@m-kopa/launchpad-cli 0.27.1 → 0.27.3

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.27.1";
+var CLI_VERSION = "0.27.3";
 
 // src/config.ts
 import * as os from "node:os";
@@ -994,8 +994,8 @@ function describe8(e) {
 }
 
 // src/commands/clone.ts
-import * as path4 from "node:path";
-import * as fs3 from "node:fs/promises";
+import * as path5 from "node:path";
+import * as fs4 from "node:fs/promises";
 
 // src/clone/tar-extract.ts
 import * as fs2 from "node:fs/promises";
@@ -1208,6 +1208,57 @@ function runGit(sp, cwd, args) {
   });
 }
 
+// src/clone/base-sha-marker.ts
+import * as path4 from "node:path";
+import * as fs3 from "node:fs/promises";
+var BASE_SHA_HEADER = "x-launchpad-base-sha";
+var MARKER_DIR = ".launchpad";
+var MARKER_RELPATH = `${MARKER_DIR}/base-sha`;
+var EXCLUDE_RELPATH = path4.join(".git", "info", "exclude");
+var EXCLUDE_LINE = `${MARKER_DIR}/`;
+var SHA_RE = /^[0-9a-f]{40}$/;
+function isValidBaseSha(value) {
+  return SHA_RE.test(value);
+}
+async function writeBaseShaMarker(cwd, sha) {
+  if (!isValidBaseSha(sha)) {
+    throw new Error(`refusing to stamp a non-SHA base marker: "${sha}"`);
+  }
+  await ensureExcluded(cwd);
+  const dir = path4.resolve(cwd, MARKER_DIR);
+  await fs3.mkdir(dir, { recursive: true });
+  await fs3.writeFile(path4.resolve(cwd, MARKER_RELPATH), `${sha}
+`, "utf8");
+}
+async function readBaseShaMarker(cwd) {
+  let raw;
+  try {
+    raw = await fs3.readFile(path4.resolve(cwd, MARKER_RELPATH), "utf8");
+  } catch {
+    return null;
+  }
+  const sha = raw.trim();
+  return isValidBaseSha(sha) ? sha : null;
+}
+async function ensureExcluded(cwd) {
+  const excludePath = path4.resolve(cwd, EXCLUDE_RELPATH);
+  let current = "";
+  try {
+    current = await fs3.readFile(excludePath, "utf8");
+  } catch {
+    await fs3.mkdir(path4.dirname(excludePath), { recursive: true });
+  }
+  const already = current.split(`
+`).some((line) => line.trim() === EXCLUDE_LINE);
+  if (already)
+    return;
+  const sep = current.length > 0 && !current.endsWith(`
+`) ? `
+` : "";
+  await fs3.writeFile(excludePath, `${current}${sep}${EXCLUDE_LINE}
+`, "utf8");
+}
+
 // src/commands/clone.ts
 var cloneCommand = {
   name: "clone",
@@ -1230,9 +1281,9 @@ async function runClone(args, io) {
   let destPreExisted = false;
   try {
     cfg = loadConfig();
-    destDir = path4.resolve(process.cwd(), `launchpad-app-${slug}`);
+    destDir = path5.resolve(process.cwd(), `launchpad-app-${slug}`);
     try {
-      await fs3.access(destDir);
+      await fs4.access(destDir);
       destPreExisted = true;
     } catch {
       destPreExisted = false;
@@ -1243,13 +1294,28 @@ async function runClone(args, io) {
       io.err(`launchpad clone: bot returned no body for /apps/${slug}/source-bundle`);
       return 1;
     }
+    const headerSha = res.headers.get(BASE_SHA_HEADER);
+    const baseSha = headerSha !== null && isValidBaseSha(headerSha) ? headerSha : null;
     const stats = await extractToDir(res.body, destDir, { stripComponents: 1 });
     await initGitRepo({
       cwd: destDir,
       initialCommitMessage: `Initial baseline from launchpad clone ${slug}`
     });
+    let stamped = false;
+    if (baseSha !== null) {
+      try {
+        await writeBaseShaMarker(destDir, baseSha);
+        stamped = true;
+      } catch (e) {
+        io.err(`launchpad clone: warning — could not record base revision: ${describe9(e)}`);
+        io.err("(the clone is usable, but deploy cannot detect divergence)");
+      }
+    }
     io.out("");
     io.out(`Cloned ${stats.fileCount} files (${formatBytes(stats.byteCount)}) into ${destDir}`);
+    if (stamped && baseSha !== null) {
+      io.out(`Base revision ${baseSha.slice(0, 12)} recorded — \`launchpad deploy\` will warn if main moves past it.`);
+    }
     io.out(`No remote configured — use \`launchpad deploy\` to ship changes back.`);
     return 0;
   } catch (e) {
@@ -1291,8 +1357,8 @@ async function runClone(args, io) {
   }
 }
 async function cleanupBestEffort(slug) {
-  const dir = path4.resolve(process.cwd(), `launchpad-app-${slug}`);
-  await fs3.rm(dir, { recursive: true, force: true }).catch(() => {
+  const dir = path5.resolve(process.cwd(), `launchpad-app-${slug}`);
+  await fs4.rm(dir, { recursive: true, force: true }).catch(() => {
     return;
   });
 }
@@ -1460,15 +1526,15 @@ function describe10(e) {
 
 // src/commands/deploy.ts
 import { existsSync as existsSync5 } from "node:fs";
-import * as path7 from "node:path";
+import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 
 // src/deploy/tar-pack.ts
-import * as fs4 from "node:fs/promises";
-import * as path5 from "node:path";
+import * as fs5 from "node:fs/promises";
+import * as path6 from "node:path";
 var MAX_COMPRESSED_TARBALL_BYTES = 50 * 1024 * 1024;
 var MAX_FILE_BYTES = 5 * 1024 * 1024;
 
@@ -1483,10 +1549,10 @@ async function packTarGz(cwd, files) {
   for (const rel of files) {
     if (rel.length === 0)
       continue;
-    const abs = path5.join(cwd, rel);
+    const abs = path6.join(cwd, rel);
     let stat;
     try {
-      stat = await fs4.lstat(abs);
+      stat = await fs5.lstat(abs);
     } catch (e) {
       if (isErrno3(e) && e.code === "ENOENT")
         continue;
@@ -1499,7 +1565,7 @@ async function packTarGz(cwd, files) {
     if (stat.size > MAX_FILE_BYTES) {
       throw new TarPackError(`file exceeds ${MAX_FILE_BYTES} bytes: ${rel} (${stat.size} bytes)`);
     }
-    const bytes = await fs4.readFile(abs);
+    const bytes = await fs5.readFile(abs);
     const mode = (stat.mode & 64) !== 0 ? 493 : 420;
     blocks.push(buildHeader({ path: rel, size: bytes.length, mode }, enc));
     blocks.push(bytes);
@@ -1618,7 +1684,7 @@ function isErrno3(e) {
 }
 
 // src/bundle/upload.ts
-async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact) {
+async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact, baseSha, overrideStale) {
   const formData = new FormData;
   formData.append("manifest", manifestYaml);
   const buf = new ArrayBuffer(bundleTarGz.byteLength);
@@ -1642,6 +1708,10 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
     authorization: `Bearer ${accessToken}`,
     accept: "application/json"
   };
+  if (baseSha)
+    headers["x-launchpad-base-sha"] = baseSha;
+  if (overrideStale)
+    headers["x-launchpad-stale-override"] = overrideStale;
   let res;
   try {
     res = await fetch(url, { method: "POST", headers, body: formData });
@@ -1684,7 +1754,7 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
 
 // src/bundle/cwd-walker.ts
 import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
-import { join as join3, relative as relative2, sep } from "node:path";
+import { join as join4, relative as relative2, sep } from "node:path";
 var DEFAULT_IGNORE = [
   ".git",
   "node_modules",
@@ -1733,7 +1803,7 @@ function walkCwd(cwd, options = {}) {
   return { files, skipped };
 }
 function walkInto(cwd, relDir, ignore, out, skipped, maxFiles) {
-  const absDir = relDir === "" ? cwd : join3(cwd, relDir);
+  const absDir = relDir === "" ? cwd : join4(cwd, relDir);
   let entries;
   try {
     entries = readdirSync(absDir);
@@ -1746,7 +1816,7 @@ function walkInto(cwd, relDir, ignore, out, skipped, maxFiles) {
   }
   for (const name of entries) {
     const relPath = relDir === "" ? name : `${relDir}/${name}`;
-    const absPath = join3(absDir, name);
+    const absPath = join4(absDir, name);
     if (DEFAULT_IGNORE_SET.has(name)) {
       skipped.push({ path: relPath, reason: "default-ignore" });
       continue;
@@ -1782,7 +1852,7 @@ function walkInto(cwd, relDir, ignore, out, skipped, maxFiles) {
   }
 }
 function loadIgnore(cwd) {
-  const file = join3(cwd, ".gitignore");
+  const file = join4(cwd, ".gitignore");
   if (!existsSync(file)) {
     return { matches: () => false };
   }
@@ -1863,7 +1933,7 @@ function globToRegExp(glob) {
 
