@launchsecure/launch-kit 0.0.38 → 0.0.40

package/dist/server/deck-mcp-entry.js

@@ -128,24 +128,24 @@ var init_deck_lockfile = __esm({
 
 // src/server/deck-config.ts
 function loadDeckConfig(rootDir) {
-  const configPath = (0, import_node_path2.join)(rootDir, CONFIG_FILENAME);
-  if (!(0, import_node_fs2.existsSync)(configPath)) return {};
+  const configPath = (0, import_node_path3.join)(rootDir, CONFIG_FILENAME);
+  if (!(0, import_node_fs3.existsSync)(configPath)) return {};
   try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(configPath, "utf-8"));
+    return JSON.parse((0, import_node_fs3.readFileSync)(configPath, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveDeckConfig(rootDir, config) {
-  const configPath = (0, import_node_path2.join)(rootDir, CONFIG_FILENAME);
-  (0, import_node_fs2.writeFileSync)(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  const configPath = (0, import_node_path3.join)(rootDir, CONFIG_FILENAME);
+  (0, import_node_fs3.writeFileSync)(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
 }
-var import_node_fs2, import_node_path2, CONFIG_FILENAME;
+var import_node_fs3, import_node_path3, CONFIG_FILENAME;
 var init_deck_config = __esm({
   "src/server/deck-config.ts"() {
     "use strict";
-    import_node_fs2 = require("node:fs");
-    import_node_path2 = require("node:path");
+    import_node_fs3 = require("node:fs");
+    import_node_path3 = require("node:path");
     CONFIG_FILENAME = ".launchdeck.json";
   }
 });
@@ -1250,7 +1250,7 @@ var init_cred_shape = __esm({
 });
 
 // src/server/mcp-client.ts
-function mcpConfigFromCourse(projectRoot) {
+function mcpConfigForProfile(projectRoot, name) {
   let cred;
   try {
     cred = readCredFile(projectRoot);
@@ -1260,7 +1260,7 @@ function mcpConfigFromCourse(projectRoot) {
   if (!cred) return null;
   const nested = toNested(cred);
   if (!nested) return null;
-  const profile = nested.profiles[nested.active];
+  const profile = nested.profiles[name];
   if (!profile?.pat || !profile.serverUrl || !profile.orgSlug || !profile.projectSlug) {
     return null;
   }
@@ -1273,6 +1273,37 @@ function mcpConfigFromCourse(projectRoot) {
     }
   };
 }
+function mcpConfigFromCourse(projectRoot) {
+  let cred;
+  try {
+    cred = readCredFile(projectRoot);
+  } catch {
+    return null;
+  }
+  if (!cred) return null;
+  const nested = toNested(cred);
+  if (!nested) return null;
+  return mcpConfigForProfile(projectRoot, nested.active);
+}
+function listCourses(projectRoot) {
+  let cred;
+  try {
+    cred = readCredFile(projectRoot);
+  } catch {
+    return [];
+  }
+  if (!cred) return [];
+  const nested = toNested(cred);
+  if (!nested) return [];
+  return Object.entries(nested.profiles).map(([name, p]) => ({
+    name,
+    org: p.orgSlug ?? "",
+    project: p.projectSlug ?? "",
+    serverUrl: p.serverUrl ?? "",
+    active: name === nested.active,
+    usable: Boolean(p.pat && p.serverUrl && p.orgSlug && p.projectSlug)
+  }));
+}
 function loadMcpConfig(projectRoot) {
   if (_config) return _config;
   const fromCourse = mcpConfigFromCourse(projectRoot);
@@ -1280,13 +1311,13 @@ function loadMcpConfig(projectRoot) {
     _config = fromCourse;
     return _config;
   }
-  const mcpPath = (0, import_node_path3.join)(projectRoot, ".mcp.json");
-  if (!(0, import_node_fs3.existsSync)(mcpPath)) {
+  const mcpPath = (0, import_node_path4.join)(projectRoot, ".mcp.json");
+  if (!(0, import_node_fs4.existsSync)(mcpPath)) {
     throw new Error(
       `No active course in ${CONFIG_FILENAME2} and no .mcp.json at ${mcpPath}. Run \`launch-course\` or bootstrap with \`launch-kit init\`.`
     );
   }
-  const raw = JSON.parse((0, import_node_fs3.readFileSync)(mcpPath, "utf-8"));
+  const raw = JSON.parse((0, import_node_fs4.readFileSync)(mcpPath, "utf-8"));
   const entry = raw.mcpServers["launch-secure"];
   if (!entry?.url) {
     throw new Error(
@@ -1299,6 +1330,23 @@ function loadMcpConfig(projectRoot) {
   };
   return _config;
 }
+function withMcpConfig(override, fn) {
+  const run = async () => {
+    const prevConfig = _config;
+    const prevSession = _sessionId;
+    _config = override;
+    _sessionId = null;
+    try {
+      return await fn();
+    } finally {
+      _config = prevConfig;
+      _sessionId = prevSession;
+    }
+  };
+  const result = _overrideLock.then(run, run);
+  _overrideLock = result.then(() => void 0, () => void 0);
+  return result;
+}
 function parseSSE(text2) {
   const lines = text2.split("\n");
