@launchsecure/launch-kit 0.0.40 → 0.0.42

package/dist/server/deck-mcp-entry.js

@@ -1421,7 +1421,13 @@ async function callTool(toolName, args) {
   }
   const textContent = result.result?.content?.[0]?.text;
   if (!textContent) return null;
-  return JSON.parse(textContent);
+  try {
+    return JSON.parse(textContent);
+  } catch {
+    const match = textContent.match(/──+\s*Error\s*──+\s*\n([\s\S]*?)(?:\n\n──|$)/i);
+    const message = (match?.[1] ?? textContent).trim();
+    throw new Error(message || "MCP tool returned an unparseable response");
+  }
 }
 async function writeDeck(input) {
   const result = await callTool("communication_write", {
@@ -1430,6 +1436,7 @@ async function writeDeck(input) {
     resource_type: "deck",
     fields: {
       deckHtml: input.html,
+      deckBlocks: input.blocks,
       sessionId: input.sessionId,
       blockCount: input.blockCount,
       sharedFrom: "launch-deck"
@@ -1444,6 +1451,7 @@ async function updateDeck(commentId, input) {
     body: input.body,
     fields: {
       deckHtml: input.html,
+      deckBlocks: input.blocks,
       sessionId: input.sessionId,
       blockCount: input.blockCount,
       sharedFrom: "launch-deck"
@@ -1454,6 +1462,49 @@ async function updateDeck(commentId, input) {
 async function deleteDeck(commentId) {
   await callTool("communication_delete", { comment_id: commentId });
 }
+function authorLabel(c) {
+  return c.author?.name || c.author?.email || "unknown";
+}
+async function readCloudDeck(commentId) {
+  const result = await callTool("communication_read", {
+    resource_type: "deck",
+    limit: 50
+  });
+  const deck = result?.comments?.find((c) => c.id === commentId);
+  if (!deck) return null;
+  return {
+    id: deck.id,
+    title: deck.title ?? "(untitled deck)",
+    author: authorLabel(deck),
+    html: typeof deck.fields?.deckHtml === "string" ? deck.fields.deckHtml : null,
+    blocks: Array.isArray(deck.fields?.deckBlocks) && deck.fields.deckBlocks.length > 0 ? deck.fields.deckBlocks : null
+  };
+}
+function currentMcpOrigin() {
+  const config = _config;
+  if (!config) throw new Error("MCP config not loaded \u2014 call loadMcpConfig first");
+  return new URL(config.url).origin;
+}
+async function createDeckShareLink(commentId) {
+  const result = await callTool("deck_share_link", {
+    comment_id: commentId,
+    action: "create"
+  });
+  const token = result.link.token;
+  return {
+    linkId: result.link.id,
+    token,
+    shareUrl: `${currentMcpOrigin()}/s/deck/${token}`,
+    reused: Boolean(result.reused)
+  };
+}
+async function revokeDeckShareLink(commentId, linkId) {
+  await callTool("deck_share_link", {
+    comment_id: commentId,
+    action: "revoke",
+    link_id: linkId
+  });
+}
 var import_node_fs4, import_node_path4, _config, _requestId, _sessionId, _overrideLock;
 var init_mcp_client = __esm({
   "src/server/mcp-client.ts"() {
@@ -1472,6 +1523,7 @@ var init_mcp_client = __esm({
 var deck_serve_exports = {};
 __export(deck_serve_exports, {
   broadcastToClients: () => broadcastToClients,
+  buildSharePayload: () => buildSharePayload,
   consumeRenderError: () => consumeRenderError,
   createFeedbackWaiter: () => createFeedbackWaiter,
   resolveFeedback: () => resolveFeedback,
@@ -1484,6 +1536,10 @@ function sessionDir(cwd, session) {
 function sessionJsonPath(cwd, session) {
   return import_node_path5.default.join(sessionDir(cwd, session), "session.json");
 }
+function sessionIdFromCloud(title, fallbackId) {
+  const slug = title.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
+  return slug || `deck-${fallbackId.slice(0, 8)}`;
+}
 function readPersistedSession(cwd, session) {
   try {
     const raw = import_node_fs5.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
@@ -1527,7 +1583,11 @@ function listPersistedSessions(cwd) {
       createdAt: persisted.createdAt,
       updatedAt: persisted.updatedAt,
       shared: Boolean(sync),
-      stale: Boolean(sync) && persisted.version > (sync?.version ?? 0)
