@launchsecure/launch-kit 0.0.44 → 0.0.46

package/dist/server/rover-entry.js

@@ -33,12 +33,201 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/server/cf-access.ts
+async function cf(opts) {
+  const res = await fetch(`${CF_API_BASE}${opts.path}`, {
+    method: opts.method,
+    headers: {
+      Authorization: `Bearer ${opts.apiToken}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      "User-Agent": "launch-kit/cf-access"
+    },
+    body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+    signal: AbortSignal.timeout(15e3)
+  });
+  const text = await res.text();
+  try {
+    return text ? JSON.parse(text) : { success: false };
+  } catch {
+    throw new Error(`[cf-access] ${opts.method} ${opts.path} \u2192 ${res.status}, non-JSON: ${text.slice(0, 200)}`);
+  }
+}
+function fail(env, what) {
+  throw new Error(`[cf-access] ${what} failed: ${JSON.stringify(env.errors)}`);
+}
+function loadState(path) {
+  if (!(0, import_node_fs.existsSync)(path)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    return typeof parsed?.accountId === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function saveState(path, state) {
+  const dir = (0, import_node_path.dirname)(path);
+  if (!(0, import_node_fs.existsSync)(dir)) (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs.writeFileSync)(path, JSON.stringify(state, null, 2));
+}
+async function getAccessAuthDomain(apiToken, accountId) {
+  const res = await cf({
+    apiToken,
+    method: "GET",
+    path: `/accounts/${accountId}/access/organizations`
+  });
+  if (!res.success || !res.result?.auth_domain) {
+    fail(res, "GET access/organizations (is Zero Trust enabled on this account?)");
+  }
+  return res.result.auth_domain;
+}
+async function ensureAccessIdp(input) {
+  const config = {
+    client_id: input.clientId,
+    client_secret: input.clientSecret,
+    auth_url: `${input.issuer}/api/oidc/authorize`,
+    token_url: `${input.issuer}/api/oidc/token`,
+    certs_url: `${input.issuer}/.well-known/jwks.json`,
+    scopes: ["openid", "email", "profile"],
+    claims: ["org", "project_access", "roles", "email"],
+    email_claim_name: "email",
+    pkce_enabled: true
+  };
+  const body = { name: IDP_NAME, type: "oidc", config };
+  let idpId = input.knownIdpId;
+  if (!idpId) {
+    const list3 = await cf({
+      apiToken: input.apiToken,
+      method: "GET",
+      path: `/accounts/${input.accountId}/access/identity_providers`
+    });
+    if (!list3.success) fail(list3, "list identity_providers");
+    idpId = (list3.result ?? []).find((p) => p.name === IDP_NAME)?.id ?? null;
+  }
+  if (idpId) {
+    const upd = await cf({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/identity_providers/${idpId}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, "update identity_provider");
+    return upd.result.id;
+  }
+  const created = await cf({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/identity_providers`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, "create identity_provider");
+  return created.result.id;
+}
+async function ensureAccessApp(input) {
+  const { service } = input;
+  const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+  const policy = service.bypass ? {
+    name: "launch-kit-public-bypass",
+    decision: "bypass",
+    include: [{ everyone: {} }]
+  } : {
+    name: "launch-kit-org-allow",
+    decision: "allow",
+    include: [
+      {
+        oidc: {
+          identity_provider_id: input.idpId,
+          claim_name: "org",
+          claim_value: input.organizationId
+        }
+      }
+    ]
+  };
+  const body = service.bypass ? {
+    name: `launch-kit ${appDomain} (public)`,
+    domain: appDomain,
+    type: "self_hosted",
+    policies: [policy]
+  } : {
+    name: `launch-kit ${appDomain}`,
+    domain: appDomain,
+    type: "self_hosted",
+    // Bot terminal = RCE surface → short session. Read portals = a workday.
+    session_duration: service.strict ? "30m" : "24h",
+    allowed_idps: [input.idpId],
+    auto_redirect_to_identity: true,
+    policies: [policy]
+  };
+  const list3 = await cf({
+    apiToken: input.apiToken,
+    method: "GET",
+    path: `/accounts/${input.accountId}/access/apps`
+  });
+  if (!list3.success) fail(list3, "list access apps");
+  const existing = (list3.result ?? []).find((a) => a.domain === appDomain);
+  if (existing) {
+    const upd = await cf({
+      apiToken: input.apiToken,
+      method: "PUT",
+      path: `/accounts/${input.accountId}/access/apps/${existing.id}`,
+      body
+    });
+    if (!upd.success || !upd.result) fail(upd, `update access app ${appDomain}`);
+    return upd.result.id;
+  }
+  const created = await cf({
+    apiToken: input.apiToken,
+    method: "POST",
+    path: `/accounts/${input.accountId}/access/apps`,
+    body
+  });
+  if (!created.success || !created.result) fail(created, `create access app ${appDomain}`);
+  return created.result.id;
+}
+async function provisionAccess(input) {
+  const authDomain = await getAccessAuthDomain(input.apiToken, input.accountId);
+  const callbackUrl = `https://${authDomain}/cdn-cgi/access/callback`;
+  const { clientId, clientSecret, organizationId } = await input.registerClient([callbackUrl]);
+  const prior = loadState(input.stateFile);
+  const idpId = await ensureAccessIdp({
+    apiToken: input.apiToken,
+    accountId: input.accountId,
+    issuer: input.issuer,
+    clientId,
+    clientSecret,
+    knownIdpId: prior?.idpId ?? null
+  });
+  saveState(input.stateFile, { idpId, accountId: input.accountId });
+  const appIds = {};
+  for (const service of input.services) {
+    const appDomain = service.path ? `${service.hostname}${service.path}` : service.hostname;
+    appIds[appDomain] = await ensureAccessApp({
+      apiToken: input.apiToken,
+      accountId: input.accountId,
+      idpId,
+      organizationId,
+      service
+    });
+  }
+  return { idpId, authDomain, appIds };
+}
+var import_node_fs, import_node_path, CF_API_BASE, IDP_NAME;
+var init_cf_access = __esm({
+  "src/server/cf-access.ts"() {
+    "use strict";
+    import_node_fs = require("node:fs");
+    import_node_path = require("node:path");
+    CF_API_BASE = "https://api.cloudflare.com/client/v4";
+    IDP_NAME = "launch-kit-oidc";
+  }
+});
+
 // src/server/cf-ingress.ts
 function serviceLabel(s) {
   return s.label ?? s.name;
 }
-async function cf(opts) {
-  const res = await fetch(`${CF_API_BASE}${opts.path}`, {
+async function cf2(opts) {
+  const res = await fetch(`${CF_API_BASE2}${opts.path}`, {
     method: opts.method,
     headers: {
       Authorization: `Bearer ${opts.apiToken}`,
@@ -63,7 +252,7 @@ function isNotFound(env) {
 }
 async function findTunnelByName(input) {
