@launchsecure/launch-kit 0.0.37 → 0.0.39

package/dist/server/init-entry.js

@@ -274,6 +274,11 @@ function writeScripts() {
   fs4.writeFileSync(WRAPPER_PATH, readScaffold("statusline-wrapper.sh"), { mode: 493 });
   fs4.writeFileSync(CHIP_PATH, readScaffold("statusline-mcp.sh"), { mode: 493 });
 }
+function writeBaseScript() {
+  fs4.mkdirSync(LK_DIR, { recursive: true });
+  fs4.writeFileSync(BASE_PATH, readScaffold("statusline-base.sh"), { mode: 493 });
+  return `bash ${BASE_PATH}`;
+}
 function wrapperCommand(opts) {
   const env = [];
   if (opts.show) env.push(`LK_STATUSLINE_SHOW=${opts.show}`);
@@ -282,10 +287,7 @@ function wrapperCommand(opts) {
   return `${prefix}bash ${WRAPPER_PATH}`;
 }
 function activateStatusline(opts = {}) {
-  const settings = readSettings();
-  if (!settings) {
-    return { ok: false, outcome: "no-settings", message: `no ~/.claude/settings.json \u2014 nothing to wrap` };
-  }
+  const settings = readSettings() ?? {};
   const currentCmd = settings.statusLine?.command;
   const alreadyWrapped = typeof currentCmd === "string" && currentCmd.includes(WRAPPER_PATH);
   if (alreadyWrapped) {
@@ -304,20 +306,22 @@ function activateStatusline(opts = {}) {
     }
     return { ok: true, outcome: "refreshed", message: "statusline already wrapped \u2014 refreshed chip scripts only" };
   }
-  if (!currentCmd) {
-    return { ok: false, outcome: "no-statusline", message: "no statusLine.command in ~/.claude/settings.json \u2014 launch-kit only extends an existing statusline" };
-  }
   writeScripts();
+  const scaffolded = !currentCmd;
+  const original = scaffolded ? { type: "command", command: writeBaseScript() } : settings.statusLine;
   const wrapped = {
     ...settings,
     statusLine: { type: "command", command: wrapperCommand(opts) },
-    [ORIGINAL_KEY]: settings.statusLine
+    [ORIGINAL_KEY]: original
   };
   writeSettings(wrapped);
   const modeParts = [];
   if (opts.show) modeParts.push(`chips: ${opts.show}`);
   if (opts.compact) modeParts.push("compact mode");
   const modeDesc = modeParts.length > 0 ? ` (${modeParts.join(", ")})` : "";
+  if (scaffolded) {
+    return { ok: true, outcome: "scaffolded", message: `no statusline found \u2014 scaffolded Claude Code's default base line and wrapped it with chips${modeDesc}; base stashed under ${ORIGINAL_KEY}` };
+  }
   return { ok: true, outcome: "activated", message: `wrapped statusLine.command${modeDesc}; original stashed under ${ORIGINAL_KEY}` };
 }
 function deactivateStatusline() {
@@ -327,18 +331,26 @@ function deactivateStatusline() {
   if (!original) {
     return { ok: false, outcome: "not-active", message: `no ${ORIGINAL_KEY} in settings.json \u2014 statusline isn't wrapped by launch-kit` };
   }
-  const restored = { ...settings, statusLine: original };
+  const wasScaffolded = original.command?.includes(BASE_PATH) ?? false;
+  const restored = { ...settings };
+  if (wasScaffolded) delete restored.statusLine;
+  else restored.statusLine = original;
   delete restored[ORIGINAL_KEY];
   writeSettings(restored);
-  for (const p of [WRAPPER_PATH, CHIP_PATH]) {
+  const toRemove = wasScaffolded ? [WRAPPER_PATH, CHIP_PATH, BASE_PATH] : [WRAPPER_PATH, CHIP_PATH];
+  for (const p of toRemove) {
     try {
       fs4.unlinkSync(p);
     } catch {
     }
   }
