@m-kopa/launchpad-cli 0.46.2 → 0.47.1

package/CHANGELOG.md

@@ -6,6 +6,50 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.47.1 — 2026-07-08
+
+**Fix: no false-success exit code when the inline access-drift apply is aborted
+(PS-2071).** 0.47.0 gated the "✓ Access reconciled" *message* on a real apply,
+but `handleAccessDrift` still returned the apply's raw exit code — and
+`deploy --apply` exits `0` both on a genuine apply and when the operator reviews
+the plan and aborts at its own prompt. So accepting the inline offer and then
+aborting made `launchpad deploy` exit `0` for a no-op — inconsistent with
+declining the offer (which exits `1`) and a false-success signal to any script.
+Now the exit code is gated on the same real-apply signal: an abort maps to `1`
+(nothing changed), while a genuine apply failure's code (`1`/`2`/`4`) passes
+through unchanged. Caught by CodeRabbit review of the 0.47.0 change.
+
+## 0.47.0 — 2026-07-07
+
+**`launchpad deploy` offers to reconcile access drift inline (PS-2071).** When a
+plain deploy is refused because the manifest's access groups diverge from what
+the gateway enforces, an **interactive terminal** now *offers to reconcile right
+there* — answer `y` and it routes straight into the gated `launchpad deploy
+--apply` flow instead of leaving you at a dead-end error to re-read, find the
+flag, and re-run. This is convenience only: it changes no control. The apply
+still shows the exact plan and prompts again before opening the PR, and the
+byte-equal validator, the second-person `allowed-groups-change` label gate for
+any access-widening change, and Terraform-as-sole-writer all still apply. A
+**non-interactive** session (CI, a pipe, redirected stdin) never auto-runs an
+access change — it prints the manual `--apply` route and exits non-zero so a
+script fails loudly. After a successful reconcile the CLI points you back at
+`launchpad deploy` to ship your content.
+
+**`launchpad update` resyncs drifted skills even when the CLI is already current
+(PS-2058).** Previously the skill bundle was re-synced only after an actual CLI
+upgrade, so a machine already on the latest CLI could sit on a stale skill
+bundle indefinitely with no warning. Now, when `update` finds the CLI already
+current, it also checks the installed skill bundle and:
+
+- **`launchpad update`** auto-resyncs a drifted bundle (best-effort; the update
+  still exits `0` regardless — a skills hiccup never fails it).
+- **`launchpad update --check`** reports the drift as an informational line
+  pointing at `launchpad skills update`; exit codes are unchanged (`10` stays
+  CLI-update-only).
+
+An in-sync bundle stays silent; an absent bundle is left to the passive
+notifier's one-time hint.
+
 ## 0.46.2 — 2026-07-07
 
 Fix: the apply-status poll no longer mistakes the endpoint's own

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.46.2";
+var CLI_VERSION = "0.47.1";
 
 // src/config.ts
 import * as os from "node:os";
@@ -6262,6 +6262,7 @@ async function runDeployApply(opts, io, deps = {}) {
       return outcomeToExit(outcome2, undefined, io);
     deletePinIfPresent(cfg, slug2, io);
     io.out(`✓ Applied ${slug2}.`);
+    deps.onApplied?.();
     return 0;
   }
   const manifestPath = resolvePath(process.cwd(), opts.file ?? "launchpad.yaml");
@@ -6344,6 +6345,7 @@ async function runDeployApply(opts, io, deps = {}) {
   deletePinIfPresent(cfg, slug, io);
   io.out("");
   io.out(`✓ Applied ${slug}. (See ${apply.prUrl} for the merged PR.)`);
+  deps.onApplied?.();
   return 0;
 }
 async function pollUntilApplied(args) {
@@ -6556,6 +6558,81 @@ function renderManifestError(loaded, io) {
   }
 }
 