   const q = new URLSearchParams({ name: input.tunnelName, is_deleted: "false" }).toString();
-  const res = await cf({
+  const res = await cf2({
     apiToken: input.apiToken,
     method: "GET",
     path: `/accounts/${input.accountId}/cfd_tunnel?${q}`
@@ -72,10 +261,10 @@ async function findTunnelByName(input) {
   const live = res.result.find((t) => t.name === input.tunnelName && !t.deleted_at);
   return live?.id ?? null;
 }
-function loadState(path) {
-  if (!(0, import_node_fs.existsSync)(path)) return null;
+function loadState2(path) {
+  if (!(0, import_node_fs2.existsSync)(path)) return null;
   try {
-    const parsed = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
     if (typeof parsed?.tunnelId === "string" && typeof parsed?.accountId === "string") {
       return parsed;
     }
@@ -84,14 +273,14 @@ function loadState(path) {
     return null;
   }
 }
-function saveState(path, state) {
-  const dir = (0, import_node_path.dirname)(path);
-  if (!(0, import_node_fs.existsSync)(dir)) (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs.writeFileSync)(path, JSON.stringify(state, null, 2));
+function saveState2(path, state) {
+  const dir = (0, import_node_path2.dirname)(path);
+  if (!(0, import_node_fs2.existsSync)(dir)) (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs2.writeFileSync)(path, JSON.stringify(state, null, 2));
 }
 async function ensureTunnel(input, knownTunnelId) {
   if (knownTunnelId) {
-    const got = await cf({
+    const got = await cf2({
       apiToken: input.apiToken,
       method: "GET",
       path: `/accounts/${input.accountId}/cfd_tunnel/${knownTunnelId}`
@@ -108,7 +297,7 @@ async function ensureTunnel(input, knownTunnelId) {
     console.log(`[cf] adopted existing tunnel "${input.tunnelName}" (${existing}) \u2014 local state was missing`);
     return existing;
   }
-  const created = await cf({
+  const created = await cf2({
     apiToken: input.apiToken,
     method: "POST",
     path: `/accounts/${input.accountId}/cfd_tunnel`,
@@ -125,7 +314,7 @@ async function ensureTunnel(input, knownTunnelId) {
   throw new Error(`[cf] tunnel create failed: ${JSON.stringify(created.errors)}`);
 }
 async function fetchConnectorToken(input, tunnelId) {
-  const res = await cf({
+  const res = await cf2({
     apiToken: input.apiToken,
     method: "GET",
     path: `/accounts/${input.accountId}/cfd_tunnel/${tunnelId}/token`
@@ -141,7 +330,7 @@ async function setIngressConfig(input, tunnelId) {
     service: `http://127.0.0.1:${s.port}`
   }));
   ingress.push({ service: "http_status:404" });
-  const res = await cf({
+  const res = await cf2({
     apiToken: input.apiToken,
     method: "PUT",
     path: `/accounts/${input.accountId}/cfd_tunnel/${tunnelId}/configurations`,
@@ -154,7 +343,7 @@ async function setIngressConfig(input, tunnelId) {
 async function ensureDnsRecord(input, tunnelId, service) {
   const fqdn = `${serviceLabel(service)}.${input.zone.name}`;
   const target = `${tunnelId}.cfargotunnel.com`;
-  const existing = await cf({
+  const existing = await cf2({
     apiToken: input.apiToken,
     method: "GET",
     path: `/zones/${input.zone.id}/dns_records?name=${encodeURIComponent(fqdn)}&type=CNAME`
@@ -162,7 +351,7 @@ async function ensureDnsRecord(input, tunnelId, service) {
   if (existing.success && Array.isArray(existing.result) && existing.result.length > 0) {
     const rec = existing.result[0];
     if (rec.content === target) return;
-    const upd = await cf({
+    const upd = await cf2({
       apiToken: input.apiToken,
       method: "PUT",
       path: `/zones/${input.zone.id}/dns_records/${rec.id}`,
@@ -173,7 +362,7 @@ async function ensureDnsRecord(input, tunnelId, service) {
     }
     return;
   }
-  const created = await cf({
+  const created = await cf2({
     apiToken: input.apiToken,
     method: "POST",
     path: `/zones/${input.zone.id}/dns_records`,
@@ -184,9 +373,9 @@ async function ensureDnsRecord(input, tunnelId, service) {
   throw new Error(`[cf] DNS record create for ${fqdn} failed: ${JSON.stringify(created.errors)}`);
 }
 async function provisionIngress(input) {
-  const prior = loadState(input.stateFile);
+  const prior = loadState2(input.stateFile);
   const tunnelId = await ensureTunnel(input, prior?.tunnelId ?? null);
-  saveState(input.stateFile, {
+  saveState2(input.stateFile, {
     tunnelId,
     accountId: input.accountId,
     tunnelName: input.tunnelName,
@@ -199,13 +388,13 @@ async function provisionIngress(input) {
   for (const s of input.services) hostnames[s.name] = `${serviceLabel(s)}.${input.zone.name}`;
   return { tunnelId, connectorToken, hostnames };
 }
-var import_node_fs, import_node_path, CF_API_BASE, CF_ERR_DNS_RECORD_EXISTS;
+var import_node_fs2, import_node_path2, CF_API_BASE2, CF_ERR_DNS_RECORD_EXISTS;
 var init_cf_ingress = __esm({
   "src/server/cf-ingress.ts"() {
     "use strict";
-    import_node_fs = require("node:fs");
-    import_node_path = require("node:path");
-    CF_API_BASE = "https://api.cloudflare.com/client/v4";
+    import_node_fs2 = require("node:fs");
+    import_node_path2 = require("node:path");
+    CF_API_BASE2 = "https://api.cloudflare.com/client/v4";
     CF_ERR_DNS_RECORD_EXISTS = 81053;
   }
 });
@@ -516,16 +705,16 @@ __export(state_exports, {
   saveRoverState: () => saveRoverState
 });
 function stateDir() {
-  return (0, import_node_path2.join)((0, import_node_os.homedir)(), LAUNCHSECURE_DIR, "rover");
+  return (0, import_node_path3.join)((0, import_node_os.homedir)(), LAUNCHSECURE_DIR, "rover");
 }
 function statePath(roverId) {
-  return (0, import_node_path2.join)(stateDir(), `${roverId}.json`);
+  return (0, import_node_path3.join)(stateDir(), `${roverId}.json`);
 }
 function loadRoverState(roverId) {
   const p = statePath(roverId);
-  if (!(0, import_node_fs2.existsSync)(p)) return null;
+  if (!(0, import_node_fs3.existsSync)(p)) return null;
   try {
-    const data = JSON.parse((0, import_node_fs2.readFileSync)(p, "utf-8"));
+    const data = JSON.parse((0, import_node_fs3.readFileSync)(p, "utf-8"));
     if (!data.roverId || !data.secret || !data.tunnelUrl) return null;
     return data;
   } catch {
@@ -533,21 +722,21 @@ function loadRoverState(roverId) {
   }
 }
 function saveRoverState(state) {
-  (0, import_node_fs2.mkdirSync)(stateDir(), { recursive: true });
+  (0, import_node_fs3.mkdirSync)(stateDir(), { recursive: true });
   const final = statePath(state.roverId);
   const tmp = `${final}.tmp`;
-  (0, import_node_fs2.writeFileSync)(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
-  (0, import_node_fs2.renameSync)(tmp, final);
+  (0, import_node_fs3.writeFileSync)(tmp, JSON.stringify(state, null, 2) + "\n", { mode: 384 });
+  (0, import_node_fs3.renameSync)(tmp, final);
 }
 function clearRoverState(roverId) {
