@launchsecure/launch-kit 0.0.35 → 0.0.37

package/dist/server/rover-entry.js

@@ -34,6 +34,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/server/cf-ingress.ts
+function serviceLabel(s) {
+  return s.label ?? s.name;
+}
 async function cf(opts) {
   const res = await fetch(`${CF_API_BASE}${opts.path}`, {
     method: opts.method,
@@ -58,6 +61,17 @@ async function cf(opts) {
 function isNotFound(env) {
   return !env.success && (env.errors ?? []).some((e) => e.code === 7003 || e.code === 1001 || e.code === 81044);
 }
+async function findTunnelByName(input) {
+  const q = new URLSearchParams({ name: input.tunnelName, is_deleted: "false" }).toString();
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/cfd_tunnel?${q}`
+  });
+  if (!res.success || !Array.isArray(res.result)) return null;
+  const live = res.result.find((t) => t.name === input.tunnelName && !t.deleted_at);
+  return live?.id ?? null;
+}
 function loadState(path) {
   if (!(0, import_node_fs.existsSync)(path)) return null;
   try {
@@ -89,16 +103,26 @@ async function ensureTunnel(input, knownTunnelId) {
       throw new Error(`[cf] tunnel GET failed: ${JSON.stringify(got.errors)}`);
     }
   }
+  const existing = await findTunnelByName(input);
+  if (existing) {
+    console.log(`[cf] adopted existing tunnel "${input.tunnelName}" (${existing}) \u2014 local state was missing`);
+    return existing;
+  }
   const created = await cf({
     apiToken: input.apiToken,
     method: "POST",
     path: `/accounts/${input.accountId}/cfd_tunnel`,
     body: { name: input.tunnelName, config_src: "cloudflare" }
   });
-  if (!created.success || !created.result) {
-    throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
+  if (created.success && created.result) return created.result.id;
+  if ((created.errors ?? []).some((e) => e.code === 1013)) {
+    const adopted = await findTunnelByName(input);
+    if (adopted) {
+      console.log(`[cf] tunnel "${input.tunnelName}" already existed (1013) \u2014 adopted ${adopted}`);
+      return adopted;
+    }
   }
-  return created.result.id;
+  throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
 }
 async function fetchConnectorToken(input, tunnelId) {
   const res = await cf({
@@ -113,7 +137,7 @@ async function fetchConnectorToken(input, tunnelId) {
 }
 async function setIngressConfig(input, tunnelId) {
   const ingress = input.services.map((s) => ({
-    hostname: `${s.name}.${input.zone.name}`,
+    hostname: `${serviceLabel(s)}.${input.zone.name}`,
     service: `http://localhost:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
@@ -128,7 +152,7 @@ async function setIngressConfig(input, tunnelId) {
   }
 }
 async function ensureDnsRecord(input, tunnelId, service) {
-  const fqdn = `${service.name}.${input.zone.name}`;
+  const fqdn = `${serviceLabel(service)}.${input.zone.name}`;
   const target = `${tunnelId}.cfargotunnel.com`;
   const existing = await cf({
     apiToken: input.apiToken,
@@ -172,7 +196,7 @@ async function provisionIngress(input) {
   await setIngressConfig(input, tunnelId);
   await Promise.all(input.services.map((s) => ensureDnsRecord(input, tunnelId, s)));
   const hostnames = {};
-  for (const s of input.services) hostnames[s.name] = `${s.name}.${input.zone.name}`;
+  for (const s of input.services) hostnames[s.name] = `${serviceLabel(s)}.${input.zone.name}`;