+// src/deploy/access-drift-offer.ts
+var asStrings = (v) => Array.isArray(v) ? v.map((x) => String(x)) : [];
+function renderAccessDriftSummary(slug, body) {
+  const lines = [`launchpad deploy: refused — ACCESS DRIFT on "${slug}".`];
+  const liveOnly = asStrings(body.live_only);
+  const manifestOnly = asStrings(body.manifest_only);
+  if (liveOnly.length > 0) {
+    lines.push(`       enforced but NOT declared (over-grant): ${liveOnly.join(", ")}`);
+  }
+  if (manifestOnly.length > 0) {
+    lines.push(`       declared but NOT enforced: ${manifestOnly.join(", ")}`);
+  }
+  lines.push("");
+  lines.push("       Your manifest's access groups don't match what the gateway enforces.");
+  lines.push("       `launchpad deploy` ships content only and cannot change access.");
+  return lines;
+}
+function renderManualApplyGuidance() {
+  return [
+    "       Run `launchpad deploy --apply` to reconcile — it opens the gated TF PR",
+    "       (an access-widening change needs the allowed-groups-change label from a",
+    "       second person) and waits for the apply verdict. Then redeploy your content.",
+    "       Nothing was committed by this attempt."
+  ];
+}
+function isYes(answer) {
+  const a = answer.trim().toLowerCase();
+  return a === "y" || a === "yes";
+}
+async function handleAccessDrift(params) {
+  const { slug, manifestPath, body, io, deps } = params;
+  for (const line of renderAccessDriftSummary(slug, body))
+    io.err(line);
+  if (!deps.interactive) {
+    for (const line of renderManualApplyGuidance())
+      io.err(line);
+    return 1;
+  }
+  io.err("");
+  const answer = await deps.prompt("Reconcile access now via the gated apply PR? You'll review the exact plan next. [y/N] ");
+  if (!isYes(answer)) {
+    io.err("");
+    io.err("Skipped — no access change was made.");
+    for (const line of renderManualApplyGuidance())
+      io.err(line);
+    return 1;
+  }
+  io.out("");
+  io.out("Reconciling access via `launchpad deploy --apply` …");
+  let applied = false;
+  const exit = await deps.runApply({ file: manifestPath, platformRepo: null, rePin: false, yes: false }, io, { onApplied: () => {
+    applied = true;
+  } });
+  if (applied) {
+    io.out("");
+    io.out("✓ Access reconciled. Re-run `launchpad deploy` to ship your content change.");
+    return exit;
+  }
+  return exit === 0 ? 1 : exit;
+}
+
+// src/io/prompt.ts
+function isInteractive() {
+  return Boolean(process.stdin.isTTY);
+}
+async function defaultPrompt2(question) {
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+
 // src/deploy/dry-run.ts
 import { execFileSync } from "node:child_process";
 import { resolve as resolve7 } from "node:path";
@@ -7402,23 +7479,17 @@ async function runModelADeploy(args) {
         return 1;
       }
       if (result.status === 409 && errorCode === "access_drift") {
-        io.err(`launchpad deploy: refused — ACCESS DRIFT on "${slug}".`);
-        const liveOnly = Array.isArray(body.live_only) ? body.live_only : [];
-        const manifestOnly = Array.isArray(body.manifest_only) ? body.manifest_only : [];
-        if (liveOnly.length > 0) {
-          io.err(`       enforced but NOT declared (over-grant): ${liveOnly.map(String).join(", ")}`);
-        }
-        if (manifestOnly.length > 0) {
-          io.err(`       declared but NOT enforced: ${manifestOnly.map(String).join(", ")}`);
-        }
-        io.err("");
-        io.err("       Your manifest's access groups don't match what the gateway enforces.");
-        io.err("       `launchpad deploy` ships content only and cannot change access.");
-        io.err("       Run `launchpad deploy --apply` to reconcile — it opens the gated TF PR");
-        io.err("       (access-widening changes need the allowed-groups-change label from a");
-        io.err("       second person) and waits for the apply verdict. Then redeploy your content.");
-        io.err("       Nothing was committed by this attempt.");
-        return 1;
+        return handleAccessDrift({
+          slug,
+          manifestPath,
+          body,
+          io,
+          deps: {
+            interactive: isInteractive(),
+            prompt: defaultPrompt2,
+            runApply: runDeployApply
+          }
+        });
       }
       io.err(`launchpad deploy: bot rejected the upload (HTTP ${result.status}, ${errorCode}).`);
       if (typeof body.message === "string") {
@@ -8885,7 +8956,7 @@ var SLUG_REGEX3 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var initCommand = {
   name: "init",
   summary: "scaffold a new launchpad.yaml in the current directory",
-  run: (args, io) => runInit(args, io, defaultPrompt2)
+  run: (args, io) => runInit(args, io, defaultPrompt3)
 };
 async function runInit(args, io, prompt) {
   const parsed = parseArgs6(args);
@@ -9375,7 +9446,7 @@ function ensureGitignoreEntries(path10, entries) {
   }
   return added;
 }
-async function defaultPrompt2(question, fallback) {
+async function defaultPrompt3(question, fallback) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
     const suffix = fallback !== undefined ? ` [${fallback}]` : "";
@@ -10056,7 +10127,7 @@ import { stdin as input, stdout as output } from "node:process";
 var destroyCommand = {
   name: "destroy",
   summary: "tear down a Launchpad app (owner-only, destructive)",
-  run: (args, io) => runDestroy(args, io, defaultPrompt3, defaultIsTty)
+  run: (args, io) => runDestroy(args, io, defaultPrompt4, defaultIsTty)
 };
 var SLUG_RE10 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 var SLUG_MIN_LENGTH = 3;
@@ -10288,7 +10359,7 @@ function renderBotError2(status, env, slug, io) {
       io.err(`launchpad destroy: bot returned HTTP ${status} (error=${errorCode}): ${message}`);
   }
 }
-async function defaultPrompt3(question) {
+async function defaultPrompt4(question) {
   const rl = createInterface2({ input, output });
   try {
     return await rl.question(question);
@@ -10957,7 +11028,7 @@ async function runRollback(opts, io, deps = {}) {
   io.out(`Rollback target: ${verifiedSha.slice(0, 12)} (${manifestRelpath})`);
   renderDiff(current, parsed.manifest, io);
   if (!opts.yes) {
-    const prompt = deps.prompt ?? defaultPrompt4;
+    const prompt = deps.prompt ?? defaultPrompt5;
     if (!process.stdin.isTTY && deps.prompt === undefined) {
       io.err("launchpad rollback: refusing to rollback non-interactively without --yes.");
       return 64;
@@ -11045,7 +11116,7 @@ function formatHostnames(hs) {
     return hs[0];
   return `[${hs.join(", ")}]`;
 }
-async function defaultPrompt4(question) {
+async function defaultPrompt5(question) {
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     return await rl.question(question);
@@ -11352,7 +11423,7 @@ async function offerRedeploy(slug, opts, io, deps) {
   const isTty = (deps.isTty ?? (() => process.stdin.isTTY === true))();
   let doRedeploy = wantsAuto;
   if (!wantsAuto && isTty) {
-    const prompt = deps.prompt ?? defaultPrompt5;
+    const prompt = deps.prompt ?? defaultPrompt6;
     let answer;
     try {
       answer = (await prompt(`Redeploy ${slug} now to activate? [y/N] `)).trim().toLowerCase();
@@ -11373,7 +11444,7 @@ async function offerRedeploy(slug, opts, io, deps) {
   };
   return run({ slug, file: opts.file ?? null, verify: true, verifyTimeoutMs: 180000 }, io, rdeps);
 }
-async function defaultPrompt5(question) {
+async function defaultPrompt6(question) {
   const rl = createInterface4({ input: input2, output: output2 });
   try {
     return await rl.question(question);
@@ -12114,9 +12185,45 @@ function printHelp3(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname8, join as join13, resolve as resolve12 } from "node:path";
+import { dirname as dirname8, join as join14, resolve as resolve12 } from "node:path";
 import { promises as fs6, existsSync as existsSync14 } from "node:fs";
+
+// src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
+import { join as join13 } from "node:path";
+import { readFileSync as readFileSync18, readdirSync as readdirSync2 } from "node:fs";
+var SKILL_PREFIX = "launchpad-";
+function skillsTargetDir() {
+  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join13(homedir2(), ".claude", "skills");
+}
+function readInstalledSkills() {
+  try {
+    const dir = skillsTargetDir();
+    const bundle = readdirSync2(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
+    if (!bundle)
+      return { present: false, version: null };
+    return {
+      present: true,
+      version: readSkillVersion(join13(dir, bundle.name, "SKILL.md"))
+    };
+  } catch {
+    return { present: false, version: null };
+  }
+}
+function readSkillVersion(path13) {
+  try {
+    const text = readFileSync18(path13, "utf8");
+    const fenceEnd = text.indexOf(`
+---`, 4);
+    const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
+    const m = /^version:\s*(.+?)\s*$/m.exec(front);
+    return m === null ? null : m[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+
+// src/commands/skills.ts
 var BUNDLE_PREFIX = "launchpad-";
 var BUNDLED_SKILLS = [
   "launchpad-onboard",
@@ -12178,7 +12285,7 @@ function printHelp4(io) {
 }
 function resolveInstallEnv() {
   const bundleDir = process.env.LAUNCHPAD_SKILLS_BUNDLE_DIR ?? defaultBundleDir();
-  const userSkillsDir = process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join13(homedir2(), ".claude", "skills");
+  const userSkillsDir = skillsTargetDir();
   return { bundleDir, userSkillsDir };
 }
 function defaultBundleDir() {
@@ -12188,7 +12295,7 @@ function defaultBundleDir() {