   try {
-    (0, import_node_fs2.unlinkSync)(statePath(roverId));
+    (0, import_node_fs3.unlinkSync)(statePath(roverId));
   } catch {
   }
 }
 function listRoverIds() {
   const dir = stateDir();
-  if (!(0, import_node_fs2.existsSync)(dir)) return [];
+  if (!(0, import_node_fs3.existsSync)(dir)) return [];
   try {
     const fs = require("node:fs");
     return fs.readdirSync(dir).filter((f) => f.endsWith(".json") && !f.includes(".tunnel.")).map((f) => f.slice(0, -5));
@@ -555,13 +744,13 @@ function listRoverIds() {
     return [];
   }
 }
-var import_node_fs2, import_node_os, import_node_path2;
+var import_node_fs3, import_node_os, import_node_path3;
 var init_state = __esm({
   "src/server/rover/state.ts"() {
     "use strict";
-    import_node_fs2 = require("node:fs");
+    import_node_fs3 = require("node:fs");
     import_node_os = require("node:os");
-    import_node_path2 = require("node:path");
+    import_node_path3 = require("node:path");
     init_launch_kit_paths();
   }
 });
@@ -610,7 +799,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@launchsecure/launch-kit",
-      version: "0.0.44",
+      version: "0.0.46",
       description: "LaunchSecure toolkit \u2014 launch-sequencer (pipeline runner + terminal bridge), launch-radar (feedback webhook receiver), launch-chart (project graph MCP), launch-deck (visual playground MCP), launch-kit-beacon (feedback Web Component), launch-recall (file-watcher backup). launch-pod is the container image these run inside.",
       license: "MIT",
       author: "LaunchSecure - AutomateWithUs",
@@ -881,7 +1070,7 @@ function renderDashboard(state, pods) {
 </head><body>
   <div class="topbar">
     <div class="brand">
-      <span class="logobox">${roverMark(20, "hsl(259 28% 12%)")}</span>
+      <span class="logobox">${roverMark(28, "hsl(259 28% 12%)", "full")}</span>
       <span class="wordmark">LaunchRover</span>
     </div>
     <div class="context">
@@ -1005,14 +1194,14 @@ function coerceEntry(raw, index) {
   if (r.args !== void 0 && (!Array.isArray(r.args) || r.args.some((a) => typeof a !== "string"))) {
     throw new Error(`[launch-kit-services] entry #${index}: args must be a string[]`);
   }
-  const skipSpawn = r.skipSpawn === true || r.bin === "";
-  return {
+  const spec = {
     name: r.name,
     port: r.port,
     bin: r.bin,
-    args: r.args ?? [],
-    skipSpawn
+    args: r.args ?? []
   };
+  if (r.skipSpawn === true || r.bin === "") spec.skipSpawn = true;
+  return spec;
 }
 function validate(services) {
   if (services.length === 0) {
@@ -1057,11 +1246,11 @@ function resolveServices(opts = {}) {
     }
     return validate(parsed.map(coerceEntry));
   }
-  const filePath = (0, import_node_path3.join)(cwd, ".launchpod", "services.json");
-  if ((0, import_node_fs3.existsSync)(filePath)) {
+  const filePath = (0, import_node_path4.join)(cwd, ".launchpod", "services.json");
+  if ((0, import_node_fs4.existsSync)(filePath)) {
     let parsed;
     try {
-      parsed = JSON.parse((0, import_node_fs3.readFileSync)(filePath, "utf8"));
+      parsed = JSON.parse((0, import_node_fs4.readFileSync)(filePath, "utf8"));
     } catch (err) {
       throw new Error(`[launch-kit-services] ${filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -1072,12 +1261,12 @@ function resolveServices(opts = {}) {
   }
   return validate(defaultServices());
 }
-var import_node_fs3, import_node_path3, SHORTHANDS, DNS_NAME_RE, SHORTHAND_NAMES;
+var import_node_fs4, import_node_path4, SHORTHANDS, DNS_NAME_RE, SHORTHAND_NAMES;
 var init_launch_kit_services = __esm({
   "src/server/launch-kit-services.ts"() {
     "use strict";
-    import_node_fs3 = require("node:fs");
-    import_node_path3 = require("node:path");
+    import_node_fs4 = require("node:fs");
+    import_node_path4 = require("node:path");
     SHORTHANDS = {
       radar: { port: 3517, bin: "launch-radar", args: [] },
       sequencer: { port: 3517, bin: "launch-sequencer", args: [] },
@@ -1097,12 +1286,23 @@ var init_launch_kit_services = __esm({
 function slugLabel(projectSlug) {
   return projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
-function serviceHostname(projectSlug, serviceName, zone) {
-  return `${slugLabel(projectSlug)}-${serviceName}.${zone}`;
+function roverToken(roverId) {
+  let h = 2166136261;
+  for (let i = 0; i < roverId.length; i++) {
+    h ^= roverId.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return ((h >>> 0) % 2176782336).toString(36).padStart(6, "0");
+}
+function serviceLabel2(projectSlug, serviceName, roverId) {
+  return `${serviceName}-${slugLabel(projectSlug)}-${roverToken(roverId)}`;
 }
-function serviceUrl(projectSlug, serviceName, zone) {
-  if (!zone) return null;
-  return `https://${serviceHostname(projectSlug, serviceName, zone)}`;
+function serviceHostname(projectSlug, serviceName, roverId, zone) {
+  return `${serviceLabel2(projectSlug, serviceName, roverId)}.${zone}`;
+}
+function serviceUrl(projectSlug, serviceName, roverId, zone) {
+  if (!zone || !roverId) return null;
+  return `https://${serviceHostname(projectSlug, serviceName, roverId, zone)}`;
 }
 var init_hostnames = __esm({
   "src/server/rover/runtime/hostnames.ts"() {
@@ -1124,8 +1324,12 @@ function validateUpRequest(state, body) {
   if (typeof body.projectSlug !== "string" || !DNS_SLUG_RE.test(body.projectSlug)) {
     throw new PodError("projectSlug must be a DNS-safe string (a-z, 0-9, -)");
   }
-  if (typeof body.claudeCredentialsB64 !== "string" || body.claudeCredentialsB64.length < 16) {
-    throw new PodError("claudeCredentialsB64 is required (base64-encoded Claude credentials JSON)");
+  const hasBlob = typeof body.claudeCredentialsB64 === "string" && body.claudeCredentialsB64.length >= 16;
+  const hasToken = typeof body.claudeOauthToken === "string" && body.claudeOauthToken.length >= 16;
+  if (!hasBlob && !hasToken) {
+    throw new PodError(
+      "one of claudeCredentialsB64 (base64-encoded Claude credentials JSON) or claudeOauthToken (CLAUDE_CODE_OAUTH_TOKEN from `claude setup-token`) is required"
+    );
   }
 }
 var DNS_SLUG_RE, PodError;
@@ -1183,12 +1387,17 @@ async function create(state, body) {
     if (body.podId) runArgs.push("--label", `launch-rover.podId=${body.podId}`);
     if (body.name) runArgs.push("--label", `launch-rover.name=${body.name}`);
     const envVars = {
-      CLAUDE_CREDENTIALS_B64: body.claudeCredentialsB64,
       LS_PAT: state.installPat,
       LS_ORG_SLUG: state.orgSlug,
       LS_PROJECT_SLUG: body.projectSlug,
+      // Folded into each service's DNS label by the pod entry so two rovers
+      // running the same project on the same zone don't collide — see
+      // runtime/hostnames.ts. Also read back in servicesForContainer below.