   return { tunnelId, connectorToken, hostnames };
 }
 var import_node_fs, import_node_path, CF_API_BASE, CF_ERR_DNS_RECORD_EXISTS;
@@ -222,6 +246,17 @@ async function ensureDocker(opts = {}) {
   const initial = detectDocker();
   if (initial.daemonAlive) return initial;
   const platform = process.platform;
+  if (initial.cliPresent && canStartDaemon(platform)) {
+    if (await confirm(opts, "Docker is installed but its daemon isn't running. Start it now?")) {
+      const started = await startDockerDaemon(platform);
+      if (started.daemonAlive) return started;
+      console.log(
+        `
+Docker did not become ready within ${Math.round(DAEMON_START_TIMEOUT_MS / 1e3)}s. Open Docker manually and re-run setup.`
+      );
+      throw new Error("Docker daemon did not start in time.");
+    }
+  }
   if (!opts.autoInstall) {
     printManualInstructions(initial, platform);
     throw new Error("Docker is not ready. Install + start it, then re-run `launch-rover setup`.");
@@ -250,6 +285,40 @@ async function ensureDocker(opts = {}) {
     `Auto-install is not supported on ${platform}. Install Docker Desktop manually, then re-run setup.`
   );
 }
+function canStartDaemon(platform) {
+  if (platform === "darwin") return true;
+  if (platform === "linux") return commandExists("systemctl");
+  return false;
+}
+async function startDockerDaemon(platform) {
+  if (platform === "darwin") {
+    runAndPrint("open", ["-a", "Docker"]);
+  } else if (platform === "linux") {
+    runAndPrint("sudo", ["systemctl", "start", "docker"]);
+  } else {
+    throw new Error(`Cannot start the Docker daemon on ${platform}.`);
+  }
+  console.log("Waiting for the Docker daemon to come up\u2026");
+  const deadline = DAEMON_START_TIMEOUT_MS;
+  let waited = 0;
+  while (waited < deadline) {
+    await (0, import_promises2.setTimeout)(DAEMON_POLL_INTERVAL_MS);
+    waited += DAEMON_POLL_INTERVAL_MS;
+    const probe = detectDocker();
+    if (probe.daemonAlive) {
+      console.log(`Docker daemon is up (after ~${Math.round(waited / 1e3)}s).`);
+      return probe;
+    }
+  }
+  return detectDocker();
+}
+function commandExists(cmd) {
+  const probe = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [cmd], {
+    stdio: "ignore",
+    timeout: 1500
+  });
+  return probe.status === 0;
+}
 function printManualInstructions(detection, platform) {
   console.log("\n\u2500\u2500 Docker is required to run launch-rover \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   if (!detection.cliPresent) {
@@ -305,13 +374,16 @@ function runAndPrint(cmd, args) {
     throw new Error(`${cmd} exited with code ${result.status ?? "signal"}`);
   }
 }
-var import_node_child_process, import_promises, import_node_process;
+var import_node_child_process, import_promises, import_node_process, import_promises2, DAEMON_START_TIMEOUT_MS, DAEMON_POLL_INTERVAL_MS;
 var init_docker_install = __esm({
   "src/server/rover/docker-install.ts"() {
     "use strict";
     import_node_child_process = require("node:child_process");
     import_promises = require("node:readline/promises");
     import_node_process = require("node:process");
+    import_promises2 = require("node:timers/promises");
+    DAEMON_START_TIMEOUT_MS = 6e4;
+    DAEMON_POLL_INTERVAL_MS = 2e3;
   }
 });
 