     resolve12(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync14(join13(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync14(join14(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -12209,12 +12316,12 @@ async function doInstall(io) {
   }
   let installed = 0;
   for (const skill of BUNDLED_SKILLS) {
-    const src = join13(env.bundleDir, skill);
+    const src = join14(env.bundleDir, skill);
     if (!await isDir(src)) {
       io.err(`launchpad skills install: bundled skill "${skill}" missing from ${env.bundleDir} — package is incomplete.`);
       return 1;
     }
-    const dest = join13(env.userSkillsDir, skill);
+    const dest = join14(env.userSkillsDir, skill);
     await fs6.rm(dest, { recursive: true, force: true });
     await fs6.cp(src, dest, { recursive: true });
     installed++;
@@ -12239,7 +12346,7 @@ async function doUninstall(io) {
       continue;
     if (!isBundleManaged(entry.name))
       continue;
-    const target = join13(env.userSkillsDir, entry.name);
+    const target = join14(env.userSkillsDir, entry.name);
     await fs6.rm(target, { recursive: true, force: true });
     removed++;
     io.out(`✗ removed ${target}`);
@@ -12262,7 +12369,7 @@ async function doList(io) {
   }
   const width = managedDirs.reduce((n, s) => Math.max(n, s.length), 0);
   for (const name of managedDirs) {
-    const skillFile = join13(env.userSkillsDir, name, "SKILL.md");
+    const skillFile = join14(env.userSkillsDir, name, "SKILL.md");
     const version = await readVersion(skillFile);
     io.out(`  ${name.padEnd(width + 2)}${version ?? "(no version)"}`);
   }
@@ -12297,9 +12404,9 @@ function describe29(e) {
 import { execFile, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname9, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join14 } from "node:path";
+import { dirname as dirname9, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join15 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync18, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync19, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
@@ -12420,7 +12527,7 @@ var PKG = "@m-kopa/launchpad-cli";
 var REGISTRY = "https://registry.npmjs.org";
 var CHANNEL_VERSION_URL = "https://get.launchpad.m-kopa.us/version.json";
 var CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
-var CHANNEL_MARKER = join14(homedir3(), ".launchpad", "channel");
+var CHANNEL_MARKER = join15(homedir3(), ".launchpad", "channel");
 var EXIT_UPDATE_AVAILABLE = 10;
 var UPGRADE_ARGS = {
   npm: ["install", "-g", `${PKG}@latest`],
@@ -12497,7 +12604,8 @@ function defaultDeps() {
     detectPm: detectPackageManager2,
     runUpgrade,
     runChannelInstaller,
-    syncSkills: runSkillsSync
+    syncSkills: runSkillsSync,
+    readInstalledSkills
   };
 }
 async function runSkillsSync() {
@@ -12520,7 +12628,25 @@ async function runSkillsSync() {
 async function syncSkillsAfterUpgrade(io, deps) {
   const result = await deps.syncSkills();
   if (result.ok) {
-    io.out("✓ Claude Code skill bundle re-synced to the new version.");
+    io.out("✓ Claude Code skill bundle re-synced to match the CLI.");
+  } else {
+    io.err("Note: couldn't auto-sync the skill bundle — run `launchpad skills update` to finish.");
+  }
+}
+async function reconcileSkillBundleWhenCurrent(io, deps, checkOnly) {
+  const skills = deps.readInstalledSkills();
+  if (!skills.present || skills.version === null)
+    return;
+  if (compareVersions(deps.cliVersion, skills.version) !== 1)
+    return;
+  if (checkOnly) {
+    io.out(`Skill bundle ${skills.version} is behind the CLI ${deps.cliVersion} — run \`launchpad skills update\`.`);
+    return;
+  }
+  io.out(`Skill bundle ${skills.version} is behind the CLI ${deps.cliVersion}; re-syncing…`);
+  const result = await deps.syncSkills();
+  if (result.ok) {
+    io.out("✓ Claude Code skill bundle re-synced to match the CLI.");
   } else {
     io.err("Note: couldn't auto-sync the skill bundle — run `launchpad skills update` to finish.");
   }
@@ -12530,8 +12656,8 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join14(tmpdir(), "launchpad-update-"));
-  const file = join14(dir, "install.sh");
+  const dir = mkdtempSync(join15(tmpdir(), "launchpad-update-"));
+  const file = join15(dir, "install.sh");
   try {
     writeFileSync7(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
@@ -12555,7 +12681,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync18(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync19(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -12681,6 +12807,7 @@ async function runUpdate(args, io, deps) {
   const current = deps.cliVersion;
   if (compareVersions(current, latest.version) >= 0) {
     io.out(`launchpad-cli is up to date (${current}).`);
+    await reconcileSkillBundleWhenCurrent(io, deps, parsed.check);
     return 0;
   }
   if (parsed.check) {
@@ -12762,7 +12889,7 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync15, readFileSync as readFileSync19, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
 import { dirname as dirname10, resolve as resolve14 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -12800,7 +12927,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync19(manifestPath, "utf8");
+    manifestYaml = readFileSync20(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -12841,7 +12968,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   }
   let entries;
   try {
-    entries = readdirSync2(abs);
+    entries = readdirSync3(abs);
   } catch (e) {
     return [`failed to read static served directory '${serveDir}/': ${describe30(e)}`];
   }
@@ -13715,21 +13842,20 @@ var listOwnersCommand = makeListOwnersCommand();
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import {
   existsSync as existsSync16,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync20,
-  readdirSync as readdirSync3,
+  readFileSync as readFileSync21,
   writeFileSync as writeFileSync8
 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
-var CACHE_FILE = join15(homedir4(), ".launchpad", "update-check.json");
+var CACHE_FILE = join16(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync20(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync21(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -13742,39 +13868,12 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync4(join15(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join16(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
-var SKILL_PREFIX = "launchpad-";
-var SKILLS_HINT_MARKER = join15(homedir4(), ".launchpad", "skills-hint-shown");
-function skillsTargetDir() {
-  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir4(), ".claude", "skills");
-}
-function readInstalledSkills() {
-  try {
-    const dir = skillsTargetDir();
-    const bundle = readdirSync3(dir, { withFileTypes: true }).find((e) => e.isDirectory() && e.name.startsWith(SKILL_PREFIX));
-    if (!bundle)
-      return { present: false, version: null };
-    return { present: true, version: readSkillVersion(join15(dir, bundle.name, "SKILL.md")) };
-  } catch {
-    return { present: false, version: null };
-  }
-}
-function readSkillVersion(path13) {
-  try {
-    const text = readFileSync20(path13, "utf8");
-    const fenceEnd = text.indexOf(`
----`, 4);
-    const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
-    const m = /^version:\s*(.+?)\s*$/m.exec(front);
-    return m === null ? null : m[1] ?? null;
-  } catch {
-    return null;
-  }
-}
+var SKILLS_HINT_MARKER = join16(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
     return existsSync16(SKILLS_HINT_MARKER);
@@ -13784,7 +13883,7 @@ function absentHintShown() {
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync4(join15(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join16(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -13887,8 +13986,8 @@ var refreshUpdateCacheCommand = {
 // src/telemetry.ts
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
-import { join as join16 } from "node:path";
-import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync21, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join17 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -13896,8 +13995,8 @@ var POSTHOG_PROJECT_KEY = "phc_CYaCuETanWc36TMTiB7cdkdnmPPhFZCkDGmWGLaNkXnb";
 var CAPTURE_PATH = "/i/v0/e/";
 var SEND_TIMEOUT_MS = 3000;
 var APP = "launchpad-cli";
-var DEVICE_ID_FILE = join16(homedir5(), ".launchpad", "telemetry-id.json");
-var FIRST_RUN_MARKER = join16(homedir5(), ".launchpad", "telemetry-notice-shown");
+var DEVICE_ID_FILE = join17(homedir5(), ".launchpad", "telemetry-id.json");
+var FIRST_RUN_MARKER = join17(homedir5(), ".launchpad", "telemetry-notice-shown");
 function buildEvent(ctx, identity, nowMs) {
   const properties = {
     app: APP,
@@ -13964,14 +14063,14 @@ async function resolveIdentityReal() {
 }
 function getOrCreateDeviceId() {
   try {
-    const raw = JSON.parse(readFileSync21(DEVICE_ID_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync22(DEVICE_ID_FILE, "utf8"));
     const id2 = raw?.deviceId;
     if (typeof id2 === "string" && id2)
       return id2;
   } catch {}
   const id = randomUUID();
   try {
-    mkdirSync5(join16(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join17(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
 `, {
       mode: 384
@@ -14049,7 +14148,7 @@ function firstRunNoticeShown() {
 }
 function markFirstRunNotice() {
   try {
-    mkdirSync5(join16(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join17(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(FIRST_RUN_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -14115,11 +14214,11 @@ import { createInterface as createInterface7 } from "node:readline/promises";
 import { platform } from "node:os";
 
