@launchsecure/launch-kit 0.0.36 → 0.0.38

package/dist/server/init-entry.js

@@ -617,6 +617,17 @@ async function cf(opts) {
 function isNotFound(env) {
   return !env.success && (env.errors ?? []).some((e) => e.code === 7003 || e.code === 1001 || e.code === 81044);
 }
+async function findTunnelByName(input) {
+  const q = new URLSearchParams({ name: input.tunnelName, is_deleted: "false" }).toString();
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/cfd_tunnel?${q}`
+  });
+  if (!res.success || !Array.isArray(res.result)) return null;
+  const live = res.result.find((t) => t.name === input.tunnelName && !t.deleted_at);
+  return live?.id ?? null;
+}
 function loadState(path6) {
   if (!(0, import_node_fs2.existsSync)(path6)) return null;
   try {
@@ -648,16 +659,26 @@ async function ensureTunnel(input, knownTunnelId) {
       throw new Error(`[cf] tunnel GET failed: ${JSON.stringify(got.errors)}`);
     }
   }
+  const existing = await findTunnelByName(input);
+  if (existing) {
+    console.log(`[cf] adopted existing tunnel "${input.tunnelName}" (${existing}) \u2014 local state was missing`);
+    return existing;
+  }
   const created = await cf({
     apiToken: input.apiToken,
     method: "POST",
     path: `/accounts/${input.accountId}/cfd_tunnel`,
     body: { name: input.tunnelName, config_src: "cloudflare" }
   });
-  if (!created.success || !created.result) {
-    throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
+  if (created.success && created.result) return created.result.id;
+  if ((created.errors ?? []).some((e) => e.code === 1013)) {
+    const adopted = await findTunnelByName(input);
+    if (adopted) {
+      console.log(`[cf] tunnel "${input.tunnelName}" already existed (1013) \u2014 adopted ${adopted}`);
+      return adopted;
+    }
   }
-  return created.result.id;
+  throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
 }
 async function fetchConnectorToken(input, tunnelId) {
   const res = await cf({
@@ -836,7 +857,13 @@ async function ensureAccessIdp(input) {
   return created.result.id;
 }
 async function ensureAccessApp(input) {
-  const policy = {
+  const { service } = input;
+  const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+  const policy = service.bypass ? {
+    name: "launch-kit-public-bypass",
+    decision: "bypass",
+    include: [{ everyone: {} }]
+  } : {
     name: "launch-kit-org-allow",
     decision: "allow",
     include: [
@@ -849,12 +876,17 @@ async function ensureAccessApp(input) {
       }
     ]
   };
-  const body = {
-    name: `launch-kit ${input.service.hostname}`,
-    domain: input.service.hostname,
+  const body = service.bypass ? {
+    name: `launch-kit ${appDomain} (public)`,
+    domain: appDomain,
+    type: "self_hosted",
+    policies: [policy]
+  } : {
+    name: `launch-kit ${appDomain}`,
+    domain: appDomain,
     type: "self_hosted",
     // Bot terminal = RCE surface → short session. Read portals = a workday.
-    session_duration: input.service.strict ? "30m" : "24h",
+    session_duration: service.strict ? "30m" : "24h",
     allowed_idps: [input.idpId],
     auto_redirect_to_identity: true,
     policies: [policy]
@@ -865,7 +897,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`
   });
   if (!list.success) fail(list, "list access apps");
-  const existing = (list.result ?? []).find((a) => a.domain === input.service.hostname);
+  const existing = (list.result ?? []).find((a) => a.domain === appDomain);
   if (existing) {
     const upd = await cf2({
       apiToken: input.apiToken,
@@ -873,7 +905,7 @@ async function ensureAccessApp(input) {
       path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
       body
     });
-    if (!upd.success || !upd.result) fail(upd, `update access app ${input.service.hostname}`);
+    if (!upd.success || !upd.result) fail(upd, `update access app ${appDomain}`);
     return upd.result.id;
   }
   const created = await cf2({