@@ -536,7 +608,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@launchsecure/launch-kit",
-      version: "0.0.35",
+      version: "0.0.37",
       description: "LaunchSecure toolkit \u2014 launch-sequencer (pipeline runner + terminal bridge), launch-radar (feedback webhook receiver), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup). launch-pod is the container image these run inside.",
       license: "MIT",
       author: "LaunchSecure - AutomateWithUs",
@@ -19422,17 +19494,17 @@ function createTunnel(opts) {
   const exhaustive = opts.provider;
   throw new Error(`[tunnel] unknown provider: ${String(exhaustive)}`);
 }
-var import_node_fs3, import_node_events, import_promises2, import_undici, import_cloudflared, dnsResolver, dnsCache, dnsResilientDispatcher, BACKOFF_MIN_MS, BACKOFF_MAX_MS, SELFTEST_INTERVAL_MS, SELFTEST_TIMEOUT_MS, NAMED_FATAL_PATTERNS, CloudflaredTunnel;
+var import_node_fs3, import_node_events, import_promises3, import_undici, import_cloudflared, dnsResolver, dnsCache, dnsResilientDispatcher, BACKOFF_MIN_MS, BACKOFF_MAX_MS, SELFTEST_INTERVAL_MS, SELFTEST_TIMEOUT_MS, NAMED_FATAL_PATTERNS, CloudflaredTunnel;
 var init_tunnel = __esm({
   "src/server/tunnel/index.ts"() {
     "use strict";
     import_node_fs3 = require("node:fs");
     import_node_events = require("node:events");
-    import_promises2 = require("node:dns/promises");
+    import_promises3 = require("node:dns/promises");
     init_source();
     import_undici = __toESM(require_undici());
     import_cloudflared = require("cloudflared");
-    dnsResolver = new import_promises2.Resolver();
+    dnsResolver = new import_promises3.Resolver();
     dnsResolver.setServers(["1.1.1.1", "8.8.8.8"]);
     dnsCache = new CacheableLookup({ resolver: dnsResolver });
     dnsResilientDispatcher = new import_undici.Agent({
@@ -19689,8 +19761,11 @@ async function podsUp(state, body) {
   await stopAndRemove(containerName);
   const dockerConfigDir = body.skipPull ? null : setupDockerConfig();
   try {
-    if (dockerConfigDir) {
-      await dockerRun(["pull", image], { DOCKER_CONFIG: dockerConfigDir });
+    if (!body.skipPull) {
+      await dockerRun(
+        ["pull", image],
+        dockerConfigDir ? { DOCKER_CONFIG: dockerConfigDir } : {}
+      );
     }
     const runArgs = [
       "run",
@@ -19852,10 +19927,10 @@ async function dockerRun(args, envOverlay = {}) {
 function setupDockerConfig() {
   const token = process.env.GHCR_PULL_TOKEN;
   if (!token) {
-    throw new PodError(
-      "GHCR_PULL_TOKEN is not set in the rover's environment. Add it to .env.local and restart the rover daemon. (Will be replaced by per-call token from LS later.)",
-      500
+    console.log(
+      "[rover] no GHCR_PULL_TOKEN set \u2014 pulling image anonymously (succeeds only if the image is public)"
     );
+    return null;
   }
   const dir = (0, import_node_fs4.mkdtempSync)((0, import_node_path3.join)((0, import_node_os3.tmpdir)(), "launch-rover-docker-"));
   const auth = Buffer.from(`${GHCR_USERNAME}:${token}`, "utf-8").toString("base64");
@@ -20171,15 +20246,27 @@ function printUsage() {
       "  --name=<host-name>     Human-readable rover name (default: hostname)",
       "  --port=<n>             Local daemon port (default: 52749)",
       "  --auto-install         Allow setup to install Docker via brew / get-docker.sh",
-      "  --yes / -y             Skip confirmation prompts (assume yes)",
+      "  --yes / -y             Skip confirmation prompts (assume yes). Also auto-starts",
+      "                         an installed-but-stopped Docker daemon without prompting.",
       "  --detach               Spawn the daemon as a detached process and exit",
       ""
     ].join("\n")
   );
 }
+function ensureNodeVersion() {
+  const raw = process.versions.node;
+  const major = Number.parseInt(raw.split(".")[0] ?? "", 10);
+  if (!Number.isFinite(major) || major < MIN_NODE_MAJOR) {
+    throw new Error(
+      `launch-rover requires Node >= ${MIN_NODE_MAJOR} (running ${raw}). Upgrade Node, then re-run \`launch-rover setup\`.`
+    );
+  }
+  console.log(`[rover] node ok: v${raw}`);
+}
 async function runSetup(argv) {
   const args = parseArgs(argv);
   console.log(`[rover] setup org=${args.orgSlug} server=${args.serverUrl}`);
+  ensureNodeVersion();
   await ensureDocker({ autoInstall: args.autoInstall, yes: args.yes });
   const dockerInfo = detectDocker();
   console.log(`[rover] docker ready: ${dockerInfo.version ?? "unknown"}`);
@@ -20314,7 +20401,7 @@ async function launchDaemon(args, ingress, state) {
 function runSetupReset(roverId) {
   clearRoverState(roverId);
 }
-var import_node_os5, import_node_child_process3, import_node_path5, import_node_fs6, KIT_VERSION, DEFAULT_SERVER, DEFAULT_DAEMON_PORT;
+var import_node_os5, import_node_child_process3, import_node_path5, import_node_fs6, KIT_VERSION, DEFAULT_SERVER, DEFAULT_DAEMON_PORT, MIN_NODE_MAJOR;
 var init_setup = __esm({
   "src/server/rover/setup.ts"() {
     "use strict";
@@ -20331,6 +20418,7 @@ var init_setup = __esm({
     KIT_VERSION = require_package().version;
     DEFAULT_SERVER = "https://launchsecure-v2.vercel.app";
     DEFAULT_DAEMON_PORT = 52749;
+    MIN_NODE_MAJOR = 18;
   }
 });
 
