "only", "with"]);
+function parseStepList(val, flag) {
+  const ids = val.split(/[,\s]+/).map((s) => s.trim()).filter(Boolean);
+  const bad = ids.filter((id) => !ALL_STEP_IDS.includes(id));
+  if (bad.length > 0) {
+    fail3(`${flag}: unknown step id(s): ${bad.join(", ")}
+  Known steps: ${ALL_STEP_IDS.join(", ")}`);
+  }
+  return ids;
+}
 function parseArgs(argv) {
   const args = {
     token: process.env.LS_PAT ?? null,
@@ -1327,6 +1608,10 @@ function parseArgs(argv) {
     dryRun: false,
     verbose: false,
     guide: null,
+    preset: null,
+    only: null,
+    skip: [],
+    with: [],
     help: false
   };
   const unknown = [];
@@ -1417,11 +1702,27 @@ function parseArgs(argv) {
         args.course = val;
         continue;
       }
+      if (key === "preset") {
+        args.preset = val;
+        continue;
+      }
+      if (key === "skip") {
+        args.skip.push(...parseStepList(val, "--skip"));
+        continue;
+      }
+      if (key === "with") {
+        args.with.push(...parseStepList(val, "--with"));
+        continue;
+      }
+      if (key === "only") {
+        args.only = [...args.only ?? [], ...parseStepList(val, "--only")];
+        continue;
+      }
       if (key === "git-identity") {
         try {
           args.gitIdentity = parseGitIdentityFlag(val);
         } catch (err) {
-          fail2(err instanceof Error ? err.message : String(err));
+          fail3(err instanceof Error ? err.message : String(err));
         }
         continue;
       }
@@ -1437,7 +1738,7 @@ function parseArgs(argv) {
   if (unknown.length > 0) {
     const knownBool = [...KNOWN_BOOL_FLAGS].join(", ");
     const knownKv = [...KNOWN_KV_KEYS].map((k) => `--${k}=<value>`).join(", ");
-    fail2(`Unknown argument(s): ${unknown.join(" ")}
+    fail3(`Unknown argument(s): ${unknown.join(" ")}
   Known boolean flags: ${knownBool}
   Known key=value flags: ${knownKv}`);
   }
@@ -1501,9 +1802,12 @@ function printHelp() {
   console.log(`launch-kit \u2014 bootstrap and refresh a LaunchSecure project on this machine
 
 Subcommands:
-  init                  Bootstrap a new project (clone, cred file, MCP, scaffolds, install)
-  refresh               Re-apply scaffolds + MCP entries in an already-initialized project
-                        (no clone, no install, no PAT prompt \u2014 see \`launch-kit refresh --help\`)
+  run                   One flow, step-selectable. \`--preset=init|refresh\` plus
+                        \`--skip\` / \`--only\` / \`--with\` choose which steps fire.
+                        \`init\` and \`refresh\` are presets over this same flow.
+  init                  Preset of \`run\` \u2014 full bootstrap (clone, cred, MCP, scaffolds, install)
+  refresh               Preset of \`run\` \u2014 re-apply scaffolds + MCP entries only
+                        (skips resolve/clone/install/onboard/recall \u2014 see \`launch-kit refresh --help\`)
   setup-git             Configure git identity + gh credential helper in one
                         shot. Use in containers / CI where init isn't needed.
                         \`launch-kit setup-git --identity="Name <email>"\`.
@@ -1580,6 +1884,20 @@ Options:
                            launch-secure MCP entry) and runs refresh instead.
                            Pass --force to re-init from scratch even when the
                            target dir is already set up.
+
+Step selection (one-command flow \u2014 compose over the preset):
+  Steps: resolve, clone, cred, mcp, gitignore, install, onboard, recall,
+         migrate-safety, ls-marketplace, recall-hook, statusline
+  --preset=<name>          init (everything) or refresh (skips resolve/clone/
+                           install/onboard/recall). Default: init. \`init\` and
+                           \`refresh\` subcommands just select this.
+  --skip=<a,b>             Remove steps from the preset (e.g. --skip=clone,install).
+                           Legacy --no-* flags are sugar for this.
+  --with=<a,b>             Add steps back onto the preset.
+  --only=<a,b>             Run exactly these steps, ignoring the preset.
+                           (Dependent steps auto-skip if their prerequisite isn't
+                           selected: clone needs resolve, onboard needs install,
+                           mcp needs cred.)