+      LS_ROVER_ID: state.roverId,
       LS_SERVER_URL: rewriteLocalhostForContainer(state.serverUrl)
     };
+    if (body.claudeCredentialsB64) envVars.CLAUDE_CREDENTIALS_B64 = body.claudeCredentialsB64;
+    if (body.claudeOauthToken) envVars.CLAUDE_CODE_OAUTH_TOKEN = body.claudeOauthToken;
     if (body.services && Array.isArray(body.services)) {
       envVars.LAUNCHKIT_SERVICES = JSON.stringify(body.services);
     }
@@ -1205,7 +1414,7 @@ async function create(state, body) {
     const containerId = (await dockerRun(runArgs)).stdout.trim();
     return { podId: body.podId ?? null, projectSlug: body.projectSlug, containerId, image, createdAt, runtime: "docker" };
   } finally {
-    if (dockerConfigDir) (0, import_node_fs4.rmSync)(dockerConfigDir, { recursive: true, force: true });
+    if (dockerConfigDir) (0, import_node_fs5.rmSync)(dockerConfigDir, { recursive: true, force: true });
   }
 }
 async function stop(_state, body) {
@@ -1287,6 +1496,7 @@ async function servicesForContainer(ref, projectSlug) {
     if (eq > 0) env[kv.slice(0, eq)] = kv.slice(eq + 1);
   }
   const zone = env.LAUNCHKIT_CF_BASE_DOMAIN || null;
+  const roverId = env.LS_ROVER_ID || null;
   let specs;
   try {
     specs = resolveServices({
@@ -1295,7 +1505,7 @@ async function servicesForContainer(ref, projectSlug) {
   } catch {
     return void 0;
   }
-  return specs.filter((s) => !s.skipSpawn).map((s) => ({ name: s.name, port: s.port, url: serviceUrl(projectSlug, s.name, zone) }));
+  return specs.filter((s) => !s.skipSpawn).map((s) => ({ name: s.name, port: s.port, url: serviceUrl(projectSlug, s.name, roverId, zone) }));
 }
 async function purgeAll(state) {
   const { pods } = await list(state);
@@ -1385,10 +1595,10 @@ function setupDockerConfig() {
     );
     return null;
   }
-  const dir = (0, import_node_fs4.mkdtempSync)((0, import_node_path4.join)((0, import_node_os2.tmpdir)(), "launch-rover-docker-"));
+  const dir = (0, import_node_fs5.mkdtempSync)((0, import_node_path5.join)((0, import_node_os2.tmpdir)(), "launch-rover-docker-"));
   const auth = Buffer.from(`${GHCR_USERNAME}:${token}`, "utf-8").toString("base64");
   const config = { auths: { [GHCR_REGISTRY]: { auth } } };
-  (0, import_node_fs4.writeFileSync)((0, import_node_path4.join)(dir, "config.json"), JSON.stringify(config), { mode: 384 });
+  (0, import_node_fs5.writeFileSync)((0, import_node_path5.join)(dir, "config.json"), JSON.stringify(config), { mode: 384 });
   return dir;
 }
 function parsePsRow(row) {
@@ -1419,14 +1629,14 @@ function parseLabels(raw) {
   }
   return out;
 }
-var import_node_child_process2, import_node_fs4, import_node_os2, import_node_path4, import_node_util, execFileAsync, DEFAULT_IMAGE, GHCR_REGISTRY, GHCR_USERNAME, MANAGED_LABEL, POD_NAME_PREFIX, VOLUME_PREFIX, dockerRuntime;
+var import_node_child_process2, import_node_fs5, import_node_os2, import_node_path5, import_node_util, execFileAsync, DEFAULT_IMAGE, GHCR_REGISTRY, GHCR_USERNAME, MANAGED_LABEL, POD_NAME_PREFIX, VOLUME_PREFIX, dockerRuntime;
 var init_docker = __esm({
   "src/server/rover/runtime/docker.ts"() {
     "use strict";
     import_node_child_process2 = require("node:child_process");
-    import_node_fs4 = require("node:fs");
+    import_node_fs5 = require("node:fs");
     import_node_os2 = require("node:os");
-    import_node_path4 = require("node:path");
+    import_node_path5 = require("node:path");
     import_node_util = require("node:util");
     init_launch_kit_services();
     init_hostnames();
@@ -1474,16 +1684,16 @@ var init_ports = __esm({
 
 // src/server/rover/runtime/registry.ts
 function podsRoot() {
-  return (0, import_node_path5.join)((0, import_node_os3.homedir)(), LAUNCHSECURE_DIR, "pods");
+  return (0, import_node_path6.join)((0, import_node_os3.homedir)(), LAUNCHSECURE_DIR, "pods");
 }
 function registryPath() {
-  return (0, import_node_path5.join)(podsRoot(), "registry.json");
+  return (0, import_node_path6.join)(podsRoot(), "registry.json");
 }
 function load() {
   const p = registryPath();
-  if (!(0, import_node_fs5.existsSync)(p)) return { pods: [] };
+  if (!(0, import_node_fs6.existsSync)(p)) return { pods: [] };
   try {
-    const doc = JSON.parse((0, import_node_fs5.readFileSync)(p, "utf-8"));
+    const doc = JSON.parse((0, import_node_fs6.readFileSync)(p, "utf-8"));
     if (!doc || !Array.isArray(doc.pods)) return { pods: [] };
     return doc;
   } catch {
@@ -1492,11 +1702,11 @@ function load() {
 }
 function save(doc) {
   const dir = podsRoot();
-  (0, import_node_fs5.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
   const final = registryPath();
   const tmp = `${final}.tmp`;
-  (0, import_node_fs5.writeFileSync)(tmp, JSON.stringify(doc, null, 2) + "\n", { mode: 384 });
-  (0, import_node_fs5.renameSync)(tmp, final);
+  (0, import_node_fs6.writeFileSync)(tmp, JSON.stringify(doc, null, 2) + "\n", { mode: 384 });
+  (0, import_node_fs6.renameSync)(tmp, final);
 }
 function recordIsAlive(rec) {
   try {
@@ -1538,13 +1748,13 @@ function removeBySlug(projectSlug) {
   const next = doc.pods.filter((p) => p.projectSlug !== projectSlug);
   if (next.length !== doc.pods.length) save({ pods: next });
 }
-var import_node_fs5, import_node_os3, import_node_path5;
+var import_node_fs6, import_node_os3, import_node_path6;
 var init_registry = __esm({
   "src/server/rover/runtime/registry.ts"() {
     "use strict";
-    import_node_fs5 = require("node:fs");
+    import_node_fs6 = require("node:fs");
     import_node_os3 = require("node:os");
-    import_node_path5 = require("node:path");
+    import_node_path6 = require("node:path");
     init_launch_kit_paths();
     init_ports();
   }
@@ -1555,27 +1765,29 @@ function isDeniedEnvKey(k) {
   return DENIED_ENV.has(k) || /^(LD_|DYLD_)/.test(k);
 }
 function buildPodEnv(state, spec, root, services) {
-  const home = (0, import_node_path6.join)(root, "home");
-  const workspace = (0, import_node_path6.join)(root, "workspace");
+  const home = (0, import_node_path7.join)(root, "home");
+  const workspace = (0, import_node_path7.join)(root, "workspace");
