@launchsecure/launch-kit 0.0.42 → 0.0.44

package/dist/server/init-entry.js

@@ -519,11 +519,13 @@ function coerceEntry(raw, index) {
   if (r.args !== void 0 && (!Array.isArray(r.args) || r.args.some((a) => typeof a !== "string"))) {
     throw new Error(`[launch-kit-services] entry #${index}: args must be a string[]`);
   }
+  const skipSpawn = r.skipSpawn === true || r.bin === "";
   return {
     name: r.name,
     port: r.port,
     bin: r.bin,
-    args: r.args ?? []
+    args: r.args ?? [],
+    skipSpawn
   };
 }
 function validate(services) {
@@ -547,6 +549,9 @@ function validate(services) {
       throw new Error(`[launch-kit-services] duplicate port ${s.port} (services must each listen on a unique port)`);
     }
     seenPorts.add(s.port);
+    if (!s.skipSpawn && s.bin === "") {
+      throw new Error(`[launch-kit-services] service "${s.name}" has an empty bin but is not ingress-only (skipSpawn) \u2014 nothing to spawn`);
+    }
   }
   return services;
 }
@@ -707,7 +712,7 @@ async function fetchConnectorToken(input, tunnelId) {
 async function setIngressConfig(input, tunnelId) {
   const ingress = input.services.map((s) => ({
     hostname: `${serviceLabel(s)}.${input.zone.name}`,
-    service: `http://localhost:${s.port}`
+    service: `http://127.0.0.1:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
   const res = await cf({
@@ -1076,14 +1081,30 @@ async function setupFromCloud() {
   console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
   return bundle;
 }
+function hasUsableCredentials(credsPath) {
+  if (!(0, import_node_fs4.existsSync)(credsPath)) return false;
+  try {
+    const raw = (0, import_node_fs4.readFileSync)(credsPath, "utf8").trim();
+    if (raw.length === 0) return false;
+    const parsed = JSON.parse(raw);
+    return parsed != null && typeof parsed === "object" && "claudeAiOauth" in parsed;
+  } catch {
+    return false;
+  }
+}
 function setupClaudeCredentials() {
   const home = process.env.HOME ?? "/home/launchpod";
   const claudeDir = (0, import_node_path4.join)(home, ".claude");
   (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
-  const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
   const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
-  (0, import_node_fs4.writeFileSync)(credsPath, decoded);
-  (0, import_node_fs4.chmodSync)(credsPath, 384);
+  if (hasUsableCredentials(credsPath)) {
+    console.log("[entrypoint] ~/.claude/.credentials.json already present \u2014 leaving Claude Code's own (refreshed) credentials intact");
+  } else {
+    const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
+    (0, import_node_fs4.writeFileSync)(credsPath, decoded);
+    (0, import_node_fs4.chmodSync)(credsPath, 384);
+    console.log("[entrypoint] seeded ~/.claude/.credentials.json from CLAUDE_CREDENTIALS_B64");
+  }
   const configPath = (0, import_node_path4.join)(home, ".claude.json");
   let cfg = {};
   if ((0, import_node_fs4.existsSync)(configPath)) {
@@ -1107,7 +1128,7 @@ function setupClaudeCredentials() {
     "launch-sequencer"
   ];
   const projects = cfg.projects ?? {};
-  const wsKey = "/workspace";
+  const wsKey = POD_WS;
   const wsProject = projects[wsKey] ?? {};
   const existingEnabled = Array.isArray(wsProject.enabledMcpjsonServers) ? wsProject.enabledMcpjsonServers : [];
   const mergedEnabled = Array.from(/* @__PURE__ */ new Set([...existingEnabled, ...PREAPPROVED_MCPS]));
@@ -1126,7 +1147,7 @@ function setupGitAndGh() {
 function detectAndSetPreviewPort() {
   if (process.env.PREVIEW_PORT) return;
   try {
-    const pkgPath = "/workspace/package.json";
+    const pkgPath = (0, import_node_path4.join)(POD_WS, "package.json");
     if (!(0, import_node_fs4.existsSync)(pkgPath)) return;
     const pkg = JSON.parse((0, import_node_fs4.readFileSync)(pkgPath, "utf-8"));
     const scripts = pkg.scripts ?? {};
@@ -1145,23 +1166,27 @@ function detectAndSetPreviewPort() {
   }
 }
 function initWorkspaceIfEmpty() {
-  process.chdir("/workspace");