   --dry-run                Preview every file write, merge, clone, and install
                            command without making any changes. Useful before
                            re-running init against a customized project. The
@@ -1621,7 +1939,7 @@ async function prompt(question) {
     resolve3(answer.trim());
   }));
 }
-function fail2(msg) {
+function fail3(msg) {
   console.error(`[launch-kit] \u2717 ${msg}`);
   process.exit(1);
 }
@@ -1643,8 +1961,8 @@ function which(bin) {
 }
 function preflight() {
   const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
-  if (nodeMajor < 18) fail2(`Node.js >= 18 required (current: ${process.versions.node}).`);
-  if (!which("git")) fail2("git not found in PATH. Install git: https://git-scm.com/downloads");
+  if (nodeMajor < 18) fail3(`Node.js >= 18 required (current: ${process.versions.node}).`);
+  if (!which("git")) fail3("git not found in PATH. Install git: https://git-scm.com/downloads");
   const hasGh2 = which("gh") !== null;
   ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh2 ? ", gh present" : ", gh not found (will use git for clone)"}`);
   return { hasGh: hasGh2 };
@@ -1819,12 +2137,12 @@ function cloneRepo(repoUrl, targetDir, hasGh2) {
   }
   const res = (0, import_node_child_process3.spawnSync)(cmd, args, { stdio: "inherit" });
   if (res.status !== 0) {
-    fail2(
+    fail3(
       `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\`, set GH_TOKEN=<a PAT with repo scope> before re-running (works without the GitHub CLI), or add an SSH key to your GitHub account.`
     );
   }
   if (!fs5.existsSync(path5.join(targetDir, ".git"))) {
-    fail2(`Clone reported success but .git is missing at ${targetDir}. Possible partial clone, filesystem issue, or sandboxing \u2014 investigate manually.`);
+    fail3(`Clone reported success but .git is missing at ${targetDir}. Possible partial clone, filesystem issue, or sandboxing \u2014 investigate manually.`);
   }
   ok(`cloned to ${targetDir}`);
 }
@@ -1915,7 +2233,7 @@ function mergeMcpFile(targetDir, launchKitEntries) {
     try {
       existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail2(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail3(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const existingServerCount = Object.keys(existing.mcpServers ?? {}).length;
@@ -1975,7 +2293,7 @@ function detectPackageManager(repoDir) {
 function runInstall(repoDir, detected) {
   const { pm } = detected;
   if (!which(pm.binary)) {
-    fail2(
+    fail3(
       `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path5.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
     );
   }
@@ -1986,7 +2304,7 @@ function runInstall(repoDir, detected) {
   }
   const res = (0, import_node_child_process3.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    fail2(
+    fail3(
       `${pm.name} install failed (exit ${res.status}).
 
 Half-init state \u2014 install didn't complete, but these files ARE on disk:
@@ -2043,7 +2361,7 @@ function runOnboard(repoDir, pm) {
   }
   const res = (0, import_node_child_process3.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    fail2(
+    fail3(
       `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path5.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
     );
   }
@@ -2234,7 +2552,7 @@ function wireLsSettings(targetDir) {
     try {
       existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail2(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail3(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const merged = { ...existing };
@@ -2288,7 +2606,7 @@ function wireRecallHook(targetDir) {
     try {
       existing = JSON.parse(fs5.readFileSync(p, "utf-8"));
     } catch (err) {
-      fail2(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
+      fail3(`Could not parse existing .claude/settings.json: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   const hooks = existing.hooks ?? {};
@@ -2353,14 +2671,14 @@ async function main2() {
     let identityVal = null;
     for (const a of process.argv.slice(3)) {
       if (a.startsWith("--identity=")) identityVal = a.slice("--identity=".length);
-      else fail2(`Unknown setup-git flag: "${a}". Supported: --identity="Name <email>".`);
+      else fail3(`Unknown setup-git flag: "${a}". Supported: --identity="Name <email>".`);
     }
-    if (!identityVal) fail2(`launch-kit setup-git requires --identity="Name <email>".`);
+    if (!identityVal) fail3(`launch-kit setup-git requires --identity="Name <email>".`);
     try {
       const identity = parseGitIdentityFlag(identityVal, "--identity");
       configureGitForBot(identity);
     } catch (err) {
-      fail2(err instanceof Error ? err.message : String(err));
+      fail3(err instanceof Error ? err.message : String(err));
     }
     return;
   }
@@ -2380,13 +2698,13 @@ async function main2() {
     for (const a of process.argv.slice(4)) {
       if (a.startsWith("--show=")) showArg = a.slice("--show=".length);
       else if (a === "--compact") compactArg = true;