   const env = {};
   for (const k of BASE_ENV_PASSTHROUGH) {
     const v = process.env[k];
     if (typeof v === "string") env[k] = v;
   }
   if (spec.claudeCredentialsB64) env.CLAUDE_CREDENTIALS_B64 = spec.claudeCredentialsB64;
+  if (spec.claudeOauthToken) env.CLAUDE_CODE_OAUTH_TOKEN = spec.claudeOauthToken;
   env.LS_PAT = state.installPat;
   env.LS_ORG_SLUG = state.orgSlug;
   env.LS_PROJECT_SLUG = spec.projectSlug;
+  env.LS_ROVER_ID = state.roverId;
   env.LS_SERVER_URL = state.serverUrl;
   env.LAUNCHKIT_SERVICES = JSON.stringify(servicesToEntries(services));
   if (spec.cfBaseDomain) env.LAUNCHKIT_CF_BASE_DOMAIN = spec.cfBaseDomain;
   env.HOME = home;
   env.LAUNCHPOD_WORKSPACE = workspace;
-  env.XDG_CONFIG_HOME = (0, import_node_path6.join)(home, ".config");
-  env.XDG_DATA_HOME = (0, import_node_path6.join)(home, ".local", "share");
-  env.XDG_CACHE_HOME = (0, import_node_path6.join)(home, ".cache");
-  env.GIT_CONFIG_GLOBAL = (0, import_node_path6.join)(home, ".gitconfig");
-  env.GH_CONFIG_DIR = (0, import_node_path6.join)(home, ".config", "gh");
+  env.XDG_CONFIG_HOME = (0, import_node_path7.join)(home, ".config");
+  env.XDG_DATA_HOME = (0, import_node_path7.join)(home, ".local", "share");
+  env.XDG_CACHE_HOME = (0, import_node_path7.join)(home, ".cache");
+  env.GIT_CONFIG_GLOBAL = (0, import_node_path7.join)(home, ".gitconfig");
+  env.GH_CONFIG_DIR = (0, import_node_path7.join)(home, ".config", "gh");
   env.LAUNCHPOD_RUNTIME = "process";
   env.LAUNCHPOD_NO_PARK = "1";
   if (spec.env && typeof spec.env === "object") {
@@ -1594,18 +1806,18 @@ function servicesToEntries(services) {
   return services.map((s) => ({ name: s.name, port: s.port, bin: s.bin, args: s.args, skipSpawn: s.skipSpawn }));
 }
 function ensurePodDirs(root) {
-  const workspace = (0, import_node_path6.join)(root, "workspace");
-  const home = (0, import_node_path6.join)(root, "home");
-  (0, import_node_fs6.mkdirSync)(root, { recursive: true, mode: 448 });
-  (0, import_node_fs6.mkdirSync)(workspace, { recursive: true, mode: 448 });
-  (0, import_node_fs6.mkdirSync)((0, import_node_path6.join)(home, ".claude"), { recursive: true, mode: 448 });
-  (0, import_node_fs6.mkdirSync)((0, import_node_path6.join)(home, ".config", "gh"), { recursive: true, mode: 448 });
-  (0, import_node_fs6.mkdirSync)((0, import_node_path6.join)(home, ".local", "share"), { recursive: true, mode: 448 });
-  (0, import_node_fs6.mkdirSync)((0, import_node_path6.join)(home, ".cache"), { recursive: true, mode: 448 });
+  const workspace = (0, import_node_path7.join)(root, "workspace");
+  const home = (0, import_node_path7.join)(root, "home");
+  (0, import_node_fs7.mkdirSync)(root, { recursive: true, mode: 448 });
+  (0, import_node_fs7.mkdirSync)(workspace, { recursive: true, mode: 448 });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path7.join)(home, ".claude"), { recursive: true, mode: 448 });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path7.join)(home, ".config", "gh"), { recursive: true, mode: 448 });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path7.join)(home, ".local", "share"), { recursive: true, mode: 448 });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path7.join)(home, ".cache"), { recursive: true, mode: 448 });
   return { workspace, home };
 }
 function spawnPod(workspace, env, logFile, projectSlug) {
-  const logFd = (0, import_node_fs6.openSync)(logFile, "a", 384);
+  const logFd = (0, import_node_fs7.openSync)(logFile, "a", 384);
   let child;
   try {
     child = (0, import_node_child_process3.spawn)(POD_ENTRY_BIN, [POD_ENTRY_ARG], {
@@ -1616,7 +1828,7 @@ function spawnPod(workspace, env, logFile, projectSlug) {
       stdio: ["ignore", logFd, logFd]
     });
   } finally {
-    (0, import_node_fs6.closeSync)(logFd);
+    (0, import_node_fs7.closeSync)(logFd);
   }
   if (typeof child.pid !== "number") {
     throw new PodError(`failed to spawn pod process for "${projectSlug}"`, 500);
@@ -1624,12 +1836,12 @@ function spawnPod(workspace, env, logFile, projectSlug) {
   child.unref();
   return child.pid;
 }
-function reconstructUrls(projectSlug, services, cfBaseDomain, localOnly) {
+function reconstructUrls(projectSlug, services, roverId, cfBaseDomain, localOnly) {
   const urls = {};
   if (localOnly || !cfBaseDomain) return urls;
   for (const s of services) {
     if (s.skipSpawn) continue;
-    const u = serviceUrl(projectSlug, s.name, cfBaseDomain);
+    const u = serviceUrl(projectSlug, s.name, roverId, cfBaseDomain);
     if (u) urls[s.name] = u;
   }
   return urls;
@@ -1641,7 +1853,7 @@ async function create2(state, body) {
     await signalGroupDown(prior, "SIGTERM");
   }
   const slot = assignSlot(body.projectSlug);
-  const root = (0, import_node_path6.join)(podsRoot(), body.projectSlug);
+  const root = (0, import_node_path7.join)(podsRoot(), body.projectSlug);
   const { workspace } = ensurePodDirs(root);
   let baseServices;
   try {
@@ -1654,12 +1866,12 @@ async function create2(state, body) {
   const services = assignPortsForSlot(baseServices, slot);
   const env = buildPodEnv(state, body, root, services);
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
-  const logFile = (0, import_node_path6.join)(root, "pod.log");
+  const logFile = (0, import_node_path7.join)(root, "pod.log");
   const pid = spawnPod(workspace, env, logFile, body.projectSlug);
   const ports = {};
   for (const s of services) if (!s.skipSpawn) ports[s.name] = s.port;
   const localOnly = body.env?.LAUNCHKIT_LOCAL_ONLY === "1";
-  const urls = reconstructUrls(body.projectSlug, services, body.cfBaseDomain, localOnly);
+  const urls = reconstructUrls(body.projectSlug, services, state.roverId, body.cfBaseDomain, localOnly);
   const record = {
     projectSlug: body.projectSlug,
     podId: body.podId ?? null,
@@ -1670,9 +1882,13 @@ async function create2(state, body) {
     ports,
     urls,
     // Kept so `start` can respawn the same service set + ingress without the
-    // original up request (creds come from the pod's own on-disk store).