-  return { ok: true, outcome: "deactivated", message: "restored original statusLine.command" };
+  return {
+    ok: true,
+    outcome: "deactivated",
+    message: wasScaffolded ? "removed launch-kit statusline and scaffolded base line \u2014 back to no statusline" : "restored original statusLine.command"
+  };
 }
-var fs4, path4, import_node_os, LK_DIR, WRAPPER_PATH, CHIP_PATH, SETTINGS_PATH, ORIGINAL_KEY;
+var fs4, path4, import_node_os, LK_DIR, WRAPPER_PATH, CHIP_PATH, BASE_PATH, SETTINGS_PATH, ORIGINAL_KEY;
 var init_statusline_install = __esm({
   "src/server/statusline-install.ts"() {
     "use strict";
@@ -348,6 +360,7 @@ var init_statusline_install = __esm({
     LK_DIR = path4.join((0, import_node_os.homedir)(), ".launchsecure");
     WRAPPER_PATH = path4.join(LK_DIR, "statusline-wrapper.sh");
     CHIP_PATH = path4.join(LK_DIR, "statusline-mcp.sh");
+    BASE_PATH = path4.join(LK_DIR, "statusline-base.sh");
     SETTINGS_PATH = path4.join((0, import_node_os.homedir)(), ".claude", "settings.json");
     ORIGINAL_KEY = "_launchKitStatuslineOriginal";
   }
@@ -857,7 +870,13 @@ async function ensureAccessIdp(input) {
   return created.result.id;
 }
 async function ensureAccessApp(input) {
-  const policy = {
+  const { service } = input;
+  const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+  const policy = service.bypass ? {
+    name: "launch-kit-public-bypass",
+    decision: "bypass",
+    include: [{ everyone: {} }]
+  } : {
     name: "launch-kit-org-allow",
     decision: "allow",
     include: [
@@ -870,12 +889,17 @@ async function ensureAccessApp(input) {
       }
     ]
   };
-  const body = {
-    name: `launch-kit ${input.service.hostname}`,
-    domain: input.service.hostname,
+  const body = service.bypass ? {
+    name: `launch-kit ${appDomain} (public)`,
+    domain: appDomain,
+    type: "self_hosted",
+    policies: [policy]
+  } : {
+    name: `launch-kit ${appDomain}`,
+    domain: appDomain,
     type: "self_hosted",
     // Bot terminal = RCE surface → short session. Read portals = a workday.
-    session_duration: input.service.strict ? "30m" : "24h",
+    session_duration: service.strict ? "30m" : "24h",
     allowed_idps: [input.idpId],
     auto_redirect_to_identity: true,
     policies: [policy]
@@ -886,7 +910,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`
   });
   if (!list.success) fail(list, "list access apps");
-  const existing = (list.result ?? []).find((a) => a.domain === input.service.hostname);
+  const existing = (list.result ?? []).find((a) => a.domain === appDomain);
   if (existing) {
     const upd = await cf2({
       apiToken: input.apiToken,
@@ -894,7 +918,7 @@ async function ensureAccessApp(input) {
       path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
       body
     });
-    if (!upd.success || !upd.result) fail(upd, `update access app ${input.service.hostname}`);
+    if (!upd.success || !upd.result) fail(upd, `update access app ${appDomain}`);
     return upd.result.id;
   }
   const created = await cf2({
@@ -903,7 +927,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`,
     body
   });
-  if (!created.success || !created.result) fail(created, `create access app ${input.service.hostname}`);
+  if (!created.success || !created.result) fail(created, `create access app ${appDomain}`);
   return created.result.id;
 }
 async function provisionAccess(input) {