-      else fail2(`Unknown statusline flag: "${a}". Supported: --show=<csv>, --compact.`);
+      else fail3(`Unknown statusline flag: "${a}". Supported: --show=<csv>, --compact.`);
     }
     const { activateStatusline: activateStatusline2, deactivateStatusline: deactivateStatusline2 } = await Promise.resolve().then(() => (init_statusline_install(), statusline_install_exports));
     let res;
     if (action === "activate") res = activateStatusline2({ show: showArg, compact: compactArg });
     else if (action === "deactivate") res = deactivateStatusline2();
-    else fail2(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
+    else fail3(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
     if (res.ok) ok(`statusline ${res.outcome} \u2014 ${res.message}`);
     else info(`statusline ${res.outcome} \u2014 ${res.message}`);
     return;
@@ -2404,7 +2722,7 @@ async function main2() {
       return;
     }
     if (action !== "pull") {
-      fail2(`Unknown secrets action: "${action}". Supported: pull.`);
+      fail3(`Unknown secrets action: "${action}". Supported: pull.`);
     }
     let envOverride = null;
     let dirArg = null;
@@ -2413,14 +2731,14 @@ async function main2() {
       if (a.startsWith("--env=")) envOverride = a.slice("--env=".length);
       else if (a.startsWith("--dir=")) dirArg = a.slice("--dir=".length);
       else if (a.startsWith("--file=")) fileArg = a.slice("--file=".length);
-      else fail2(`Unknown secrets pull flag: "${a}". Supported: --env, --dir, --file.`);
+      else fail3(`Unknown secrets pull flag: "${a}". Supported: --env, --dir, --file.`);
     }
     const targetDir = path5.resolve(dirArg ?? process.cwd());
     const { runSecretsPull: runSecretsPull2 } = await Promise.resolve().then(() => (init_secrets_pull(), secrets_pull_exports));
     try {
       await runSecretsPull2({ targetDir, envOverride, fileName: fileArg });
     } catch (err) {
-      fail2(err instanceof Error ? err.message : String(err));
+      fail3(err instanceof Error ? err.message : String(err));
     }
     return;
   }
@@ -2431,10 +2749,14 @@ async function main2() {
     return;
   }
   if (!subcommand || subcommand.startsWith("--")) {
-    fail2(`missing subcommand. Usage: launch-kit <init|refresh|statusline|secrets> [options]. Run with --help.`);
+    fail3(`missing subcommand. Usage: launch-kit <run|init|refresh|statusline|secrets> [options]. Run with --help.`);
+  }
+  if (subcommand !== "init" && subcommand !== "refresh" && subcommand !== "run") {
+    fail3(`Unknown subcommand "${subcommand}". Supported: run, init, refresh, statusline, secrets. Run with --help for usage.`);
   }
-  if (subcommand !== "init" && subcommand !== "refresh") {
-    fail2(`Unknown subcommand "${subcommand}". Supported: init, refresh, statusline, secrets. Run with --help for usage.`);
+  if (!args.preset) args.preset = subcommand === "refresh" ? "refresh" : "init";
+  if (!PRESETS[args.preset]) {
+    fail3(`Unknown --preset "${args.preset}". Known presets: ${Object.keys(PRESETS).join(", ")}.`);
   }
   DRY_RUN = args.dryRun;
   VERBOSE = args.verbose || DRY_RUN;
@@ -2444,102 +2766,30 @@ async function main2() {
     console.log(c.dim("Lines tagged (dry-run) show what would happen."));
     console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   }
-  if (subcommand === "refresh") return mainRefresh(args);
-  return mainInit(args);
+  return runFlow(args);
 }
-async function mainRefresh(args) {
-  const cwd = process.cwd();
-  const targetDir = path5.resolve(args.targetDir ?? cwd);
-  if (!fs5.existsSync(targetDir)) fail2(`target dir does not exist: ${targetDir}`);
-  let cred;
-  let source;
-  try {
-    const recovery = recoverCred(targetDir, getRecoveryOptions());
-    cred = recovery.cred;
-    source = recovery.source;
-  } catch (err) {
-    fail2(err instanceof Error ? err.message : String(err));
-  }
-  if (cred && source === "mcp") {
-    info(`recovered cred from .mcp.json launch-secure headers (PAT + org + project + url)`);
-    const courseName = inferCourseName(cred.serverUrl);
-    const nested2 = upsertProfile(null, courseName, cred);
-    if (DRY_RUN) {
-      dryNote(`would write ${CONFIG_FILENAME} from recovered .mcp.json cred (course: ${courseName})`);
-    } else {
-      writeJsonAtomic(path5.join(targetDir, CONFIG_FILENAME), nested2, 384);
-      ok(`wrote ${CONFIG_FILENAME} (course: ${courseName})`);
-    }
-  }
-  if (!cred && args.token && args.orgSlug && args.projectSlug) {
-    const courseName = args.course ?? inferCourseName(args.serverUrl);
-    const seedCfg = {
-      pat: args.token,
-      orgSlug: args.orgSlug,
-      projectSlug: args.projectSlug,
-      serverUrl: args.serverUrl
-    };
-    info(`no ${CONFIG_FILENAME} found \u2014 seeding it from --token/--org/--project (course: ${courseName})`);
-    writeConfigFile(targetDir, seedCfg, courseName);
-    cred = { active: courseName, profiles: { [courseName]: seedCfg } };
-  }
-  if (!cred) {
-    fail2(
-      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json.
