@launchsecure/launch-kit 0.0.35 → 0.0.37

package/dist/server/radar-docker-init-entry.js

@@ -21,13 +21,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server/radar-docker-init-entry.ts
 var radar_docker_init_entry_exports = {};
 __export(radar_docker_init_entry_exports, {
+  maybeProvisionAccess: () => maybeProvisionAccess,
   maybeProvisionIngress: () => maybeProvisionIngress,
   spawnServiceGroup: () => spawnServiceGroup
 });
 module.exports = __toCommonJS(radar_docker_init_entry_exports);
 var import_node_child_process = require("node:child_process");
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path4 = require("node:path");
 
 // src/server/radar/mcp.ts
 var import_node_https = require("node:https");
@@ -152,10 +153,9 @@ var SHORTHANDS = {
   sequencer: { port: 3517, bin: "launch-sequencer", args: [] },
   chart: { port: 52819, bin: "launch-chart", args: ["serve"] },
   deck: { port: 52829, bin: "launch-deck", args: ["serve"] },
-  council: { port: 52839, bin: "launch-council", args: ["serve"] },
   // Claude web terminal — exposes a viewable/drivable `claude` session at
-  // `bot.<baseDomain>`. NOTE: no auth gate yet (tracked as a separate
-  // high-priority rover-security work item); ships behind a plain link first.
+  // `bot.<baseDomain>`. Gated at the edge by CF Access → our OIDC IdP (#183);
+  // see GATED_SERVICES in radar-docker-init-entry.ts (bot = strict session).
   bot: { port: 52849, bin: "launch-bot", args: ["serve"] }
 };
 var DNS_NAME_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -259,6 +259,9 @@ var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 var CF_API_BASE = "https://api.cloudflare.com/client/v4";
 var CF_ERR_DNS_RECORD_EXISTS = 81053;
+function serviceLabel(s) {
+  return s.label ?? s.name;
+}
 async function cf(opts) {
   const res = await fetch(`${CF_API_BASE}${opts.path}`, {
     method: opts.method,
@@ -283,6 +286,17 @@ async function cf(opts) {
 function isNotFound(env) {
   return !env.success && (env.errors ?? []).some((e) => e.code === 7003 || e.code === 1001 || e.code === 81044);
 }
+async function findTunnelByName(input) {
+  const q = new URLSearchParams({ name: input.tunnelName, is_deleted: "false" }).toString();
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/cfd_tunnel?${q}`
+  });
+  if (!res.success || !Array.isArray(res.result)) return null;
+  const live = res.result.find((t) => t.name === input.tunnelName && !t.deleted_at);
+  return live?.id ?? null;
+}
 function loadState(path) {
   if (!(0, import_node_fs2.existsSync)(path)) return null;
   try {
@@ -314,16 +328,26 @@ async function ensureTunnel(input, knownTunnelId) {
       throw new Error(`[cf] tunnel GET failed: ${JSON.stringify(got.errors)}`);
     }
   }
+  const existing = await findTunnelByName(input);
+  if (existing) {
+    console.log(`[cf] adopted existing tunnel "${input.tunnelName}" (${existing}) \u2014 local state was missing`);
+    return existing;
+  }
   const created = await cf({
     apiToken: input.apiToken,
     method: "POST",
     path: `/accounts/${input.accountId}/cfd_tunnel`,
     body: { name: input.tunnelName, config_src: "cloudflare" }
   });
-  if (!created.success || !created.result) {
-    throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
+  if (created.success && created.result) return created.result.id;
+  if ((created.errors ?? []).some((e) => e.code === 1013)) {
+    const adopted = await findTunnelByName(input);
+    if (adopted) {
+      console.log(`[cf] tunnel "${input.tunnelName}" already existed (1013) \u2014 adopted ${adopted}`);
+      return adopted;
+    }
   }
-  return created.result.id;
+  throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
 }
 async function fetchConnectorToken(input, tunnelId) {
   const res = await cf({
@@ -338,7 +362,7 @@ async function fetchConnectorToken(input, tunnelId) {
 }
 async function setIngressConfig(input, tunnelId) {
   const ingress = input.services.map((s) => ({
-    hostname: `${s.name}.${input.zone.name}`,
+    hostname: `${serviceLabel(s)}.${input.zone.name}`,
     service: `http://localhost:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
@@ -353,7 +377,7 @@ async function setIngressConfig(input, tunnelId) {
   }
 }
 async function ensureDnsRecord(input, tunnelId, service) {