 // src/bundle/cron-bundle.ts
 import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join4, resolve as resolve4 } from "node:path";
+import { dirname as dirname4, join as join5, resolve as resolve5 } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { build as esbuild } from "esbuild";
 function parseWranglerTopLevel(tomlText) {
@@ -1939,7 +2009,7 @@ function locateWorkerConfig(cwd, walkFiles, script) {
   for (const rel of walkFiles) {
     if (!rel.endsWith("wrangler.toml"))
       continue;
-    const abs = resolve4(cwd, rel);
+    const abs = resolve5(cwd, rel);
     let text;
     try {
       text = readFileSync2(abs, "utf8");
@@ -1951,8 +2021,8 @@ function locateWorkerConfig(cwd, walkFiles, script) {
       continue;
     if (cfg.main === undefined || cfg.main === "")
       continue;
-    const workerDir = dirname3(abs);
-    return { entryAbs: join4(workerDir, cfg.main), workerDir, cfg };
+    const workerDir = dirname4(abs);
+    return { entryAbs: join5(workerDir, cfg.main), workerDir, cfg };
   }
   return null;
 }
@@ -2022,7 +2092,7 @@ async function buildWorkerArtifact(cwd, manifestYaml, walkFiles) {
 
 // src/bundle/boundary.ts
 import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync3 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 import { parse as parseYaml2 } from "yaml";
 
 // ../launchpad-engine/dist/schema.js
@@ -2484,43 +2554,43 @@ var PLATFORM_SEEDED_GITHUB_PATHS = new Set([
   ".github/scripts/parse-gitleaks.mjs",
   ".github/scripts/parse-bun-audit.mjs"
 ]);
-function checkDenyList(path6) {
-  const segments = path6.split("/");
+function checkDenyList(path7) {
+  const segments = path7.split("/");
   const basename = segments[segments.length - 1];
   const isExample = basename.endsWith(".example");
   if (basename.startsWith(".env") && !isExample) {
-    return { path: path6, rule: "env-file", message: `'${path6}' is an environment file (.env*) — never shippable` };
+    return { path: path7, rule: "env-file", message: `'${path7}' is an environment file (.env*) — never shippable` };
   }
   if (basename === ".npmrc") {
-    return { path: path6, rule: "npmrc", message: `'${path6}' (.npmrc) may carry registry auth — never shippable` };
+    return { path: path7, rule: "npmrc", message: `'${path7}' (.npmrc) may carry registry auth — never shippable` };
   }
   if (basename.startsWith(".dev.vars") && !isExample) {
-    return { path: path6, rule: "dev-vars", message: `'${path6}' is a wrangler dev-vars file — never shippable` };
+    return { path: path7, rule: "dev-vars", message: `'${path7}' is a wrangler dev-vars file — never shippable` };
   }
   if (segments.includes(".claude")) {
-    return { path: path6, rule: "claude-dir", message: `'${path6}' is under a .claude/ directory (AI-workspace state) — never shippable` };
+    return { path: path7, rule: "claude-dir", message: `'${path7}' is under a .claude/ directory (AI-workspace state) — never shippable` };
   }
   if (segments.includes(".git")) {
-    return { path: path6, rule: "git-dir", message: `'${path6}' is under .git/ — never shippable` };
+    return { path: path7, rule: "git-dir", message: `'${path7}' is under .git/ — never shippable` };
   }
   if (segments[0] === ".github") {
-    if (PLATFORM_SEEDED_GITHUB_PATHS.has(path6))
+    if (PLATFORM_SEEDED_GITHUB_PATHS.has(path7))
       return "seeded";
     return {
-      path: path6,
+      path: path7,
       rule: "github-dir",
-      message: `'${path6}' — repo-root .github/ is platform-owned (workflows execute under the M-KOPA Actions identity); developer-supplied .github/** is not shippable`
+      message: `'${path7}' — repo-root .github/ is platform-owned (workflows execute under the M-KOPA Actions identity); developer-supplied .github/** is not shippable`
     };
   }
   return null;
 }
-function checkSecretShape(path6, readFileContent) {
-  const segments = path6.split("/");
+function checkSecretShape(path7, readFileContent) {
+  const segments = path7.split("/");
   const basename = segments[segments.length - 1];
   const deny = (what) => ({
-    path: path6,
+    path: path7,
     rule: "secret-shape",
-    message: `'${path6}' looks like ${what} — never shippable; if this is a false positive, rename the file`
+    message: `'${path7}' looks like ${what} — never shippable; if this is a false positive, rename the file`
   });
   if (basename.endsWith(".pem"))
     return deny("PEM key material (*.pem)");
@@ -2536,7 +2606,7 @@ function checkSecretShape(path6, readFileContent) {
   if (segments.includes(".aws"))
     return deny("AWS credentials (.aws/**)");
   if (basename.endsWith(".json") && readFileContent !== undefined) {
-    const content = readFileContent(path6);
+    const content = readFileContent(path7);
     if (content !== undefined && /"private_key"\s*:/.test(content)) {
       return deny('service-account-shaped JSON (carries a "private_key" field)');
     }
@@ -2550,41 +2620,41 @@ function applyAppBoundary(contract, files, options = {}) {
   const excluded = [];
   const denied = [];
   const rootPrefix = contract.root === "." ? "" : `${contract.root}/`;
-  for (const path6 of [...files].sort()) {
-    if (path6 !== ALWAYS_SHIP) {
-      if (rootPrefix !== "" && !path6.startsWith(rootPrefix)) {
-        excluded.push({ path: path6, reason: "outside-root" });
+  for (const path7 of [...files].sort()) {
+    if (path7 !== ALWAYS_SHIP) {
+      if (rootPrefix !== "" && !path7.startsWith(rootPrefix)) {
+        excluded.push({ path: path7, reason: "outside-root" });
         continue;
       }
-      const rel = rootPrefix === "" ? path6 : path6.slice(rootPrefix.length);
+      const rel = rootPrefix === "" ? path7 : path7.slice(rootPrefix.length);
       if (!contract.include.some((p) => matchContractPattern(p, rel))) {
-        excluded.push({ path: path6, reason: "not-included" });
+        excluded.push({ path: path7, reason: "not-included" });
         continue;
       }
       if (contract.exclude.some((p) => matchContractPattern(p, rel))) {
-        excluded.push({ path: path6, reason: "exclude" });
+        excluded.push({ path: path7, reason: "exclude" });
         continue;
       }
-      if (ignorePatterns.some((p) => matchIgnorePattern(p, path6))) {
-        excluded.push({ path: path6, reason: "launchpadignore" });
+      if (ignorePatterns.some((p) => matchIgnorePattern(p, path7))) {
+        excluded.push({ path: path7, reason: "launchpadignore" });
         continue;
       }
     }
-    const denial = checkDenyList(path6);
+    const denial = checkDenyList(path7);
     if (denial === "seeded") {
-      excluded.push({ path: path6, reason: "platform-seeded" });
+      excluded.push({ path: path7, reason: "platform-seeded" });
       continue;
     }
     if (denial !== null) {
       denied.push(denial);
       continue;
     }
-    const secret = checkSecretShape(path6, options.readFileContent);
+    const secret = checkSecretShape(path7, options.readFileContent);
     if (secret !== null) {
       denied.push(secret);
       continue;
     }
-    included.push(path6);
+    included.push(path7);
   }
   return { files: included, excluded, denied };
 }
@@ -2612,7 +2682,7 @@ function verifyBuildInputs(build, files) {
     return issues;
   }
   let cwd = rootDir === "." ? "" : rootDir;
-  const resolve5 = (p) => {
+  const resolve6 = (p) => {
     const cleaned = p.startsWith("./") ? p.slice(2) : p;
     const trimmed = cleaned.replace(/\/+$/, "");
     return cwd === "" ? trimmed : `${cwd}/${trimmed}`;
@@ -2632,7 +2702,7 @@ function verifyBuildInputs(build, files) {
         cwd = null;
         continue;
       }
-      const resolved = resolve5(target);
+      const resolved = resolve6(target);
       if (!dirSet.has(resolved)) {
         issues.push({
           input: target,
@@ -2659,7 +2729,7 @@ function verifyBuildInputs(build, files) {
       for (const src of sources) {
         if (!PLAIN_PATH.test(src))
           continue;
-        const resolved = resolve5(src);
+        const resolved = resolve6(src);
         if (!exists(resolved)) {
           issues.push({
             input: src,
@@ -3419,7 +3489,7 @@ function applyBoundaryToFiles(args) {
   }
   const contract = resolveAppBoundary({ appType: input.appType, app: input.app });
   let launchpadIgnore = [];
-  const ignorePath = join5(cwd, ".launchpadignore");
+  const ignorePath = join6(cwd, ".launchpadignore");
   if (existsSync2(ignorePath)) {
     try {
       launchpadIgnore = parseLaunchpadIgnore(readFileSync3(ignorePath, "utf8"));
@@ -3427,9 +3497,9 @@ function applyBoundaryToFiles(args) {
   }
   const result = applyAppBoundary(contract, files, {
     launchpadIgnore,
-    readFileContent: (path6) => {
+    readFileContent: (path7) => {
       try {
-        const abs = join5(cwd, path6);
+        const abs = join6(cwd, path7);
         const stat = lstatSync2(abs);
         if (!stat.isFile() || stat.size > MAX_CONTENT_PROBE_BYTES)
           return;
@@ -3481,8 +3551,8 @@ ${lines}`
 