@@ -20383,7 +20471,7 @@ async function runTeardown(argv) {
       }
       const deadline = Date.now() + 3e3;
       while (Date.now() < deadline && isPidAlive(lock.pid)) {
-        await sleep(100);
+        await sleep2(100);
       }
       if (isPidAlive(lock.pid) && parsed.force) {
         console.log("[rover] daemon did not exit, sending SIGKILL");
@@ -20451,7 +20539,7 @@ function isPidAlive(pid) {
     return false;
   }
 }
-function sleep(ms) {
+function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 var import_node_fs7, import_node_os6, import_node_path6;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchsecure/launch-kit",
-  "version": "0.0.35",
+  "version": "0.0.37",
   "description": "LaunchSecure toolkit — launch-sequencer (pipeline runner + terminal bridge), launch-radar (feedback webhook receiver), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup). launch-pod is the container image these run inside.",
   "license": "MIT",
   "author": "LaunchSecure - AutomateWithUs",

package/scaffolds/ls-marketplace/plugins/kit/skills/deploy-check/SKILL.md

@@ -80,6 +80,11 @@ Run `BUILD_CMD` (the project's real build, so the check matches CI). Skip if `--
 
 **DB-safety guard (only when the build touches a DB).** If the detected `BUILD_CMD` runs migrations as part of the build (e.g. a Node build script that chains `prisma migrate deploy`, or any build that applies `MIGRATION_TOOL` migrations — detect by scanning the build script / target), then a prod DB connection string must NOT be used. If the relevant connection env (`DATABASE_URL`, `DB_URL`, etc.) looks production-y (matches `neon.tech`, `rds.amazonaws.com`, `supabase.co`, a `vercel.app` proxy host, etc.), refuse the build step: `⚠ build skipped — build applies migrations and DATABASE_URL looks production-y (<host>); re-run with a dev DB or pass --skip=build`. If the build does NOT touch a DB (most stacks), skip this guard.
 
+**Build-cache hygiene (avoid stale-cache false positives).** Incremental-cache frameworks reuse a build cache across runs, and a cache left over from a prior build/dev run on a different commit can make a *clean-tree* build fail with a stale-manifest error even though CI (which always builds clean) succeeds. The classic signature is Next.js's `PageNotFoundError: Cannot find module for page: <route>` / `Failed to collect page data for <route>` (often `ENOENT` pointing into `.next/`) — observed on `.well-known/*` and other dynamic routes that build fine in CI. To keep the build check faithful to CI:
+
+1. **Clear the framework cache before building** when the project uses a cache-based framework. Remove only the framework's own *regenerable, gitignored* cache dir if it exists — `.next/` (Next.js) · `.nuxt/` + `.output/` (Nuxt) · `.svelte-kit/` (SvelteKit) · `.astro/` (Astro) · `.turbo/` (Turborepo/Turbopack). **Never** remove `dist/`, `build/`, `out/`, `node_modules/`, or anything git-tracked — confirm the dir is gitignored before deleting. Non-cache stacks: skip this, there is nothing to clear.
+2. **Retry-once backstop.** If a build still fails AND the stderr matches a stale-cache signature (`Cannot find module for page`, `Failed to collect page data`, or an `ENOENT` referencing the cache dir), clear the cache (step 1) and re-run `BUILD_CMD` exactly once. Report ✗ only if the clean rebuild also fails; if the rebuild passes, report ✓ and note `(first attempt failed on a stale-cache artifact — passed clean)`. This prevents a regenerable-cache quirk from producing a NO-GO.
+
 ### 5. schema_drift (only when MIGRATION_TOOL supports it)
 