   for (const line of lines) {
@@ -1406,16 +1454,17 @@ async function updateDeck(commentId, input) {
 async function deleteDeck(commentId) {
   await callTool("communication_delete", { comment_id: commentId });
 }
-var import_node_fs3, import_node_path3, _config, _requestId, _sessionId;
+var import_node_fs4, import_node_path4, _config, _requestId, _sessionId, _overrideLock;
 var init_mcp_client = __esm({
   "src/server/mcp-client.ts"() {
     "use strict";
-    import_node_fs3 = require("node:fs");
-    import_node_path3 = require("node:path");
+    import_node_fs4 = require("node:fs");
+    import_node_path4 = require("node:path");
     init_cred_shape();
     _config = null;
     _requestId = 0;
     _sessionId = null;
+    _overrideLock = Promise.resolve();
   }
 });
 
@@ -1430,14 +1479,14 @@ __export(deck_serve_exports, {
   startDeckServer: () => startDeckServer
 });
 function sessionDir(cwd, session) {
-  return import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", session);
+  return import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", session);
 }
 function sessionJsonPath(cwd, session) {
-  return import_node_path4.default.join(sessionDir(cwd, session), "session.json");
+  return import_node_path5.default.join(sessionDir(cwd, session), "session.json");
 }
 function readPersistedSession(cwd, session) {
   try {
-    const raw = import_node_fs4.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
+    const raw = import_node_fs5.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -1445,7 +1494,7 @@ function readPersistedSession(cwd, session) {
 }
 function writePersistedSession(cwd, session, payload) {
   const dir = sessionDir(cwd, session);
-  import_node_fs4.default.mkdirSync(dir, { recursive: true });
+  import_node_fs5.default.mkdirSync(dir, { recursive: true });
   const existing = readPersistedSession(cwd, session);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const next = {
@@ -1457,18 +1506,19 @@ function writePersistedSession(cwd, session, payload) {
     createdAt: existing?.createdAt ?? now,
     updatedAt: now
   };
-  import_node_fs4.default.writeFileSync(sessionJsonPath(cwd, session), JSON.stringify(next, null, 2));
+  import_node_fs5.default.writeFileSync(sessionJsonPath(cwd, session), JSON.stringify(next, null, 2));
   return next;
 }
 function listPersistedSessions(cwd) {
-  const base = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
-  if (!import_node_fs4.default.existsSync(base)) return [];
-  const entries = import_node_fs4.default.readdirSync(base, { withFileTypes: true });
+  const base = import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
+  if (!import_node_fs5.default.existsSync(base)) return [];
+  const entries = import_node_fs5.default.readdirSync(base, { withFileTypes: true });
   const sessions = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const persisted = readPersistedSession(cwd, entry.name);
     if (!persisted) continue;
+    const sync = readSyncRecord(cwd, persisted.id);
     sessions.push({
       id: persisted.id,
       mode: persisted.mode,
@@ -1476,33 +1526,34 @@ function listPersistedSessions(cwd) {
       version: persisted.version,
       createdAt: persisted.createdAt,
       updatedAt: persisted.updatedAt,
-      shared: Boolean(readSyncRecord(cwd, persisted.id))
+      shared: Boolean(sync),
+      stale: Boolean(sync) && persisted.version > (sync?.version ?? 0)
     });
   }
   sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return sessions;
 }
 function deletePersistedSession(cwd, session) {
-  const base = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
+  const base = import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files");
   if (session === "all") {
-    if (import_node_fs4.default.existsSync(base)) import_node_fs4.default.rmSync(base, { recursive: true, force: true });
+    if (import_node_fs5.default.existsSync(base)) import_node_fs5.default.rmSync(base, { recursive: true, force: true });
     return;
   }
   const dir = sessionDir(cwd, session);
-  if (import_node_fs4.default.existsSync(dir)) import_node_fs4.default.rmSync(dir, { recursive: true, force: true });
+  if (import_node_fs5.default.existsSync(dir)) import_node_fs5.default.rmSync(dir, { recursive: true, force: true });
 }
 function syncJsonPath(cwd, session) {
-  return import_node_path4.default.join(sessionDir(cwd, session), ".sync.json");
+  return import_node_path5.default.join(sessionDir(cwd, session), ".sync.json");
 }