@@ -882,7 +914,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`,
     body
   });
-  if (!created.success || !created.result) fail(created, `create access app ${input.service.hostname}`);
+  if (!created.success || !created.result) fail(created, `create access app ${appDomain}`);
   return created.result.id;
 }
 async function provisionAccess(input) {
@@ -901,7 +933,8 @@ async function provisionAccess(input) {
   saveState2(input.stateFile, { idpId, accountId: input.accountId });
   const appIds = {};
   for (const service of input.services) {
-    appIds[service.hostname] = await ensureAccessApp({
+    const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+    appIds[appDomain] = await ensureAccessApp({
       apiToken: input.apiToken,
       accountId: input.accountId,
       idpId,
@@ -922,6 +955,15 @@ var init_cf_access = __esm({
   }
 });
 
+// src/server/radar/registration.ts
+var RECEIVER_PATH;
+var init_registration = __esm({
+  "src/server/radar/registration.ts"() {
+    "use strict";
+    RECEIVER_PATH = "/api/radar/ingest";
+  }
+});
+
 // src/server/radar-docker-init-entry.ts
 var radar_docker_init_entry_exports = {};
 __export(radar_docker_init_entry_exports, {
@@ -942,6 +984,60 @@ function run2(cmd, args, stdio = "inherit") {
   const r = (0, import_node_child_process2.spawnSync)(cmd, args, { stdio });
   return r.status ?? 1;
 }
+function readCrashState() {
+  try {
+    const s = JSON.parse((0, import_node_fs4.readFileSync)(CRASH_STATE_FILE, "utf8"));
+    return typeof s?.count === "number" && s.count >= 0 ? s : null;
+  } catch {
+    return null;
+  }
+}
+function bumpCrashCount() {
+  const prev = readCrashState();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const next = {
+    count: (prev?.count ?? 0) + 1,
+    firstAt: prev?.firstAt ?? now,
+    lastAt: now
+  };
+  try {
+    (0, import_node_fs4.mkdirSync)(LAUNCHPOD_DIR, { recursive: true });
+    (0, import_node_fs4.writeFileSync)(CRASH_STATE_FILE, JSON.stringify(next, null, 2));
+  } catch (err) {
+    console.warn(`[entrypoint] could not persist boot-crash counter (continuing unprotected): ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return next.count;
+}
+function clearCrashCount() {
+  try {
+    if ((0, import_node_fs4.existsSync)(CRASH_STATE_FILE)) (0, import_node_fs4.writeFileSync)(CRASH_STATE_FILE, JSON.stringify({ count: 0, firstAt: "", lastAt: "" }));
+  } catch {
+  }
+}
+async function parkAfterCrashLoop(count) {
+  const lines = [
+    "==================================================================",
+    `[entrypoint] CRASH-LOOP HALT \u2014 ${count} consecutive failed boots (cap ${MAX_BOOT_CRASHES}).`,
+    "[entrypoint] Refusing to restart again. Container is now PARKED (idle, not",
+    "[entrypoint] exiting) so it stops thrashing CF APIs and logs. Fix the root",
+    "[entrypoint] cause, clear the counter, then restart the container:",
+    `[entrypoint]   rm ${CRASH_STATE_FILE} && docker restart <container>`,
+    "=================================================================="
+  ];
+  for (const l of lines) console.error(l);
+  for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+    process.on(sig, () => {
+      console.log(`[entrypoint] received ${sig} while parked \u2014 exiting`);
+      process.exit(0);
+    });
+  }
+  setInterval(() => {
+    console.error(`[entrypoint] still parked after crash-loop halt \u2014 clear ${CRASH_STATE_FILE} and restart to retry`);
+  }, 15 * 6e4);
+  await new Promise(() => {
+  });
+  throw new Error("unreachable");
+}
 async function setupFromCloud() {
   const pat = requireEnv("LS_PAT");
   const orgSlug = requireEnv("LS_ORG_SLUG");
@@ -1120,20 +1216,31 @@ async function maybeProvisionAccess(bundle, ingress) {
   const skipped = [];
   for (const [name, hostname] of Object.entries(ingress.hostnames)) {
     const cfg = GATED_SERVICES[name];
-    if (cfg) services.push({ hostname, strict: cfg.strict });
