@m-kopa/launchpad-cli 0.52.0 → 0.53.0

package/dist/cli.js

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.52.0";
+var CLI_VERSION = "0.53.0";
 
 // src/config.ts
 import * as os from "node:os";
@@ -1342,7 +1342,7 @@ async function extractToDir(body, destDir, opts = {}) {
   const absDest = path3.resolve(destDir);
   try {
     const existing = await fs2.readdir(absDest);
-    if (existing.length > 0) {
+    if (existing.length > 0 && opts.allowNonEmpty !== true) {
       throw new DestinationNotEmptyError(`destination ${absDest} is not empty (${existing.length} entries); refusing to extract`);
     }
   } catch (e) {
@@ -1470,8 +1470,18 @@ async function writeBaseShaMarker(cwd, sha) {
   await ensureExcluded(cwd);
   const dir = path4.resolve(cwd, MARKER_DIR);
   await fs3.mkdir(dir, { recursive: true });
-  await fs3.writeFile(path4.resolve(cwd, MARKER_RELPATH), `${sha}
-`, "utf8");
+  const marker = path4.resolve(cwd, MARKER_RELPATH);
+  const temporary = `${marker}.tmp-${process.pid}-${crypto.randomUUID()}`;
+  try {
+    await fs3.writeFile(temporary, `${sha}
+`, { encoding: "utf8", mode: 384 });
+    await fs3.rename(temporary, marker);
+  } catch (error) {
+    await fs3.rm(temporary, { force: true }).catch(() => {
+      return;
+    });
+    throw error;
+  }
 }
 async function readBaseShaMarker(cwd) {
   let raw;
@@ -1483,6 +1493,18 @@ async function readBaseShaMarker(cwd) {
   const sha = raw.trim();
   return isValidBaseSha(sha) ? sha : null;
 }
+async function readBaseShaMarkerState(cwd) {
+  let raw;
+  try {
+    raw = await fs3.readFile(path4.resolve(cwd, MARKER_RELPATH), "utf8");
+  } catch (error) {
+    if (isErrno3(error) && error.code === "ENOENT")
+      return { kind: "missing" };
+    return { kind: "malformed" };
+  }
+  const sha = raw.trim();
+  return isValidBaseSha(sha) ? { kind: "valid", sha } : { kind: "malformed" };
+}
 async function ensureExcluded(cwd) {
   const excludePath = path4.resolve(cwd, EXCLUDE_RELPATH);
   let current = "";
@@ -1501,6 +1523,9 @@ async function ensureExcluded(cwd) {
   await fs3.writeFile(excludePath, `${current}${sep}${EXCLUDE_LINE}
 `, "utf8");
 }
+function isErrno3(error) {
+  return error instanceof Error && "code" in error;
+}
 