 function readSyncRecord(cwd, session) {
   try {
-    return JSON.parse(import_node_fs4.default.readFileSync(syncJsonPath(cwd, session), "utf-8"));
+    return JSON.parse(import_node_fs5.default.readFileSync(syncJsonPath(cwd, session), "utf-8"));
   } catch {
     return null;
   }
 }
 function writeSyncRecord(cwd, session, rec) {
-  import_node_fs4.default.writeFileSync(syncJsonPath(cwd, session), JSON.stringify(rec, null, 2));
+  import_node_fs5.default.writeFileSync(syncJsonPath(cwd, session), JSON.stringify(rec, null, 2));
 }
 function escHtml2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -1515,7 +1566,7 @@ function readIframeArtifact(cwd, src) {
   const rel = decodeURIComponent(src.slice("/deck-files/".length));
   if (rel.includes("..")) return null;
   try {
-    return import_node_fs4.default.readFileSync(import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", rel), "utf-8");
+    return import_node_fs5.default.readFileSync(import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", rel), "utf-8");
   } catch {
     return null;
   }
@@ -1612,23 +1663,23 @@ function broadcastToClients(message) {
   }
 }
 function serveStatic(res, filePath) {
-  if (!import_node_fs4.default.existsSync(filePath) || !import_node_fs4.default.statSync(filePath).isFile()) return false;
-  const ext = import_node_path4.default.extname(filePath).toLowerCase();
+  if (!import_node_fs5.default.existsSync(filePath) || !import_node_fs5.default.statSync(filePath).isFile()) return false;
+  const ext = import_node_path5.default.extname(filePath).toLowerCase();
   const mime = MIME_TYPES[ext] ?? "application/octet-stream";
   res.writeHead(200, { "Content-Type": mime, "Cache-Control": "no-cache" });
-  import_node_fs4.default.createReadStream(filePath).pipe(res);
+  import_node_fs5.default.createReadStream(filePath).pipe(res);
   return true;
 }
 function resolveClientDir() {
-  const sibling = import_node_path4.default.join(__dirname, "..", "deck-client");
-  if (import_node_fs4.default.existsSync(import_node_path4.default.join(sibling, "assets"))) return sibling;
-  const devDist = import_node_path4.default.join(__dirname, "..", "..", "dist", "deck-client");
-  if (import_node_fs4.default.existsSync(import_node_path4.default.join(devDist, "assets"))) return devDist;
+  const sibling = import_node_path5.default.join(__dirname, "..", "deck-client");
+  if (import_node_fs5.default.existsSync(import_node_path5.default.join(sibling, "assets"))) return sibling;
+  const devDist = import_node_path5.default.join(__dirname, "..", "..", "dist", "deck-client");
+  if (import_node_fs5.default.existsSync(import_node_path5.default.join(devDist, "assets"))) return devDist;
   return sibling;
 }
 function serveIndex(res, clientDir) {
-  const indexPath = import_node_path4.default.join(clientDir, "index.html");
-  if (!import_node_fs4.default.existsSync(indexPath)) {
+  const indexPath = import_node_path5.default.join(clientDir, "index.html");
+  if (!import_node_fs5.default.existsSync(indexPath)) {
     res.writeHead(500, { "Content-Type": "text/plain" });
     res.end(`LaunchDeck client bundle not found at ${clientDir}. Run 'npm run build:client'.`);
     return;
@@ -1711,6 +1762,10 @@ async function startDeckServer(opts = {}) {
         jsonResponse(res, 200, { config: cfg });
         return;
       }
+      if (req.method === "GET" && url2.pathname === "/api/deck/courses") {
+        jsonResponse(res, 200, { courses: listCourses(cwd) });
+        return;
+      }
       if (req.method === "POST" && url2.pathname === "/api/deck/config") {
         try {
           const body = JSON.parse(await readBody(req));
@@ -1732,15 +1787,15 @@ async function startDeckServer(opts = {}) {
               const baseUrl = `/deck-files/${sessionEncoded}`;
               const html = generateBlastRadiusHtml(block.manifest, baseUrl);
               const report = generateBlastRadiusReport(block.manifest);
-              const dir = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
-              import_node_fs4.default.mkdirSync(dir, { recursive: true });
-              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius.html"), html);
-              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius-report.md"), report);
-              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
+              const dir = import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
+              import_node_fs5.default.mkdirSync(dir, { recursive: true });