@@ -922,7 +946,8 @@ async function provisionAccess(input) {
   saveState2(input.stateFile, { idpId, accountId: input.accountId });
   const appIds = {};
   for (const service of input.services) {
-    appIds[service.hostname] = await ensureAccessApp({
+    const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+    appIds[appDomain] = await ensureAccessApp({
       apiToken: input.apiToken,
       accountId: input.accountId,
       idpId,
@@ -943,6 +968,15 @@ var init_cf_access = __esm({
   }
 });
 
+// src/server/radar/registration.ts
+var RECEIVER_PATH;
+var init_registration = __esm({
+  "src/server/radar/registration.ts"() {
+    "use strict";
+    RECEIVER_PATH = "/api/radar/ingest";
+  }
+});
+
 // src/server/radar-docker-init-entry.ts
 var radar_docker_init_entry_exports = {};
 __export(radar_docker_init_entry_exports, {
@@ -1195,20 +1229,31 @@ async function maybeProvisionAccess(bundle, ingress) {
   const skipped = [];
   for (const [name, hostname] of Object.entries(ingress.hostnames)) {
     const cfg = GATED_SERVICES[name];
-    if (cfg) services.push({ hostname, strict: cfg.strict });
-    else skipped.push(name);
+    if (!cfg) {
+      skipped.push(name);
+      continue;
+    }
+    services.push({ hostname, strict: cfg.strict });
+    for (const path6 of cfg.publicPaths ?? []) {
+      services.push({ hostname, path: path6, bypass: true });
+    }
   }
   if (skipped.length > 0) {
     console.log(`[entrypoint] CF Access: leaving machine surface(s) ungated: ${skipped.join(", ")}`);
   }
   if (services.length === 0) {
-    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview not provisioned)");
+    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview/radar/deck not provisioned)");
     return;
   }
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
   const pat = requireEnv("LS_PAT");
   const stateFile = "/workspace/.launchpod/launch-kit-access.json";
-  console.log(`[entrypoint] gating ${services.map((s) => s.hostname).join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  const gatedHosts = services.filter((s) => !s.bypass).map((s) => s.hostname);
+  const bypassed = services.filter((s) => s.bypass).map((s) => `${s.hostname}${s.path ?? ""}`);
+  console.log(`[entrypoint] gating ${gatedHosts.join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  if (bypassed.length > 0) {
+    console.log(`[entrypoint] CF Access: public bypass for ${bypassed.join(", ")}`);
+  }
   const result = await provisionAccess({
     apiToken: token,
     accountId,
@@ -1364,6 +1409,7 @@ var init_radar_docker_init_entry = __esm({
     init_launch_kit_services();
     init_cf_ingress();
     init_cf_access();
+    init_registration();
     REQUIRED_ENV = [
       "CLAUDE_CREDENTIALS_B64",
       "LS_PAT",
@@ -1378,7 +1424,11 @@ var init_radar_docker_init_entry = __esm({
       // Claude web terminal — live drivable shell ⇒ RCE surface ⇒ short session.
       bot: { strict: true },
       // The user's own dev/preview server — a workday-length session is fine.
-      preview: { strict: false }
+      preview: { strict: false },
+      // Radar: gate the UI, bypass the (HMAC-verified) webhook receiver path.
+      radar: { strict: false, publicPaths: [RECEIVER_PATH] },
+      // Deck: gate the whole host — its push is localhost-only, never hits the edge.