-  const fqdn = `${service.name}.${input.zone.name}`;
+  const fqdn = `${serviceLabel(service)}.${input.zone.name}`;
   const target = `${tunnelId}.cfargotunnel.com`;
   const existing = await cf({
     apiToken: input.apiToken,
@@ -397,10 +421,181 @@ async function provisionIngress(input) {
   await setIngressConfig(input, tunnelId);
   await Promise.all(input.services.map((s) => ensureDnsRecord(input, tunnelId, s)));
   const hostnames = {};
-  for (const s of input.services) hostnames[s.name] = `${s.name}.${input.zone.name}`;
+  for (const s of input.services) hostnames[s.name] = `${serviceLabel(s)}.${input.zone.name}`;
   return { tunnelId, connectorToken, hostnames };
 }
 
+// src/server/cf-access.ts
+var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
+var CF_API_BASE2 = "https://api.cloudflare.com/client/v4";
+var IDP_NAME = "launch-kit-oidc";
+async function cf2(opts) {
+  const res = await fetch(`${CF_API_BASE2}${opts.path}`, {
+    method: opts.method,
+    headers: {
+      Authorization: `Bearer ${opts.apiToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": "launch-kit/cf-access"
+    },
+    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+    signal: AbortSignal.timeout(15e3)
+  });
+  const text = await res.text();
+  try {
+    return text ? JSON.parse(text) : { success: false };
+  } catch {
+    throw new Error(`[cf-access] ${opts.method} ${opts.path} \u2192 ${res.status}, non-JSON: ${text.slice(0, 200)}`);
+  }
+}
+function fail(env, what) {
+  throw new Error(`[cf-access] ${what} failed: ${JSON.stringify(env.errors)}`);
+}
+function loadState2(path) {
+  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    return typeof parsed?.accountId === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function saveState2(path, state) {
+  const dir = (0, import_node_path3.dirname)(path);
+  if (!(0, import_node_fs3.existsSync)(dir)) (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs3.writeFileSync)(path, JSON.stringify(state, null, 2));
+}
+async function getAccessAuthDomain(apiToken, accountId) {
+  const res = await cf2({
+    apiToken,
+    method: "GET",
+    path: `/accounts/${accountId}/access/organizations`
+  });
+  if (!res.success || !res.result?.auth_domain) {
+    fail(res, "GET access/organizations (is Zero Trust enabled on this account?)");
+  }
+  return res.result.auth_domain;
+}
+async function ensureAccessIdp(input) {
+  const config = {
+    client_id: input.clientId,
+    client_secret: input.clientSecret,
+    auth_url: `${input.issuer}/api/oidc/authorize`,
+    token_url: `${input.issuer}/api/oidc/token`,
+    certs_url: `${input.issuer}/.well-known/jwks.json`,
+    scopes: ["openid", "email", "profile"],
+    claims: ["org", "project_access", "roles", "email"],
+    email_claim_name: "email",
+    pkce_enabled: true
+  };
+  const body = { name: IDP_NAME, type: "oidc", config };
+  let idpId = input.knownIdpId;
+  if (!idpId) {
+    const list = await cf2({
+      apiToken: input.apiToken,
+      method: "GET",
+      path: `/accounts/${input.accountId}/access/identity_providers`
+    });
+    if (!list.success) fail(list, "list identity_providers");
+    idpId = (list.result ?? []).find((p) => p.name === IDP_NAME)?.id ?? null;
+  }
+  if (idpId) {
+    const upd = await cf2({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/identity_providers/${idpId}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, "update identity_provider");
+    return upd.result.id;
+  }
+  const created = await cf2({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/identity_providers`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, "create identity_provider");
+  return created.result.id;
+}
+async function ensureAccessApp(input) {
+  const policy = {
+    name: "launch-kit-org-allow",
+    decision: "allow",
+    include: [
+      {
+        oidc: {
+          identity_provider_id: input.idpId,
+          claim_name: "org",
+          claim_value: input.organizationId
+        }
+      }
+    ]
+  };
+  const body = {
+    name: `launch-kit ${input.service.hostname}`,
+    domain: input.service.hostname,
+    type: "self_hosted",
+    // Bot terminal = RCE surface → short session. Read portals = a workday.