+              import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, "blast-radius.html"), html);
+              import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, "blast-radius-report.md"), report);
+              import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
               const contractData = generateContract(block.manifest);
               const contractMd = contractToMarkdown(contractData);
-              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "contract.json"), JSON.stringify(contractData, null, 2));
-              import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "contract.md"), contractMd);
+              import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, "contract.json"), JSON.stringify(contractData, null, 2));
+              import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, "contract.md"), contractMd);
               block.type = "iframe";
               block.src = `${baseUrl}/blast-radius.html`;
               delete block.manifest;
@@ -1767,9 +1822,9 @@ async function startDeckServer(opts = {}) {
                 const sessionEncoded = encodeURIComponent(body.session);
                 const baseUrl = `/deck-files/${sessionEncoded}`;
                 const filename = `${slugify(block.label)}.html`;
-                const dir = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
-                import_node_fs4.default.mkdirSync(dir, { recursive: true });
-                import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, filename), html);
+                const dir = import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", body.session);
+                import_node_fs5.default.mkdirSync(dir, { recursive: true });
+                import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, filename), html);
                 block.type = "iframe";
                 block.src = `${baseUrl}/${filename}`;
                 delete block.content;
@@ -1809,14 +1864,34 @@ async function startDeckServer(opts = {}) {
           jsonResponse(res, 404, { ok: false, error: "session not found" });
           return;
         }
+        let course;
         try {
-          loadMcpConfig(cwd);
-        } catch (err) {
-          jsonResponse(res, 400, {
-            ok: false,
-            error: `Cloud sharing needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}`
-          });
-          return;
+          const raw = await readBody(req);
+          if (raw.trim()) {
+            course = JSON.parse(raw).course?.trim() || void 0;
+          }
+        } catch {
+        }
+        let override = null;
+        if (course) {
+          override = mcpConfigForProfile(cwd, course);
+          if (!override) {
+            jsonResponse(res, 400, {
+              ok: false,
+              error: `Course "${course}" is not a usable profile in .launch-secure.cred.config (missing pat/serverUrl/orgSlug/projectSlug?).`
+            });
+            return;
+          }
+        } else {
+          try {
+            loadMcpConfig(cwd);
+          } catch (err) {
+            jsonResponse(res, 400, {
+              ok: false,
+              error: `Cloud sharing needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}`
+            });
+            return;
+          }
         }
         try {
           const blocks = Array.isArray(persisted.blocks) ? persisted.blocks : [];
@@ -1825,24 +1900,27 @@ async function startDeckServer(opts = {}) {
           const body = `Shared deck "${id}" \u2014 ${blocks.length} block${blocks.length === 1 ? "" : "s"}${types.length ? ` (${types.join(", ")})` : ""}. Open the Decks tab in the Communication Center to view.`;
           const input = { title: id, body, html, sessionId: id, blockCount: blocks.length };
           const existing2 = readSyncRecord(cwd, id);
-          let resourceId;
-          let updated = false;
-          if (existing2?.resourceId) {
-            try {
-              ({ id: resourceId } = await updateDeck(existing2.resourceId, input));
-              updated = true;
-            } catch {
-              ({ id: resourceId } = await writeDeck(input));
+          const doShare = async () => {
+            if (existing2?.resourceId) {
+              try {
+                const { id: rid2 } = await updateDeck(existing2.resourceId, input);
+                return { resourceId: rid2, updated: true };
+              } catch {
+                const { id: rid2 } = await writeDeck(input);