+      deck: { strict: false }
     };
     if (!process.env.VITEST) {
       main().catch((err) => {
@@ -1584,6 +1634,7 @@ var ALL_STEP_IDS = [
   "migrate-safety",
   "ls-marketplace",
   "recall-hook",
+  "project-info",
   "statusline"
 ];
 var PRESETS = {
@@ -1591,6 +1642,7 @@ var PRESETS = {
   refresh: ["resolve", "clone", "install", "onboard", "recall"]
 };
 var LAUNCH_KIT_PKG = "@launchsecure/launch-kit";
+var LAUNCH_KIT_PKG_LATEST = `${LAUNCH_KIT_PKG}@latest`;
 var LAUNCH_KIT_TOOLS_GUIDE_STATIC_HEAD = `
 Wired in Claude Code (.mcp.json):
   launch-secure   \u2014 LS API: work items, comms, secrets, members, board
@@ -1661,6 +1713,7 @@ var KNOWN_BOOL_FLAGS = /* @__PURE__ */ new Set([
   "--no-migrate-safety",
   "--no-ls-marketplace",
   "--no-recall-hook",
+  "--no-project-info",
   "--refresh-scaffolds",
   "--quiet",
   "--force",
@@ -1694,6 +1747,7 @@ function parseArgs(argv) {
     noMigrateSafety: false,
     noLsMarketplace: false,
     noRecallHook: false,
+    noProjectInfo: false,
     refreshScaffolds: false,
     quiet: false,
     force: false,
@@ -1738,6 +1792,10 @@ function parseArgs(argv) {
       args.noRecallHook = true;
       continue;
     }
+    if (raw === "--no-project-info") {
+      args.noProjectInfo = true;
+      continue;
+    }
     if (raw === "--refresh-scaffolds") {
       args.refreshScaffolds = true;
       continue;
@@ -1872,6 +1930,8 @@ Options:
   --no-migrate-safety      Skip refreshing the migrate-safety scaffold.
   --no-ls-marketplace      Skip refreshing the launch-secure marketplace.
   --no-recall-hook         Skip refreshing the recall-hook scaffold.
+  --no-project-info        Skip wiring the gitignored CLAUDE.md-imported
+                           project-info snapshot (/kit:project-info refreshes it).
   --refresh-scaffolds      Force-overwrite migrate-safety files (default is to
                            preserve user edits). Use this to pull updates
                            published to @launchsecure/launch-kit.
@@ -1907,8 +1967,8 @@ Subcommands:
                         Env resolved from --env \u2192 $LS_ENV \u2192 server-side project default \u2192
                         single-env auto-pick. See \`launch-kit secrets --help\`.
   statusline activate   Wrap ~/.claude/settings.json's statusLine.command so MCP daemon
-                        chips (recall, chart, deck, council) get appended. Refuses to
-                        create one if none exists \u2014 additive only.
+                        chips (recall, chart, deck, council) get appended. If no
+                        statusline exists, scaffolds Claude Code's default base line first.
   statusline deactivate Restore the original statusLine.command and remove kit scripts.
 
 Usage:
@@ -1979,7 +2039,7 @@ Options:
 
 Step selection (one-command flow \u2014 compose over the preset):
   Steps: resolve, clone, cred, mcp, gitignore, install, onboard, recall,
-         migrate-safety, ls-marketplace, recall-hook, statusline
+         migrate-safety, ls-marketplace, recall-hook, project-info, statusline
   --preset=<name>          init (everything) or refresh (skips resolve/clone/
                            install/onboard/recall). Default: init. \`init\` and
                            \`refresh\` subcommands just select this.