+    // original up request (blob creds come from the pod's own on-disk store).
     services: baseServices.map((s) => s.name),
     cfBaseDomain: body.cfBaseDomain,
+    // Token mode writes nothing to disk, so the long-lived token is kept here to
+    // re-inject on respawn. Undefined (omitted) in blob mode. registry.json is
+    // 0o600 — same protection blob mode gives the on-disk credentials file.
+    claudeOauthToken: body.claudeOauthToken,
     stopped: false,
     root,
     logFile,
@@ -1709,7 +1925,7 @@ async function tear2(_state, body) {
   let volumesRemoved = false;
   if (body.purge) {
     try {
-      (0, import_node_fs6.rmSync)(rec.root, { recursive: true, force: true });
+      (0, import_node_fs7.rmSync)(rec.root, { recursive: true, force: true });
       volumesRemoved = true;
     } catch (err) {
       console.warn(`[rover] purge of process pod folder "${rec.root}" failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1735,7 +1951,12 @@ async function start2(state, body) {
   }
   const services = assignPortsForSlot(baseServices, rec.slot);
   const { workspace } = ensurePodDirs(rec.root);
-  const env = buildPodEnv(state, { projectSlug: rec.projectSlug, cfBaseDomain: rec.cfBaseDomain }, rec.root, services);
+  const env = buildPodEnv(
+    state,
+    { projectSlug: rec.projectSlug, cfBaseDomain: rec.cfBaseDomain, claudeOauthToken: rec.claudeOauthToken },
+    rec.root,
+    services
+  );
   const pid = spawnPod(workspace, env, rec.logFile, rec.projectSlug);
   upsert({ ...rec, pid, pgid: pid, stopped: false });
   console.log(`[rover] process pod "${body.projectSlug}" resumed \u2014 pid ${pid}, slot ${rec.slot}`);
@@ -1801,13 +2022,13 @@ async function signalGroupDown(rec, signal) {
 function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-var import_node_child_process3, import_node_fs6, import_node_path6, POD_ENTRY_BIN, POD_ENTRY_ARG, DENIED_ENV, BASE_ENV_PASSTHROUGH, processRuntime;
+var import_node_child_process3, import_node_fs7, import_node_path7, POD_ENTRY_BIN, POD_ENTRY_ARG, DENIED_ENV, BASE_ENV_PASSTHROUGH, processRuntime;
 var init_process = __esm({
   "src/server/rover/runtime/process.ts"() {
     "use strict";
     import_node_child_process3 = require("node:child_process");
-    import_node_fs6 = require("node:fs");
-    import_node_path6 = require("node:path");
+    import_node_fs7 = require("node:fs");
+    import_node_path7 = require("node:path");
     init_launch_kit_services();
     init_hostnames();
     init_ports();
@@ -1902,25 +2123,25 @@ __export(daemon_exports, {
   startDaemon: () => startDaemon
 });
 function lockPath() {
-  return (0, import_node_path7.join)((0, import_node_os4.homedir)(), LAUNCHSECURE_DIR, ROVER_LOCK_FILENAME);
+  return (0, import_node_path8.join)((0, import_node_os4.homedir)(), LAUNCHSECURE_DIR, ROVER_LOCK_FILENAME);
 }
 function readRoverLock() {
   const p = lockPath();
-  if (!(0, import_node_fs7.existsSync)(p)) return null;
+  if (!(0, import_node_fs8.existsSync)(p)) return null;
   try {
-    return JSON.parse((0, import_node_fs7.readFileSync)(p, "utf-8"));
+    return JSON.parse((0, import_node_fs8.readFileSync)(p, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeLock(lock) {
-  const dir = (0, import_node_path7.join)((0, import_node_os4.homedir)(), LAUNCHSECURE_DIR);
-  (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
-  (0, import_node_fs7.writeFileSync)(lockPath(), JSON.stringify(lock, null, 2) + "\n", "utf-8");
+  const dir = (0, import_node_path8.join)((0, import_node_os4.homedir)(), LAUNCHSECURE_DIR);
+  (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs8.writeFileSync)(lockPath(), JSON.stringify(lock, null, 2) + "\n", "utf-8");
 }
 function clearLock() {
   try {
-    (0, import_node_fs7.unlinkSync)(lockPath());
+    (0, import_node_fs8.unlinkSync)(lockPath());
   } catch {
   }
 }
@@ -1990,6 +2211,9 @@ async function handleRequest(req, res, state) {
   if (method === "GET" && path === "/health") {
     return json(res, 200, { ok: true, roverId: state.roverId, orgSlug: state.orgSlug });
   }
+  if (method === "GET" && path === "/self/status") {
+    return json(res, 200, { roverId: state.roverId, kitVersion: KIT_VERSION, podImage: POD_IMAGE });
+  }
   if (method === "GET" && (path === "/" || path === "/pods" || path === "/ui")) {
     try {
       const { pods } = await podsList(state);
@@ -2040,6 +2264,47 @@ async function handleRequest(req, res, state) {
       return json(res, 500, { error: err instanceof Error ? err.message : "internal_error" });
     }
   }
+  if (method === "POST" && path === "/self/update") {
+    const rawBody = await readBody(req);
+    const sigHeader = req.headers["x-ls-signature"];
+    const sigStr = Array.isArray(sigHeader) ? sigHeader[0] : sigHeader;
+    const failure = verifySignature(state.secret, rawBody, sigStr);
+    if (failure) {
+      console.warn(`[rover] POST /self/update \u2192 401 (${failure})`);
+      return json(res, 401, { error: "invalid_signature" });
+    }
+    let targetVersion;
+    if (rawBody.length > 0) {
+      try {
+        targetVersion = JSON.parse(rawBody).targetVersion;
+      } catch {
+        return json(res, 400, { error: "malformed_json" });
+      }
+    }
+    if (!targetVersion || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(targetVersion)) {
+      return json(res, 400, { error: "invalid_target_version", detail: "expected a concrete semver, e.g. 0.0.45" });
+    }
+    if (targetVersion === KIT_VERSION) {
+      return json(res, 200, { ok: true, updated: false, reason: "already_on_target", kitVersion: KIT_VERSION });
+    }
+    json(res, 200, { ok: true, updating: true, from: KIT_VERSION, to: targetVersion });
+    const argv0 = process.argv[1] ?? "launch-rover";
+    const child = (0, import_node_child_process4.spawn)(
+      process.execPath,
+      [argv0, "rover-update", `--rover=${state.roverId}`, `--version=${targetVersion}`, `--pod-image=${POD_IMAGE}`],
+      { detached: true, stdio: "ignore", env: process.env }
+    );
+    child.unref();
+    console.log(`[rover] /self/update \u2014 spawned updater (pid ${child.pid}) ${KIT_VERSION} \u2192 ${targetVersion}; exiting for re-exec`);
+    setTimeout(() => {
+      try {
+        process.kill(process.pid, "SIGTERM");
+      } catch {
+        process.exit(0);
+      }
+    }, 250).unref();
+    return;
+  }
   if (method === "POST" && path === "/shutdown") {
     const rawBody = await readBody(req);
     const sigHeader = req.headers["x-ls-signature"];
@@ -2087,7 +2352,7 @@ function readBody(req) {
   });
 }
 async function sendHeartbeat(state) {
-  const payload = JSON.stringify({ roverId: state.roverId });