+                return { resourceId: rid2, updated: false };
+              }
             }
-          } else {
-            ({ id: resourceId } = await writeDeck(input));
-          }
+            const { id: rid } = await writeDeck(input);
+            return { resourceId: rid, updated: false };
+          };
+          const { resourceId, updated } = override ? await withMcpConfig(override, doShare) : await doShare();
           writeSyncRecord(cwd, id, {
             resourceId,
             sharedAt: (/* @__PURE__ */ new Date()).toISOString(),
-            version: persisted.version
+            version: persisted.version,
+            course
           });
-          jsonResponse(res, 200, { ok: true, resourceId, updated });
+          jsonResponse(res, 200, { ok: true, resourceId, updated, course });
         } catch (err) {
           jsonResponse(res, 500, { ok: false, error: String(err) });
         }
@@ -1865,7 +1943,7 @@ async function startDeckServer(opts = {}) {
         try {
           await deleteDeck(sync.resourceId);
           try {
-            import_node_fs4.default.rmSync(syncJsonPath(cwd, id), { force: true });
+            import_node_fs5.default.rmSync(syncJsonPath(cwd, id), { force: true });
           } catch {
           }
           jsonResponse(res, 200, { ok: true, deleted: true });
@@ -1976,7 +2054,7 @@ async function startDeckServer(opts = {}) {
           res.end("Forbidden");
           return;
         }
-        const filePath = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
+        const filePath = import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
         if (serveStatic(res, filePath)) return;
         res.writeHead(404);
         res.end("Not found");
@@ -1989,25 +2067,25 @@ async function startDeckServer(opts = {}) {
           res.end("Forbidden");
           return;
         }
-        const filePath = import_node_path4.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
-        if (!import_node_fs4.default.existsSync(filePath) || !import_node_fs4.default.statSync(filePath).isFile()) {
+        const filePath = import_node_path5.default.join(cwd, LAUNCHSECURE_DIR, "deck-files", relative);
+        if (!import_node_fs5.default.existsSync(filePath) || !import_node_fs5.default.statSync(filePath).isFile()) {
           res.writeHead(404);
           res.end("Not found");
           return;
         }
-        const ext = import_node_path4.default.extname(filePath).toLowerCase();
+        const ext = import_node_path5.default.extname(filePath).toLowerCase();
         const mime = MIME_TYPES[ext] ?? "application/octet-stream";
-        const filename = import_node_path4.default.basename(filePath);
+        const filename = import_node_path5.default.basename(filePath);
         res.writeHead(200, {
           "Content-Type": mime,
           "Content-Disposition": `attachment; filename="${filename}"`,
           "Cache-Control": "no-cache"
         });
-        import_node_fs4.default.createReadStream(filePath).pipe(res);
+        import_node_fs5.default.createReadStream(filePath).pipe(res);
         return;
       }
       if (url2.pathname !== "/") {
-        const staticPath = import_node_path4.default.join(clientDir, url2.pathname);
+        const staticPath = import_node_path5.default.join(clientDir, url2.pathname);
         if (serveStatic(res, staticPath)) return;
       }
       serveIndex(res, clientDir);
@@ -2106,13 +2184,13 @@ function runServeCli(argv) {
     process.exit(1);
   });
 }
-var import_node_http, import_node_fs4, import_node_path4, import_ws, DEFAULT_PORT, MAX_PORT_SCAN, MIME_TYPES, pendingFeedback, lastRenderError, wss;
+var import_node_http, import_node_fs5, import_node_path5, import_ws, DEFAULT_PORT, MAX_PORT_SCAN, MIME_TYPES, pendingFeedback, lastRenderError, wss;
 var init_deck_serve = __esm({
   "src/server/deck-serve.ts"() {
     "use strict";
     import_node_http = __toESM(require("node:http"));
-    import_node_fs4 = __toESM(require("node:fs"));
-    import_node_path4 = __toESM(require("node:path"));
+    import_node_fs5 = __toESM(require("node:fs"));
+    import_node_path5 = __toESM(require("node:path"));
     import_ws = require("ws");
     init_launch_kit_paths();
     init_deck_lockfile();
@@ -2206,15 +2284,15 @@ async function handleTool(name, args) {
             const baseUrl = `/deck-files/${sessionEncoded}`;
             const html = generateBlastRadiusHtml(block.manifest, baseUrl);
             const report = generateBlastRadiusReport(block.manifest);