+      stale: Boolean(sync) && persisted.version > (sync?.version ?? 0),
+      shareUrl: sync?.publicShareUrl,
+      course: sync?.course,
+      watching: sync?.watching,
+      watchedFrom: sync?.watchedFrom
     });
   }
   sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -1555,6 +1615,24 @@ function readSyncRecord(cwd, session) {
 function writeSyncRecord(cwd, session, rec) {
   import_node_fs5.default.writeFileSync(syncJsonPath(cwd, session), JSON.stringify(rec, null, 2));
 }
+function resolveShareConfig(cwd, course) {
+  if (course) {
+    const override = mcpConfigForProfile(cwd, course);
+    if (!override) {
+      return { error: `Course "${course}" is not a usable profile in .launch-secure.cred.config (missing pat/serverUrl/orgSlug/projectSlug?).` };
+    }
+    return { override };
+  }
+  try {
+    loadMcpConfig(cwd);
+  } catch (err) {
+    return { error: `Cloud sharing needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}` };
+  }
+  return { override: null };
+}
+function runWithShareConfig(override, fn) {
+  return override ? withMcpConfig(override, fn) : fn();
+}
 function escHtml2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -1571,31 +1649,49 @@ function readIframeArtifact(cwd, src) {
     return null;
   }
 }
-function renderShareSection(cwd, block) {
-  const label = block?.label ? `<h2 class="db-title">${escHtml2(String(block.label))}</h2>` : "";
+function renderShareSection(cwd, block, showLabel = true) {
+  const label = showLabel && block?.label ? `<h2 class="db-title">${escHtml2(String(block.label))}</h2>` : "";
   switch (block?.type) {
     case "iframe": {
       const doc = readIframeArtifact(cwd, block.src) ?? "<p>(missing artifact)</p>";
-      return `<section class="db">${label}<iframe class="db-frame" sandbox="allow-scripts allow-popups" srcdoc="${escAttr(doc)}"></iframe></section>`;
+      return `${label}<iframe class="db-frame" sandbox="allow-scripts allow-popups" srcdoc="${escAttr(doc)}"></iframe>`;
     }
     case "rich-html":
     case "html":
-      return `<section class="db">${label}<div class="db-html">${typeof block.content === "string" ? block.content : ""}</div></section>`;
+      return `${label}<div class="db-html">${typeof block.content === "string" ? block.content : ""}</div>`;
     case "markdown":
-      return `<section class="db">${label}<div class="db-md" data-md="${escAttr(typeof block.content === "string" ? block.content : "")}"></div></section>`;
+      return `${label}<div class="db-md" data-md="${escAttr(typeof block.content === "string" ? block.content : "")}"></div>`;
     case "mermaid":
-      return `<section class="db">${label}<pre class="mermaid">${escHtml2(typeof block.content === "string" ? block.content : "")}</pre></section>`;
+      if (typeof block.renderedSvg === "string" && block.renderedSvg.trim()) {
+        return `${label}<div class="mermaid-svg">${block.renderedSvg}</div>`;
+      }
+      return `${label}<pre class="mermaid">${escHtml2(typeof block.content === "string" ? block.content : "")}</pre>`;
     case "options": {
       const opts = Array.isArray(block.options) ? block.options : [];
-      const lis = opts.map(
-        (o) => `<li><strong>${escHtml2(String(o?.label ?? o?.id ?? ""))}</strong>${o?.description ? ` \u2014 ${escHtml2(String(o.description))}` : ""}</li>`
+      const cards = opts.map(
+        (o) => `<div class="db-option"><div class="db-option-label">${escHtml2(String(o?.label ?? o?.id ?? ""))}</div>${o?.description ? `<div class="db-option-desc">${escHtml2(String(o.description))}</div>` : ""}${o?.preview ? `<pre class="db-option-pre">${escHtml2(String(o.preview))}</pre>` : ""}</div>`
       ).join("");
-      return `<section class="db">${label}<ul>${lis}</ul></section>`;
+      return `${label}<div class="db-options">${cards}</div>`;
     }
     default:
-      return `<section class="db">${label}</section>`;
+      return label;
   }
 }