-Refresh re-applies configs to an already-wired checkout, so it needs a cred. Two ways forward:
-  \u2022 Seed it inline (you already have the repo): re-run refresh with credentials \u2014
-      launch-kit refresh --dir=${path5.relative(cwd, targetDir) || "."} --token=<pat> --org=<org> --project=<project>
-  \u2022 Or run a full init in place \u2014 it detects this existing repo and skips the clone:
-      launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}`
-    );
-  }
-  const nested = toNested(cred);
-  if (!nested) fail2(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl).`);
-  const active = nested.profiles[nested.active];
-  if (!active) fail2(`${CONFIG_FILENAME} active profile "${nested.active}" is not present in profiles.`);
-  info(`refreshing launch-kit in ${targetDir} (course: ${nested.active}, project: ${active.orgSlug}/${active.projectSlug}) \u2026`);
-  header("launch-kit refresh", [
-    ["course", nested.active],
-    ["project", `${active.orgSlug}/${active.projectSlug}`],
-    ["dir", path5.relative(cwd, targetDir) || "."]
-  ]);
-  const cfg = { pat: active.pat, orgSlug: active.orgSlug, projectSlug: active.projectSlug, serverUrl: active.serverUrl };
-  phase(".mcp.json", mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg)));
-  ensureGitignoreLine(targetDir, CONFIG_FILENAME);
-  if (!args.noMigrateSafety) phase("migrate-safety", scaffoldMigrateSafety(targetDir, args.refreshScaffolds));
-  if (!args.noLsMarketplace) phase("ls-marketplace", scaffoldLsMarketplace(targetDir));
-  if (!args.noRecallHook) phase("recall-hook", scaffoldRecallHook(targetDir));
-  const slR = tryActivateStatusline();
-  if (slR) phase("statusline", slR);
-  if (DRY_RUN) {
-    console.log("");
-    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(c.bold("DRY RUN COMPLETE") + c.dim(" \u2014 refresh would have applied the above; no files modified."));
-    console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    return;
-  }
-  ok(`refresh complete \u2014 restart Claude Code to pick up any new /kit:* commands`);
-  const showGuide = args.quiet ? false : args.guide === true;
-  const hints = ["Restart Claude Code to pick up any new /kit:* commands."];
-  if (!showGuide && !args.quiet) hints.push("Run with --guide to print the full MCP + slash-command catalog. --verbose for per-file detail.");
-  footer("Refresh complete.", hints);
-  if (showGuide) {
-    console.log(c.dim(`(refresh never runs these: clone, dependency install, onboard script, launch-recall init \u2014 use \`launch-kit init\` for a full bootstrap)`));
-    console.log(getLaunchKitToolsGuide());
-  }
-}
-async function mainInit(args) {
-  const probeDir = path5.resolve(args.targetDir ?? process.cwd());
-  if (!args.force && fs5.existsSync(probeDir)) {
-    const detection = detectExistingBootstrap(probeDir);
-    if (detection.bootstrapped) {
-      info(`detected existing bootstrap at ${probeDir} (${detection.reason})`);
-      info(`delegating to refresh. Pass --force to re-init from scratch (will re-prompt for PAT if needed).`);
-      return mainRefresh({ ...args, targetDir: probeDir });
-    }
-  }
+function resolveEnabledSteps(args) {
+  let enabled;
+  if (args.only) {
+    enabled = new Set(args.only);
+  } else {
+    enabled = new Set(ALL_STEP_IDS);
+    for (const id of PRESETS[args.preset ?? "init"] ?? []) enabled.delete(id);
+  }
+  for (const id of args.skip) enabled.delete(id);
+  for (const id of args.with) enabled.add(id);
+  if (args.noInstall) enabled.delete("install");
+  if (args.noOnboard) enabled.delete("onboard");
+  if (args.noRecall) enabled.delete("recall");
+  if (args.noMigrateSafety) enabled.delete("migrate-safety");
+  if (args.noLsMarketplace) enabled.delete("ls-marketplace");
+  if (args.noRecallHook) enabled.delete("recall-hook");
+  return enabled;
+}
+async function stepResolve(ctx) {
+  const { args } = ctx;
   if (!args.token || !args.orgSlug || !args.projectSlug) {
-    const recoveryDir = path5.resolve(args.targetDir ?? process.cwd());
+    const recoveryDir = path5.resolve(args.targetDir ?? ctx.cwd);
     if (fs5.existsSync(recoveryDir)) {