@@ -2285,19 +2345,19 @@ function buildLaunchKitMcpEntries(cfg) {
     },
     "launch-chart": {
       command: "npx",
-      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"]
+      args: ["-y", "-p", LAUNCH_KIT_PKG_LATEST, "launch-chart"]
     },
     "launch-deck": {
       command: "npx",
-      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-deck"]
+      args: ["-y", "-p", LAUNCH_KIT_PKG_LATEST, "launch-deck"]
     },
     "launch-orbit": {
       command: "npx",
-      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-orbit", "mcp"]
+      args: ["-y", "-p", LAUNCH_KIT_PKG_LATEST, "launch-orbit", "mcp"]
     },
     "launch-recall": {
       command: "npx",
-      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "mcp"]
+      args: ["-y", "-p", LAUNCH_KIT_PKG_LATEST, "launch-recall", "mcp"]
     }
   };
 }
@@ -2317,6 +2377,18 @@ function mergeMcpEntry(existing, ours) {
   }
   return merged;
 }
+function pinLaunchKitLatest(servers) {
+  const fixed = [];
+  for (const [name, entry] of Object.entries(servers)) {
+    if (entry.command !== "npx" || !Array.isArray(entry.args)) continue;
+    const i = entry.args.indexOf(LAUNCH_KIT_PKG);
+    if (i !== -1) {
+      entry.args[i] = LAUNCH_KIT_PKG_LATEST;
+      fixed.push(name);
+    }
+  }
+  return fixed;
+}
 function mergeMcpFile(targetDir, launchKitEntries) {
   const p = path5.join(targetDir, ".mcp.json");
   const hadExisting = fs5.existsSync(p);
@@ -2342,12 +2414,14 @@ function mergeMcpFile(targetDir, launchKitEntries) {
       merged.mcpServers[name] = entry;
     }
   }
+  const pinned = pinLaunchKitLatest(merged.mcpServers);
   if (DRY_RUN) {
     const action = hadExisting && existingServerCount > 0 ? "would merge into" : "would write";
-    dryNote(`${action} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}]`);
+    dryNote(`${action} .mcp.json \u2014 overwriting [${overwrites.join(", ") || "none"}], adding [${additions.join(", ") || "none"}], pinning @latest on [${pinned.join(", ") || "none"}]`);
     return { status: "skipped", summary: "(dry-run)" };
   }
   fs5.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  if (pinned.length > 0) info(`pinned @latest on ${pinned.length} launch-kit MCP entr${pinned.length === 1 ? "y" : "ies"}: ${pinned.join(", ")}`);
   const verb = hadExisting && existingServerCount > 0 ? "merged" : "wrote";
   ok(`${verb === "merged" ? "merged into" : "wrote"} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
   const total = Object.keys(launchKitEntries).length;
@@ -2433,14 +2507,14 @@ function runRecallInit(repoDir) {
   const recallEntry = path5.resolve(__dirname, "recall-entry.js");
   const useSibling = fs5.existsSync(recallEntry);
   const cmd = useSibling ? process.execPath : "npx";
-  const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "init"];
+  const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG_LATEST, "launch-recall", "init"];
   if (DRY_RUN) {
     dryNote(`would run launch-recall init: ${cmd} ${args.join(" ")} (cwd: ${repoDir})`);
     return;
   }
   const res = (0, import_node_child_process3.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
   if (res.status !== 0) {
-    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path5.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
+    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path5.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG_LATEST} launch-recall init`);
     return;
   }
   ok(`launch-recall ready (shadow git initialized)`);