 // src/bundle/orchestrate.ts
 async function bundleAndDeploy(args) {
-  const { cfg, cwd, slug } = args;
-  const manifestPath = join6(cwd, "launchpad.yaml");
+  const { cfg, cwd, slug, overrideStale } = args;
+  const manifestPath = join7(cwd, "launchpad.yaml");
   let manifestYaml;
   try {
     manifestYaml = readFileSync4(manifestPath, "utf8");
@@ -3526,7 +3596,8 @@ async function bundleAndDeploy(args) {
     return { kind: "worker-build-error", message: workerBuild.message };
   }
   const workerArtifact = workerBuild.kind === "ok" ? workerBuild.artifact : undefined;
-  const uploadResult = await uploadBundle(cfg, slug, manifestYaml, packResult.bytes, workerArtifact);
+  const baseSha = await readBaseShaMarker(cwd);
+  const uploadResult = await uploadBundle(cfg, slug, manifestYaml, packResult.bytes, workerArtifact, baseSha, overrideStale);
   if (uploadResult.kind !== "ok") {
     return {
       kind: "upload-error",
@@ -3579,7 +3650,7 @@ async function listDeployFiles(opts) {
   return [...paths].sort();
 }
 function runGit2(sp, cwd, args) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const spawnOpts = { cwd, stdio: ["ignore", "pipe", "pipe"] };
     const child = sp("git", [...args], spawnOpts);
     let stdout = "";
@@ -3595,7 +3666,7 @@ function runGit2(sp, cwd, args) {
     });
     child.once("close", (code) => {
       if (code === 0) {
-        resolve5(stdout);
+        resolve6(stdout);
         return;
       }
       reject(new GitFilesError(`\`git ${args.join(" ")}\` exited ${code}: ${stderr.trim()}`));
@@ -3625,6 +3696,9 @@ function parseDeployFlags(args) {
   let timeoutMinutes = null;
   let atSha = null;
   let modeFlagsSeen = 0;
+  let allowStale = false;
+  let rebaseOntoHead = false;
+  let overrideStale = null;
   let i = 0;
   while (i < args.length) {
     const a = args[i] ?? "";
@@ -3752,6 +3826,27 @@ function parseDeployFlags(args) {
       i += 2;
       continue;
     }
+    if (a === "--allow-stale") {
+      allowStale = true;
+      i += 1;
+      continue;
+    }
+    if (a === "--rebase-onto-head") {
+      rebaseOntoHead = true;
+      i += 1;
+      continue;
+    }
+    if (a === "--override-stale") {
+      const v = args[i + 1];
+      if (v === undefined)
+        return `missing value for ${a}`;
+      if (v.length < 7) {
+        return `invalid --override-stale "${v}" — echo at least the first 7 chars of the head SHA from the block message`;
+      }
+      overrideStale = v;
+      i += 2;
+      continue;
+    }
     if (a === "--timeout-seconds") {
       const v = args[i + 1];
       if (v === undefined)
@@ -3804,6 +3899,12 @@ function parseDeployFlags(args) {
   if (modeFlagsSeen > 1) {
     return "--new, --resume, --abandon, --dry-run, and --apply are mutually exclusive";
   }
+  if (mode !== "content" && (allowStale || rebaseOntoHead || overrideStale !== null)) {
+    return "--allow-stale / --rebase-onto-head / --override-stale are only valid for a content deploy";
+  }
+  if (rebaseOntoHead && overrideStale !== null) {
+    return "--rebase-onto-head and --override-stale are mutually exclusive — re-stamp to head, or override in place, not both";
+  }
   if (mode === "dry-run") {
     if (slug !== null)
       return "--dry-run does not accept --slug (slug is read from launchpad.yaml)";
@@ -3892,7 +3993,7 @@ function parseDeployFlags(args) {
       return `invalid slug "${slug}" — expected ${SLUG_RE3.source}`;
     }
     return {
-      mode: { kind: "content", slug },
+      mode: { kind: "content", slug, allowStale, rebaseOntoHead, overrideStale },
       message,
       timeoutSeconds
     };
@@ -3945,31 +4046,31 @@ function parseDeployFlags(args) {
 
 // src/deploy/apply.ts
 import { existsSync as existsSync3, rmSync } from "node:fs";
-import { resolve as resolvePath, join as join7 } from "node:path";
+import { resolve as resolvePath, join as join8 } from "node:path";
 
 // src/manifest/load.ts
 import { readFileSync as readFileSync5 } from "node:fs";
 import { parse as parseYaml3, YAMLParseError } from "yaml";
-function loadManifest(path6) {
+function loadManifest(path7) {
   let raw;
   try {
-    raw = readFileSync5(path6, "utf8");
+    raw = readFileSync5(path7, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
-      return { kind: "file-not-found", path: path6 };
+      return { kind: "file-not-found", path: path7 };
     }
-    return { kind: "read-error", path: path6, message: e.message ?? String(err) };
+    return { kind: "read-error", path: path7, message: e.message ?? String(err) };
   }
-  return parseManifest2(raw, path6);
+  return parseManifest2(raw, path7);
 }
-function parseManifest2(yamlText, path6) {
+function parseManifest2(yamlText, path7) {
   let parsed;
   try {
     parsed = parseYaml3(yamlText);
   } catch (err) {
     const message = err instanceof YAMLParseError ? err.message : err.message ?? String(err);
-    return { kind: "yaml-parse-error", path: path6, message };
+    return { kind: "yaml-parse-error", path: path7, message };
   }
   const result = ManifestSchema.safeParse(parsed);
   if (result.success) {
@@ -3977,7 +4078,7 @@ function parseManifest2(yamlText, path6) {
   }
   return {
     kind: "schema-error",
-    path: path6,
+    path: path7,
     issues: formatIssues(result.error)
   };
 }
@@ -4175,7 +4276,7 @@ function sleep(ms) {
   return new Promise((res) => setTimeout(res, ms));
 }
 function deletePinIfPresent(cfg, slug, io) {
-  const pinPath = join7(cfg.stateDir, slug, "group.json");
+  const pinPath = join8(cfg.stateDir, slug, "group.json");
   if (!existsSync3(pinPath))
     return;
   try {
@@ -4257,12 +4358,12 @@ function renderManifestError(loaded, io) {
 