+  process.chdir(POD_WS);
   if ((0, import_node_fs4.existsSync)(".git")) {
-    console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
+    console.log(`[entrypoint] ${POD_WS} already initialized \u2014 skipping init`);
     return;
   }
-  console.log("[entrypoint] /workspace is empty \u2014 running launch-kit init");
+  console.log(`[entrypoint] ${POD_WS} is empty \u2014 running launch-kit init`);
   const status = run2("launch-kit", [
     "init",
     `--token=${requireEnv("LS_PAT")}`,
     `--org=${requireEnv("LS_ORG_SLUG")}`,
     `--project=${requireEnv("LS_PROJECT_SLUG")}`,
     `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
-    `--dir=/workspace`
+    `--dir=${POD_WS}`
   ]);
   if (status !== 0) fail2(`[entrypoint] launch-kit init failed (status ${status})`);
 }
 async function maybeProvisionIngress(bundle, services, projectSlug) {
+  if (LOCAL_ONLY) {
+    console.log("[entrypoint] LAUNCHKIT_LOCAL_ONLY=1 \u2014 skipping CF ingress; services run on localhost only");
+    return null;
+  }
   const token = bundle.cloudflareToken ?? null;
   const accountId = bundle.cloudflareAccountId ?? null;
   const zones = bundle.cloudflareZones ?? [];
@@ -1181,7 +1206,7 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   } else {
     fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
-  const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
+  const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-tunnel.json");
   const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
   for (const s of services) {
@@ -1247,7 +1272,7 @@ async function maybeProvisionAccess(bundle, ingress) {
   }
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
   const pat = requireEnv("LS_PAT");
-  const stateFile = "/workspace/.launchpod/launch-kit-access.json";
+  const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-access.json");
   const gatedHosts = services.filter((s) => !s.bypass).map((s) => s.hostname);
   const bypassed = services.filter((s) => s.bypass).map((s) => `${s.hostname}${s.path ?? ""}`);
   console.log(`[entrypoint] gating ${gatedHosts.join(", ")} behind CF Access (IdP: ${serverUrl})`);
@@ -1346,11 +1371,13 @@ function spawnServiceGroup(services) {
   }).finally(removeSignals);
 }
 async function main() {
-  const priorCrashes = readCrashState()?.count ?? 0;
-  if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
-  const bootAttempt = bumpCrashCount();
-  if (bootAttempt > 1) {
-    console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+  if (!NO_PARK) {
+    const priorCrashes = readCrashState()?.count ?? 0;
+    if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
+    const bootAttempt = bumpCrashCount();
+    if (bootAttempt > 1) {
+      console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+    }
   }
   for (const k of REQUIRED_ENV) requireEnv(k);
   const bundle = await setupFromCloud();
@@ -1384,8 +1411,10 @@ async function main() {
     }
   }
   const stableTimer = setTimeout(() => {
-    clearCrashCount();
-    console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+    if (!NO_PARK) {
+      clearCrashCount();
+      console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+    }
   }, STABLE_AFTER_MS);
   stableTimer.unref?.();
   try {
@@ -1398,7 +1427,7 @@ async function main() {
     process.exit(1);
   }
 }
-var import_node_child_process2, import_node_fs4, import_node_path4, REQUIRED_ENV, LAUNCHPOD_DIR, CRASH_STATE_FILE, MAX_BOOT_CRASHES, STABLE_AFTER_MS, GATED_SERVICES;
+var import_node_child_process2, import_node_fs4, import_node_path4, REQUIRED_ENV, POD_WS, NO_PARK, LOCAL_ONLY, LAUNCHPOD_DIR, CRASH_STATE_FILE, MAX_BOOT_CRASHES, STABLE_AFTER_MS, GATED_SERVICES;
 var init_radar_docker_init_entry = __esm({
   "src/server/radar-docker-init-entry.ts"() {
     "use strict";
@@ -1411,12 +1440,14 @@ var init_radar_docker_init_entry = __esm({
     init_cf_access();
     init_registration();
     REQUIRED_ENV = [
-      "CLAUDE_CREDENTIALS_B64",
       "LS_PAT",
       "LS_ORG_SLUG",