-    else skipped.push(name);
+    if (!cfg) {
+      skipped.push(name);
+      continue;
+    }
+    services.push({ hostname, strict: cfg.strict });
+    for (const path6 of cfg.publicPaths ?? []) {
+      services.push({ hostname, path: path6, bypass: true });
+    }
   }
   if (skipped.length > 0) {
     console.log(`[entrypoint] CF Access: leaving machine surface(s) ungated: ${skipped.join(", ")}`);
   }
   if (services.length === 0) {
-    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview not provisioned)");
+    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview/radar/deck not provisioned)");
     return;
   }
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
   const pat = requireEnv("LS_PAT");
   const stateFile = "/workspace/.launchpod/launch-kit-access.json";
-  console.log(`[entrypoint] gating ${services.map((s) => s.hostname).join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  const gatedHosts = services.filter((s) => !s.bypass).map((s) => s.hostname);
+  const bypassed = services.filter((s) => s.bypass).map((s) => `${s.hostname}${s.path ?? ""}`);
+  console.log(`[entrypoint] gating ${gatedHosts.join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  if (bypassed.length > 0) {
+    console.log(`[entrypoint] CF Access: public bypass for ${bypassed.join(", ")}`);
+  }
   const result = await provisionAccess({
     apiToken: token,
     accountId,
@@ -1226,6 +1333,12 @@ function spawnServiceGroup(services) {
   }).finally(removeSignals);
 }
 async function main() {
+  const priorCrashes = readCrashState()?.count ?? 0;
+  if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
+  const bootAttempt = bumpCrashCount();
+  if (bootAttempt > 1) {
+    console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+  }
   for (const k of REQUIRED_ENV) requireEnv(k);
   const bundle = await setupFromCloud();
   setupClaudeCredentials();
@@ -1257,15 +1370,22 @@ async function main() {
       console.warn(`[entrypoint] \u26A0 first service is "${first.name}", not "radar" \u2014 quick tunneling is owned by the radar agent today, so NO external URL will be available.`);
     }
   }
+  const stableTimer = setTimeout(() => {
+    clearCrashCount();
+    console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+  }, STABLE_AFTER_MS);
+  stableTimer.unref?.();
   try {
     await spawnServiceGroup(services);
+    clearTimeout(stableTimer);
     process.exit(0);
   } catch (err) {
+    clearTimeout(stableTimer);
     console.error(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
 }
-var import_node_child_process2, import_node_fs4, import_node_path4, REQUIRED_ENV, GATED_SERVICES;
+var import_node_child_process2, import_node_fs4, import_node_path4, REQUIRED_ENV, LAUNCHPOD_DIR, CRASH_STATE_FILE, MAX_BOOT_CRASHES, STABLE_AFTER_MS, GATED_SERVICES;
 var init_radar_docker_init_entry = __esm({
   "src/server/radar-docker-init-entry.ts"() {
     "use strict";
@@ -1276,17 +1396,26 @@ var init_radar_docker_init_entry = __esm({
     init_launch_kit_services();
     init_cf_ingress();
     init_cf_access();
+    init_registration();
     REQUIRED_ENV = [
       "CLAUDE_CREDENTIALS_B64",
       "LS_PAT",
       "LS_ORG_SLUG",
       "LS_PROJECT_SLUG"
     ];
+    LAUNCHPOD_DIR = "/workspace/.launchpod";
+    CRASH_STATE_FILE = (0, import_node_path4.join)(LAUNCHPOD_DIR, ".boot-crash.json");
+    MAX_BOOT_CRASHES = 5;
+    STABLE_AFTER_MS = 3e4;
     GATED_SERVICES = {
       // Claude web terminal — live drivable shell ⇒ RCE surface ⇒ short session.
       bot: { strict: true },
       // The user's own dev/preview server — a workday-length session is fine.
-      preview: { strict: false }
+      preview: { strict: false },
+      // Radar: gate the UI, bypass the (HMAC-verified) webhook receiver path.
+      radar: { strict: false, publicPaths: [RECEIVER_PATH] },
+      // Deck: gate the whole host — its push is localhost-only, never hits the edge.