-            const dir = (0, import_node_path5.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
-            import_node_fs5.default.mkdirSync(dir, { recursive: true });
-            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "blast-radius.html"), html);
-            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "blast-radius-report.md"), report);
-            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
+            const dir = (0, import_node_path6.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
+            import_node_fs6.default.mkdirSync(dir, { recursive: true });
+            import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, "blast-radius.html"), html);
+            import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, "blast-radius-report.md"), report);
+            import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, "blast-radius-manifest.json"), JSON.stringify(block.manifest, null, 2));
             const contractData = generateContract(block.manifest);
             const contractMd = contractToMarkdown(contractData);
-            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.json"), JSON.stringify(contractData, null, 2));
-            import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.md"), contractMd);
+            import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, "contract.json"), JSON.stringify(contractData, null, 2));
+            import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, "contract.md"), contractMd);
             block.type = "iframe";
             block.src = `${baseUrl}/blast-radius.html`;
             delete block.manifest;
@@ -2241,9 +2319,9 @@ async function handleTool(name, args) {
               const sessionEncoded = encodeURIComponent(session);
               const baseUrl = `/deck-files/${sessionEncoded}`;
               const filename = `${slugify(block.label)}.html`;
-              const dir = (0, import_node_path5.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
-              import_node_fs5.default.mkdirSync(dir, { recursive: true });
-              import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, filename), html);
+              const dir = (0, import_node_path6.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
+              import_node_fs6.default.mkdirSync(dir, { recursive: true });
+              import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, filename), html);
               block.type = "iframe";
               block.src = `${baseUrl}/${filename}`;
               delete block.content;
@@ -2337,11 +2415,11 @@ async function handleTool(name, args) {
         }));
       }
       try {
-        const logDir = (0, import_node_path5.join)((0, import_node_os2.homedir)(), LAUNCHSECURE_DIR);
-        (0, import_node_fs6.mkdirSync)(logDir, { recursive: true });
-        const logPath = (0, import_node_path5.join)(logDir, "launch-deck.log");
-        const out = (0, import_node_fs6.openSync)(logPath, "a");
-        const err = (0, import_node_fs6.openSync)(logPath, "a");
+        const logDir = (0, import_node_path6.join)((0, import_node_os3.homedir)(), LAUNCHSECURE_DIR);
+        (0, import_node_fs7.mkdirSync)(logDir, { recursive: true });
+        const logPath = (0, import_node_path6.join)(logDir, "launch-deck.log");
+        const out = (0, import_node_fs7.openSync)(logPath, "a");
+        const err = (0, import_node_fs7.openSync)(logPath, "a");
         const entryPath = process.argv[1];
         const config = loadDeckConfig(projectRoot);
         const resolvedPort = args.port ?? config.port;
@@ -2397,21 +2475,21 @@ async function handleTool(name, args) {
     }
     case "generate_contract": {
       const session = args.session;
-      const dir = (0, import_node_path5.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
-      const manifestPath = (0, import_node_path5.join)(dir, "blast-radius-manifest.json");
-      if (!import_node_fs5.default.existsSync(manifestPath)) {
+      const dir = (0, import_node_path6.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
+      const manifestPath = (0, import_node_path6.join)(dir, "blast-radius-manifest.json");
+      if (!import_node_fs6.default.existsSync(manifestPath)) {
         return text(JSON.stringify({
           error: `No blast radius manifest found for session "${session}". Push a blast-radius block first.`,
           hint: "Use the deck tool with a blast-radius block type to create a session."