       "LS_PROJECT_SLUG"
     ];
-    LAUNCHPOD_DIR = "/workspace/.launchpod";
+    POD_WS = process.env.LAUNCHPOD_WORKSPACE ?? "/workspace";
+    NO_PARK = process.env.LAUNCHPOD_NO_PARK === "1";
+    LOCAL_ONLY = process.env.LAUNCHKIT_LOCAL_ONLY === "1";
+    LAUNCHPOD_DIR = (0, import_node_path4.join)(POD_WS, ".launchpod");
     CRASH_STATE_FILE = (0, import_node_path4.join)(LAUNCHPOD_DIR, ".boot-crash.json");
     MAX_BOOT_CRASHES = 5;
     STABLE_AFTER_MS = 3e4;

package/dist/server/launch-bot-entry.js

@@ -611,6 +611,14 @@ var require_claude_bridge = __commonJS({
           },
           onError = () => {
           },
+          // Fired (at most once per session) when Claude Code prints its
+          // authentication-failure banner — i.e. the credential it resolved was
+          // rejected by the Anthropic API. In a headless pod nobody is watching the
+          // pty, so this is the only signal the credential died; callers surface it
+          // (radar card + status banner) instead of failing silently. Detail is a
+          // short human string.
+          onAuthFailure = () => {
+          },
           cols = 80,
           rows = 24,
           // When true, spawn `claude --resume <sessionId>` instead of starting a
@@ -671,6 +679,7 @@ var require_claude_bridge = __commonJS({
           this.sessions.set(sessionId, session);
           let trustPromptHandled = false;
           let autoStartSent = !!initialPrompt;
+          let authFailureReported = false;
           let dataBuffer = "";
           claudeProcess.onData((data) => {
             if (process.env.DEBUG) {
@@ -685,6 +694,15 @@ var require_claude_bridge = __commonJS({
                 console.log(`Sent Enter to accept trust prompt for session ${sessionId}`);
               }, 500);
             }
+            if (!authFailureReported && /Please run \/login|Invalid authentication credentials/i.test(dataBuffer)) {
+              authFailureReported = true;
+              console.error(`Claude session ${sessionId}: authentication failed (credential rejected by Anthropic API)`);
+              try {
+                onAuthFailure("Claude credential rejected (401) \u2014 pod could not authenticate to the Anthropic API.");
+              } catch (e) {
+                console.error(`onAuthFailure handler threw for session ${sessionId}:`, e);
+              }
+            }
             if (!autoStartSent && appendSystemPrompt && dataBuffer.includes("\u276F")) {
               autoStartSent = true;
               console.log(`Auto-starting agent in session ${sessionId}`);
@@ -3246,6 +3264,13 @@ var require_src = __commonJS({
                 message: error.message
               });
             },
+            onAuthFailure: (detail) => {
+              this.broadcastToSession(sessionId, {
+                type: "auth_failed",
+                sessionId,
+                message: detail
+              });
+            },
             ...options
           });
           session.active = true;
@@ -3717,13 +3742,22 @@ var require_src = __commonJS({
       return new TerminalHandler(options);
     }
     function createWebSocketHandler2(httpServer, handler2, wsPath = "/terminal/ws") {
-      const wss2 = new WebSocket.Server({
-        server: httpServer,
-        path: wsPath
-      });
+      const wss2 = new WebSocket.Server({ noServer: true });
       wss2.on("connection", (ws, req) => {
         handler2.handleWebSocketConnection(ws, req);
       });
+      httpServer.on("upgrade", (req, socket, head) => {
+        let pathname;
+        try {
+          pathname = new URL(req.url || "/", "http://localhost").pathname;
+        } catch {
+          return;
+        }
+        if (pathname !== wsPath) return;
+        wss2.handleUpgrade(req, socket, head, (ws) => {
+          wss2.emit("connection", ws, req);
+        });
+      });
       return wss2;
     }
     function detectClaudeCli2() {

package/dist/server/radar-docker-init-entry.js

@@ -190,11 +190,13 @@ function coerceEntry(raw, index) {