 // src/deploy/dry-run.ts
 import { execFileSync } from "node:child_process";
-import { resolve as resolve5 } from "node:path";
+import { resolve as resolve6 } from "node:path";
 var MANIFEST_SHA_REGEX2 = /^[0-9a-f]{40}$/;
 async function runDeployDryRun(opts, io, deps = {}) {
   const cfg = deps.config ?? loadConfig();
   const fetcher = deps.fetcher ?? fetch;
-  const manifestPath = resolve5(process.cwd(), opts.file ?? "launchpad.yaml");
+  const manifestPath = resolve6(process.cwd(), opts.file ?? "launchpad.yaml");
   const loaded = loadManifest(manifestPath);
   if (loaded.kind !== "ok") {
     return renderManifestError2(loaded, opts.json, io);
@@ -4608,12 +4709,12 @@ function handleNetworkError(e, io, slug, verb) {
 }
 
 // src/commands/infer-slug.ts
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
 import { parse as parseYaml4 } from "yaml";
 var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 function inferSlugFromCwd(cwd) {
-  const base = path6.basename(cwd);
+  const base = path7.basename(cwd);
   const m = base.match(DIRNAME_RE);
   return m === null ? null : m[1];
 }
@@ -4638,11 +4739,11 @@ function inferSlugFromManifestFile(manifestPath) {
   }
 }
 function inferSlug(opts) {
-  const manifestPath = path6.resolve(opts.cwd, opts.file ?? "launchpad.yaml");
+  const manifestPath = path7.resolve(opts.cwd, opts.file ?? "launchpad.yaml");
   const fromManifest = inferSlugFromManifestFile(manifestPath);
   const fromDir = inferSlugFromCwd(opts.cwd);
   if (fromManifest !== null && fromDir !== null && fromManifest !== fromDir) {
-    opts.warn?.(`note: directory name suggests "${fromDir}" but ${path6.basename(manifestPath)} ` + `declares "${fromManifest}" — using the manifest. ` + `(Pass <slug> or --slug to override.)`);
+    opts.warn?.(`note: directory name suggests "${fromDir}" but ${path7.basename(manifestPath)} ` + `declares "${fromManifest}" — using the manifest. ` + `(Pass <slug> or --slug to override.)`);
   }
   return fromManifest ?? fromDir;
 }
@@ -4698,9 +4799,18 @@ async function runDeploy(args, io) {
     }, io);
   }
   const cwd = process.cwd();
-  const manifestPath = path7.join(cwd, "launchpad.yaml");
+  const manifestPath = path8.join(cwd, "launchpad.yaml");
   if (existsSync5(manifestPath)) {
-    return runModelADeploy({ cwd, manifestPath, argv: args, io });
+    const contentMode = flags.mode.kind === "content" ? flags.mode : { allowStale: false, rebaseOntoHead: false, overrideStale: null };
+    return runModelADeploy({
+      cwd,
+      manifestPath,
+      argv: args,
+      io,
+      allowStale: contentMode.allowStale,
+      rebaseOntoHead: contentMode.rebaseOntoHead,
+      overrideStale: contentMode.overrideStale
+    });
   }
   const parsed = parseArgs2(args);
   if (parsed === null) {
@@ -4713,7 +4823,7 @@ async function runDeploy(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad deploy: could not infer slug from cwd (${path7.basename(process.cwd())});
+      io.err(`launchpad deploy: could not infer slug from cwd (${path8.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -4733,7 +4843,7 @@ async function runDeploy(args, io) {
       return 1;
     }
     let contentManifestYaml = null;
-    const contentManifestPath = path7.join(process.cwd(), "launchpad.yaml");
+    const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
     if (existsSync5(contentManifestPath)) {
       try {
         contentManifestYaml = readFileSync7(contentManifestPath, "utf8");
@@ -4885,7 +4995,16 @@ function formatBytes2(n) {
 function describe13(e) {
   return e instanceof Error ? e.message : String(e);
 }
-function surfaceDeployExtras(body, io, slug) {
+function surfaceDeployExtras(body, io, slug, allowStale = false) {
+  const st = body.staleness;
+  if (st !== undefined && !allowStale) {
+    if (st.kind === "stale") {
+      io.err(`warning: main has moved since you cloned (base ${st.base_sha.slice(0, 8)} → head ${(st.head_sha ?? "").slice(0, 8)}).`);
+      io.err(`         A teammate may have shipped changes you don't have. Review \`launchpad status ${slug}\` before relying on this deploy.`);
+    } else {
+      io.err(`warning: could not verify whether main has moved since you cloned (base ${st.base_sha.slice(0, 8)}); proceeding.`);
+    }
+  }
   if (body.boundary_stripped !== undefined && body.boundary_stripped.length > 0) {
     io.err(`warning: the bot stripped ${body.boundary_stripped.length} never-shippable file(s) server-side:`);
     for (const p of body.boundary_stripped.slice(0, 10)) {
@@ -4907,6 +5026,32 @@ function surfaceDeployExtras(body, io, slug) {
     io.out(`  Full list: \`launchpad status ${slug}\`.`);
   }
 }
+function isStaleBlock(body) {
+  const code = body?.error;
+  return code === "stale_overlap" || code === "stale_unverifiable";
+}
+function surfaceStaleBlock(body, io) {
+  const code = String(body.error);
+  const head = typeof body.head_sha === "string" ? body.head_sha : null;
+  if (code === "stale_overlap" && Array.isArray(body.paths)) {
+    io.err(`launchpad deploy: BLOCKED — this deploy would roll back ${body.paths.length} file(s) a teammate changed on main since you cloned:`);
+    for (const p of body.paths.slice(0, 20)) {
+      io.err(`         - ${String(p)}`);
+    }
+    if (body.paths.length > 20) {
+      io.err(`         … and ${body.paths.length - 20} more`);
+    }
+  } else {
+    io.err(`launchpad deploy: BLOCKED — main moved since you cloned and the overlap cannot be proven` + (typeof body.reason === "string" ? ` (${body.reason})` : "") + `; treating as unsafe.`);
+  }
+  io.err("");
+  io.err("       To recover (after reconciling the listed file(s) with main):");
+  io.err("         launchpad deploy --rebase-onto-head");
+  if (head !== null) {
+    io.err("       Or, to deliberately overwrite them in place:");
+    io.err(`         launchpad deploy --override-stale ${head.slice(0, 8)}`);
+  }
+}
 async function runModelADeploy(args) {
   const { cwd, manifestPath, io } = args;
   let slug;
@@ -4935,7 +5080,23 @@ async function runModelADeploy(args) {
   }
   let result;
   try {
-    result = await bundleAndDeploy({ cfg, cwd, slug });
+    result = await bundleAndDeploy({
+      cwd,
+      cfg,
+      slug,
+      overrideStale: args.overrideStale
+    });
+    if (args.rebaseOntoHead && result.kind === "upload-error" && result.status === 409 && isStaleBlock(result.body)) {
+      const head = result.body.head_sha;
+      if (typeof head === "string" && isValidBaseSha(head)) {
+        await writeBaseShaMarker(cwd, head);
+        io.out(`Re-stamped base revision to current head ${head.slice(0, 12)}; retrying deploy …`);
+        result = await bundleAndDeploy({ cwd, cfg, slug });
+      } else {
+        io.err("launchpad deploy: --rebase-onto-head could not read a head SHA from the block; re-clone the app instead.");
+        return 1;
+      }
+    }
   } catch (e) {
     if (e instanceof UnauthenticatedError) {
       io.err(`launchpad deploy: ${e.message}`);
@@ -4971,6 +5132,10 @@ async function runModelADeploy(args) {
         }
         return 1;
       }
+      if (result.status === 409 && isStaleBlock(body)) {
+        surfaceStaleBlock(body, io);
+        return 1;
+      }
       io.err(`launchpad deploy: bot rejected the upload (HTTP ${result.status}, ${errorCode}).`);
       if (typeof body.message === "string") {
         io.err(`       ${body.message}`);
@@ -5004,7 +5169,7 @@ async function runModelADeploy(args) {
         if (typeof success.head_sha === "string") {
           io.out(`  (managed main @ ${success.head_sha.slice(0, 8)} matches the bundle)`);
         }
-        surfaceDeployExtras(success, io, slug);
+        surfaceDeployExtras(success, io, slug, args.allowStale);
         return 0;
       }
       if (success.status === "provisioning_started") {
@@ -5041,7 +5206,7 @@ async function runModelADeploy(args) {
       if (typeof success.message === "string") {
         io.out(`  ${success.message}`);
       }
-      surfaceDeployExtras(success, io, slug);
+      surfaceDeployExtras(success, io, slug, args.allowStale);
       io.out("");
       io.out("Committed; build pending — Cloudflare Pages is building this deploy now.");
       io.out(`Run \`launchpad status ${slug}\` to confirm the build outcome (success / failure + log excerpt).`);
@@ -5051,7 +5216,7 @@ async function runModelADeploy(args) {
 }
 