+function buildSharePayload(cwd, session, blocks, svgByIndex = {}) {
+  const enriched = blocks.map((b, i) => {
+    const svg = svgByIndex[String(i)];
+    return b?.type === "mermaid" && typeof svg === "string" && svg.trim() ? { ...b, renderedSvg: svg } : b;
+  });
+  const html = buildShareHtml(cwd, session, enriched);
+  const cloudBlocks = enriched.map((b) => {
+    if (b?.type === "iframe" && typeof b.src === "string") {
+      const content = readIframeArtifact(cwd, b.src);
+      return content ? { ...b, content } : b;
+    }
+    return b;
+  });
+  return { html, cloudBlocks };
+}
 function buildShareHtml(cwd, session, blocks) {
   if (blocks.length === 1) {
     const only = blocks[0];
@@ -1605,28 +1701,57 @@ function buildShareHtml(cwd, session, blocks) {
     }
   }
   const list = blocks;
-  const sections = list.map((b) => renderShareSection(cwd, b)).join("\n");
+  const multi = list.length > 1;
+  const tabBar = multi ? `<nav class="deck-tabs">${list.map(
+    (b, i) => `<button class="deck-tab${i === 0 ? " active" : ""}" data-tab-btn="${i}">${escHtml2(String(b?.label ?? `Tab ${i + 1}`))}</button>`
+  ).join("")}</nav>` : "";
+  const sections = list.map(
+    (b, i) => `<section class="db" data-tab="${i}"${multi && i > 0 ? " hidden" : ""}>${renderShareSection(cwd, b, !multi)}</section>`
+  ).join("\n");
   const hasMd = list.some((b) => b?.type === "markdown");
-  const hasMermaid = list.some((b) => b?.type === "mermaid");
+  const hasUnrenderedMermaid = list.some(
+    (b) => b?.type === "mermaid" && !(typeof b?.renderedSvg === "string" && b.renderedSvg.trim())
+  );
   return `<!DOCTYPE html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>${escHtml2(session)}</title>
+<link href="https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,100..1000&display=swap" rel="stylesheet">
 <style>
-  body { margin:0; font-family: ui-sans-serif, system-ui, sans-serif; background:#0b0e14; color:#e6e9ef; }
+  body { margin:0; font-family: 'DM Sans', system-ui, sans-serif; background:#0b0e14; color:#e6e9ef; }
   .db { padding:20px 24px; border-bottom:1px solid #1e2433; }
   .db-title { font-size:13px; font-weight:600; margin:0 0 12px; color:#9aa4b2; text-transform:uppercase; letter-spacing:.05em; }
   .db-frame { width:100%; height:70vh; border:0; border-radius:8px; background:#fff; }
   .db-html { background:#fff; color:#111; border-radius:8px; padding:16px; overflow:auto; }
   ul { line-height:1.7; }
-  .mermaid { background:#fff; border-radius:8px; padding:16px; }
+  /* The embedded SVG is dark-themed (captured from the deck client); keep its
+     backdrop transparent so it sits on the dark page, matching the in-app
+     DeckView \u2014 not a white card. The CDN-source fallback also renders dark. */
+  .mermaid { background:transparent; border-radius:8px; padding:16px; }
+  .mermaid-svg { background:transparent; border-radius:8px; padding:16px; overflow:auto; }
+  .mermaid-svg svg { max-width:100%; height:auto; }
+  .db-options { display:grid; gap:12px; grid-template-columns:repeat(auto-fill, minmax(220px, 1fr)); }
+  .db-option { border:2px solid #1e2433; border-radius:8px; padding:16px; }
+  .db-option-label { font-size:14px; font-weight:600; color:#e6e9ef; }
+  .db-option-desc { margin-top:4px; font-size:12px; color:#9aa4b2; }
+  .db-option-pre { margin-top:8px; padding:8px; border-radius:6px; background:#11151f; font-size:12px; overflow:auto; }
+  .deck-tabs { position:sticky; top:0; z-index:5; display:flex; flex-wrap:wrap; gap:2px; background:#0b0e14; border-bottom:1px solid #1e2433; padding:0 16px; }
+  .deck-tab { appearance:none; border:0; background:transparent; color:#9aa4b2; font:inherit; font-size:13px; font-weight:500; padding:12px 16px; cursor:pointer; border-bottom:2px solid transparent; }
+  .deck-tab:hover { color:#e6e9ef; }
+  .deck-tab.active { color:#c084fc; border-bottom-color:#c084fc; }
+  .db[hidden] { display:none; }
 </style></head>
 <body>
+${tabBar}
 ${sections}