       const { cred } = recoverCred(recoveryDir, getRecoveryOptions());
       const nested = cred ? toNested(cred) : null;
@@ -2567,16 +2817,18 @@ async function mainInit(args) {
     const t = await prompt("LaunchSecure PAT (ls_pat_\u2026): ");
     args.token = t || null;
   }
-  if (!args.token) fail2("--token (or LS_PAT env) is required.");
-  if (!/^ls_pat_/.test(args.token)) fail2("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
-  if (!args.orgSlug) fail2("--org=<orgSlug> is required.");
-  if (!args.projectSlug) fail2("--project=<projectSlug> is required.");
+  if (!args.token) fail3("--token (or LS_PAT env) is required.");
+  if (!/^ls_pat_/.test(args.token)) fail3("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
+  if (!args.orgSlug) fail3("--org=<orgSlug> is required.");
+  if (!args.projectSlug) fail3("--project=<projectSlug> is required.");
   header("launch-kit init", [
     ["org", args.orgSlug],
     ["project", args.projectSlug],
     ["server", args.serverUrl]
   ]);
+  ctx.headerPrinted = true;
   const { hasGh: hasGh2 } = preflight();
+  ctx.hasGh = hasGh2;
   phase("preflight", { status: "ok", summary: `node ${process.versions.node}${hasGh2 ? " \xB7 git \xB7 gh" : " \xB7 git (gh not found \u2014 will use git for clone)"}` });
   if (args.gitIdentity) {
     configureGitForBot(args.gitIdentity);
@@ -2589,120 +2841,271 @@ async function mainInit(args) {
   try {
     resolved = await callProjectInfo(args);
   } catch (err) {
-    fail2(err instanceof Error ? err.message : String(err));
+    fail3(err instanceof Error ? err.message : String(err));
   }
   ok(`resolved "${resolved.projectName}"`);
   phase("project_info", { status: "ok", summary: `"${resolved.projectName}"` });
   if (!resolved.repositoryUrl) {
-    fail2(
+    fail3(
       `Project "${resolved.projectSlug}" has no GitHub repository configured. Connect GitHub at ${args.serverUrl}/${resolved.orgSlug}/projects/${resolved.projectSlug}/settings/integrations, then re-run init.`
     );
   }
-  const repoUrl = resolved.repositoryUrl;
-  const cwd = process.cwd();
-  const targetDir = path5.resolve(args.targetDir ?? path5.join(cwd, resolved.projectSlug));
+  ctx.resolved = resolved;
+  ctx.repoUrl = resolved.repositoryUrl;
+  ctx.targetDir = path5.resolve(args.targetDir ?? path5.join(ctx.cwd, resolved.projectSlug));
+  ctx.cfg = { pat: args.token, orgSlug: resolved.orgSlug, projectSlug: resolved.projectSlug, serverUrl: args.serverUrl };
+  ctx.courseName = args.course ?? inferCourseName(ctx.cfg.serverUrl);
+}
+function stepClone(ctx) {
+  const repoUrl = ctx.repoUrl;
+  const { targetDir, cwd } = ctx;
   const normalizedRemote = normalizeRepoUrl(repoUrl);
-  let skipClone = false;
   if (fs5.existsSync(targetDir)) {
     if (isGitRepo(targetDir)) {
       const existingRemote = gitRemoteUrl(targetDir);
       if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
         ok(`${targetDir} is already a clone of ${repoUrl} \u2014 wiring this existing repo (skipping clone, no GitHub auth needed)`);
         info(`tip: once wired, use \`launch-kit refresh\` here to re-apply configs without re-running init`);
-        skipClone = true;
+        ctx.skipClone = true;
       } else {
-        fail2(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
+        fail3(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
       }
     } else if (!dirIsEmpty(targetDir)) {
-      fail2(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
+      fail3(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
     }
   }
   const relTarget = path5.relative(cwd, targetDir) || ".";
-  if (!skipClone) {
+  if (!ctx.skipClone) {
     section(`Cloning ${repoUrl}`);
-    cloneRepo(repoUrl, targetDir, hasGh2);
+    cloneRepo(repoUrl, targetDir, ctx.hasGh);
     phase("clone", { status: "ok", summary: `\u2192 ${relTarget}` });
   } else {
     phase("clone", { status: "in-sync", summary: `${relTarget} (already a clone of this repo)` });
   }
-  const cfg = {
-    pat: args.token,
-    orgSlug: resolved.orgSlug,
-    projectSlug: resolved.projectSlug,
-    serverUrl: args.serverUrl
-  };