 // src/commands/envvars.ts
-import * as path8 from "node:path";
+import * as path9 from "node:path";
 var envvarsCommand = {
   name: "envvars",
   summary: "list / set / remove production env vars (slug-scoped)",
@@ -5071,7 +5236,7 @@ async function runEnvvars(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad envvars: could not infer slug from cwd (${path8.basename(process.cwd())});
+      io.err(`launchpad envvars: could not infer slug from cwd (${path9.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -5242,7 +5407,7 @@ function describe14(e) {
 
 // src/commands/generate.ts
 import { mkdirSync, readFileSync as readFileSync8, writeFileSync } from "node:fs";
-import { dirname as dirname4, resolve as resolve7, relative as relative3 } from "node:path";
+import { dirname as dirname5, resolve as resolve8, relative as relative3 } from "node:path";
 var generateCommand = {
   name: "generate",
   summary: "emit derived artefacts (wrangler.toml, deploy.yml) from launchpad.yaml",
@@ -5255,14 +5420,14 @@ async function runGenerate(args, io) {
     io.err("Usage: launchpad generate [--file <path>] [--dry-run] [--force] [--json]");
     return 64;
   }
-  const manifestPath = resolve7(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve8(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   if (result.kind !== "ok") {
     return flags.json ? renderManifestErrorJson(result, io) : renderManifestErrorHuman(result, io);
   }
-  const appRoot = dirname4(manifestPath);
-  const wranglerPath = resolve7(appRoot, "container", "wrangler.toml");
-  const workflowPath = resolve7(appRoot, ".github", "workflows", "deploy.yml");
+  const appRoot = dirname5(manifestPath);
+  const wranglerPath = resolve8(appRoot, "container", "wrangler.toml");
+  const workflowPath = resolve8(appRoot, ".github", "workflows", "deploy.yml");
   const wranglerOut = generateWranglerToml(result.manifest);
   const workflowOut = generateGithubDeployWorkflow(result.manifest);
   if (flags.dryRun) {
@@ -5277,7 +5442,7 @@ async function runGenerate(args, io) {
   ];
   return flags.json ? renderApplyJson(reports, appRoot, io) : renderApplyHuman(reports, appRoot, io);
 }
-function applyOne(artefact, path9, out, force) {
+function applyOne(artefact, path10, out, force) {
   if (out.kind === "not-applicable") {
     return {
       artefact,
@@ -5285,32 +5450,32 @@ function applyOne(artefact, path9, out, force) {
       warnings: []
     };
   }
-  const existing = readIfExists(path9);
+  const existing = readIfExists(path10);
   if (existing.kind === "read-error") {
     return {
       artefact,
-      action: { kind: "write-error", path: path9, message: existing.message },
+      action: { kind: "write-error", path: path10, message: existing.message },
       warnings: out.warnings
     };
   }
   if (existing.kind === "ok" && existing.content === out.content) {
-    return { artefact, action: { kind: "unchanged", path: path9 }, warnings: out.warnings };
+    return { artefact, action: { kind: "unchanged", path: path10 }, warnings: out.warnings };
   }
   if (existing.kind === "ok" && existing.content !== out.content && !force) {
     return {
       artefact,
-      action: { kind: "would-overwrite", path: path9 },
+      action: { kind: "would-overwrite", path: path10 },
       warnings: out.warnings
     };
   }
   try {
-    mkdirSync(dirname4(path9), { recursive: true });
-    writeFileSync(path9, out.content, "utf8");
+    mkdirSync(dirname5(path10), { recursive: true });
+    writeFileSync(path10, out.content, "utf8");
     return {
       artefact,
       action: {
         kind: "written",
-        path: path9,
+        path: path10,
         bytes: Buffer.byteLength(out.content, "utf8")
       },
       warnings: out.warnings
@@ -5320,16 +5485,16 @@ function applyOne(artefact, path9, out, force) {
       artefact,
       action: {
         kind: "write-error",
-        path: path9,
+        path: path10,
         message: err.message ?? String(err)
       },
       warnings: out.warnings
     };
   }
 }
-function readIfExists(path9) {
+function readIfExists(path10) {
   try {
-    return { kind: "ok", content: readFileSync8(path9, "utf8") };
+    return { kind: "ok", content: readFileSync8(path10, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -5541,12 +5706,12 @@ function parseFlags(args) {
 