+      deck: { strict: false }
     };
     if (!process.env.VITEST) {
       main().catch((err) => {

package/dist/server/radar-docker-init-entry.js

@@ -286,6 +286,17 @@ async function cf(opts) {
 function isNotFound(env) {
   return !env.success && (env.errors ?? []).some((e) => e.code === 7003 || e.code === 1001 || e.code === 81044);
 }
+async function findTunnelByName(input) {
+  const q = new URLSearchParams({ name: input.tunnelName, is_deleted: "false" }).toString();
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/cfd_tunnel?${q}`
+  });
+  if (!res.success || !Array.isArray(res.result)) return null;
+  const live = res.result.find((t) => t.name === input.tunnelName && !t.deleted_at);
+  return live?.id ?? null;
+}
 function loadState(path) {
   if (!(0, import_node_fs2.existsSync)(path)) return null;
   try {
@@ -317,16 +328,26 @@ async function ensureTunnel(input, knownTunnelId) {
       throw new Error(`[cf] tunnel GET failed: ${JSON.stringify(got.errors)}`);
     }
   }
+  const existing = await findTunnelByName(input);
+  if (existing) {
+    console.log(`[cf] adopted existing tunnel "${input.tunnelName}" (${existing}) \u2014 local state was missing`);
+    return existing;
+  }
   const created = await cf({
     apiToken: input.apiToken,
     method: "POST",
     path: `/accounts/${input.accountId}/cfd_tunnel`,
     body: { name: input.tunnelName, config_src: "cloudflare" }
   });
-  if (!created.success || !created.result) {
-    throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
+  if (created.success && created.result) return created.result.id;
+  if ((created.errors ?? []).some((e) => e.code === 1013)) {
+    const adopted = await findTunnelByName(input);
+    if (adopted) {
+      console.log(`[cf] tunnel "${input.tunnelName}" already existed (1013) \u2014 adopted ${adopted}`);
+      return adopted;
+    }
   }
-  return created.result.id;
+  throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
 }
 async function fetchConnectorToken(input, tunnelId) {
   const res = await cf({
@@ -499,7 +520,13 @@ async function ensureAccessIdp(input) {
   return created.result.id;
 }
 async function ensureAccessApp(input) {
-  const policy = {
+  const { service } = input;
+  const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+  const policy = service.bypass ? {
+    name: "launch-kit-public-bypass",
+    decision: "bypass",
+    include: [{ everyone: {} }]
+  } : {
     name: "launch-kit-org-allow",
     decision: "allow",
     include: [
@@ -512,12 +539,17 @@ async function ensureAccessApp(input) {
       }
     ]
   };
-  const body = {
-    name: `launch-kit ${input.service.hostname}`,
-    domain: input.service.hostname,
+  const body = service.bypass ? {
+    name: `launch-kit ${appDomain} (public)`,
+    domain: appDomain,
+    type: "self_hosted",
+    policies: [policy]
+  } : {
+    name: `launch-kit ${appDomain}`,
+    domain: appDomain,
     type: "self_hosted",
     // Bot terminal = RCE surface → short session. Read portals = a workday.
-    session_duration: input.service.strict ? "30m" : "24h",
+    session_duration: service.strict ? "30m" : "24h",
     allowed_idps: [input.idpId],
     auto_redirect_to_identity: true,
     policies: [policy]
@@ -528,7 +560,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`
   });
   if (!list.success) fail(list, "list access apps");
-  const existing = (list.result ?? []).find((a) => a.domain === input.service.hostname);
+  const existing = (list.result ?? []).find((a) => a.domain === appDomain);
   if (existing) {
     const upd = await cf2({
       apiToken: input.apiToken,
@@ -536,7 +568,7 @@ async function ensureAccessApp(input) {
       path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
       body
     });
-    if (!upd.success || !upd.result) fail(upd, `update access app ${input.service.hostname}`);
+    if (!upd.success || !upd.result) fail(upd, `update access app ${appDomain}`);
     return upd.result.id;
   }
   const created = await cf2({
@@ -545,7 +577,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`,
     body
   });