@@ -2731,7 +2805,7 @@ function wireRecallHook(targetDir) {
 }
 function tryActivateStatusline() {
   if (DRY_RUN) {
-    dryNote(`would wrap ~/.claude/settings.json statusLine.command with launch-kit's MCP chip wrapper (skips silently if no statusline configured)`);
+    dryNote(`would wrap ~/.claude/settings.json statusLine.command with launch-kit's MCP chip wrapper (scaffolds Claude Code's default base line first if none is configured)`);
     return { status: "skipped", summary: "(dry-run)" };
   }
   const res = activateStatusline();
@@ -2739,6 +2813,10 @@ function tryActivateStatusline() {
     ok(`statusline wrapped \u2014 MCP chips will render alongside your existing statusline next session`);
     return { status: "ok", summary: "wrapped \u2014 MCP chips render next session" };
   }
+  if (res.ok && res.outcome === "scaffolded") {
+    ok(`no statusline found \u2014 scaffolded Claude Code's default base line; MCP chips render alongside it next session`);
+    return { status: "ok", summary: "scaffolded default base line + chips" };
+  }
   if (res.ok && res.outcome === "refreshed") {
     info(`statusline already wrapped \u2014 refreshed chip scripts`);
     return { status: "ok", summary: "chip scripts refreshed" };
@@ -2797,8 +2875,8 @@ async function main2() {
     if (action === "activate") res = activateStatusline2({ show: showArg, compact: compactArg });
     else if (action === "deactivate") res = deactivateStatusline2();
     else fail3(`Unknown statusline action: "${action}". Supported: activate, deactivate.`);
-    if (res.ok) ok(`statusline ${res.outcome} \u2014 ${res.message}`);
-    else info(`statusline ${res.outcome} \u2014 ${res.message}`);
+    const mark = res.ok ? "\u2713" : "\u2717";
+    console.log(`[launch-kit] ${mark} statusline ${res.outcome} \u2014 ${res.message}`);
     return;
   }
   if (subcommand === "secrets") {
@@ -2876,6 +2954,7 @@ function resolveEnabledSteps(args) {
   if (args.noMigrateSafety) enabled.delete("migrate-safety");
   if (args.noLsMarketplace) enabled.delete("ls-marketplace");
   if (args.noRecallHook) enabled.delete("recall-hook");
+  if (args.noProjectInfo) enabled.delete("project-info");
   return enabled;
 }
 async function stepResolve(ctx) {
@@ -3105,6 +3184,90 @@ function stepStatusline(_ctx) {
   const slR = tryActivateStatusline();
   if (slR) phase("statusline", slR);
 }
+var PROJECT_INFO_REL = ".claude/launch-kit/project-info.md";
+function ensureClaudeMdImport(targetDir) {
+  const p = path5.join(targetDir, "CLAUDE.md");
+  const importLine = `@${PROJECT_INFO_REL}`;
+  const block = `<!-- launch-kit:project-info \u2014 generated import; safe to move, keep the line -->
+${importLine}
+<!-- /launch-kit:project-info -->
+`;
+  if (fs5.existsSync(p)) {
+    const content = fs5.readFileSync(p, "utf-8");
+    if (content.includes(importLine)) return "in-sync";
+    if (DRY_RUN) {
+      dryNote(`would add ${importLine} import to CLAUDE.md`);
+      return "added";
+    }
+    fs5.writeFileSync(p, content + (content.endsWith("\n") ? "" : "\n") + "\n" + block, "utf-8");
+    return "added";
+  }
+  if (DRY_RUN) {
+    dryNote(`would create CLAUDE.md with ${importLine} import`);
+    return "created";
+  }
+  fs5.writeFileSync(p, `# CLAUDE.md
+
+${block}`, "utf-8");
+  return "created";
+}
+function renderProjectInfoSkeleton(ctx) {
+  const cfg = ctx.cfg;
+  const projectName = ctx.resolved?.projectName ?? cfg.projectSlug;
+  const repo = ctx.resolved?.repositoryUrl ?? "\u2014";