 // src/groups/client.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
+import { dirname as dirname6, join as join10 } from "node:path";
 var CACHE_TTL_MS = 60 * 60 * 1000;
 var CACHE_FILENAME = "groups.json";
 async function fetchGroups(cfg, opts = {}) {
   const now = opts.now ?? Date.now;
-  const cachePath = join9(cfg.cacheDir, CACHE_FILENAME);
+  const cachePath = join10(cfg.cacheDir, CACHE_FILENAME);
   if (opts.forceRefresh !== true) {
     const cached = readCache(cachePath);
     if (cached !== null) {
@@ -5581,10 +5746,10 @@ async function fetchGroups(cfg, opts = {}) {
   writeCache(cachePath, { fetchedAt, groups });
   return { kind: "ok", source: "fresh", fetchedAt, groups };
 }
-function readCache(path9) {
+function readCache(path10) {
   let raw;
   try {
-    raw = readFileSync9(path9, "utf8");
+    raw = readFileSync9(path10, "utf8");
   } catch {
     return null;
   }
@@ -5612,10 +5777,10 @@ function isEntraGroup(value) {
   const g = value;
   return typeof g.id === "string" && typeof g.displayName === "string" && (typeof g.mailNickname === "string" || g.mailNickname === null);
 }
-function writeCache(path9, envelope) {
+function writeCache(path10, envelope) {
   try {
-    mkdirSync2(dirname5(path9), { recursive: true });
-    writeFileSync2(path9, JSON.stringify(envelope), "utf8");
+    mkdirSync2(dirname6(path10), { recursive: true });
+    writeFileSync2(path10, JSON.stringify(envelope), "utf8");
   } catch {}
 }
 function describe15(e) {
@@ -6086,16 +6251,16 @@ function describe18(e) {
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
 import { existsSync as existsSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
 import { existsSync as existsSync6, readFileSync as readFileSync10, statSync } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function detectAppShape(cwd) {
-  const hasPackageJson = existsSync6(join10(cwd, "package.json"));
-  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync6(join10(cwd, file)));
-  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync6(join10(cwd, n)));
+  const hasPackageJson = existsSync6(join11(cwd, "package.json"));
+  const hasAnyLockfile = LOCKFILES.some(({ file }) => existsSync6(join11(cwd, file)));
+  const hasViteConfig = VITE_CONFIG_NAMES.some((n) => existsSync6(join11(cwd, n)));
   if (!hasPackageJson && !hasAnyLockfile && !hasViteConfig) {
     return {
       kind: "not-applicable",
@@ -6141,7 +6306,7 @@ var LOCKFILES = [
   { file: "yarn.lock", pm: "yarn" }
 ];
 function detectPackageManager(cwd) {
-  const present = LOCKFILES.filter(({ file }) => existsSync6(join10(cwd, file)));
+  const present = LOCKFILES.filter(({ file }) => existsSync6(join11(cwd, file)));
   if (present.length === 0) {
     return {
       kind: "ambiguous",
@@ -6163,7 +6328,7 @@ function detectPackageManager(cwd) {
 }
 function detectVitePresence(cwd) {
   for (const name of VITE_CONFIG_NAMES) {
-    const p = join10(cwd, name);
+    const p = join11(cwd, name);
     if (existsSync6(p)) {
       return { kind: "ok", value: { path: p } };
     }
@@ -6174,7 +6339,7 @@ function detectVitePresence(cwd) {
   };
 }
 function detectAppType(cwd) {
-  const fnDir = join10(cwd, "functions");
+  const fnDir = join11(cwd, "functions");
   let hasFunctionsDir = false;
   if (existsSync6(fnDir)) {
     try {
@@ -6186,7 +6351,7 @@ function detectAppType(cwd) {
   return { kind: "ok", value: hasFunctionsDir ? "react+api" : "react" };
 }
 function detectBuildCommand(cwd, pm) {
-  const pkgJsonPath = join10(cwd, "package.json");
+  const pkgJsonPath = join11(cwd, "package.json");
   if (!existsSync6(pkgJsonPath)) {
     return {
       kind: "ambiguous",
@@ -6259,7 +6424,7 @@ async function runInit(args, io, prompt) {
     return 64;
   }
   const { inputs, options } = parsed;
-  const outPath = resolve8(process.cwd(), options.out);
+  const outPath = resolve9(process.cwd(), options.out);
   if (existsSync7(outPath) && !options.force) {
     io.err(`launchpad init: ${outPath} already exists`);
     io.err("Pass --force to overwrite.");
@@ -6307,7 +6472,7 @@ async function runInit(args, io, prompt) {
   }
   io.out(`✓ wrote ${outPath}`);
   if (options.gitignore) {
-    const gitignorePath = resolve8(process.cwd(), ".gitignore");
+    const gitignorePath = resolve9(process.cwd(), ".gitignore");
     try {
       const changed = ensureGitignoreEntries(gitignorePath, [".env", ".env.local"]);
       if (changed.length > 0) {
@@ -6676,10 +6841,10 @@ function buildManifest(inputs, detected) {
 function renderYaml(manifest) {
   return yamlStringify(manifest, { lineWidth: 0 });
 }
-function ensureGitignoreEntries(path9, entries) {
+function ensureGitignoreEntries(path10, entries) {
   let current = "";
-  if (existsSync7(path9)) {
-    current = readFileSync11(path9, "utf8");
+  if (existsSync7(path10)) {
+    current = readFileSync11(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -6697,7 +6862,7 @@ function ensureGitignoreEntries(path9, entries) {
     }
   }
   if (added.length > 0) {
-    writeFileSync3(path9, out, { encoding: "utf8" });
+    writeFileSync3(path10, out, { encoding: "utf8" });
   }
   return added;
 }
@@ -6724,7 +6889,11 @@ function makeLoginCommand(deps = REAL_DEPS) {
     run: (args, io) => runLogin(args, io, deps)
   };
 }
-async function runLogin(_args, io, deps) {
+async function runLogin(args, io, deps) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printLoginHelp(io);
+    return 0;
+  }
   try {
     const cfg = loadConfig();
     if (cfg.authLegacy) {
@@ -6775,6 +6944,27 @@ async function runLegacyLogin(io, botUrl, sessionPath, deps) {
   io.out(`Access token expires in ~${expiresIn}s; refreshes silently.`);
   return 0;
 }
+function printLoginHelp(io) {
+  io.out("launchpad login — authenticate and store a session.");
+  io.out("");
+  io.out("Usage:");
+  io.out("  launchpad login        Sign in via the browser and store a session");
+  io.out("");
+  io.out("Opens your browser to sign in with your M-KOPA Microsoft account");
+  io.out("through the Launchpad auth gateway (loopback PKCE), then writes the");
+  io.out("session to ~/.launchpad/session.json. The short-lived access token");
+  io.out("refreshes silently as you use the CLI.");
+  io.out("");
+  io.out("Environment:");
+  io.out("  LAUNCHPAD_AUTH_LEGACY=1     Force the legacy Cloudflare Access flow");
+  io.out("                             (deprecated; removed when the dual-auth");
+  io.out("                             window closes)");
+  io.out("  LAUNCHPAD_AUTH_GATEWAY_URL  Override the gateway base URL (testing)");
+  io.out("");
+  io.out("Exit codes:");
+  io.out("  0   signed in / session stored");
+  io.out("  1   login failed (network, browser, or gateway error)");
+}
 function describe19(e) {
   return e instanceof Error ? e.message : String(e);
 }
@@ -6789,7 +6979,11 @@ function makeLogoutCommand(deps = REAL_DEPS2) {
     run: (args, io) => runLogout(args, io, deps)
   };
 }
-async function runLogout(_args, io, deps) {
+async function runLogout(args, io, deps) {
+  if (args.includes("--help") || args.includes("-h")) {
+    printLogoutHelp(io);
+    return 0;
+  }
   try {
     const cfg = loadConfig();
     let session = null;
@@ -6819,12 +7013,28 @@ async function runLogout(_args, io, deps) {
     return 1;
   }
 }
+function printLogoutHelp(io) {
+  io.out("launchpad logout — revoke the session server-side and clear it locally.");
+  io.out("");
+  io.out("Usage:");
+  io.out("  launchpad logout       Revoke server-side, then clear the local session");
+  io.out("");
+  io.out("Gateway (v2) sessions are revoked server-side (the refresh token dies");
+  io.out("immediately; any in-flight access token expires within ~15 minutes),");
+  io.out("then the local ~/.launchpad/session.json is cleared. Logout also works");
+  io.out("offline: if the gateway is unreachable the local session is cleared");
+  io.out("anyway with a warning, and the exit code stays 0.");
+  io.out("");
+  io.out("Exit codes:");
+  io.out("  0   logged out (or already logged out)");
+  io.out("  1   could not clear the local session (file IO / config error)");
+}
 function describe20(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/logs.ts
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var logsCommand = {
   name: "logs",
   summary: "show recent Pages deployment history (slug-scoped)",
@@ -6846,7 +7056,7 @@ async function runLogs(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad logs: could not infer slug from cwd (${path9.basename(process.cwd())});
+      io.err(`launchpad logs: could not infer slug from cwd (${path10.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -6974,7 +7184,7 @@ function describe21(e) {
 }
 
 // src/commands/merge.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var mergeCommand = {
   name: "merge",
   summary: "squash-merge a review-passed PR (slug-scoped)",
@@ -6995,7 +7205,7 @@ async function runMerge(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad merge: could not infer slug from cwd (${path10.basename(process.cwd())});
+      io.err(`launchpad merge: could not infer slug from cwd (${path11.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -7147,7 +7357,7 @@ function describe22(e) {
 }
 
 // src/commands/plan.ts
-import { resolve as resolve9 } from "node:path";
+import { resolve as resolve10 } from "node:path";
 var planCommand = {
   name: "plan",
   summary: "summarise what the manifest would deploy (offline)",
@@ -7160,7 +7370,7 @@ async function runPlan(args, io) {
     io.err("Usage: launchpad plan [--file <path>] [--json]");
     return 64;
   }
-  const manifestPath = resolve9(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   return flags.json ? renderJson(result, io) : renderHuman(result, io);
 }
@@ -7605,8 +7815,8 @@ import { stringify as stringifyYaml } from "yaml";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
-  const path11 = opts.includeManifest === true ? `/apps/${encodeURIComponent(slug)}/manifest/state?include=manifest` : `/apps/${encodeURIComponent(slug)}/manifest/state`;
-  const raw = await apiJson(cfg, { path: path11 }, fetcher);
+  const path12 = opts.includeManifest === true ? `/apps/${encodeURIComponent(slug)}/manifest/state?include=manifest` : `/apps/${encodeURIComponent(slug)}/manifest/state`;
+  const raw = await apiJson(cfg, { path: path12 }, fetcher);
   return {
     slug: raw.slug,
     hasAppFile: raw.hasAppFile,
@@ -7619,8 +7829,8 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
 
 // src/deploy/manifest-status.ts
 async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
-  const path11 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
-  return apiJson(cfg, { path: path11 }, fetcher);
+  const path12 = `/apps/${encodeURIComponent(slug)}/manifest/status`;
+  return apiJson(cfg, { path: path12 }, fetcher);
 }
 
 // src/deploy/deployment-status.ts
@@ -8188,17 +8398,17 @@ async function runStatus(args, io) {
 }
 function computeDrift(local, deployed) {
   const diffs = [];
-  const cmp = (path11, l, d) => {
+  const cmp = (path12, l, d) => {
     const li = l ?? null;
     const di = d ?? null;
     if (typeof li === "object" || typeof di === "object") {
       if (JSON.stringify(li) !== JSON.stringify(di)) {
-        diffs.push({ path: path11, local: l, deployed: d });
+        diffs.push({ path: path12, local: l, deployed: d });
       }
       return;
     }
     if (li !== di) {
-      diffs.push({ path: path11, local: l, deployed: d });
+      diffs.push({ path: path12, local: l, deployed: d });
     }
   };
   cmp("metadata.name", local.metadata.name, deployed.metadata.name);
@@ -8502,7 +8712,7 @@ function isEnoent(e) {
 }
 