 // src/report/breadcrumb.ts
-import { writeFileSync as writeFileSync10, readFileSync as readFileSync22, mkdirSync as mkdirSync6 } from "node:fs";
+import { writeFileSync as writeFileSync10, readFileSync as readFileSync23, mkdirSync as mkdirSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join17, dirname as dirname11 } from "node:path";
+import { join as join18, dirname as dirname11 } from "node:path";
 function breadcrumbPath() {
-  return join17(homedir6(), ".launchpad", "last-run.json");
+  return join18(homedir6(), ".launchpad", "last-run.json");
 }
 function writeBreadcrumb(verb, exit) {
   try {
@@ -14130,7 +14229,7 @@ function writeBreadcrumb(verb, exit) {
 }
 function readBreadcrumb() {
   try {
-    const raw = JSON.parse(readFileSync22(breadcrumbPath(), "utf8"));
+    const raw = JSON.parse(readFileSync23(breadcrumbPath(), "utf8"));
     if (typeof raw !== "object" || raw === null)
       return null;
     const r = raw;

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAqEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAqEA,OAAO,EAGL,4BAA4B,EAC7B,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,EAAa,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,KAAK,EAAS,OAAO,EAAY,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;AAEjD,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAEF,UAAU,UAAU;IAClB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAmQD;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAoBpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAwBpE;AAkMD,2BAA2B;AAC3B,OAAO,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/commands/update.d.ts