 Schema-vs-migrations consistency, using the tool's own drift command:

package/scaffolds/ls-marketplace/plugins/kit/skills/kickoff/SKILL.md

@@ -1,5 +1,5 @@
 ---
-description: Cold-start a session — read the last HANDOFF snapshot, the newest shipping log, the git summary, and (if LS is connected) your open work items, reconcile them, then categorize all pending work (resume in-flight · review/PR feedback · bugs · high-priority · low-hanging fruit · stale/dead · tech-debt/deferred, plus a non-pickable blocked list) and let you choose a list to work from before drilling into a specific item. Read-only; the complement to /kit:handoff. Does NOT branch, commit, or write files unless you confirm a next step.
+description: Cold-start a session — read the last HANDOFF snapshot, the newest shipping log, the git summary, any in-flight orbits/worktrees, and (if LS is connected) your open work items, reconcile them, then categorize all pending work (resume in-flight · review/PR feedback · bugs · high-priority · low-hanging fruit · stale/dead · tech-debt/deferred, plus a non-pickable blocked list) and let you choose a list to work from before drilling into a specific item. Read-only; the complement to /kit:handoff. Does NOT branch, commit, or write files unless you confirm a next step.
 ---
 
 # /kit:kickoff
@@ -28,7 +28,7 @@ Parse `$ARGUMENTS`:
 
 ## Step 1 — Gather the sources (don't show yet)
 
-Pull from four layers in parallel. Each is independently optional; a missing one is noted, not fatal.
+Pull from five layers in parallel. Each is independently optional; a missing one is noted, not fatal.
 
 **1a. The HANDOFF snapshot** — read `doc/handoff/HANDOFF.md` if it exists. Extract its four live sections: **Where we are**, **What's next** (the priority-ordered 1–3), **Open threads**, and the embedded **Kickoff prompt**. This is the human-curated "what's next," highest signal. If the file doesn't exist, note "no HANDOFF yet — first kickoff" and lean on git + work items.
 
@@ -40,6 +40,8 @@ Pull from four layers in parallel. Each is independently optional; a missing one
 - `git status --porcelain` — uncommitted work. Filter out generated noise (`.launchsecure/graphs/*.json`, `node_modules`, `dist`, `.next`). What remains is genuine in-flight work — a **"resume this"** candidate.
 - Current branch + whether it's ahead/behind base.
 
+> ⚠️ Everything in 1c is scoped to the **current** worktree only. In-flight work in other worktrees/orbits is invisible here — 1e covers it. Do not present a "resume in-flight" list without running 1e first.
+
 **1d. Work items (only if LS connected)** — build the backlog candidates:
 - `mcp__launch-secure__work_items_list({ assignee_email: "<git email>", status: "IN_PROGRESS" })` — things you already started; strongest "resume" candidates.
 - `mcp__launch-secure__work_items_list({ assignee_email: "<git email>", status: "TODO" })` — your queued backlog.
@@ -48,6 +50,15 @@ Pull from four layers in parallel. Each is independently optional; a missing one
 
 > Use the hosted `launch-secure` MCP by default. Only use `local-launch-secure` if the active course points there (see `/kit:course`). Don't ask for org/project slugs — the `.mcp.json` headers default to the current project.
 