-  const courseName = args.course ?? inferCourseName(cfg.serverUrl);
-  writeConfigFile(targetDir, cfg, courseName);
-  phase("cred file", { status: "ok", summary: `course=${courseName}, active` });
-  phase(".mcp.json", mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg)));
-  ensureGitignoreLine(targetDir, CONFIG_FILENAME);
-  let installSkippedReason = null;
-  const detected = detectPackageManager(targetDir);
-  if (detected) info(`detected package manager: ${detected.pm.name} (${detected.source})`);
-  if (args.noInstall) {
-    installSkippedReason = "--no-install passed";
-  } else if (!detected) {
-    installSkippedReason = "no package.json found";
-  } else {
-    section(`Installing dependencies (${detected.pm.name})`);
-    runInstall(targetDir, detected);
-    phase("install", { status: "ok", summary: `${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` });
-    if (!args.noOnboard) {
-      if (hasOnboardScript(targetDir)) {
-        section(`Running ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}`);
-        runOnboard(targetDir, detected.pm);
-        phase("onboard", { status: "ok", summary: `${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}` });
-      } else {
-        section("Pulling environment secrets");
-        info("running launch-kit secrets pull \u2026");
-        if (DRY_RUN) {
-          dryNote(`would run: launch-kit secrets pull --dir=${path5.relative(cwd, targetDir) || "."}`);
-          phase("secrets pull", { status: "skipped", summary: "(dry-run)" });
-        } else {
-          try {
-            await runSecretsPull({ targetDir, envOverride: null, fileName: ".env.local" });
-            phase("secrets pull", { status: "ok", summary: ".env.local from cloud LS" });
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            warn(`secrets pull skipped \u2014 ${msg}`);
-            phase("secrets pull", { status: "warn", summary: "pull manually with `launch-kit secrets pull`" });
-          }
-        }
-      }
+}
+function stepCred(ctx) {
+  const { args, cwd } = ctx;
+  if (ctx.cfg && ctx.resolved) {
+    writeConfigFile(ctx.targetDir, ctx.cfg, ctx.courseName);
+    phase("cred file", { status: "ok", summary: `course=${ctx.courseName}, active` });
+    return;
+  }
+  const targetDir = ctx.targetDir;
+  if (!fs5.existsSync(targetDir)) fail3(`target dir does not exist: ${targetDir}`);
+  let cred;
+  let source;
+  try {
+    const recovery = recoverCred(targetDir, getRecoveryOptions());
+    cred = recovery.cred;
+    source = recovery.source;
+  } catch (err) {
+    fail3(err instanceof Error ? err.message : String(err));
+  }
+  if (cred && source === "mcp") {
+    info(`recovered cred from .mcp.json launch-secure headers (PAT + org + project + url)`);
+    const courseName = inferCourseName(cred.serverUrl);
+    const nested2 = upsertProfile(null, courseName, cred);
+    if (DRY_RUN) {
+      dryNote(`would write ${CONFIG_FILENAME} from recovered .mcp.json cred (course: ${courseName})`);
+    } else {
+      writeJsonAtomic(path5.join(targetDir, CONFIG_FILENAME), nested2, 384);
+      ok(`wrote ${CONFIG_FILENAME} (course: ${courseName})`);
     }
   }
-  const hasOnboard = hasOnboardScript(targetDir);
-  if (installSkippedReason) phase("install", { status: "skipped", summary: installSkippedReason });
-  if (!args.noRecall) {
-    section("Initializing launch-recall (shadow git backup)");
-    runRecallInit(targetDir);
-    phase("launch-recall", { status: "ok", summary: "shadow git ready" });
+  if (!cred && args.token && args.orgSlug && args.projectSlug) {
+    const courseName = args.course ?? inferCourseName(args.serverUrl);
+    const seedCfg = {
+      pat: args.token,
+      orgSlug: args.orgSlug,
+      projectSlug: args.projectSlug,
+      serverUrl: args.serverUrl
+    };
+    info(`no ${CONFIG_FILENAME} found \u2014 seeding it from --token/--org/--project (course: ${courseName})`);
+    writeConfigFile(targetDir, seedCfg, courseName);
+    cred = { active: courseName, profiles: { [courseName]: seedCfg } };
+  }
+  if (!cred) {
+    fail3(
+      `no ${CONFIG_FILENAME} found at ${targetDir}, and could not recover from .mcp.json.