@@ -1,4 +1,5 @@
 import { type ChannelUpdateResult } from "./channel-auth.js";
+import { type InstalledSkillsState } from "../skills-bundle.js";
 import type { CliIo, Command, ExitCode } from "../dispatcher.js";
 /** Browser-based installer the platform channel directs users to for upgrades. */
 export declare const CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
@@ -96,6 +97,12 @@ export interface UpdateDeps {
      * failure). See {@link runSkillsSync}.
      */
     readonly syncSkills: () => Promise<SkillsSyncResult>;
+    /**
+     * Read the freshness of the on-disk Claude Code skill bundle. Injected so
+     * the already-up-to-date branch's drift check is unit-testable without
+     * touching the filesystem. See {@link reconcileSkillBundleWhenCurrent}.
+     */
+    readonly readInstalledSkills: () => InstalledSkillsState;
 }
 /** Outcome of the post-upgrade skill-bundle re-sync. */
 export interface SkillsSyncResult {

package/dist/commands/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAuDA,OAAO,EAA4B,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAWjE,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAYrE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAEpD,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AASnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,MAAM,CAGvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAEpB;AAED,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAIF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CA4BnE;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAiBhE;AAID,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAI3D,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACtD;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AA+GD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,YAAY,CAAC,CAI5D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAQrD;AA0JD;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,QAAQ,CAAC,CA2GnB"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAuDA,OAAO,EAA4B,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAWjE,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAYrE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;AAEpD,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,CAAC;AASnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,cAAc,GAAG,MAAM,CAGvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAEpB;AAED,eAAO,MAAM,aAAa,EAAE,OAI3B,CAAC;AAIF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CA4BnE;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAiBhE;AAID,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAI3D,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAEpC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;CAC1D;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AA8JD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAAC,YAAY,CAAC,CAI5D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAQrD;AA0JD;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,QAAQ,CAAC,CAiHnB"}