+**1e. Orbits / other worktrees** — the in-flight work that 1c structurally can't see. A feature usually lives in its own orbit (isolated worktree + forked DB), so the current tree being clean does NOT mean nothing is in flight. Enumerate + classify them:
+- **Primary: `mcp__launch-orbit__orbit_check({ all: true })`** (if launch-orbit is wired) — sweeps every orbit registered for THIS repo and returns, per orbit, a `recommendation` + two verdicts. This replaces the hand-rolled dirty/ahead/merged math — orbit_check already runs `git status`, the merged-vs-base check, AND the DB/data drop-safety checks, then tells you which orbits still hold work vs. are safe to drop:
+  - **not `dropSafe`** (uncommitted changes or commits ahead of base) → a **🔧 Resume in-flight** candidate. Pull the "N dirty, M ahead" label from its `git.clean` / `git.merged` check summaries, and use the report's `actions[]` for what's needed to land it.
+  - **`dropSafe`** (merged + clean, nothing to lose) → a **🪦 Stale / dead** candidate ("orbit ‹slug› merged + clean — safe to drop"). Note: `healthy:false` here is usually just the DB being down, not real work — don't promote it to resume on that alone.
+- `mcp__launch-orbit__orbit_list` — use for the stable slug + `age` metadata to label candidates and sort 🔧 Resume in-flight (freshest first).
+- `git worktree list` — also surfaces **bare** worktrees created outside launch-orbit (these won't appear in orbit_check/orbit_list). For each such non-orbit worktree other than the current one, fall back to raw git: `git -C <path> status --porcelain` (uncommitted, filter the generated noise from 1c) + `git -C <path> rev-list --count <base>..HEAD` (commits ahead). Same rule: dirty/ahead → resume; clean + 0-ahead → stale/dead.
+- `orbit_check` / `orbit_list` span **all** projects on the machine — keep only orbits whose `path` is under this repo's root.
+- **Fallback (launch-orbit not wired):** classify every worktree from `git worktree list` with the raw-git pair above — still works, just without the DB/data drop-safety signal.
+
 ## Step 2 — Reconcile + flag drift
 
 Before showing anything, cross-check the sources against each other. This is the honesty pass — the inverse of what `/kit:standup` does for shipped work.
@@ -65,7 +76,7 @@ Pool every candidate from the reconciled sources (HANDOFF "What's next" + "Open
 
 Then sort each remaining item into **one** bucket — most-specific bucket wins, in this precedence:
 
-1. **🔧 Resume in-flight** — uncommitted local work + `IN_PROGRESS` work items. The strongest "continue what you started" signal; always wins if present.
+1. **🔧 Resume in-flight** — uncommitted local work in the current tree (1c) + **dirty/ahead orbits & other worktrees (1e)** + `IN_PROGRESS` work items. The strongest "continue what you started" signal; always wins if present. Sort orbit/worktree candidates by recency (`age` / most-recently-touched first) — the freshest dirty orbit is usually what you were last on, even if it isn't the current tree.
 2. **👀 Review / PR feedback** — work waiting on *your* action on something already in motion: open PRs you authored or are assigned to review, unresolved review comments, `needs-review`/`changes-requested` tags. Time-sensitive (someone's blocked on you), so it outranks fresh work.
 3. **🐛 Bugs / broken** — defects: work items of type `bug` or tagged `bug`/`defect`/`regression`, and `broken`/`failing`/`revert`/`not patched` follow-up flags from commit bodies. Distinct from feature backlog regardless of priority.
 4. **🔥 High-priority** — items the project marks urgent: a work-item priority/severity field at its top value, tags like `p0`/`p1`/`urgent`, **and** everything in HANDOFF "What's next" (human-curated = high priority by definition), minus anything Step 2 flagged stale.
@@ -87,6 +98,7 @@ One compact block: orientation header, then each **non-empty** bucket with up to
 
 🔧 Resume in-flight (N)
 - <item — handle/branch/file · short why>
+- <orbit ‹slug› [branch] · N dirty, M ahead · touched <age>>
   …up to 5… (+N more)
 
 👀 Review / PR feedback (N)
@@ -131,7 +143,10 @@ Readable in under a minute. The 🚧 Blocked list is informational only — neve
 Once a specific item is chosen:
 