+${multi ? `<script>(function(){var b=[].slice.call(document.querySelectorAll('[data-tab-btn]')),s=[].slice.call(document.querySelectorAll('[data-tab]'));b.forEach(function(x){x.addEventListener('click',function(){var i=x.getAttribute('data-tab-btn');s.forEach(function(y){y.hidden=y.getAttribute('data-tab')!==i;});b.forEach(function(z){z.classList.toggle('active',z===x);});});});})();</script>` : ""}
 ${hasMd ? `<script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
 <script>document.querySelectorAll('.db-md').forEach(function(el){try{el.innerHTML=marked.parse(el.dataset.md||'')}catch(e){el.textContent=el.dataset.md||''}});</script>` : ""}
-${hasMermaid ? `<script type="module">import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.esm.min.mjs';mermaid.initialize({startOnLoad:true,theme:'dark'});</script>` : ""}
+${hasUnrenderedMermaid ? `<script type="module">import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';mermaid.initialize({startOnLoad:true,theme:document.documentElement.classList.contains('light')?'default':'dark',securityLevel:'loose',fontFamily:"'DM Sans', system-ui, sans-serif"});</script>` : ""}
 </body></html>`;
 }
+function broadcastDiscuss() {
+  broadcastToClients({ type: "discuss_session", sessions: discussSessions.map((d) => d.id) });
+}
 function consumeRenderError() {
   const err = lastRenderError;
   lastRenderError = null;
@@ -1856,6 +1981,74 @@ async function startDeckServer(opts = {}) {
         jsonResponse(res, 200, { sessions: listPersistedSessions(cwd) });
         return;
       }
+      const pullMatch = url2.pathname.match(/^\/api\/cloud-decks\/([^/]+)\/pull$/);
+      if (pullMatch && req.method === "POST") {
+        const deckId = decodeURIComponent(pullMatch[1]);
+        let course;
+        try {
+          const raw = await readBody(req);
+          if (raw.trim()) {
+            const parsed = JSON.parse(raw);
+            course = parsed.course?.trim() || void 0;
+          }
+        } catch {
+        }
+        const cfg = resolveShareConfig(cwd, course);
+        if ("error" in cfg) {
+          jsonResponse(res, 400, { ok: false, error: cfg.error });
+          return;
+        }
+        try {
+          const deck = await runWithShareConfig(cfg.override, () => readCloudDeck(deckId));
+          if (!deck) {
+            jsonResponse(res, 404, { ok: false, error: `No shared deck "${deckId}" in this course.` });
+            return;
+          }
+          if (!deck.html && !deck.blocks) {
+            jsonResponse(res, 422, { ok: false, error: "That deck carries no viewable content (no deckHtml or deckBlocks)." });
+            return;
+          }
+          const session = sessionIdFromCloud(deck.title, deck.id);
+          const sessionEncoded = encodeURIComponent(session);
+          let blocks;
+          if (deck.html) {
+            const dir = sessionDir(cwd, session);
+            import_node_fs5.default.mkdirSync(dir, { recursive: true });
+            import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, "imported.html"), deck.html);
+            blocks = [{ type: "iframe", label: deck.title, src: `/deck-files/${sessionEncoded}/imported.html` }];
+          } else {
+            blocks = deck.blocks;
+          }
+          const persisted = writePersistedSession(cwd, session, { mode: "show", blocks });
+          writeSyncRecord(cwd, session, {
+            resourceId: deck.id,
+            sharedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            version: persisted.version,
+            course,
+            watching: true,
+            watchedFrom: deck.author
+          });
+          broadcastToClients({
+            type: "session",
+            session,
+            mode: "show",
+            blocks,
+            version: persisted.version
+          });
+          jsonResponse(res, 200, {
+            ok: true,
+            session,
+            deckId: deck.id,
+            title: deck.title,
+            author: deck.author,