package/dist/deploy/access-drift-offer.d.ts

@@ -0,0 +1,46 @@
+import type { CliIo, ExitCode } from "../dispatcher.js";
+import type { ApplyOptions } from "./apply.js";
+/** The two-direction group diff the bot returns with a 409 `access_drift`. */
+export interface AccessDriftBody {
+    readonly live_only?: unknown;
+    readonly manifest_only?: unknown;
+}
+export interface AccessDriftDeps {
+    /** True when we may prompt (stdin is a TTY). */
+    readonly interactive: boolean;
+    /** Ask a yes/no question; resolves the raw typed line. */
+    readonly prompt: (question: string) => Promise<string>;
+    /**
+     * Run the gated apply flow. Defaults to `runDeployApply` at the call site.
+     * The third arg carries an `onApplied` hook the flow fires only when a
+     * terraform apply actually completes — so we never claim success when the
+     * operator reviews the plan and aborts (both paths exit 0).
+     */
+    readonly runApply: (opts: ApplyOptions, io: CliIo, deps?: {
+        readonly onApplied?: () => void;
+    }) => Promise<ExitCode>;
+}
+/**
+ * The drift summary — printed in every case (interactive or not). Names both
+ * directions of the divergence so the operator can see exactly what would
+ * change before deciding.
+ */
+export declare function renderAccessDriftSummary(slug: string, body: AccessDriftBody): string[];
+/**
+ * The manual fallback guidance — printed when the session is non-interactive,
+ * or when the operator declines the inline offer.
+ */
+export declare function renderManualApplyGuidance(): string[];
+/**
+ * Surface an access-drift refusal and, when interactive, offer to reconcile
+ * inline via the gated apply flow. Returns the exit code the deploy command
+ * should return.
+ */
+export declare function handleAccessDrift(params: {
+    readonly slug: string;
+    readonly manifestPath: string;
+    readonly body: AccessDriftBody;
+    readonly io: CliIo;
+    readonly deps: AccessDriftDeps;
+}): Promise<ExitCode>;
+//# sourceMappingURL=access-drift-offer.d.ts.map

package/dist/deploy/access-drift-offer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-drift-offer.d.ts","sourceRoot":"","sources":["../../src/deploy/access-drift-offer.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,CACjB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,KACvC,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAKD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,GACpB,MAAM,EAAE,CAoBV;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,EAAE,CAOpD;AAQD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoDpB"}

package/dist/deploy/apply.d.ts

@@ -27,6 +27,14 @@ export interface ApplyDeps {
     readonly fetcher?: typeof fetch;
     /** Polling interval seconds (defaults to 10s; tests use 0). */
     readonly pollIntervalSeconds?: number;
+    /**
+     * Fired exactly once, when a terraform apply actually COMPLETES in this
+     * invocation (not when the operator aborts at the confirmation prompt, and
+     * not on a non-applied terminal state). Lets a caller — e.g. the PS-2071
+     * inline access-drift offer — distinguish a real reconcile from an abort,
+     * both of which exit 0.
+     */
+    readonly onApplied?: () => void;
 }
 export declare function runDeployApply(opts: ApplyOptions, io: CliIo, deps?: ApplyDeps): Promise<ExitCode>;
 //# sourceMappingURL=apply.d.ts.map

package/dist/deploy/apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/deploy/apply.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;oEAGgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAwCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAoLnB"}
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/deploy/apply.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAU1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;wDACoD;IACpD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;oEAGgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAwCD,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,KAAK,EACT,IAAI,GAAE,SAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CAsLnB"}

package/dist/io/prompt.d.ts

@@ -0,0 +1,13 @@
+/**
+ * True when we can meaningfully prompt the operator — stdin is an interactive
+ * TTY. In a pipe, a CI job, or a redirected stdin this is false, and callers
+ * must fall back to a non-interactive path rather than block on a read that
+ * will never receive input.
+ */
+export declare function isInteractive(): boolean;
+/**
+ * Ask a question on stdin/stdout and resolve the raw typed line (untrimmed).
+ * The readline interface is always closed, even if the question rejects.
+ */
+export declare function defaultPrompt(question: string): Promise<string>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/io/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/io/prompt.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrE"}

package/dist/skills-bundle.d.ts

@@ -0,0 +1,20 @@
+/** Prefix every bundled launchpad skill directory shares. */
+export declare const SKILL_PREFIX = "launchpad-";
+/** Freshness of the on-disk Claude Code skill bundle vs the running CLI. */
+export interface InstalledSkillsState {
+    /** True if any `launchpad-*` skill is installed under the skills dir. */
+    readonly present: boolean;
+    /** The bundle's `version:` frontmatter, or null if unreadable. */
+    readonly version: string | null;
+}
+/** Where `launchpad skills install` writes the bundle (mirrors skills.ts). */
+export declare function skillsTargetDir(): string;
+/**
+ * Synchronously read the installed skill-bundle freshness. Hot-path safe:
+ * one `readdir` + at most one small `readFile`, no network. A missing or
+ * unreadable skills dir is reported as `{ present: false }` (not an error).
+ */
+export declare function readInstalledSkills(): InstalledSkillsState;
+/** Parse the `version:` frontmatter from a SKILL.md (inside the `---` fence). */
+export declare function readSkillVersion(path: string): string | null;
+//# sourceMappingURL=skills-bundle.d.ts.map

package/dist/skills-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-bundle.d.ts","sourceRoot":"","sources":["../src/skills-bundle.ts"],"names":[],"mappings":"AAiBA,6DAA6D;AAC7D,eAAO,MAAM,YAAY,eAAe,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,MAAM,CAKxC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,oBAAoB,CAc1D;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW5D"}