+    session_duration: input.service.strict ? "30m" : "24h",
+    allowed_idps: [input.idpId],
+    auto_redirect_to_identity: true,
+    policies: [policy]
+  };
+  const list = await cf2({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/access/apps`
+  });
+  if (!list.success) fail(list, "list access apps");
+  const existing = (list.result ?? []).find((a) => a.domain === input.service.hostname);
+  if (existing) {
+    const upd = await cf2({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, `update access app ${input.service.hostname}`);
+    return upd.result.id;
+  }
+  const created = await cf2({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/apps`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, `create access app ${input.service.hostname}`);
+  return created.result.id;
+}
+async function provisionAccess(input) {
+  const authDomain = await getAccessAuthDomain(input.apiToken, input.accountId);
+  const callbackUrl = `https://${authDomain}/cdn-cgi/access/callback`;
+  const { clientId, clientSecret, organizationId } = await input.registerClient([callbackUrl]);
+  const prior = loadState2(input.stateFile);
+  const idpId = await ensureAccessIdp({
+    apiToken: input.apiToken,
+    accountId: input.accountId,
+    issuer: input.issuer,
+    clientId,
+    clientSecret,
+    knownIdpId: prior?.idpId ?? null
+  });
+  saveState2(input.stateFile, { idpId, accountId: input.accountId });
+  const appIds = {};
+  for (const service of input.services) {
+    appIds[service.hostname] = await ensureAccessApp({
+      apiToken: input.apiToken,
+      accountId: input.accountId,
+      idpId,
+      organizationId,
+      service
+    });
+  }
+  return { idpId, authDomain, appIds };
+}
+
 // src/server/radar-docker-init-entry.ts
 var REQUIRED_ENV = [
   "CLAUDE_CREDENTIALS_B64",
@@ -408,19 +603,77 @@ var REQUIRED_ENV = [
   "LS_ORG_SLUG",
   "LS_PROJECT_SLUG"
 ];
-function fail(message) {
+function fail2(message) {
   console.error(message);
   process.exit(1);
 }
 function requireEnv(name) {
   const v = process.env[name];
-  if (!v) fail(`ERROR: ${name} is required but not set`);
+  if (!v) fail2(`ERROR: ${name} is required but not set`);
   return v;
 }
 function run(cmd, args, stdio = "inherit") {
   const r = (0, import_node_child_process.spawnSync)(cmd, args, { stdio });
   return r.status ?? 1;
 }
+var LAUNCHPOD_DIR = "/workspace/.launchpod";
+var CRASH_STATE_FILE = (0, import_node_path4.join)(LAUNCHPOD_DIR, ".boot-crash.json");
+var MAX_BOOT_CRASHES = 5;
+var STABLE_AFTER_MS = 3e4;
+function readCrashState() {
+  try {
+    const s = JSON.parse((0, import_node_fs4.readFileSync)(CRASH_STATE_FILE, "utf8"));
+    return typeof s?.count === "number" && s.count >= 0 ? s : null;
+  } catch {
+    return null;
+  }
+}
+function bumpCrashCount() {
+  const prev = readCrashState();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const next = {
+    count: (prev?.count ?? 0) + 1,
+    firstAt: prev?.firstAt ?? now,
+    lastAt: now
+  };
+  try {
+    (0, import_node_fs4.mkdirSync)(LAUNCHPOD_DIR, { recursive: true });
+    (0, import_node_fs4.writeFileSync)(CRASH_STATE_FILE, JSON.stringify(next, null, 2));
+  } catch (err) {
+    console.warn(`[entrypoint] could not persist boot-crash counter (continuing unprotected): ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return next.count;
+}
+function clearCrashCount() {
+  try {
+    if ((0, import_node_fs4.existsSync)(CRASH_STATE_FILE)) (0, import_node_fs4.writeFileSync)(CRASH_STATE_FILE, JSON.stringify({ count: 0, firstAt: "", lastAt: "" }));
+  } catch {
+  }
+}
+async function parkAfterCrashLoop(count) {
+  const lines = [
+    "==================================================================",
+    `[entrypoint] CRASH-LOOP HALT \u2014 ${count} consecutive failed boots (cap ${MAX_BOOT_CRASHES}).`,
+    "[entrypoint] Refusing to restart again. Container is now PARKED (idle, not",
+    "[entrypoint] exiting) so it stops thrashing CF APIs and logs. Fix the root",
+    "[entrypoint] cause, clear the counter, then restart the container:",