+Refresh re-applies configs to an already-wired checkout, so it needs a cred. Two ways forward:
+  \u2022 Seed it inline (you already have the repo): re-run with credentials \u2014
+      launch-kit refresh --dir=${path5.relative(cwd, targetDir) || "."} --token=<pat> --org=<org> --project=<project>
+  \u2022 Or run a full init in place \u2014 it detects this existing repo and skips the clone:
+      launch-kit init --token=<pat> --org=<org> --project=<project> --dir=${path5.relative(cwd, targetDir) || "."}`
+    );
+  }
+  const nested = toNested(cred);
+  if (!nested) fail3(`${CONFIG_FILENAME} is malformed or missing required fields (pat/orgSlug/projectSlug/serverUrl).`);
+  const active = nested.profiles[nested.active];
+  if (!active) fail3(`${CONFIG_FILENAME} active profile "${nested.active}" is not present in profiles.`);
+  ctx.cfg = { pat: active.pat, orgSlug: active.orgSlug, projectSlug: active.projectSlug, serverUrl: active.serverUrl };
+  ctx.courseName = nested.active;
+  info(`refreshing launch-kit in ${targetDir} (course: ${nested.active}, project: ${active.orgSlug}/${active.projectSlug}) \u2026`);
+  if (!ctx.headerPrinted) {
+    header("launch-kit refresh", [
+      ["course", nested.active],
+      ["project", `${active.orgSlug}/${active.projectSlug}`],
+      ["dir", path5.relative(cwd, targetDir) || "."]
+    ]);
+    ctx.headerPrinted = true;
+  }
+}
+function stepMcp(ctx) {
+  phase(".mcp.json", mergeMcpFile(ctx.targetDir, buildLaunchKitMcpEntries(ctx.cfg)));
+}
+function stepGitignore(ctx) {
+  ensureGitignoreLine(ctx.targetDir, CONFIG_FILENAME);
+}
+function stepInstall(ctx) {
+  const detected = detectPackageManager(ctx.targetDir);
+  ctx.detected = detected;
+  if (detected) info(`detected package manager: ${detected.pm.name} (${detected.source})`);
+  if (!detected) {
+    ctx.installSkippedReason = "no package.json found";
+    phase("install", { status: "skipped", summary: ctx.installSkippedReason });
+    return;
+  }
+  section(`Installing dependencies (${detected.pm.name})`);
+  runInstall(ctx.targetDir, detected);
+  ctx.installRan = true;
+  phase("install", { status: "ok", summary: `${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` });
+}
+async function stepOnboard(ctx) {
+  if (!ctx.installRan || !ctx.detected) return;
+  const { detected, targetDir, cwd } = ctx;
+  if (hasOnboardScript(targetDir)) {
+    section(`Running ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}`);
+    runOnboard(targetDir, detected.pm);
+    phase("onboard", { status: "ok", summary: `${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}` });
+    return;
+  }
+  section("Pulling environment secrets");
+  info("running launch-kit secrets pull \u2026");
+  if (DRY_RUN) {
+    dryNote(`would run: launch-kit secrets pull --dir=${path5.relative(cwd, targetDir) || "."}`);
+    phase("secrets pull", { status: "skipped", summary: "(dry-run)" });
+    return;
+  }
+  try {
+    await runSecretsPull({ targetDir, envOverride: null, fileName: ".env.local" });
+    phase("secrets pull", { status: "ok", summary: ".env.local from cloud LS" });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    warn(`secrets pull skipped \u2014 ${msg}`);
+    phase("secrets pull", { status: "warn", summary: "pull manually with `launch-kit secrets pull`" });
   }
-  if (!args.noMigrateSafety) phase("migrate-safety", scaffoldMigrateSafety(targetDir, args.refreshScaffolds));
-  if (!args.noLsMarketplace) phase("ls-marketplace", scaffoldLsMarketplace(targetDir));
-  if (!args.noRecallHook) phase("recall-hook", scaffoldRecallHook(targetDir));
+}
+function stepRecall(ctx) {
+  section("Initializing launch-recall (shadow git backup)");
+  runRecallInit(ctx.targetDir);
+  phase("launch-recall", { status: "ok", summary: "shadow git ready" });
+}
+function stepMigrateSafety(ctx) {
+  phase("migrate-safety", scaffoldMigrateSafety(ctx.targetDir, ctx.args.refreshScaffolds));
+}
+function stepLsMarketplace(ctx) {
+  phase("ls-marketplace", scaffoldLsMarketplace(ctx.targetDir));
+}
+function stepRecallHook(ctx) {
+  phase("recall-hook", scaffoldRecallHook(ctx.targetDir));
+}
+function stepStatusline(_ctx) {
   const slR = tryActivateStatusline();
   if (slR) phase("statusline", slR);
+}
+var STEPS = [
+  { id: "resolve", run: stepResolve },
+  { id: "clone", requires: ["resolve"], run: stepClone },
+  { id: "cred", run: stepCred },
+  { id: "mcp", requires: ["cred"], run: stepMcp },
+  { id: "gitignore", run: stepGitignore },
+  { id: "install", run: stepInstall },
+  { id: "onboard", requires: ["install"], run: stepOnboard },
+  { id: "recall", run: stepRecall },