-  if (!created.success || !created.result) fail(created, `create access app ${input.service.hostname}`);
+  if (!created.success || !created.result) fail(created, `create access app ${appDomain}`);
   return created.result.id;
 }
 async function provisionAccess(input) {
@@ -564,7 +596,8 @@ async function provisionAccess(input) {
   saveState2(input.stateFile, { idpId, accountId: input.accountId });
   const appIds = {};
   for (const service of input.services) {
-    appIds[service.hostname] = await ensureAccessApp({
+    const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+    appIds[appDomain] = await ensureAccessApp({
       apiToken: input.apiToken,
       accountId: input.accountId,
       idpId,
@@ -575,6 +608,9 @@ async function provisionAccess(input) {
   return { idpId, authDomain, appIds };
 }
 
+// src/server/radar/registration.ts
+var RECEIVER_PATH = "/api/radar/ingest";
+
 // src/server/radar-docker-init-entry.ts
 var REQUIRED_ENV = [
   "CLAUDE_CREDENTIALS_B64",
@@ -595,6 +631,64 @@ function run(cmd, args, stdio = "inherit") {
   const r = (0, import_node_child_process.spawnSync)(cmd, args, { stdio });
   return r.status ?? 1;
 }
+var LAUNCHPOD_DIR = "/workspace/.launchpod";
+var CRASH_STATE_FILE = (0, import_node_path4.join)(LAUNCHPOD_DIR, ".boot-crash.json");
+var MAX_BOOT_CRASHES = 5;
+var STABLE_AFTER_MS = 3e4;
+function readCrashState() {
+  try {
+    const s = JSON.parse((0, import_node_fs4.readFileSync)(CRASH_STATE_FILE, "utf8"));
+    return typeof s?.count === "number" && s.count >= 0 ? s : null;
+  } catch {
+    return null;
+  }
+}
+function bumpCrashCount() {
+  const prev = readCrashState();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const next = {
+    count: (prev?.count ?? 0) + 1,
+    firstAt: prev?.firstAt ?? now,
+    lastAt: now
+  };
+  try {
+    (0, import_node_fs4.mkdirSync)(LAUNCHPOD_DIR, { recursive: true });
+    (0, import_node_fs4.writeFileSync)(CRASH_STATE_FILE, JSON.stringify(next, null, 2));
+  } catch (err) {
+    console.warn(`[entrypoint] could not persist boot-crash counter (continuing unprotected): ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return next.count;
+}
+function clearCrashCount() {
+  try {
+    if ((0, import_node_fs4.existsSync)(CRASH_STATE_FILE)) (0, import_node_fs4.writeFileSync)(CRASH_STATE_FILE, JSON.stringify({ count: 0, firstAt: "", lastAt: "" }));
+  } catch {
+  }
+}
+async function parkAfterCrashLoop(count) {
+  const lines = [
+    "==================================================================",
+    `[entrypoint] CRASH-LOOP HALT \u2014 ${count} consecutive failed boots (cap ${MAX_BOOT_CRASHES}).`,
+    "[entrypoint] Refusing to restart again. Container is now PARKED (idle, not",
+    "[entrypoint] exiting) so it stops thrashing CF APIs and logs. Fix the root",
+    "[entrypoint] cause, clear the counter, then restart the container:",
+    `[entrypoint]   rm ${CRASH_STATE_FILE} && docker restart <container>`,
+    "=================================================================="
+  ];
+  for (const l of lines) console.error(l);
+  for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+    process.on(sig, () => {
+      console.log(`[entrypoint] received ${sig} while parked \u2014 exiting`);
+      process.exit(0);
+    });
+  }
+  setInterval(() => {
+    console.error(`[entrypoint] still parked after crash-loop halt \u2014 clear ${CRASH_STATE_FILE} and restart to retry`);
+  }, 15 * 6e4);
+  await new Promise(() => {
+  });
+  throw new Error("unreachable");
+}
 async function setupFromCloud() {
   const pat = requireEnv("LS_PAT");
   const orgSlug = requireEnv("LS_ORG_SLUG");
@@ -752,7 +846,11 @@ var GATED_SERVICES = {
   // Claude web terminal — live drivable shell ⇒ RCE surface ⇒ short session.
   bot: { strict: true },
   // The user's own dev/preview server — a workday-length session is fine.
-  preview: { strict: false }
+  preview: { strict: false },
+  // Radar: gate the UI, bypass the (HMAC-verified) webhook receiver path.
+  radar: { strict: false, publicPaths: [RECEIVER_PATH] },
+  // Deck: gate the whole host — its push is localhost-only, never hits the edge.