+            blockCount: blocks.length,
+            course
+          });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
       const shareMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/share$/);
       if (shareMatch && req.method === "POST") {
         const id = decodeURIComponent(shareMatch[1]);
@@ -1865,45 +2058,35 @@ async function startDeckServer(opts = {}) {
           return;
         }
         let course;
+        let svgByIndex = {};
+        let publicLink = false;
         try {
           const raw = await readBody(req);
           if (raw.trim()) {
-            course = JSON.parse(raw).course?.trim() || void 0;
+            const parsed = JSON.parse(raw);
+            course = parsed.course?.trim() || void 0;
+            if (parsed.svgByIndex && typeof parsed.svgByIndex === "object") svgByIndex = parsed.svgByIndex;
+            publicLink = parsed.publicLink === true;
           }
         } catch {
         }
-        let override = null;
-        if (course) {
-          override = mcpConfigForProfile(cwd, course);
-          if (!override) {
-            jsonResponse(res, 400, {
-              ok: false,
-              error: `Course "${course}" is not a usable profile in .launch-secure.cred.config (missing pat/serverUrl/orgSlug/projectSlug?).`
-            });
-            return;
-          }
-        } else {
-          try {
-            loadMcpConfig(cwd);
-          } catch (err) {
-            jsonResponse(res, 400, {
-              ok: false,
-              error: `Cloud sharing needs an active LaunchSecure course (.launch-secure.cred.config) or a "launch-secure" entry in .mcp.json: ${String(err)}`
-            });
-            return;
-          }
+        const cfg = resolveShareConfig(cwd, course);
+        if ("error" in cfg) {
+          jsonResponse(res, 400, { ok: false, error: cfg.error });
+          return;
         }
+        const { override } = cfg;
         try {
           const blocks = Array.isArray(persisted.blocks) ? persisted.blocks : [];
-          const html = buildShareHtml(cwd, id, blocks);
+          const { html, cloudBlocks } = buildSharePayload(cwd, id, blocks, svgByIndex);
           const types = blocks.map((b) => b?.type).filter(Boolean);
           const body = `Shared deck "${id}" \u2014 ${blocks.length} block${blocks.length === 1 ? "" : "s"}${types.length ? ` (${types.join(", ")})` : ""}. Open the Decks tab in the Communication Center to view.`;
-          const input = { title: id, body, html, sessionId: id, blockCount: blocks.length };
-          const existing2 = readSyncRecord(cwd, id);
+          const input = { title: id, body, html, blocks: cloudBlocks, sessionId: id, blockCount: blocks.length };
+          const existingSync = readSyncRecord(cwd, id);
           const doShare = async () => {
-            if (existing2?.resourceId) {
+            if (existingSync?.resourceId) {
               try {
-                const { id: rid2 } = await updateDeck(existing2.resourceId, input);
+                const { id: rid2 } = await updateDeck(existingSync.resourceId, input);
                 return { resourceId: rid2, updated: true };
               } catch {
                 const { id: rid2 } = await writeDeck(input);
@@ -1913,14 +2096,89 @@ async function startDeckServer(opts = {}) {
             const { id: rid } = await writeDeck(input);
             return { resourceId: rid, updated: false };
           };
-          const { resourceId, updated } = override ? await withMcpConfig(override, doShare) : await doShare();
+          const result = await runWithShareConfig(override, async () => {
+            const shared = await doShare();
+            let link = null;
+            let linkError;
+            if (publicLink) {
+              try {
+                const minted = await createDeckShareLink(shared.resourceId);
+                link = { shareUrl: minted.shareUrl, linkId: minted.linkId };
+              } catch (err) {