 1. **Produce its kickoff prompt.** If the chosen slice matches the one HANDOFF already wrote a "Kickoff prompt for the next session" for, **reuse that verbatim** in a fenced block. Otherwise synthesize one in the **same shape** handoff uses (Starting **‹item — Title›** · read CLAUDE.md + HANDOFF + relevant Briefs · then the 1–6 design-shape questions: Surface, Fields/inputs, Eligibility, Data path, feature-specific, Out-of-scope). Make it specific to the chosen slice, not generic.
-2. **Offer the setup as a confirmed next step — do not do it unprompted.** In one line, offer to: branch off the base (`git checkout <base> && git pull && git checkout -b <slice-branch>`) **or** create an isolated orbit (`/kit:orbit`) if the slice wants a forked DB. Wait for an explicit "yes" / branch name before running any git or orbit command — this is a state mutation and falls under the per-action confirmation rule.
+2. **Offer the setup as a confirmed next step — do not do it unprompted.** Tailor the offer to what was picked:
+   - **Picked an existing orbit/worktree (1e candidate):** it already exists — offer to switch into it (`mcp__launch-orbit__orbit_switch` to activate, then work in its `path`), NOT to create a branch. Never re-create an orbit that's already live.
+   - **Picked a fresh slice:** offer to branch off the base (`git checkout <base> && git pull && git checkout -b <slice-branch>`) **or** create an isolated orbit (`/kit:orbit`) if the slice wants a forked DB.
+   Wait for an explicit "yes" / branch name before running any git or orbit command — this is a state mutation and falls under the per-action confirmation rule.
 3. If the chosen slice is a `TODO` work item and the user confirms starting it, offer (don't auto-run) to move it to `IN_PROGRESS` via `mcp__launch-secure__work_item_move` / `work_item_update`.
 
 ## Edge cases
@@ -141,6 +156,7 @@ Once a specific item is chosen:
 - **Clean tree, nothing in flight, empty backlog** — say so plainly ("nothing in flight; HANDOFF's next is ‹X›") and just present HANDOFF's "What's next" as the candidates. Don't invent work.
 - **HANDOFF wildly out of sync with git** (many stale "next" items already shipped) — lead with the drift block and suggest the previous session likely forgot `/kit:handoff`; offer to reconstruct current-state from git, but don't write HANDOFF here (that's `/kit:handoff`'s job).
 - **Mid-branch resume** (current branch already ahead of base) — surface "continue this branch" at the top of the 🔧 Resume in-flight list, and skip the branch-creation offer in Step 6 unless the user picks a different item.
+- **In-flight work lives in an orbit, not the current tree** (the common case — current tree clean but a dirty/ahead orbit exists per 1e) — do NOT report "nothing in flight." Lead 🔧 Resume in-flight with the freshest dirty/ahead orbit, and in Step 6 offer `orbit_switch` into it rather than a new branch.
 - **Everything lands in one bucket** (e.g. all candidates are stale) — that's fine; show the single list and skip Stage A (no choice to make), going straight to picking an item.
 
 ## Notes for the assistant

package/scaffolds/ls-marketplace/plugins/kit/skills/orbit/SKILL.md

@@ -13,17 +13,19 @@ Parse `$ARGUMENTS` — first token is the subcommand:
 - **switch <branch>** — activate an orbit: atomically repoint the `current` anchor at its worktree, then operate under that anchor.
 - **deactivate** — clear the `current` anchor so work targets the main checkout again.
 - **doctor** — surface registry inconsistencies.
-- **check <branch> --target=<target-branch>** — run pre-merge gates WITHOUT merging.
+- **check &lt;branch&gt;** — `[--all] [--deep] [--base=<ref>] [--json]` — orbit **cleanliness** report: DROP-SAFE + HEALTHY verdicts, recommendation + concrete actions. (Different from `check-merge` — this is "is it safe to delete / sane to keep working in", not "will it merge".)
+- **check-merge &lt;branch&gt; --target=&lt;target-branch&gt;** — run pre-merge gates WITHOUT merging.
 - **merge &lt;branch&gt; --target=&lt;target-branch&gt;** — `[--cleanup=full|none] [--skip-gate=<id>,…]` — run gates + merge.
-- **drop &lt;branch&gt;** — `[--no-backup]` — tear down (backup, drop DB, remove worktree, deregister).
+- **drop &lt;branch&gt;** — `[--no-backup] [--force]` — tear down (drop-safety guard, then backup, drop DB, remove worktree, deregister).
 