+  { id: "migrate-safety", run: stepMigrateSafety },
+  { id: "ls-marketplace", run: stepLsMarketplace },
+  { id: "recall-hook", run: stepRecallHook },
+  { id: "statusline", run: stepStatusline }
+];
+function buildCtx(args, enabled) {
+  const cwd = process.cwd();
+  const targetDir = path5.resolve(args.targetDir ?? cwd);
+  if (enabled.has("resolve") && !args.force && fs5.existsSync(targetDir)) {
+    const detection = detectExistingBootstrap(targetDir);
+    if (detection.bootstrapped) {
+      info(`detected existing bootstrap at ${targetDir} (${detection.reason})`);
+      info(`delegating to refresh. Pass --force to re-init from scratch (will re-prompt for PAT if needed).`);
+      for (const id of PRESETS.refresh) enabled.delete(id);
+    }
+  }
+  return {
+    args,
+    enabled,
+    cwd,
+    targetDir,
+    hasGh: false,
+    cfg: null,
+    courseName: null,
+    resolved: null,
+    repoUrl: null,
+    skipClone: false,
+    headerPrinted: false,
+    detected: null,
+    installRan: false,
+    installSkippedReason: null
+  };
+}
+async function runFlow(args) {
+  const enabled = resolveEnabledSteps(args);
+  const ctx = buildCtx(args, enabled);
+  for (const step of STEPS) {
+    if (!ctx.enabled.has(step.id)) continue;
+    if (step.requires?.some((r) => !ctx.enabled.has(r))) continue;
+    await step.run(ctx);
+  }
+  epilogue(ctx);
+}
+function epilogue(ctx) {
+  const { args, cwd, targetDir } = ctx;
+  const isRefreshLike = !ctx.enabled.has("resolve");
+  const relTarget = path5.relative(cwd, targetDir) || ".";
   if (DRY_RUN) {
     console.log("");
     console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(c.bold("DRY RUN COMPLETE") + c.dim(` \u2014 no files were modified, no commands ran.`));
-    console.log(c.dim(`Target: ${targetDir}`));
-    console.log(c.dim(`Re-run without --dry-run to apply the changes shown above.`));
+    if (isRefreshLike) {
+      console.log(c.bold("DRY RUN COMPLETE") + c.dim(" \u2014 refresh would have applied the above; no files modified."));
+    } else {
+      console.log(c.bold("DRY RUN COMPLETE") + c.dim(` \u2014 no files were modified, no commands ran.`));
+      console.log(c.dim(`Target: ${targetDir}`));
+      console.log(c.dim(`Re-run without --dry-run to apply the changes shown above.`));
+    }
     console.log(c.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     return;
   }
-  ok(`done \u2014 ${resolved.projectName} is ready at ${targetDir}`);
+  if (isRefreshLike) {
+    ok(`refresh complete \u2014 restart Claude Code to pick up any new /kit:* commands`);
+    const showGuide2 = args.quiet ? false : args.guide === true;
+    const hints = ["Restart Claude Code to pick up any new /kit:* commands."];
+    if (!showGuide2 && !args.quiet) hints.push("Run with --guide to print the full MCP + slash-command catalog. --verbose for per-file detail.");
+    footer("Refresh complete.", hints);
+    if (showGuide2) {
+      console.log(c.dim(`(refresh never runs these: clone, dependency install, onboard script, launch-recall init \u2014 use \`launch-kit init\` for a full bootstrap)`));
+      console.log(getLaunchKitToolsGuide());
+    }
+    return;
+  }
+  const projectName = ctx.resolved?.projectName ?? relTarget;
+  ok(`done \u2014 ${projectName} is ready at ${targetDir}`);
   const showGuide = args.quiet ? false : args.guide ?? true;
   const nextSteps = [`cd ${relTarget}`];
-  if (installSkippedReason) {
-    nextSteps.push(detected ? `${detected.pm.binary} ${detected.pm.installArgs.join(" ")}     # install skipped: ${installSkippedReason}` : `npm install                                                   # install skipped: ${installSkippedReason}`);
-    if (hasOnboard && detected && !args.noOnboard) {
-      nextSteps.push(`${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}     # project setup hook`);
+  if (ctx.installSkippedReason) {
+    nextSteps.push(ctx.detected ? `${ctx.detected.pm.binary} ${ctx.detected.pm.installArgs.join(" ")}     # install skipped: ${ctx.installSkippedReason}` : `npm install                                                   # install skipped: ${ctx.installSkippedReason}`);
+    if (hasOnboardScript(targetDir) && ctx.detected && ctx.enabled.has("onboard")) {
+      nextSteps.push(`${ctx.detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}     # project setup hook`);
     }
   }
   nextSteps.push("claude                                                   # launch Claude Code (5 MCPs wired)");
-  footer(`${resolved.projectName} is ready at ${relTarget}.`, [
+  footer(`${projectName} is ready at ${relTarget}.`, [
     "Next:",
     ...nextSteps.map((s) => "  " + s)
   ]);