   if (r.args !== void 0 && (!Array.isArray(r.args) || r.args.some((a) => typeof a !== "string"))) {
     throw new Error(`[launch-kit-services] entry #${index}: args must be a string[]`);
   }
+  const skipSpawn = r.skipSpawn === true || r.bin === "";
   return {
     name: r.name,
     port: r.port,
     bin: r.bin,
-    args: r.args ?? []
+    args: r.args ?? [],
+    skipSpawn
   };
 }
 function validate(services) {
@@ -218,6 +220,9 @@ function validate(services) {
       throw new Error(`[launch-kit-services] duplicate port ${s.port} (services must each listen on a unique port)`);
     }
     seenPorts.add(s.port);
+    if (!s.skipSpawn && s.bin === "") {
+      throw new Error(`[launch-kit-services] service "${s.name}" has an empty bin but is not ingress-only (skipSpawn) \u2014 nothing to spawn`);
+    }
   }
   return services;
 }
@@ -363,7 +368,7 @@ async function fetchConnectorToken(input, tunnelId) {
 async function setIngressConfig(input, tunnelId) {
   const ingress = input.services.map((s) => ({
     hostname: `${serviceLabel(s)}.${input.zone.name}`,
-    service: `http://localhost:${s.port}`
+    service: `http://127.0.0.1:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
   const res = await cf({
@@ -613,11 +618,13 @@ var RECEIVER_PATH = "/api/radar/ingest";
 
 // src/server/radar-docker-init-entry.ts
 var REQUIRED_ENV = [
-  "CLAUDE_CREDENTIALS_B64",
   "LS_PAT",
   "LS_ORG_SLUG",
   "LS_PROJECT_SLUG"
 ];
+var POD_WS = process.env.LAUNCHPOD_WORKSPACE ?? "/workspace";
+var NO_PARK = process.env.LAUNCHPOD_NO_PARK === "1";
+var LOCAL_ONLY = process.env.LAUNCHKIT_LOCAL_ONLY === "1";
 function fail2(message) {
   console.error(message);
   process.exit(1);
@@ -631,7 +638,7 @@ function run(cmd, args, stdio = "inherit") {
   const r = (0, import_node_child_process.spawnSync)(cmd, args, { stdio });
   return r.status ?? 1;
 }
-var LAUNCHPOD_DIR = "/workspace/.launchpod";
+var LAUNCHPOD_DIR = (0, import_node_path4.join)(POD_WS, ".launchpod");
 var CRASH_STATE_FILE = (0, import_node_path4.join)(LAUNCHPOD_DIR, ".boot-crash.json");
 var MAX_BOOT_CRASHES = 5;
 var STABLE_AFTER_MS = 3e4;
@@ -714,14 +721,30 @@ async function setupFromCloud() {
   console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
   return bundle;
 }
+function hasUsableCredentials(credsPath) {
+  if (!(0, import_node_fs4.existsSync)(credsPath)) return false;
+  try {
+    const raw = (0, import_node_fs4.readFileSync)(credsPath, "utf8").trim();
+    if (raw.length === 0) return false;
+    const parsed = JSON.parse(raw);
+    return parsed != null && typeof parsed === "object" && "claudeAiOauth" in parsed;
+  } catch {
+    return false;
+  }
+}
 function setupClaudeCredentials() {
   const home = process.env.HOME ?? "/home/launchpod";
   const claudeDir = (0, import_node_path4.join)(home, ".claude");
   (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
-  const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
   const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
-  (0, import_node_fs4.writeFileSync)(credsPath, decoded);
-  (0, import_node_fs4.chmodSync)(credsPath, 384);
+  if (hasUsableCredentials(credsPath)) {
+    console.log("[entrypoint] ~/.claude/.credentials.json already present \u2014 leaving Claude Code's own (refreshed) credentials intact");
+  } else {
+    const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
+    (0, import_node_fs4.writeFileSync)(credsPath, decoded);
+    (0, import_node_fs4.chmodSync)(credsPath, 384);
+    console.log("[entrypoint] seeded ~/.claude/.credentials.json from CLAUDE_CREDENTIALS_B64");
+  }
   const configPath = (0, import_node_path4.join)(home, ".claude.json");
   let cfg = {};
   if ((0, import_node_fs4.existsSync)(configPath)) {
@@ -745,7 +768,7 @@ function setupClaudeCredentials() {
     "launch-sequencer"
   ];
   const projects = cfg.projects ?? {};
-  const wsKey = "/workspace";
+  const wsKey = POD_WS;
   const wsProject = projects[wsKey] ?? {};