+                linkError = err instanceof Error ? err.message : String(err);
+              }
+            }
+            return { shared, link, linkError };
+          });
+          if (publicLink && result.linkError && !result.shared.updated) {
+            try {
+              await runWithShareConfig(override, () => deleteDeck(result.shared.resourceId));
+            } catch {
+            }
+            jsonResponse(res, 200, {
+              ok: false,
+              error: `Couldn't create the public link, so the deck wasn't shared: ${result.linkError}`
+            });
+            return;
+          }
+          const publicShareUrl = result.link?.shareUrl ?? existingSync?.publicShareUrl;
+          const publicLinkId = result.link?.linkId ?? existingSync?.publicLinkId;
           writeSyncRecord(cwd, id, {
-            resourceId,
+            resourceId: result.shared.resourceId,
             sharedAt: (/* @__PURE__ */ new Date()).toISOString(),
             version: persisted.version,
-            course
+            course,
+            ...publicShareUrl ? { publicShareUrl } : {},
+            ...publicLinkId ? { publicLinkId } : {}
+          });
+          jsonResponse(res, 200, {
+            ok: true,
+            resourceId: result.shared.resourceId,
+            updated: result.shared.updated,
+            course,
+            shareUrl: publicShareUrl ?? null,
+            ...result.linkError ? { linkWarning: result.linkError } : {}
           });
-          jsonResponse(res, 200, { ok: true, resourceId, updated, course });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
+      const publicLinkMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/public-link$/);
+      if (publicLinkMatch && (req.method === "POST" || req.method === "DELETE")) {
+        const id = decodeURIComponent(publicLinkMatch[1]);
+        const sync = readSyncRecord(cwd, id);
+        if (!sync?.resourceId) {
+          jsonResponse(res, 409, { ok: false, error: "Share this deck to the cloud first, then create a public link." });
+          return;
+        }
+        const cfg = resolveShareConfig(cwd, sync.course);
+        if ("error" in cfg) {
+          jsonResponse(res, 400, { ok: false, error: cfg.error });
+          return;
+        }
+        const { override } = cfg;
+        if (req.method === "DELETE") {
+          if (!sync.publicLinkId) {
+            if (sync.publicShareUrl) {
+              writeSyncRecord(cwd, id, { ...sync, publicShareUrl: void 0, publicLinkId: void 0 });
+            }
+            jsonResponse(res, 200, { ok: true, revoked: false });
+            return;
+          }
+          try {
+            await runWithShareConfig(override, () => revokeDeckShareLink(sync.resourceId, sync.publicLinkId));
+            writeSyncRecord(cwd, id, { ...sync, publicShareUrl: void 0, publicLinkId: void 0 });
+            jsonResponse(res, 200, { ok: true, revoked: true });
+          } catch (err) {
+            jsonResponse(res, 500, { ok: false, error: String(err) });
+          }
+          return;
+        }
+        try {
+          const minted = await runWithShareConfig(override, () => createDeckShareLink(sync.resourceId));
+          writeSyncRecord(cwd, id, { ...sync, publicShareUrl: minted.shareUrl, publicLinkId: minted.linkId });
+          jsonResponse(res, 200, { ok: true, shareUrl: minted.shareUrl });
         } catch (err) {
           jsonResponse(res, 500, { ok: false, error: String(err) });
         }
@@ -1948,7 +2206,16 @@ async function startDeckServer(opts = {}) {
           }
           jsonResponse(res, 200, { ok: true, deleted: true });
         } catch (err) {
-          jsonResponse(res, 500, { ok: false, error: String(err) });
+          const msg = err instanceof Error ? err.message : String(err);
+          if (/not\s*found/i.test(msg)) {
+            try {
+              import_node_fs5.default.rmSync(syncJsonPath(cwd, id), { force: true });
+            } catch {