+  const todo = "_Not populated yet \u2014 run `/kit:project-info` in Claude Code._";
+  return [
+    `# Project Info \u2014 ${projectName}`,
+    ``,
+    `<!-- launch-kit:generated \u2014 local, git-ignored snapshot. NOT a source of truth. -->`,
+    `> Wired by \`launch-kit\` init. This is a **local, git-ignored snapshot** of`,
+    `> project facts so Claude doesn't re-query them every session. Members,`,
+    `> providers, and environments are filled from LaunchSecure by the`,
+    `> \`/kit:project-info\` skill \u2014 run it to populate or refresh. Treat as a`,
+    `> cache: it can go stale, so re-run after team/provider/env changes.`,
+    ``,
+    `## Identity`,
+    `- **Org:** ${cfg.orgSlug}`,
+    `- **Project:** ${projectName} (\`${cfg.projectSlug}\`)`,
+    `- **Server:** ${cfg.serverUrl}`,
+    `- **Course:** ${ctx.courseName ?? "\u2014"}`,
+    `- **Repo:** ${repo}`,
+    ``,
+    `## Members`,
+    todo,
+    ``,
+    `## Providers / integrations`,
+    todo,
+    ``,
+    `## Environments`,
+    todo,
+    ``
+  ].join("\n");
+}
+function stepProjectInfo(ctx) {
+  if (!ctx.cfg) {
+    phase("project-info", { status: "skipped", summary: "no cred resolved" });
+    return;
+  }
+  ensureGitignoreLine(ctx.targetDir, PROJECT_INFO_REL);
+  const importResult = ensureClaudeMdImport(ctx.targetDir);
+  const dest = path5.join(ctx.targetDir, PROJECT_INFO_REL);
+  const existed = fs5.existsSync(dest);
+  if (!existed) {
+    if (DRY_RUN) {
+      dryNote(`would write ${PROJECT_INFO_REL} identity skeleton`);
+    } else {
+      fs5.mkdirSync(path5.dirname(dest), { recursive: true });
+      fs5.writeFileSync(dest, renderProjectInfoSkeleton(ctx), "utf-8");
+      ok(`wrote ${PROJECT_INFO_REL}`);
+    }
+  }
+  const summary = existed ? `kept file \xB7 CLAUDE.md ${importResult} \xB7 /kit:project-info to refresh` : `wrote skeleton \xB7 CLAUDE.md ${importResult} \xB7 /kit:project-info to populate`;
+  phase("project-info", {
+    status: existed && importResult === "in-sync" ? "in-sync" : "ok",
+    summary
+  });
+}
 var STEPS = [
   { id: "resolve", run: stepResolve },
   { id: "clone", requires: ["resolve"], run: stepClone },
@@ -3117,6 +3280,7 @@ var STEPS = [
   { id: "migrate-safety", run: stepMigrateSafety },
   { id: "ls-marketplace", run: stepLsMarketplace },
   { id: "recall-hook", run: stepRecallHook },
+  { id: "project-info", requires: ["cred"], run: stepProjectInfo },
   { id: "statusline", run: stepStatusline }
 ];
 function buildCtx(args, enabled) {

package/dist/server/radar-docker-init-entry.js

@@ -520,7 +520,13 @@ async function ensureAccessIdp(input) {
   return created.result.id;
 }
 async function ensureAccessApp(input) {
-  const policy = {
+  const { service } = input;
+  const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+  const policy = service.bypass ? {
+    name: "launch-kit-public-bypass",
+    decision: "bypass",
+    include: [{ everyone: {} }]
+  } : {
     name: "launch-kit-org-allow",
     decision: "allow",
     include: [
@@ -533,12 +539,17 @@ async function ensureAccessApp(input) {
       }
     ]
   };
-  const body = {
-    name: `launch-kit ${input.service.hostname}`,
-    domain: input.service.hostname,
+  const body = service.bypass ? {
+    name: `launch-kit ${appDomain} (public)`,
+    domain: appDomain,
+    type: "self_hosted",
+    policies: [policy]
+  } : {
+    name: `launch-kit ${appDomain}`,
+    domain: appDomain,
     type: "self_hosted",
     // Bot terminal = RCE surface → short session. Read portals = a workday.