package/dist/update-notifier.d.ts

@@ -1,5 +1,8 @@
 import type { CliIo, Command } from "./dispatcher.js";
 import { resolveLatestVersion, type InstallChannel } from "./commands/update.js";
+import { readInstalledSkills, type InstalledSkillsState } from "./skills-bundle.js";
+export { readInstalledSkills };
+export type { InstalledSkillsState };
 /** Internal verb the detached refresh process runs. Hidden from help. */
 export declare const INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 /** Re-check the registry at most once per this window (24h). */
@@ -15,19 +18,6 @@ export interface CacheState {
 export declare function readCache(): CacheState | null;
 /** Write the cache file (0600), creating ~/.launchpad if needed. Best-effort. */
 export declare function writeCache(state: CacheState): void;
-/** Freshness of the on-disk Claude Code skill bundle vs the running CLI. */
-export interface InstalledSkillsState {
-    /** True if any `launchpad-*` skill is installed under the skills dir. */
-    readonly present: boolean;
-    /** The bundle's `version:` frontmatter, or null if unreadable. */
-    readonly version: string | null;
-}
-/**
- * Synchronously read the installed skill-bundle freshness. Hot-path safe:
- * one `readdir` + at most one small `readFile`, no network. A missing or
- * unreadable skills dir is reported as `{ present: false }` (not an error).
- */
-export declare function readInstalledSkills(): InstalledSkillsState;
 /** Has the one-time "skills not installed" hint already been shown? */
 export declare function absentHintShown(): boolean;
 /** Record that the one-time absent hint was shown. Best-effort. */

package/dist/update-notifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-notifier.d.ts","sourceRoot":"","sources":["../src/update-notifier.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAIL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAE9B,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,QAAsB,CAAC;AAQrD,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,UAAU,GAAG,IAAI,CAkB7C;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAOlD;AAWD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAUD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,oBAAoB,CAW1D;AAgBD,uEAAuE;AACvE,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C;AAID,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,cAAc,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,UAAU,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;IACzD,uEAAuE;IACvE,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC;IACxC,sDAAsD;IACtD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAQxD;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,cAAc,GACtB,MAAM,CAMR;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,YAAY,GACjB,IAAI,CAgCN;AAwBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,MAAM,GAAG,SAA2B,GAC5C,IAAI,CAuBN;AAID,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,UAAU,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AASD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,WAA6B,GAClC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,EAAE,OAQvC,CAAC"}
+{"version":3,"file":"update-notifier.d.ts","sourceRoot":"","sources":["../src/update-notifier.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAIL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAE9D,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,QAAsB,CAAC;AAQrD,6CAA6C;AAC7C,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,UAAU,GAAG,IAAI,CAkB7C;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAOlD;AAQD,uEAAuE;AACvE,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C;AAID,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,cAAc,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,UAAU,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;IACzD,uEAAuE;IACvE,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC;IACxC,sDAAsD;IACtD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAQxD;AAED,gDAAgD;AAChD,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,cAAc,GACtB,MAAM,CAMR;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,KAAK,EACT,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,YAAY,GACjB,IAAI,CAgCN;AAwBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,KAAK,EACT,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,MAAM,GAAG,SAA2B,GAC5C,IAAI,CAuBN;AAID,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,UAAU,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AASD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,WAA6B,GAClC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,EAAE,OAQvC,CAAC"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.46.2";
+export declare const CLI_VERSION = "0.47.1";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@m-kopa/launchpad-cli",
-  "version": "0.46.2",
-  "description": "Launchpad CLI \u2014 clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
+  "version": "0.47.1",
+  "description": "Launchpad CLI — clone / deploy / review / merge against Launchpad-managed apps. Talks to the portal-bot endpoints (SCOPE-M-760 / T4).",
   "type": "module",
   "bin": {
     "launchpad": "./dist/cli.js"

package/skills/launchpad-content-pr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-content-pr
 description: Push a content change to a Launchpad app via `launchpad deploy` and verify it shipped via `launchpad status`. Covers the post-first-deploy iteration loop (edit → deploy → verify) — subsequent deploys commit directly to the app repo's main and the Pages build runs asynchronously, so verification is its own step. Use when someone says "push a content change", "ship an update", "/launchpad-content-pr", "verify my deploy", or after `/launchpad-deploy` reports `done` and they want to follow up with an edit.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -193,11 +193,15 @@ group passes (no need to use `deploy --dry-run` as a workaround).
 > `access.allowed_entra_groups` and running a plain `launchpad deploy`
 > ships content only — it does **not** reconcile the gateway's access
 > policy, so the change won't take effect (and is refused once the
-> access-drift gate is enforced). To change a live app's groups, the
-> user self-serves the **gated Terraform route**: `launchpad deploy
-> --apply` (preview with `--dry-run`, confirm with `launchpad status`).
-> Do **not** tell the user to raise a request with the platform team —
-> `--apply` IS the self-serve route. See `/launchpad-status` and the
+> access-drift gate is enforced). When that refusal happens in an
+> **interactive terminal**, the CLI now **offers to reconcile inline** —
+> answering `y` routes straight into the gated apply flow (which shows
+> the plan and confirms again before opening the PR). To change a live
+> app's groups the user self-serves the **gated Terraform route**:
+> `launchpad deploy --apply` (preview with `--dry-run`, confirm with
+> `launchpad status`) — or just accept the inline offer. Do **not** tell
+> the user to raise a request with the platform team — `--apply` IS the
+> self-serve route. See `/launchpad-status` and the
 > [auth & groups](https://get.launchpad.m-kopa.us/docs/concepts/auth-groups#changing-access-on-an-existing-app)
 > doc.
 