         }));
       }
       try {
-        const raw = import_node_fs5.default.readFileSync(manifestPath, "utf-8");
+        const raw = import_node_fs6.default.readFileSync(manifestPath, "utf-8");
         const manifest = JSON.parse(raw);
         const contract = generateContract(manifest);
         const markdown = contractToMarkdown(contract);
-        import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.json"), JSON.stringify(contract, null, 2));
-        import_node_fs5.default.writeFileSync((0, import_node_path5.join)(dir, "contract.md"), markdown);
+        import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, "contract.json"), JSON.stringify(contract, null, 2));
+        import_node_fs6.default.writeFileSync((0, import_node_path6.join)(dir, "contract.md"), markdown);
         return text(JSON.stringify(contract));
       } catch (err) {
         return text(JSON.stringify({ error: `Failed to generate contract: ${err}` }));
@@ -2502,16 +2580,16 @@ function startDeckMcpServer() {
     process.exit(0);
   });
 }
-var import_node_http2, import_node_fs5, import_node_path5, import_node_child_process2, import_node_fs6, import_node_os2, SERVER_INFO, TOOLS;
+var import_node_http2, import_node_fs6, import_node_path6, import_node_child_process2, import_node_fs7, import_node_os3, SERVER_INFO, TOOLS;
 var init_deck_mcp = __esm({
   "src/server/deck-mcp.ts"() {
     "use strict";
     import_node_http2 = __toESM(require("node:http"));
-    import_node_fs5 = __toESM(require("node:fs"));
-    import_node_path5 = require("node:path");
+    import_node_fs6 = __toESM(require("node:fs"));
+    import_node_path6 = require("node:path");
     import_node_child_process2 = require("node:child_process");
-    import_node_fs6 = require("node:fs");
-    import_node_os2 = require("node:os");
+    import_node_fs7 = require("node:fs");
+    import_node_os3 = require("node:os");
     init_launch_kit_paths();
     init_deck_lockfile();
     init_deck_config();
@@ -2655,8 +2733,92 @@ var init_deck_mcp = __esm({
 
 // src/server/deck-mcp-entry.ts
 init_deck_lockfile();
+
+// src/server/prune-npx-cache.ts
+var import_node_fs2 = require("node:fs");
+var import_node_os2 = require("node:os");
+var import_node_path2 = require("node:path");
+var import_node_util = require("node:util");
+var PKG = "@launchsecure/launch-kit";
+var readFileAsync = (0, import_node_util.promisify)(import_node_fs2.readFile);
+var readdirAsync = (0, import_node_util.promisify)(import_node_fs2.readdir);
+var rmAsync = (0, import_node_util.promisify)(import_node_fs2.rm);
+var realpathAsync = (0, import_node_util.promisify)(import_node_fs2.realpath);
+function npxCacheRoot() {
+  const cache = process.env.npm_config_cache;
+  if (cache && cache.trim()) return (0, import_node_path2.join)(cache, "_npx");
+  if (process.platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA;
+    if (localAppData) return (0, import_node_path2.join)(localAppData, "npm-cache", "_npx");
+  }
+  return (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".npm", "_npx");
+}
+function ownVersion() {
+  let dir = __dirname;
+  for (let i = 0; i < 8; i++) {
+    try {
+      const pkg = JSON.parse((0, import_node_fs2.readFileSync)((0, import_node_path2.join)(dir, "package.json"), "utf8"));
+      if (pkg && pkg.name === PKG) return typeof pkg.version === "string" ? pkg.version : null;
+    } catch {
+    }
+    const parent = (0, import_node_path2.dirname)(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+async function pruneStaleNpxCache() {
+  try {
+    const version = ownVersion();
+    if (!version) return;
+    const root = npxCacheRoot();
+    let hashes;
+    try {
+      hashes = await readdirAsync(root);
+    } catch {
+      return;
+    }
+    const selfPath = await realpathAsync(process.argv[1] || __dirname).catch(() => __dirname);
+    let reaped = 0;
+    for (const hash of hashes) {
+      const dir = (0, import_node_path2.join)(root, hash);
+      if (selfPath === dir || selfPath.startsWith(dir + import_node_path2.sep)) continue;
+      let ver;
+      try {
+        const lkPkg = JSON.parse(
+          await readFileAsync((0, import_node_path2.join)(dir, "node_modules", PKG, "package.json"), "utf8")
+        );
+        ver = lkPkg.version;
+      } catch {
+        continue;
+      }
+      if (ver === version) continue;
+      try {
+        const top = JSON.parse(await readFileAsync((0, import_node_path2.join)(dir, "package.json"), "utf8"));
+        const spec = top?.dependencies?.[PKG];
+        if (typeof spec === "string" && spec.startsWith("file:")) continue;
+      } catch {
+      }
+      try {
+        await rmAsync(dir, { recursive: true, force: true });
+        reaped++;
+      } catch {
+      }
+    }
+    if (reaped > 0) {
+      process.stderr.write(
+        `[launch-kit] npx-cache: reaped ${reaped} stale copy(ies), kept v${version}
+`
+      );
+    }
+  } catch {
+  }
+}
+
+// src/server/deck-mcp-entry.ts
 async function main() {
   setProjectRoot(process.cwd());
+  void pruneStaleNpxCache();
   const argv = process.argv.slice(2);
   const subcommand = argv[0];
   if (subcommand === "serve") {