+    `[entrypoint]   rm ${CRASH_STATE_FILE} && docker restart <container>`,
+    "=================================================================="
+  ];
+  for (const l of lines) console.error(l);
+  for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+    process.on(sig, () => {
+      console.log(`[entrypoint] received ${sig} while parked \u2014 exiting`);
+      process.exit(0);
+    });
+  }
+  setInterval(() => {
+    console.error(`[entrypoint] still parked after crash-loop halt \u2014 clear ${CRASH_STATE_FILE} and restart to retry`);
+  }, 15 * 6e4);
+  await new Promise(() => {
+  });
+  throw new Error("unreachable");
+}
 async function setupFromCloud() {
   const pat = requireEnv("LS_PAT");
   const orgSlug = requireEnv("LS_ORG_SLUG");
@@ -431,13 +684,16 @@ async function setupFromCloud() {
   try {
     bundle = await mcp.call("radar_bootstrap_get", {});
   } catch (err) {
-    fail(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
+    fail2(`[entrypoint] radar_bootstrap_get failed (${err instanceof Error ? err.message : String(err)}) \u2014 check LS_PAT has mcp:radar:bootstrap scope and LS_ORG_SLUG/LS_PROJECT_SLUG point at a project the user has access to.`);
   }
   if (!process.env.GIT_USER_NAME) process.env.GIT_USER_NAME = bundle.gitName;
   if (!process.env.GIT_USER_EMAIL) process.env.GIT_USER_EMAIL = bundle.gitEmail;
   if (!process.env.GH_TOKEN && bundle.githubToken) process.env.GH_TOKEN = bundle.githubToken;
+  if (!process.env.RADAR_RULES && Array.isArray(bundle.radarRules) && bundle.radarRules.length > 0) {
+    process.env.RADAR_RULES = JSON.stringify(bundle.radarRules);
+  }
   if (!process.env.GH_TOKEN) {
-    fail(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
+    fail2(`[entrypoint] no GH_TOKEN available \u2014 user has not connected GitHub (githubTokenStatus=${bundle.githubTokenStatus}). Connect GitHub in LS or pre-set GH_TOKEN in the container env.`);
   }
   const cfNote = bundle.cloudflareToken ? "cloudflare=connected" : "cloudflare=none";
   console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
@@ -445,17 +701,17 @@ async function setupFromCloud() {
 }
 function setupClaudeCredentials() {
   const home = process.env.HOME ?? "/home/launchpod";
-  const claudeDir = (0, import_node_path3.join)(home, ".claude");
-  (0, import_node_fs3.mkdirSync)(claudeDir, { recursive: true });
+  const claudeDir = (0, import_node_path4.join)(home, ".claude");
+  (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
   const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
-  const credsPath = (0, import_node_path3.join)(claudeDir, ".credentials.json");
-  (0, import_node_fs3.writeFileSync)(credsPath, decoded);
-  (0, import_node_fs3.chmodSync)(credsPath, 384);
-  const configPath = (0, import_node_path3.join)(home, ".claude.json");
+  const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
+  (0, import_node_fs4.writeFileSync)(credsPath, decoded);
+  (0, import_node_fs4.chmodSync)(credsPath, 384);
+  const configPath = (0, import_node_path4.join)(home, ".claude.json");
   let cfg = {};
-  if ((0, import_node_fs3.existsSync)(configPath)) {
+  if ((0, import_node_fs4.existsSync)(configPath)) {
     try {
-      cfg = JSON.parse((0, import_node_fs3.readFileSync)(configPath, "utf8"));
+      cfg = JSON.parse((0, import_node_fs4.readFileSync)(configPath, "utf8"));
     } catch {
       cfg = {};
     }
@@ -481,21 +737,21 @@ function setupClaudeCredentials() {
   wsProject.enabledMcpjsonServers = mergedEnabled;
   projects[wsKey] = wsProject;
   cfg.projects = projects;
-  (0, import_node_fs3.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
-  (0, import_node_fs3.chmodSync)(configPath, 384);
+  (0, import_node_fs4.writeFileSync)(configPath, JSON.stringify(cfg, null, 2));
+  (0, import_node_fs4.chmodSync)(configPath, 384);
 }
 function setupGitAndGh() {
   const name = process.env.GIT_USER_NAME ?? "Radar Bot";
   const email = process.env.GIT_USER_EMAIL ?? "radar@launchpod.local";
   const status = run("launch-kit", ["setup-git", `--identity=${name} <${email}>`]);