+  const payload = JSON.stringify({ roverId: state.roverId, kitVersion: KIT_VERSION, podImage: POD_IMAGE });
   const { header } = buildSignatureHeader(state.secret, payload);
   const url = new URL("/api/rover/heartbeat", state.serverUrl);
   await postJson(url, payload, { "X-LS-Signature": header });
@@ -2126,21 +2391,24 @@ function postJson(url, body, extra) {
     req.end();
   });
 }
-var import_node_fs7, import_node_http2, import_node_http3, import_node_https2, import_node_os4, import_node_path7, ROVER_LOCK_FILENAME;
+var import_node_child_process4, import_node_fs8, import_node_http2, import_node_http3, import_node_https2, import_node_os4, import_node_path8, KIT_VERSION, POD_IMAGE, ROVER_LOCK_FILENAME;
 var init_daemon = __esm({
   "src/server/rover/daemon.ts"() {
     "use strict";
-    import_node_fs7 = require("node:fs");
+    import_node_child_process4 = require("node:child_process");
+    import_node_fs8 = require("node:fs");
     import_node_http2 = require("node:http");
     import_node_http3 = require("node:http");
     import_node_https2 = require("node:https");
     import_node_os4 = require("node:os");
-    import_node_path7 = require("node:path");
+    import_node_path8 = require("node:path");
     init_launch_kit_paths();
     init_dashboard();
     init_hmac();
     init_pods();
     init_state();
+    KIT_VERSION = require_package().version;
+    POD_IMAGE = process.env.LAUNCHKIT_POD_IMAGE ?? "ghcr.io/launchsecure/launch-pod:latest";
     ROVER_LOCK_FILENAME = "launch-rover.lock";
   }
 });
@@ -20903,11 +21171,11 @@ function createTunnel(opts) {
   const exhaustive = opts.provider;
   throw new Error(`[tunnel] unknown provider: ${String(exhaustive)}`);
 }
-var import_node_fs8, import_node_events, import_promises3, import_undici, import_cloudflared, dnsResolver, dnsCache, dnsResilientDispatcher, BACKOFF_MIN_MS, BACKOFF_MAX_MS, SELFTEST_INTERVAL_MS, SELFTEST_TIMEOUT_MS, NAMED_FATAL_PATTERNS, CloudflaredTunnel;
+var import_node_fs9, import_node_events, import_promises3, import_undici, import_cloudflared, dnsResolver, dnsCache, dnsResilientDispatcher, BACKOFF_MIN_MS, BACKOFF_MAX_MS, SELFTEST_INTERVAL_MS, SELFTEST_TIMEOUT_MS, NAMED_FATAL_PATTERNS, CloudflaredTunnel;
 var init_tunnel = __esm({
   "src/server/tunnel/index.ts"() {
     "use strict";
-    import_node_fs8 = require("node:fs");
+    import_node_fs9 = require("node:fs");
     import_node_events = require("node:events");
     import_promises3 = require("node:dns/promises");
     init_source();
@@ -20955,7 +21223,7 @@ var init_tunnel = __esm({
       }
       async start() {
         if (this.tunnel) return;
-        if (!(0, import_node_fs8.existsSync)(import_cloudflared.bin)) {
+        if (!(0, import_node_fs9.existsSync)(import_cloudflared.bin)) {
           console.log("[tunnel] downloading cloudflared binary (one-time setup)\u2026");
           try {
             await (0, import_cloudflared.install)(import_cloudflared.bin);
@@ -21222,9 +21490,9 @@ async function runSetup(argv) {
   }
   const zone = await resolveZone(lsConfig.cfApiToken, lsConfig.cfDomainName);
   console.log(`[rover] resolved CF zone: ${zone.name} (account ${zone.accountId})`);
-  const stateDir2 = (0, import_node_path8.join)((0, import_node_os6.homedir)(), LAUNCHSECURE_DIR, "rover");
-  (0, import_node_fs9.mkdirSync)(stateDir2, { recursive: true });
-  const tunnelStateFile = (0, import_node_path8.join)(stateDir2, `${roverId}.tunnel.json`);
+  const stateDir2 = (0, import_node_path9.join)((0, import_node_os6.homedir)(), LAUNCHSECURE_DIR, "rover");
+  (0, import_node_fs10.mkdirSync)(stateDir2, { recursive: true });
+  const tunnelStateFile = (0, import_node_path9.join)(stateDir2, `${roverId}.tunnel.json`);
   const idSuffix = roverId.replace(/[^a-z0-9]/gi, "").toLowerCase().slice(-8);
   const subdomain = `rover-${args.orgSlug.replace(/[^a-z0-9-]/gi, "-").toLowerCase().slice(0, 30)}-${idSuffix}`;
   const tunnelName = `launch-rover-${roverId}`;
@@ -21257,7 +21525,7 @@ async function runSetup(argv) {
       platform: (0, import_node_os6.platform)(),
       hostname: args.name ?? (0, import_node_os6.hostname)(),
       dockerVersion,
-      kitVersion: KIT_VERSION,
+      kitVersion: KIT_VERSION2,
       // The actual pod backend this host runs — lets LS show the reported
       // runtime and flag drift from the configured `defaultRuntime`.
       runtime: args.runtime
@@ -21267,6 +21535,14 @@ async function runSetup(argv) {
   console.log(
     `[rover] LS state: ${outcome.approvalStatus}${outcome.reused ? " (reused existing secret)" : " (new secret minted)"}`
   );
+  await gateDashboard({
+    apiToken: lsConfig.cfApiToken,
+    accountId: zone.accountId,
+    issuer: args.serverUrl,
+    hostname,
+    pat: args.pat,
+    stateFile: (0, import_node_path9.join)(stateDir2, `${roverId}.access.json`)
+  });
   await launchDaemon(args, ingress, outcome.state);
   console.log("");
   if (outcome.approvalStatus === "pending_approval") {
@@ -21322,7 +21598,7 @@ async function launchDaemon(args, ingress, state) {
     return;
   }
   const argv0 = process.argv[1] ?? "launch-rover";
-  const child = (0, import_node_child_process4.spawn)(process.execPath, [argv0, "serve", `--rover=${state.roverId}`], {
+  const child = (0, import_node_child_process5.spawn)(process.execPath, [argv0, "serve", `--rover=${state.roverId}`], {
     detached: true,
     stdio: "ignore",
     env: {
@@ -21334,6 +21610,52 @@ async function launchDaemon(args, ingress, state) {
   child.unref();
   console.log(`[rover] daemon spawned (pid ${child.pid}, detached)`);
 }
+async function gateDashboard(input) {
+  const services = [
+    // Host-level gate — the read-only dashboard. 24h session (not RCE-bearing,
+    // unlike the bot terminal which the pod entrypoint marks strict).
+    { hostname: input.hostname, strict: false },
+    // Public carve-outs for the machine routes.
+    ...ACCESS_BYPASS_PATHS.map((path) => ({ hostname: input.hostname, path, bypass: true }))
+  ];
+  console.log(`[rover] gating ${input.hostname} behind CF Access (IdP: ${input.issuer})`);
+  try {
+    const result = await provisionAccess({
+      apiToken: input.apiToken,
+      accountId: input.accountId,
+      issuer: input.issuer,
+      services,
+      stateFile: input.stateFile,
+      registerClient: (redirectUris) => registerOidcClient(input.issuer, input.pat, redirectUris)
+    });
+    console.log(`[rover] CF Access gate live \u2014 IdP ${result.idpId}, auth domain ${result.authDomain}`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `CF Access gating failed: ${msg}
+  The dashboard would be publicly reachable without it, so setup is aborting before the tunnel goes live.