-    session_duration: input.service.strict ? "30m" : "24h",
+    session_duration: service.strict ? "30m" : "24h",
     allowed_idps: [input.idpId],
     auto_redirect_to_identity: true,
     policies: [policy]
@@ -549,7 +560,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`
   });
   if (!list.success) fail(list, "list access apps");
-  const existing = (list.result ?? []).find((a) => a.domain === input.service.hostname);
+  const existing = (list.result ?? []).find((a) => a.domain === appDomain);
   if (existing) {
     const upd = await cf2({
       apiToken: input.apiToken,
@@ -557,7 +568,7 @@ async function ensureAccessApp(input) {
       path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
       body
     });
-    if (!upd.success || !upd.result) fail(upd, `update access app ${input.service.hostname}`);
+    if (!upd.success || !upd.result) fail(upd, `update access app ${appDomain}`);
     return upd.result.id;
   }
   const created = await cf2({
@@ -566,7 +577,7 @@ async function ensureAccessApp(input) {
     path: `/accounts/${input.accountId}/access/apps`,
     body
   });
-  if (!created.success || !created.result) fail(created, `create access app ${input.service.hostname}`);
+  if (!created.success || !created.result) fail(created, `create access app ${appDomain}`);
   return created.result.id;
 }
 async function provisionAccess(input) {
@@ -585,7 +596,8 @@ async function provisionAccess(input) {
   saveState2(input.stateFile, { idpId, accountId: input.accountId });
   const appIds = {};
   for (const service of input.services) {
-    appIds[service.hostname] = await ensureAccessApp({
+    const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+    appIds[appDomain] = await ensureAccessApp({
       apiToken: input.apiToken,
       accountId: input.accountId,
       idpId,
@@ -596,6 +608,9 @@ async function provisionAccess(input) {
   return { idpId, authDomain, appIds };
 }
 
+// src/server/radar/registration.ts
+var RECEIVER_PATH = "/api/radar/ingest";
+
 // src/server/radar-docker-init-entry.ts
 var REQUIRED_ENV = [
   "CLAUDE_CREDENTIALS_B64",
@@ -831,7 +846,11 @@ var GATED_SERVICES = {
   // Claude web terminal — live drivable shell ⇒ RCE surface ⇒ short session.
   bot: { strict: true },
   // The user's own dev/preview server — a workday-length session is fine.
-  preview: { strict: false }
+  preview: { strict: false },
+  // Radar: gate the UI, bypass the (HMAC-verified) webhook receiver path.
+  radar: { strict: false, publicPaths: [RECEIVER_PATH] },
+  // Deck: gate the whole host — its push is localhost-only, never hits the edge.
+  deck: { strict: false }
 };
 async function registerOidcClient(serverUrl, pat, redirectUris) {
   const res = await fetch(new URL("/api/rover/oidc-client", serverUrl), {
@@ -858,20 +877,31 @@ async function maybeProvisionAccess(bundle, ingress) {
   const skipped = [];
   for (const [name, hostname] of Object.entries(ingress.hostnames)) {
     const cfg = GATED_SERVICES[name];
-    if (cfg) services.push({ hostname, strict: cfg.strict });
-    else skipped.push(name);
+    if (!cfg) {
+      skipped.push(name);
+      continue;
+    }
+    services.push({ hostname, strict: cfg.strict });
+    for (const path of cfg.publicPaths ?? []) {
+      services.push({ hostname, path, bypass: true });
+    }
   }
   if (skipped.length > 0) {
     console.log(`[entrypoint] CF Access: leaving machine surface(s) ungated: ${skipped.join(", ")}`);
   }
   if (services.length === 0) {
-    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview not provisioned)");
+    console.log("[entrypoint] CF Access: no human-facing service to gate (bot/preview/radar/deck not provisioned)");
     return;
   }
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
   const pat = requireEnv("LS_PAT");
   const stateFile = "/workspace/.launchpod/launch-kit-access.json";
-  console.log(`[entrypoint] gating ${services.map((s) => s.hostname).join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  const gatedHosts = services.filter((s) => !s.bypass).map((s) => s.hostname);
+  const bypassed = services.filter((s) => s.bypass).map((s) => `${s.hostname}${s.path ?? ""}`);
+  console.log(`[entrypoint] gating ${gatedHosts.join(", ")} behind CF Access (IdP: ${serverUrl})`);
+  if (bypassed.length > 0) {
+    console.log(`[entrypoint] CF Access: public bypass for ${bypassed.join(", ")}`);
+  }
   const result = await provisionAccess({
     apiToken: token,
     accountId,