+            }
+            jsonResponse(res, 200, { ok: true, deleted: false, reason: "already removed" });
+            return;
+          }
+          jsonResponse(res, 500, { ok: false, error: msg });
         }
         return;
       }
@@ -2039,6 +2306,10 @@ async function startDeckServer(opts = {}) {
           deletePersistedSession(cwd, session);
         } catch {
         }
+        const beforePins = discussSessions.length;
+        discussSessions = session === "all" ? [] : discussSessions.filter((d) => d.id !== session);
+        if (discussSessions.length !== beforePins) broadcastDiscuss();
+        if (session === "all" || activeSession?.id === session) activeSession = null;
         jsonResponse(res, 200, { ok: true });
         return;
       }
@@ -2047,6 +2318,16 @@ async function startDeckServer(opts = {}) {
         jsonResponse(res, 200, err ?? null);
         return;
       }
+      if (req.method === "GET" && url2.pathname === "/api/active-session") {
+        jsonResponse(res, 200, {
+          discuss: discussSessions.map((d) => d.id),
+          // ordered = pin number
+          active: activeSession?.id ?? null,
+          focused: activeSession?.focused ?? false,
+          activeAt: activeSession?.at ?? null
+        });
+        return;
+      }
       if (req.method === "GET" && url2.pathname.startsWith("/deck-files/")) {
         const relative = decodeURIComponent(url2.pathname.slice("/deck-files/".length));
         if (relative.includes("..") || relative.startsWith("/")) {
@@ -2119,6 +2400,24 @@ async function startDeckServer(opts = {}) {
             source: msg.source ?? ""
           };
         }
+        if (msg.type === "active_session" && msg.session) {
+          activeSession = {
+            id: msg.session,
+            focused: msg.focused ?? false,
+            at: Date.now()
+          };
+        }
+        if (msg.type === "discuss_session" && msg.session) {
+          const id = msg.session;
+          const idx = discussSessions.findIndex((d) => d.id === id);
+          if (idx >= 0) discussSessions.splice(idx, 1);
+          else discussSessions.push({ id, at: Date.now() });
+          broadcastDiscuss();
+        }
+        if (msg.type === "discuss_clear_all") {
+          discussSessions = [];
+          broadcastDiscuss();
+        }
       } catch {
       }
     });
@@ -2184,7 +2483,7 @@ function runServeCli(argv) {
     process.exit(1);
   });
 }
-var import_node_http, import_node_fs5, import_node_path5, import_ws, DEFAULT_PORT, MAX_PORT_SCAN, MIME_TYPES, pendingFeedback, lastRenderError, wss;
+var import_node_http, import_node_fs5, import_node_path5, import_ws, DEFAULT_PORT, MAX_PORT_SCAN, MIME_TYPES, pendingFeedback, lastRenderError, activeSession, discussSessions, wss;
 var init_deck_serve = __esm({
   "src/server/deck-serve.ts"() {
     "use strict";
@@ -2214,6 +2513,8 @@ var init_deck_serve = __esm({
     };
     pendingFeedback = /* @__PURE__ */ new Map();
     lastRenderError = null;
+    activeSession = null;
+    discussSessions = [];
     wss = null;
   }
 });
@@ -2227,7 +2528,7 @@ function httpGet(url) {
   return new Promise((resolve, reject) => {
     const parsed = new URL(url);
     const req = import_node_http2.default.request(
-      { hostname: parsed.hostname, port: parsed.port, path: parsed.pathname, method: "GET" },
+      { hostname: parsed.hostname, port: parsed.port, path: parsed.pathname + parsed.search, method: "GET" },
       (res) => {
         let buf = "";
         res.on("data", (chunk) => {
@@ -2473,6 +2774,30 @@ async function handleTool(name, args) {
       }
       return text(JSON.stringify({ running: false }));
     }
+    case "active_session": {
+      const lock = getLiveLock(projectRoot);
+      if (!lock) {
+        return text(JSON.stringify({
+          error: "LaunchDeck server is not running \u2014 nothing is open.",
+          hint: "Start it with start_server, or ask the user to open the deck."