package/skills/launchpad-deploy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy
 description: Walk a Launchpad user through deploying an app from their local working directory (Model A — `launchpad init` + `launchpad deploy`). Wraps the CLI verbs end-to-end: detects the app shape, scaffolds `launchpad.yaml`, resolves the allowed Entra group via `launchpad groups`, bundles the CWD via `launchpad deploy`, and watches the rollout via `launchpad status`. Use when someone says "deploy a new app", "ship my app to Launchpad", "/launchpad-deploy", "I have an app locally — get it on Launchpad", or any variant. Resume/abandon for legacy in-flight provisioning is at the bottom.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->
@@ -235,10 +235,15 @@ Use whichever fits; `--dry-run` additionally previews the Terraform.
 
 This `--group` flow sets the group at **first deploy**. Changing the
 group on an **existing** app is a different path — a plain `launchpad
-deploy` ships content only and won't move the gateway policy. The
-self-serve fix is `launchpad deploy --apply` (the gated Terraform
-route); see `/launchpad-content-pr`. Never route the user to the
-platform team for a group change.
+deploy` ships content only and won't move the gateway policy. When a
+plain deploy detects access drift in an **interactive terminal** it now
+**offers to reconcile inline** (answer `y` to route straight into the
+gated apply flow, which shows the plan and confirms again before it
+opens the PR); in a non-interactive session it prints the manual
+`launchpad deploy --apply` route and exits non-zero. Either way the fix
+is the gated Terraform apply — see `/launchpad-content-pr`. Never route
+the user to the platform team for a group change, and never tell them
+access drift is unfixable: the self-serve reconcile is one keystroke.
 
 If `launchpad groups list` fails with:
 

package/skills/launchpad-deploy-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-deploy-status
 description: Show the current provisioning stage + failure reason for a Launchpad app via `launchpad status` (Model A drift + deployment_verified) and `launchpad apps` (lifecycle bucket), or watch provisioning live with `launchpad watch`. Renders the M-892 stage trace for in-flight provisioning, and is the canonical home for `launchpad recover` (repair a terminal-failed app record that is actually live). Use when someone says "what's the status of demo-X", "/launchpad-deploy-status", "is my deploy stuck", "watch my deploy go live", "watch provisioning", "my app says failed but it's serving", or after `/launchpad-deploy` reports a non-`done` terminal stage.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-destroy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-destroy
 description: Tear down a Launchpad app end-to-end via `launchpad destroy` — Cloudflare Pages project, edge-auth wiring (gateway KV/audience entries, or the Access app for `auth: access` apps), custom hostname, platform-repo TF, and the app repo (archive-renamed). Owner-only verb with a two-step destructive confirmation. Use when someone says "destroy this app", "/launchpad-destroy", "tear down `<slug>`", "delete the app", or asks to clean up a smoke-test / orphan / retired app.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-identity/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-identity
 description: Teach an app author how to use the signed-in user's identity inside a Launchpad app — read the gateway-forwarded X-Launchpad-User-Assertion in a Pages Function, VERIFY it with @m-kopa/platform-auth (fail-closed), and show who's logged in (sub/email/name). Use when someone says "who is logged in", "show the current user", "get the user's email in my app", "auth in my launchpad app", "read the user identity", "/launchpad-identity", or is wiring up an /api/me for a gateway-fronted app.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-onboard
 description: One-time setup for the Launchpad CLI + Claude Code skill bundle. Verifies the `launchpad` CLI is installed and current, runs `launchpad whoami` to confirm the session is fresh, and checks the bundled skills are installed and in lock-step with the CLI. Idempotent — safe to re-run any time. Use when someone says "set me up for Launchpad", "I just got a new machine and want to use Launchpad", "/launchpad-onboard", or any of the other launchpad-* skills fails on a prereq check.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-report
 description: File a bug report or feature request to the Launchpad team's tracker from the CLI. Use when someone reports something broken, hits an error in a launchpad command, or wishes a feature existed — e.g. "this is broken", "report a bug", "can you file that", "I wish launchpad could…", "/launchpad-bug", "/launchpad-feature". Always confirm and show exactly what you'll send before filing; never file silently.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->

package/skills/launchpad-status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: launchpad-status
 description: Show whether a Launchpad app's local launchpad.yaml matches what's deployed, and read the deployed manifest. Wraps `launchpad pull` (fetch deployed YAML) and `launchpad status` (drift report). Use when someone says "is my app in sync", "what's deployed", "show drift", "/launchpad-status", "/launchpad-pull", or after `launchpad deploy` to verify the change landed.
-version: 0.46.2
+version: 0.47.1
 ---
 
 <!-- BEGIN shell-contract (managed by scripts/sync-skill-contract.sh — edit skills/_partials/shell-contract.md) -->