 // src/commands/review.ts
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 var reviewCommand = {
   name: "review",
   summary: "show the review state for a PR (slug-scoped)",
@@ -8522,7 +8732,7 @@ async function runReview(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad review: could not infer slug from cwd (${path11.basename(process.cwd())});
+      io.err(`launchpad review: could not infer slug from cwd (${path12.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -8779,16 +8989,16 @@ async function runRollback(opts, io, deps = {}) {
     yes: true
   }, io, applyDeps);
 }
-function readCurrentManifest(path12) {
-  if (!existsSync8(path12))
+function readCurrentManifest(path13) {
+  if (!existsSync8(path13))
     return null;
   let raw;
   try {
-    raw = readFileSync13(path12, "utf8");
+    raw = readFileSync13(path13, "utf8");
   } catch {
     return null;
   }
-  const parsed = parseManifest2(raw, path12);
+  const parsed = parseManifest2(raw, path13);
   if (parsed.kind !== "ok")
     return null;
   return summarise(parsed.manifest);
@@ -9283,23 +9493,23 @@ var CELL_LABEL2 = {
   not_deployed: "NOT_DEPLOYED"
 };
 function loadSet(fleetFile, setName, io) {
-  const path12 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync10(path12)) {
-    io.err(`✗ ${path12}`);
+  const path13 = resolvePath5(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
+  if (!existsSync10(path13)) {
+    io.err(`✗ ${path13}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml6(readFileSync15(path12, "utf8"));
+    obj = parseYaml6(readFileSync15(path13, "utf8"));
   } catch (e) {
-    io.err(`✗ ${path12}`);
+    io.err(`✗ ${path13}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
   const parsed = parseFleetSecretSets(obj);
   if (!parsed.ok) {
-    io.err(`✗ ${path12}`);
+    io.err(`✗ ${path13}`);
     io.err(`  ${parsed.issues.length} schema issue(s):`);
     for (const i of parsed.issues)
       io.err(`    ${i.path}: ${i.message}`);
@@ -9308,7 +9518,7 @@ function loadSet(fleetFile, setName, io) {
   const set = parsed.manifest.secretSets.find((s) => s.name === setName);
   if (set === undefined) {
     const names = parsed.manifest.secretSets.map((s) => s.name).join(", ");
-    io.err(`✗ secret-set "${setName}" not found in ${path12}`);
+    io.err(`✗ secret-set "${setName}" not found in ${path13}`);
     io.err(`  declared sets: ${names}`);
     return 1;
   }
@@ -9528,7 +9738,7 @@ function setPushExit(e) {
 
 // src/commands/secrets-template.ts
 import { existsSync as existsSync11, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -9536,7 +9746,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve10(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve11(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -9550,7 +9760,7 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve10(process.cwd(), flags.out);
+  const outPath = resolve11(process.cwd(), flags.out);
   if (existsSync11(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
@@ -9839,8 +10049,8 @@ function printHelp2(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname6, join as join11, resolve as resolve11 } from "node:path";
-import { promises as fs5, existsSync as existsSync12 } from "node:fs";
+import { dirname as dirname7, join as join12, resolve as resolve12 } from "node:path";
+import { promises as fs6, existsSync as existsSync12 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 var BUNDLE_PREFIX = "launchpad-";
 var BUNDLED_SKILLS = [
@@ -9901,17 +10111,17 @@ function printHelp3(io) {
 }
 function resolveInstallEnv() {
   const bundleDir = process.env.LAUNCHPAD_SKILLS_BUNDLE_DIR ?? defaultBundleDir();
-  const userSkillsDir = process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join11(homedir2(), ".claude", "skills");
+  const userSkillsDir = process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join12(homedir2(), ".claude", "skills");
   return { bundleDir, userSkillsDir };
 }
 function defaultBundleDir() {
-  const here = dirname6(fileURLToPath(import.meta.url));
+  const here = dirname7(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve11(here, "..", "skills"),
-    resolve11(here, "..", "..", "skills")
+    resolve12(here, "..", "skills"),
+    resolve12(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync12(join11(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync12(join12(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -9927,19 +10137,19 @@ async function doInstall(io) {
     return 1;
   }
   if (!await isDir(env.userSkillsDir)) {
-    await fs5.mkdir(env.userSkillsDir, { recursive: true });
+    await fs6.mkdir(env.userSkillsDir, { recursive: true });
     io.out(`Created ${env.userSkillsDir}.`);
   }
   let installed = 0;
   for (const skill of BUNDLED_SKILLS) {
-    const src = join11(env.bundleDir, skill);
+    const src = join12(env.bundleDir, skill);
     if (!await isDir(src)) {
       io.err(`launchpad skills install: bundled skill "${skill}" missing from ${env.bundleDir} — package is incomplete.`);
       return 1;
     }
-    const dest = join11(env.userSkillsDir, skill);
-    await fs5.rm(dest, { recursive: true, force: true });
-    await fs5.cp(src, dest, { recursive: true });
+    const dest = join12(env.userSkillsDir, skill);
+    await fs6.rm(dest, { recursive: true, force: true });
+    await fs6.cp(src, dest, { recursive: true });
     installed++;
     io.out(`✓ ${skill} → ${dest}`);
   }
@@ -9955,15 +10165,15 @@ async function doUninstall(io) {
     io.out(`launchpad skills uninstall: ${env.userSkillsDir} does not exist — nothing to do.`);
     return 0;
   }
-  const entries = await fs5.readdir(env.userSkillsDir, { withFileTypes: true });
+  const entries = await fs6.readdir(env.userSkillsDir, { withFileTypes: true });
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
     if (!isBundleManaged(entry.name))
       continue;
-    const target = join11(env.userSkillsDir, entry.name);
-    await fs5.rm(target, { recursive: true, force: true });
+    const target = join12(env.userSkillsDir, entry.name);
+    await fs6.rm(target, { recursive: true, force: true });
     removed++;
     io.out(`✗ removed ${target}`);
   }
@@ -9977,7 +10187,7 @@ async function doList(io) {
     io.out("(none — ~/.claude/skills/ does not exist)");
     return 0;
   }
-  const entries = await fs5.readdir(env.userSkillsDir, { withFileTypes: true });
+  const entries = await fs6.readdir(env.userSkillsDir, { withFileTypes: true });
   const managedDirs = entries.filter((e) => e.isDirectory() && isBundleManaged(e.name)).map((e) => e.name).sort();
   if (managedDirs.length === 0) {
     io.out("(none — run `launchpad skills install`)");
@@ -9985,16 +10195,16 @@ async function doList(io) {
   }
   const width = managedDirs.reduce((n, s) => Math.max(n, s.length), 0);
   for (const name of managedDirs) {
-    const skillFile = join11(env.userSkillsDir, name, "SKILL.md");
+    const skillFile = join12(env.userSkillsDir, name, "SKILL.md");
     const version = await readVersion(skillFile);
     io.out(`  ${name.padEnd(width + 2)}${version ?? "(no version)"}`);
   }
   return 0;
 }
-async function readVersion(path12) {
+async function readVersion(path13) {
   let text;
   try {
-    text = await fs5.readFile(path12, "utf8");
+    text = await fs6.readFile(path13, "utf8");
   } catch {
     return null;
   }
@@ -10004,9 +10214,9 @@ async function readVersion(path12) {
   const m = /^version:\s*(.+?)\s*$/m.exec(front);
   return m === null ? null : m[1] ?? null;
 }
-async function isDir(path12) {
+async function isDir(path13) {
   try {
-    const stat = await fs5.stat(path12);
+    const stat = await fs6.stat(path13);
     return stat.isDirectory();
   } catch {
     return false;
@@ -10020,7 +10230,7 @@ function describe29(e) {
 import { execFile, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname7, resolve as resolve12, relative as relative4, isAbsolute as isAbsolute2, join as join12 } from "node:path";
+import { dirname as dirname8, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join13 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
 import { readFileSync as readFileSync16, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
@@ -10065,9 +10275,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve12) => {
-    server.once("error", () => resolve12(false));
-    server.listen(0, "127.0.0.1", () => resolve12(true));
+  const bound = await new Promise((resolve13) => {
+    server.once("error", () => resolve13(false));
+    server.listen(0, "127.0.0.1", () => resolve13(true));
   });
   if (!bound)
     return null;
@@ -10143,7 +10353,7 @@ var PKG = "@m-kopa/launchpad-cli";
 var REGISTRY = "https://registry.npmjs.org";
 var CHANNEL_VERSION_URL = "https://get.launchpad.m-kopa.us/version.json";
 var CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
-var CHANNEL_MARKER = join12(homedir3(), ".launchpad", "channel");
+var CHANNEL_MARKER = join13(homedir3(), ".launchpad", "channel");
 var EXIT_UPDATE_AVAILABLE = 10;
 var UPGRADE_ARGS = {
   npm: ["install", "-g", `${PKG}@latest`],
@@ -10210,6 +10420,7 @@ function compareVersions(a, b) {
   }
   return 0;
 }
+var NOTIFIER_OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
 function defaultDeps() {
   const channel = detectInstallChannel();
   return {
@@ -10218,16 +10429,42 @@ function defaultDeps() {
     fetchLatestVersion: channel === "platform" ? fetchLatestFromChannel : fetchLatestVersion,
     detectPm: detectPackageManager2,
     runUpgrade,
-    runChannelInstaller
+    runChannelInstaller,
+    syncSkills: runSkillsSync
   };
 }
+async function runSkillsSync() {
+  const cliPath = process.argv[1];
+  if (!cliPath)
+    return { ok: false };
+  return await new Promise((resolvePromise) => {
+    try {
+      const child = spawn5(process.execPath, [cliPath, "skills", "update"], {
+        stdio: "ignore",
+        env: { ...process.env, [NOTIFIER_OPT_OUT_ENV]: "1" }
+      });
+      child.on("error", () => resolvePromise({ ok: false }));
+      child.on("close", (code) => resolvePromise({ ok: code === 0 }));
+    } catch {
+      resolvePromise({ ok: false });
+    }
+  });
+}
+async function syncSkillsAfterUpgrade(io, deps) {
+  const result = await deps.syncSkills();
+  if (result.ok) {
+    io.out("✓ Claude Code skill bundle re-synced to the new version.");
+  } else {
+    io.err("Note: couldn't auto-sync the skill bundle — run `launchpad skills update` to finish.");
+  }
+}
 async function openSystemBrowser(url) {
   const opener = process.platform === "darwin" ? "open" : "xdg-open";
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join12(tmpdir(), "launchpad-update-"));
-  const file = join12(dir, "install.sh");
+  const dir = mkdtempSync(join13(tmpdir(), "launchpad-update-"));
+  const file = join13(dir, "install.sh");
   try {
     writeFileSync7(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
@@ -10314,7 +10551,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve12(dirname7(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve13(dirname8(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -10322,7 +10559,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve12(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve13(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -10394,6 +10631,7 @@ async function runUpdate(args, io, deps) {
       io.out(`✓ launchpad-cli updated to ${latest.version}.`);
       io.out("If `launchpad --version` still shows the old version, open a new");
       io.out("shell (or check for a PATH-shadowing bun/pnpm global install).");
+      await syncSkillsAfterUpgrade(io, deps);
       return 0;
     }
     io.err("");
@@ -10430,8 +10668,7 @@ async function runUpdate(args, io, deps) {
   }
   io.out("");
   io.out(`✓ launchpad-cli updated to ${latest.version}.`);
-  io.out("Next: run `launchpad skills update` to re-sync the Claude Code skill bundle");
-  io.out("(the CLI and the skill bundle are version-locked together).");
+  await syncSkillsAfterUpgrade(io, deps);
   return 0;
 }
 function printHelp4(io) {
@@ -10459,7 +10696,7 @@ function printHelp4(io) {
 