   const existingEnabled = Array.isArray(wsProject.enabledMcpjsonServers) ? wsProject.enabledMcpjsonServers : [];
   const mergedEnabled = Array.from(/* @__PURE__ */ new Set([...existingEnabled, ...PREAPPROVED_MCPS]));
@@ -764,7 +787,7 @@ function setupGitAndGh() {
 function detectAndSetPreviewPort() {
   if (process.env.PREVIEW_PORT) return;
   try {
-    const pkgPath = "/workspace/package.json";
+    const pkgPath = (0, import_node_path4.join)(POD_WS, "package.json");
     if (!(0, import_node_fs4.existsSync)(pkgPath)) return;
     const pkg = JSON.parse((0, import_node_fs4.readFileSync)(pkgPath, "utf-8"));
     const scripts = pkg.scripts ?? {};
@@ -783,23 +806,27 @@ function detectAndSetPreviewPort() {
   }
 }
 function initWorkspaceIfEmpty() {
-  process.chdir("/workspace");
+  process.chdir(POD_WS);
   if ((0, import_node_fs4.existsSync)(".git")) {
-    console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
+    console.log(`[entrypoint] ${POD_WS} already initialized \u2014 skipping init`);
     return;
   }
-  console.log("[entrypoint] /workspace is empty \u2014 running launch-kit init");
+  console.log(`[entrypoint] ${POD_WS} is empty \u2014 running launch-kit init`);
   const status = run("launch-kit", [
     "init",
     `--token=${requireEnv("LS_PAT")}`,
     `--org=${requireEnv("LS_ORG_SLUG")}`,
     `--project=${requireEnv("LS_PROJECT_SLUG")}`,
     `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
-    `--dir=/workspace`
+    `--dir=${POD_WS}`
   ]);
   if (status !== 0) fail2(`[entrypoint] launch-kit init failed (status ${status})`);
 }
 async function maybeProvisionIngress(bundle, services, projectSlug) {
+  if (LOCAL_ONLY) {
+    console.log("[entrypoint] LAUNCHKIT_LOCAL_ONLY=1 \u2014 skipping CF ingress; services run on localhost only");
+    return null;
+  }
   const token = bundle.cloudflareToken ?? null;
   const accountId = bundle.cloudflareAccountId ?? null;
   const zones = bundle.cloudflareZones ?? [];
@@ -819,7 +846,7 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   } else {
     fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
-  const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
+  const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-tunnel.json");
   const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
   for (const s of services) {
@@ -895,7 +922,7 @@ async function maybeProvisionAccess(bundle, ingress) {
   }
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
   const pat = requireEnv("LS_PAT");
-  const stateFile = "/workspace/.launchpod/launch-kit-access.json";
+  const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-access.json");
   const gatedHosts = services.filter((s) => !s.bypass).map((s) => s.hostname);
   const bypassed = services.filter((s) => s.bypass).map((s) => `${s.hostname}${s.path ?? ""}`);
   console.log(`[entrypoint] gating ${gatedHosts.join(", ")} behind CF Access (IdP: ${serverUrl})`);
@@ -994,11 +1021,13 @@ function spawnServiceGroup(services) {
   }).finally(removeSignals);
 }
 async function main() {
-  const priorCrashes = readCrashState()?.count ?? 0;
-  if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
-  const bootAttempt = bumpCrashCount();
-  if (bootAttempt > 1) {
-    console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+  if (!NO_PARK) {
+    const priorCrashes = readCrashState()?.count ?? 0;
+    if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
+    const bootAttempt = bumpCrashCount();
+    if (bootAttempt > 1) {
+      console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+    }
   }
   for (const k of REQUIRED_ENV) requireEnv(k);
   const bundle = await setupFromCloud();
@@ -1032,8 +1061,10 @@ async function main() {
     }
   }
   const stableTimer = setTimeout(() => {
-    clearCrashCount();
-    console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+    if (!NO_PARK) {
+      clearCrashCount();
+      console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+    }
   }, STABLE_AFTER_MS);
   stableTimer.unref?.();
   try {