+        }));
+      }
+      try {
+        const resp = await fetch(`${lock.url}/api/active-session`, {
+          signal: AbortSignal.timeout(3e3)
+        });
+        const data = await resp.json();
+        const pins = data.discuss ?? [];
+        const targets = pins.length ? pins : data.active ? [data.active] : [];
+        return text(JSON.stringify({
+          ...data,
+          targets,
+          targetSource: pins.length ? "pinned" : data.active ? "active-tab" : "none"
+        }));
+      } catch (err) {
+        return text(JSON.stringify({ error: `Failed to read active session: ${err}` }));
+      }
+    }
     case "generate_contract": {
       const session = args.session;
       const dir = (0, import_node_path6.join)(projectRoot, LAUNCHSECURE_DIR, "deck-files", session);
@@ -2495,6 +2820,31 @@ async function handleTool(name, args) {
         return text(JSON.stringify({ error: `Failed to generate contract: ${err}` }));
       }
     }
+    case "deck_pull": {
+      const lock = getLiveLock(projectRoot);
+      if (!lock) {
+        return text(JSON.stringify({ error: "LaunchDeck server is not running. Call start_server first." }));
+      }
+      const deckId = args.deck?.trim();
+      if (!deckId) {
+        return text(JSON.stringify({ error: "Provide the deck's comment id (from launch-secure deck_list / watched_decks)." }));
+      }
+      const course = args.course?.trim();
+      try {
+        const resp = await httpPost(`${lock.url}/api/cloud-decks/${encodeURIComponent(deckId)}/pull`, course ? { course } : {});
+        const parsed = JSON.parse(resp);
+        if (parsed.ok === false) {
+          return text(JSON.stringify({ error: parsed.error ?? "Failed to pull the deck." }));
+        }
+        return text(JSON.stringify({
+          ...parsed,
+          url: lock.url,
+          action: "Deck pulled into a local tab. Open the LaunchDeck browser to view it; it can now be \u{1F441}-watched like any local deck."
+        }));
+      } catch (err) {
+        return text(JSON.stringify({ error: `Failed to pull deck: ${err}` }));
+      }
+    }
     default:
       return text(`Unknown tool: ${name}`);
   }
@@ -2713,6 +3063,11 @@ var init_deck_mcp = __esm({
         description: "Check whether the LaunchDeck UI server is running.",
         inputSchema: { type: "object", properties: {} }
       },
+      {
+        name: "active_session",
+        description: 'Find out which deck(s) the user is currently looking at or watching. Returns `discuss` (an ORDERED list of sessions the user is explicitly WATCHING via the \u{1F441} eye button \u2014 order = the number shown in the UI; the strongest signal, use these when non-empty), `active` (the tab last shown in the browser), `focused` (whether the deck window itself was focused when `active` was reported \u2014 if false, the user is probably elsewhere and `active` is just the last-viewed tab), and `targets` (the resolved answer to "which deck(s) does the user mean": the watched decks if any, else the active tab). Use this instead of guessing from the session list when the user says "this deck" / "the open one" / "the ones I\'m watching".',
+        inputSchema: { type: "object", properties: {} }
+      },
       {
         name: "generate_contract",
         description: "Generate a contract from a previously pushed blast-radius session.\n\nReads the blast radius manifest from the session's saved files and produces a structured contract with actionable items, acceptance criteria, dependencies, and a verify-unchanged checklist.\n\nReturns JSON contract. Also saves contract.json and contract.md to the session directory.",
@@ -2726,6 +3081,24 @@ var init_deck_mcp = __esm({
           },
           required: ["session"]
         }
+      },
+      {
+        name: "deck_pull",
+        description: "Pull a cloud-shared deck DOWN into a local LaunchDeck session tab \u2014 the inverse of publishing a deck up. After this, the deck is an ordinary local tab the user can view, \u{1F441}-watch, download, or re-pull. Takes the deck's comment id \u2014 get it from launch-secure's deck_list or watched_decks. The deck is reconstructed from its shared HTML snapshot as one self-contained block (view-faithful; not re-editable block-by-block). Requires the LaunchDeck server to be running (start_server first). Note: listing shared decks and reading watch state live on the launch-secure MCP (deck_list / watched_decks), not here.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            deck: {
+              type: "string",
+              description: "Deck comment id (from launch-secure deck_list / watched_decks)."
+            },
+            course: {
+              type: "string",
+              description: "Optional course (cred profile) to read from. Omit for the active course."
+            }
+          },
+          required: ["deck"]
+        }
       }
     ];
   }