+  Most common cause: the rover's Cloudflare token lacks Access scopes (Access: Apps and Policies + Account: Access Organizations, both Edit).
+  Re-mint the token from LS \u2192 Organization \u2192 Integrations \u2192 Cloudflare (the "Create token" link pre-selects them), update the rover, and re-run setup.`
+    );
+  }
+}
+async function registerOidcClient(serverUrl, pat, redirectUris) {
+  const res = await fetch(new URL("/api/rover/oidc-client", serverUrl), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${pat}`,
+      "Content-Type": "application/json",
+      Accept: "application/json"
+    },
+    body: JSON.stringify({ redirectUris }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.success || !body.data) {
+    throw new Error(`OIDC client provisioning failed (HTTP ${res.status}): ${body?.error ?? "unexpected response"}`);
+  }
+  return body.data;
+}
 function runSetupReset(roverId) {
   clearRoverState(roverId);
 }
@@ -21345,24 +21667,26 @@ function isPidAlive(pid) {
     return false;
   }
 }
-var import_node_os6, import_node_child_process4, import_node_path8, import_node_fs9, KIT_VERSION, DEFAULT_SERVER, DEFAULT_DAEMON_PORT, MIN_NODE_MAJOR;
+var import_node_os6, import_node_child_process5, import_node_path9, import_node_fs10, KIT_VERSION2, DEFAULT_SERVER, DEFAULT_DAEMON_PORT, MIN_NODE_MAJOR, ACCESS_BYPASS_PATHS;
 var init_setup = __esm({
   "src/server/rover/setup.ts"() {
     "use strict";
     import_node_os6 = require("node:os");
-    import_node_child_process4 = require("node:child_process");
-    import_node_path8 = require("node:path");
-    import_node_fs9 = require("node:fs");
+    import_node_child_process5 = require("node:child_process");
+    import_node_path9 = require("node:path");
+    import_node_fs10 = require("node:fs");
+    init_cf_access();
     init_cf_ingress();
     init_launch_kit_paths();
     init_docker_install();
     init_mcp_client();
     init_registration();
     init_state();
-    KIT_VERSION = require_package().version;
+    KIT_VERSION2 = require_package().version;
     DEFAULT_SERVER = "https://launchsecure-v2.vercel.app";
     DEFAULT_DAEMON_PORT = 52749;
     MIN_NODE_MAJOR = 18;
+    ACCESS_BYPASS_PATHS = ["/health", "/pods/up", "/pods/down", "/pods/start", "/pods/list", "/shutdown"];
   }
 });
 
@@ -21427,15 +21751,15 @@ async function runTeardown(argv) {
     }
   }
   clearRoverState(parsed.roverId);
-  const tunnelStateFile = (0, import_node_path9.join)(
+  const tunnelStateFile = (0, import_node_path10.join)(
     (0, import_node_os7.homedir)(),
     LAUNCHSECURE_DIR,
     "rover",
     `${parsed.roverId}.tunnel.json`
   );
-  if ((0, import_node_fs10.existsSync)(tunnelStateFile)) {
+  if ((0, import_node_fs11.existsSync)(tunnelStateFile)) {
     try {
-      (0, import_node_fs10.unlinkSync)(tunnelStateFile);
+      (0, import_node_fs11.unlinkSync)(tunnelStateFile);
     } catch {
     }
   }
@@ -21486,19 +21810,75 @@ function isPidAlive2(pid) {
 function sleep3(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-var import_node_fs10, import_node_os7, import_node_path9;
+var import_node_fs11, import_node_os7, import_node_path10;
 var init_teardown = __esm({
   "src/server/rover/teardown.ts"() {
     "use strict";
-    import_node_fs10 = require("node:fs");
+    import_node_fs11 = require("node:fs");
     import_node_os7 = require("node:os");
-    import_node_path9 = require("node:path");
+    import_node_path10 = require("node:path");
     init_launch_kit_paths();
     init_daemon();
     init_state();
   }
 });
 
+// src/server/rover/update.ts
+var update_exports = {};
+__export(update_exports, {
+  runUpdate: () => runUpdate
+});
+function parseArgs3(argv) {
+  const get = (k) => argv.find((a) => a.startsWith(`--${k}=`))?.slice(`--${k}=`.length);
+  const roverId = get("rover");
+  const version = get("version");
+  if (!roverId) throw new Error("rover-update requires --rover=<id>");
+  if (!version || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`rover-update requires --version=<concrete semver> (got "${version ?? ""}")`);
+  }
+  return { roverId, version, podImage: get("pod-image") };
+}
+function log(msg) {
+  process.stdout.write(`[rover-update] ${msg}
+`);
+}
+async function runUpdate(argv) {
+  const args = parseArgs3(argv);
+  log(`updating ${KIT_PACKAGE} \u2192 ${args.version} for rover ${args.roverId}`);
+  const install2 = (0, import_node_child_process6.spawnSync)("npm", ["install", "-g", `${KIT_PACKAGE}@${args.version}`], {
+    stdio: "inherit",
+    env: process.env
+  });
+  if (install2.status !== 0) {
+    log(`\u2717 npm install failed (status ${install2.status ?? "unknown"}); re-launching the existing version`);
+  } else {
+    log(`\u2713 installed ${KIT_PACKAGE}@${args.version}`);
+  }
+  if (args.podImage) {
+    const pull = (0, import_node_child_process6.spawnSync)("docker", ["pull", args.podImage], { stdio: "inherit", env: process.env });
+    if (pull.status === 0) {
+      log(`\u2713 pulled ${args.podImage}`);
+    } else {
+      log(`\u26A0 docker pull skipped/failed (status ${pull.status ?? "unknown"}) \u2014 pod will pull on next up`);
+    }
+  }
+  const child = (0, import_node_child_process6.spawn)("launch-rover", ["serve", `--rover=${args.roverId}`], {
+    detached: true,
+    stdio: "ignore",
+    env: process.env
+  });
+  child.unref();
+  log(`re-launched daemon (pid ${child.pid}); updater exiting`);
+}
+var import_node_child_process6, KIT_PACKAGE;
+var init_update = __esm({
+  "src/server/rover/update.ts"() {
+    "use strict";
+    import_node_child_process6 = require("node:child_process");
+    KIT_PACKAGE = "@launchsecure/launch-kit";
+  }
+});
+
 // src/server/rover-entry.ts
 function logStderr(msg) {
   process.stderr.write(`[launch-rover] ${msg}
@@ -21561,6 +21941,11 @@ async function main() {
       runStatus2(argv.slice(1));
       return;
     }
+    case "rover-update": {
+      const { runUpdate: runUpdate2 } = await Promise.resolve().then(() => (init_update(), update_exports));
+      await runUpdate2(argv.slice(1));
+      return;
+    }
     case "teardown": {
       const { runTeardown: runTeardown2 } = await Promise.resolve().then(() => (init_teardown(), teardown_exports));
       await runTeardown2(argv.slice(1));