 // src/commands/validate.ts
 import { readFileSync as readFileSync17 } from "node:fs";
-import { dirname as dirname8, resolve as resolve13 } from "node:path";
+import { dirname as dirname9, resolve as resolve14 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -10473,17 +10710,17 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path12 = resolve13(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifest(path12);
+  const path13 = resolve14(process.cwd(), file ?? "launchpad.yaml");
+  const result = loadManifest(path13);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
-  const boundary = checkBoundary(path12, result.manifest.app !== undefined);
+  const boundary = checkBoundary(path13, result.manifest.app !== undefined);
   const groupCheck = strictGroups ? await checkGroups(allowedEntraGroups(result.manifest.access)) : { kind: "skipped" };
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
 function checkBoundary(manifestPath, declared) {
-  const dir = dirname8(manifestPath);
+  const dir = dirname9(manifestPath);
   let files;
   try {
     files = walkCwd(dir).files;
@@ -10806,12 +11043,18 @@ function describe31(e) {
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join13 } from "node:path";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync18, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join14 } from "node:path";
+import {
+  existsSync as existsSync13,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync18,
+  readdirSync as readdirSync2,
+  writeFileSync as writeFileSync8
+} from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
-var CACHE_FILE = join13(homedir4(), ".launchpad", "update-check.json");
+var CACHE_FILE = join14(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
     const raw = JSON.parse(readFileSync18(CACHE_FILE, "utf8"));
@@ -10827,11 +11070,53 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync3(join13(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync3(join14(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
+var SKILL_PREFIX = "launchpad-";
+var SKILLS_HINT_MARKER = join14(homedir4(), ".launchpad", "skills-hint-shown");
+function skillsTargetDir() {
+  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join14(homedir4(), ".claude", "skills");
+}
+function readInstalledSkills() {
+  try {
+    const dir = skillsTargetDir();
+    const bundle = readdirSync2(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
+    if (!bundle)
+      return { present: false, version: null };
+    return { present: true, version: readSkillVersion(join14(dir, bundle.name, "SKILL.md")) };
+  } catch {
+    return { present: false, version: null };
+  }
+}
+function readSkillVersion(path13) {
+  try {
+    const text = readFileSync18(path13, "utf8");
+    const fenceEnd = text.indexOf(`
+---`, 4);
+    const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
+    const m = /^version:\s*(.+?)\s*$/m.exec(front);
+    return m === null ? null : m[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function absentHintShown() {
+  try {
+    return existsSync13(SKILLS_HINT_MARKER);
+  } catch {
+    return false;
+  }
+}
+function markAbsentHintShown() {
+  try {
+    mkdirSync3(join14(homedir4(), ".launchpad"), { recursive: true });
+    writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
+`, { mode: 384 });
+  } catch {}
+}
 function isSuppressed(ctx) {
   if (ctx.env[OPT_OUT_ENV])
     return true;
@@ -10850,6 +11135,12 @@ function noticeLine(current, latest, channel) {
   const how = channel === "platform" ? `re-run the installer at ${CHANNEL_INSTALL_URL}` : "run `launchpad update`";
   return `▲ launchpad ${current} → ${latest} available — ${how} (silence with ${OPT_OUT_ENV}=1).`;
 }
+function skillsDriftLine(bundleVersion, cliVersion) {
+  return `▲ launchpad skill bundle ${bundleVersion} is behind the CLI ${cliVersion} — run \`launchpad skills update\` (silence with ${OPT_OUT_ENV}=1).`;
+}
+function skillsAbsentLine() {
+  return `▲ launchpad Claude Code skills aren't installed — run \`launchpad skills install\` to add them (silence with ${OPT_OUT_ENV}=1).`;
+}
 function maybeNotify(io, ctx, deps) {
   if (isSuppressed(ctx))
     return;
@@ -10857,6 +11148,15 @@ function maybeNotify(io, ctx, deps) {
   if (cache?.latest && compareVersions(cache.latest, deps.cliVersion) === 1) {
     io.err(noticeLine(deps.cliVersion, cache.latest, deps.channel()));
   }
+  const skills = deps.readInstalledSkills();
+  if (!skills.present) {
+    if (!deps.absentHintShown()) {
+      io.err(skillsAbsentLine());
+      deps.markAbsentHintShown();
+    }
+  } else if (skills.version && compareVersions(deps.cliVersion, skills.version) === 1) {
+    io.err(skillsDriftLine(skills.version, deps.cliVersion));
+  }
   if (cache === null || deps.now() - cache.checkedAt > CHECK_INTERVAL_MS) {
     deps.spawnRefresh();
   }
@@ -10880,7 +11180,10 @@ function notifyAfterCommand(io, argv, cliPath = process.argv[1]) {
       channel: detectInstallChannel,
       readCache: readCache2,
       now: Date.now,
-      spawnRefresh: () => spawnDetachedRefresh(cliPath)
+      spawnRefresh: () => spawnDetachedRefresh(cliPath),
+      readInstalledSkills,
+      absentHintShown,
+      markAbsentHintShown
     });
   } catch {}
 }