-  if (status !== 0) fail(`[entrypoint] launch-kit setup-git failed (status ${status})`);
+  if (status !== 0) fail2(`[entrypoint] launch-kit setup-git failed (status ${status})`);
 }
 function detectAndSetPreviewPort() {
   if (process.env.PREVIEW_PORT) return;
   try {
     const pkgPath = "/workspace/package.json";
-    if (!(0, import_node_fs3.existsSync)(pkgPath)) return;
-    const pkg = JSON.parse((0, import_node_fs3.readFileSync)(pkgPath, "utf-8"));
+    if (!(0, import_node_fs4.existsSync)(pkgPath)) return;
+    const pkg = JSON.parse((0, import_node_fs4.readFileSync)(pkgPath, "utf-8"));
     const scripts = pkg.scripts ?? {};
     const portRe = /(?:--port[= ]|-p\s+|\bPORT=)(\d{2,5})\b/;
     for (const name of ["dev", "start", "serve"]) {
@@ -513,7 +769,7 @@ function detectAndSetPreviewPort() {
 }
 function initWorkspaceIfEmpty() {
   process.chdir("/workspace");
-  if ((0, import_node_fs3.existsSync)(".git")) {
+  if ((0, import_node_fs4.existsSync)(".git")) {
     console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
     return;
   }
@@ -526,7 +782,7 @@ function initWorkspaceIfEmpty() {
     `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
     `--dir=/workspace`
   ]);
-  if (status !== 0) fail(`[entrypoint] launch-kit init failed (status ${status})`);
+  if (status !== 0) fail2(`[entrypoint] launch-kit init failed (status ${status})`);
 }
 async function maybeProvisionIngress(bundle, services, projectSlug) {
   const token = bundle.cloudflareToken ?? null;
@@ -534,28 +790,36 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   const zones = bundle.cloudflareZones ?? [];
   if (!token && !accountId && zones.length === 0) return null;
   if (!token || !accountId) {
-    fail(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
+    fail2(`[entrypoint] cloudflare integration is partial \u2014 token=${token ? "set" : "missing"} accountId=${accountId ? "set" : "missing"}. Re-connect the Cloudflare provider in LS.`);
   }
   const baseDomain = process.env.LAUNCHKIT_CF_BASE_DOMAIN?.trim();
   let chosen = null;
   if (baseDomain) {
     chosen = zones.find((z) => z.name === baseDomain) ?? null;
     if (!chosen) {
-      fail(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
+      fail2(`[entrypoint] LAUNCHKIT_CF_BASE_DOMAIN="${baseDomain}" is not among the connected CF token's zones (${zones.map((z) => z.name).join(", ") || "none"}). Either change the env or grant Zone:Read on that zone in the CF token.`);
     }
   } else if (zones.length === 1) {
     chosen = { id: zones[0].id, name: zones[0].name };
   } else {
-    fail(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
+    fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
   const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
-  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => s.name).join(",")}`);
+  const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+  for (const s of services) {
+    const label = `${slugLabel}-${s.name}`;
+    if (!DNS_LABEL_RE.test(label)) {
+      fail2(`[entrypoint] hostname label "${label}" (${label.length} chars) is not a valid DNS label \u2014 must be 1\u201363 chars of [a-z0-9-] with no leading/trailing hyphen. Shorten the project slug ("${projectSlug}") or the service name ("${s.name}").`);
+    }
+  }
+  console.log(`[entrypoint] provisioning CF named tunnel \u2014 name=launch-kit-${projectSlug} zone=${chosen.name} services=${services.map((s) => `${slugLabel}-${s.name}`).join(",")}`);
   const result = await provisionIngress({
     apiToken: token,
     accountId,
     zone: chosen,
     tunnelName: `launch-kit-${projectSlug}`,
-    services: services.map((s) => ({ name: s.name, port: s.port })),
+    services: services.map((s) => ({ name: s.name, label: `${slugLabel}-${s.name}`, port: s.port })),
     stateFile
   });
   for (const [name, fqdn] of Object.entries(result.hostnames)) {
@@ -563,6 +827,61 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   }
   return result;
 }
+var GATED_SERVICES = {
+  // Claude web terminal — live drivable shell ⇒ RCE surface ⇒ short session.