+  deck: { strict: false }
 };
 async function registerOidcClient(serverUrl, pat, redirectUris) {
   const res = await fetch(new URL("/api/rover/oidc-client", serverUrl), {
@@ -779,20 +877,31 @@ async function maybeProvisionAccess(bundle, ingress) {
   const skipped = [];
   for (const [name, hostname] of Object.entries(ingress.hostnames)) {
     const cfg = GATED_SERVICES[name];
-    if (cfg) services.push({ hostname, strict: cfg.strict });
-    else skipped.push(name);
+    if (!cfg) {
+      skipped.push(name);
+      continue;
+    }
+    services.push({ hostname, strict: cfg.strict });
+    for (const path of cfg.publicPaths ?? []) {
+      services.push({ hostname, path, bypass: true });
+    }
   }
   if (skipped.length > 0) {
     console.log(`[entrypoint] CF Access: leaving machine surface(s) ungated: ${skipped.join(", ")}`);
   }
   if (services.length === 0) {
-    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview not provisioned)");
+    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview/radar/deck not provisioned)");
     return;
   }
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
   const pat = requireEnv("LS_PAT");
   const stateFile = "/workspace/.launchpod/launch-kit-access.json";
-  console.log(`[entrypoint] gating ${services.map((s) => s.hostname).join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  const gatedHosts = services.filter((s) => !s.bypass).map((s) => s.hostname);
+  const bypassed = services.filter((s) => s.bypass).map((s) => `${s.hostname}${s.path ?? ""}`);
+  console.log(`[entrypoint] gating ${gatedHosts.join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  if (bypassed.length > 0) {
+    console.log(`[entrypoint] CF Access: public bypass for ${bypassed.join(", ")}`);
+  }
   const result = await provisionAccess({
     apiToken: token,
     accountId,
@@ -885,6 +994,12 @@ function spawnServiceGroup(services) {
   }).finally(removeSignals);
 }
 async function main() {
+  const priorCrashes = readCrashState()?.count ?? 0;
+  if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
+  const bootAttempt = bumpCrashCount();
+  if (bootAttempt > 1) {
+    console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+  }
   for (const k of REQUIRED_ENV) requireEnv(k);
   const bundle = await setupFromCloud();
   setupClaudeCredentials();
@@ -916,10 +1031,17 @@ async function main() {
       console.warn(`[entrypoint] \u26A0 first service is "${first.name}", not "radar" \u2014 quick tunneling is owned by the radar agent today, so NO external URL will be available.`);
     }
   }
+  const stableTimer = setTimeout(() => {
+    clearCrashCount();
+    console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+  }, STABLE_AFTER_MS);
+  stableTimer.unref?.();
   try {
     await spawnServiceGroup(services);
+    clearTimeout(stableTimer);
     process.exit(0);
   } catch (err) {
+    clearTimeout(stableTimer);
     console.error(`[entrypoint] ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }

package/dist/server/rover-entry.js

@@ -61,6 +61,17 @@ async function cf(opts) {
 function isNotFound(env) {
   return !env.success && (env.errors ?? []).some((e) => e.code === 7003 || e.code === 1001 || e.code === 81044);
 }
+async function findTunnelByName(input) {
+  const q = new URLSearchParams({ name: input.tunnelName, is_deleted: "false" }).toString();
+  const res = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/cfd_tunnel?${q}`
+  });
+  if (!res.success || !Array.isArray(res.result)) return null;
+  const live = res.result.find((t) => t.name === input.tunnelName && !t.deleted_at);
+  return live?.id ?? null;
+}
 function loadState(path) {
   if (!(0, import_node_fs.existsSync)(path)) return null;
   try {
@@ -92,16 +103,26 @@ async function ensureTunnel(input, knownTunnelId) {
       throw new Error(`[cf] tunnel GET failed: ${JSON.stringify(got.errors)}`);
     }
   }
+  const existing = await findTunnelByName(input);
+  if (existing) {
+    console.log(`[cf] adopted existing tunnel "${input.tunnelName}" (${existing}) \u2014 local state was missing`);
+    return existing;
+  }
   const created = await cf({
     apiToken: input.apiToken,
     method: "POST",
     path: `/accounts/${input.accountId}/cfd_tunnel`,
     body: { name: input.tunnelName, config_src: "cloudflare" }
   });
-  if (!created.success || !created.result) {
-    throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
+  if (created.success && created.result) return created.result.id;
+  if ((created.errors ?? []).some((e) => e.code === 1013)) {
+    const adopted = await findTunnelByName(input);
+    if (adopted) {
+      console.log(`[cf] tunnel "${input.tunnelName}" already existed (1013) \u2014 adopted ${adopted}`);
+      return adopted;
+    }
   }
-  return created.result.id;
+  throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
 }
 async function fetchConnectorToken(input, tunnelId) {
   const res = await cf({
@@ -587,7 +608,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@launchsecure/launch-kit",
-      version: "0.0.36",
+      version: "0.0.38",
       description: "LaunchSecure toolkit \u2014 launch-sequencer (pipeline runner + terminal bridge), launch-radar (feedback webhook receiver), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup). launch-pod is the container image these run inside.",
       license: "MIT",
       author: "LaunchSecure - AutomateWithUs",