 Examples:
 - `/kit:orbit create feat-channel-rename --profile=fe`
-- `/kit:orbit check feat-channel-rename --target=implementation`
+- `/kit:orbit check feat-channel-rename` · `/kit:orbit check --all`
+- `/kit:orbit check-merge feat-channel-rename --target=implementation`
 - `/kit:orbit merge feat-channel-rename --target=implementation`
 - `/kit:orbit doctor`
 
-## Preflight (runs on create / check / merge)
+## Preflight (runs on create / check-merge / merge)
 
 1. Confirm `mcp__launch-orbit__orbit_doctor` returns no critical inconsistencies for THIS project. If it does, surface them and stop — the operator probably wants `/kit:orbit drop <stale-branch>` first.
 2. Confirm `orbit.json` exists at the repo root. If missing, tell the user to add one (point at the orbit docs) and stop.
@@ -61,7 +63,23 @@ Switching to a *different* orbit just repoints the anchor — re-run `nextAction
 
 `mcp__launch-orbit__orbit_doctor` → list every issue with a one-line fix (e.g. `orphan-registration` → `/kit:orbit drop <branch>`).
 
-### check
+### check (cleanliness)
+
+`mcp__launch-orbit__orbit_check(branch)` (or `all: true` to sweep this repo's orbits; `deep: true` adds the prisma schema-drift check) → render the two-verdict report:
+
+```
+orbit feat-channel-rename [feat-channel-rename]   DROP-SAFE: NO   HEALTHY: YES
+  recommendation: KEEP — unmerged or uncommitted work would be lost on drop.
+  Drop-safety:  ✗ uncommitted changes · ✗ 3 commits ahead · ✓ no orbit-only rows
+  Working-health: ✓ registry · ⚠ env drift · ✓ DB reachable · ✓ ports free
+  Actions:
+    → Commit or stash the uncommitted changes …
+    → Merge feat-channel-rename into implementation …
+```
+
+Use it to answer "can I drop this / is it sane to keep working in" — e.g. before cleaning up stale orbits, or at session start. The report carries a `recommendation` + `actions[]`; surface those verbatim. DB checks skip gracefully if the cluster is down.
+
+### check-merge (pre-merge gates)
 
 `mcp__launch-orbit__orbit_check_mergeable(branch, target)` → render the gate report:
 
@@ -76,7 +94,7 @@ result: BLOCKED — fix build-lint then retry.
 
 ### merge
 
-1. Run `check` first (same report). If `passed: false`, stop with the report — don't attempt the merge.
+1. Run `check-merge` first (same report). If `passed: false`, stop with the report — don't attempt the merge.
 2. If `passed: true`, call `mcp__launch-orbit__orbit_merge(branch, target, cleanup, skipGates)` and surface the result.
 3. Default `cleanup: "full"` (orbit is dropped post-merge after pg_dump). The operator must pass `--cleanup=none` to keep the orbit around.
 4. After a successful merge, recommend `/kit:standup` to surface the change in the next standup, and `/kit:diagram` if it touched the schema.
@@ -85,11 +103,13 @@ result: BLOCKED — fix build-lint then retry.
 
 `mcp__launch-orbit__orbit_drop(branch, backup: !args.noBackup)` → idempotent. Surface `backups[]` paths.
 
+**Drop-safety guard (default on).** `orbit_drop` runs the drop-safety checks first and THROWS if the orbit still has uncommitted/unmerged work or orbit-only DB data. When that happens, surface the blockers and DON'T pass `force: true` reflexively — relay the verdict, let the operator decide. Only pass `force: true` after they explicitly confirm "drop anyway, I'll lose that work". (Tip: run `/kit:orbit check <branch>` first to see the full report and the recommended actions.)
+
 ## Conventions encoded here
 
 - **No bare `--target=master`.** Default merge target is `implementation` per project CLAUDE.md ("implementation branch is parent for all impl branches"). If the operator types `--target=master`, double-check by asking once.
 - **No `--skip-gate` without a reason in the next message.** Surface a banner: `"Skipping gates: <ids>. Reason?"` — let the operator answer in chat; do NOT proceed silently.
-- **Always run `check` before `merge`.** The skill enforces this — even if the operator runs `merge` directly, the skill runs `check` first.
+- **Always run `check-merge` before `merge`.** The skill enforces this — even if the operator runs `merge` directly, the skill runs `check-merge` first.
 - **Layer awareness.** Pre-flight always prints `detect_project_stack` layers so the operator sees parity (or absence) between chart layers and orbit gate scope.
 
 ## Constraints