+  bot: { strict: true },
+  // The user's own dev/preview server — a workday-length session is fine.
+  preview: { strict: false }
+};
+async function registerOidcClient(serverUrl, pat, redirectUris) {
+  const res = await fetch(new URL("/api/rover/oidc-client", serverUrl), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${pat}`,
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    },
+    body: JSON.stringify({ redirectUris }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.success || !body.data) {
+    fail2(`[entrypoint] OIDC client provisioning failed (HTTP ${res.status}): ${body?.error ?? "unexpected response"}`);
+  }
+  return body.data;
+}
+async function maybeProvisionAccess(bundle, ingress) {
+  const token = bundle.cloudflareToken ?? null;
+  const accountId = bundle.cloudflareAccountId ?? null;
+  if (!token || !accountId) return;
+  const services = [];
+  const skipped = [];
+  for (const [name, hostname] of Object.entries(ingress.hostnames)) {
+    const cfg = GATED_SERVICES[name];
+    if (cfg) services.push({ hostname, strict: cfg.strict });
+    else skipped.push(name);
+  }
+  if (skipped.length > 0) {
+    console.log(`[entrypoint] CF Access: leaving machine surface(s) ungated: ${skipped.join(", ")}`);
+  }
+  if (services.length === 0) {
+    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview not provisioned)");
+    return;
+  }
+  const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
+  const pat = requireEnv("LS_PAT");
+  const stateFile = "/workspace/.launchpod/launch-kit-access.json";
+  console.log(`[entrypoint] gating ${services.map((s) => s.hostname).join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  const result = await provisionAccess({
+    apiToken: token,
+    accountId,
+    issuer: serverUrl,
+    services,
+    stateFile,
+    registerClient: (redirectUris) => registerOidcClient(serverUrl, pat, redirectUris)
+  });
+  console.log(`[entrypoint] CF Access gate live \u2014 IdP ${result.idpId}, auth domain ${result.authDomain}`);
+}
 function spawnServiceGroup(services) {
   const children = [];
   let shuttingDown = false;
@@ -645,6 +964,12 @@ function spawnServiceGroup(services) {
   }).finally(removeSignals);
 }
 async function main() {
+  const priorCrashes = readCrashState()?.count ?? 0;
+  if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
+  const bootAttempt = bumpCrashCount();
+  if (bootAttempt > 1) {
+    console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+  }
   for (const k of REQUIRED_ENV) requireEnv(k);
   const bundle = await setupFromCloud();
   setupClaudeCredentials();
@@ -655,7 +980,7 @@ async function main() {
   try {
     services = resolveServices();
   } catch (err) {
-    fail(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
+    fail2(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
   }
   console.log(`[entrypoint] services: ${services.map((s) => `${s.name}@${s.port}`).join(", ")}`);
   const ingress = await maybeProvisionIngress(bundle, services, requireEnv("LS_PROJECT_SLUG"));
@@ -664,8 +989,9 @@ async function main() {
     const radarFqdn = ingress.hostnames.radar;
     if (radarFqdn) process.env.RADAR_CF_TUNNEL_HOSTNAME = radarFqdn;
     else if (services.some((s) => s.name === "radar")) {
-      fail(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
+      fail2(`[entrypoint] internal: ingress provisioned but no hostname for radar`);
     }
+    await maybeProvisionAccess(bundle, ingress);
   } else if (services.length > 1) {
     const first = services[0];
     console.warn(
@@ -675,10 +1001,17 @@ async function main() {
       console.warn(`[entrypoint] \u26A0 first service is "${first.name}", not "radar" \u2014 quick tunneling is owned by the radar agent today, so NO external URL will be available.`);
     }
   }
+  const stableTimer = setTimeout(() => {
+    clearCrashCount();
+    console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+  }, STABLE_AFTER_MS);
+  stableTimer.unref?.();
   try {
     await spawnServiceGroup(services);
+    clearTimeout(stableTimer);
     process.exit(0);
   } catch (err) {
+    clearTimeout(stableTimer);
     console.error(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
@@ -691,6 +1024,7 @@ if (!process.env.VITEST) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  maybeProvisionAccess,
   maybeProvisionIngress,
   spawnServiceGroup
 });