 // src/commands/clone.ts
 var cloneCommand = {
@@ -1525,12 +1550,7 @@ async function runClone(args, io) {
   try {
     cfg = loadConfig();
     destDir = path5.resolve(process.cwd(), `launchpad-app-${slug}`);
-    try {
-      await fs4.access(destDir);
-      destPreExisted = true;
-    } catch {
-      destPreExisted = false;
-    }
+    destPreExisted = await pathExists(destDir);
     io.out(`Cloning ${slug} into ${destDir} …`);
     const res = await apiRaw(cfg, { path: `/apps/${slug}/source-bundle` });
     if (res.body === null) {
@@ -1538,67 +1558,93 @@ async function runClone(args, io) {
       return 1;
     }
     const headerSha = res.headers.get(BASE_SHA_HEADER);
-    const baseSha = headerSha !== null && isValidBaseSha(headerSha) ? headerSha : null;
+    if (headerSha === null || !isValidBaseSha(headerSha)) {
+      io.err("launchpad clone: bot did not return trustworthy source provenance; no files were extracted.");
+      io.err("  Retry later or ask the Launchpad team to verify the bot version.");
+      return 1;
+    }
+    const baseSha = headerSha;
     const stats = await extractToDir(res.body, destDir, { stripComponents: 1 });
     await initGitRepo({
       cwd: destDir,
       initialCommitMessage: `Initial baseline from launchpad clone ${slug}`
     });
-    let stamped = false;
-    if (baseSha !== null) {
-      try {
-        await writeBaseShaMarker(destDir, baseSha);
-        stamped = true;
-      } catch (e) {
-        io.err(`launchpad clone: warning — could not record base revision: ${describe9(e)}`);
-        io.err("(the clone is usable, but deploy cannot detect divergence)");
-      }
-    }
+    const markerFailure = await persistCloneMarker({
+      slug,
+      destDir,
+      destPreExisted,
+      baseSha,
+      io
+    });
+    if (markerFailure !== null)
+      return markerFailure;
     io.out("");
     io.out(`Cloned ${stats.fileCount} files (${formatBytes(stats.byteCount)}) into ${destDir}`);
-    if (stamped && baseSha !== null) {
-      io.out(`Base revision ${baseSha.slice(0, 12)} recorded — \`launchpad deploy\` will warn if main moves past it.`);
-    }
+    io.out(`Base revision ${baseSha.slice(0, 12)} recorded - \`launchpad pull\` can refresh this clone safely.`);
     io.out(`No remote configured — use \`launchpad deploy\` to ship changes back.`);
     return 0;
-  } catch (e) {
-    if (e instanceof UnauthenticatedError) {
-      io.err(e.message);
-      return 1;
-    }
-    if (e instanceof ForbiddenError) {
-      io.err(e.message);
-      return 1;
-    }
-    if (e instanceof NotFoundError) {
-      io.err(`launchpad clone: app "${slug}" not found (or you have no access)`);
-      return 1;
-    }
-    if (e instanceof DestinationNotEmptyError) {
-      io.err(`launchpad clone: ${e.message}`);
-      io.err("(move or delete the existing directory and re-run)");
-      return 1;
-    }
-    if (e instanceof TarballParseError) {
-      io.err(`launchpad clone: malformed tarball from bot: ${e.message}`);
-      if (!destPreExisted)
-        await cleanupBestEffort(slug);
-      return 1;
-    }
-    if (e instanceof PathTraversalError) {
-      io.err(`launchpad clone: refusing to extract — ${e.message}`);
-      if (!destPreExisted)
-        await cleanupBestEffort(slug);
-      return 1;
-    }
-    if (e instanceof GitInitError) {
-      io.err(`launchpad clone: ${e.message}`);
-      return 1;
+  } catch (error) {
+    return handleCloneError(error, slug, destPreExisted, io);
+  }
+}
+async function persistCloneMarker(args) {
+  try {
+    await writeBaseShaMarker(args.destDir, args.baseSha);
+    return null;
+  } catch (error) {
+    args.io.err(`launchpad clone: could not record source provenance: ${describe9(error)}`);
+    if (args.destPreExisted) {
+      args.io.err(`  Remove the generated files from ${args.destDir}, then retry.`);
+    } else {
+      await cleanupBestEffort(args.slug);
+      args.io.err("  The incomplete clone was removed. Retry the command.");
     }
-    io.err(`launchpad clone failed: ${describe9(e)}`);
     return 1;
   }
 }
+async function handleCloneError(error, slug, destPreExisted, io) {
+  if (isCloneAuthError(error)) {
+    io.err(error.message);
+  } else if (error instanceof NotFoundError) {
+    io.err(`launchpad clone: app "${slug}" not found (or you have no access)`);
+  } else if (error instanceof DestinationNotEmptyError) {
+    io.err(`launchpad clone: ${error.message}`);
+    io.err("(move or delete the existing directory and re-run)");
+  } else if (error instanceof TarballParseError) {
+    io.err(`launchpad clone: malformed tarball from bot: ${error.message}`);
+    if (!destPreExisted)
+      await cleanupBestEffort(slug);
+  } else if (error instanceof PathTraversalError) {
+    io.err(`launchpad clone: refusing to extract - ${error.message}`);
+    if (!destPreExisted)
+      await cleanupBestEffort(slug);
+  } else if (error instanceof GitInitError) {
+    await handleGitInitError(error, slug, destPreExisted, io);
+  } else {
+    io.err(`launchpad clone failed: ${describe9(error)}`);
+  }
+  return 1;
+}
+async function handleGitInitError(error, slug, destPreExisted, io) {
+  io.err(`launchpad clone: ${error.message}`);
+  if (destPreExisted)
+    return;
+  await cleanupBestEffort(slug);
+  io.err("  The incomplete clone was removed. Retry the command.");
+}
+function isCloneAuthError(error) {
+  return error instanceof UnauthenticatedError || error instanceof ForbiddenError;
+}
+async function pathExists(target) {
+  try {
+    await fs4.lstat(target);
+    return true;
+  } catch (error) {
+    if (isErrno4(error) && error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
 async function cleanupBestEffort(slug) {
   const dir = path5.resolve(process.cwd(), `launchpad-app-${slug}`);
   await fs4.rm(dir, { recursive: true, force: true }).catch(() => {
@@ -1615,6 +1661,9 @@ function formatBytes(n) {
 function describe9(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function isErrno4(error) {
+  return error instanceof Error && "code" in error;
+}
 
 // src/commands/create.ts
 var createCommand = {
@@ -1794,7 +1843,7 @@ async function packTarGz(cwd, files) {
     try {
       stat = await fs5.lstat(abs);
     } catch (e) {
-      if (isErrno3(e) && e.code === "ENOENT")
+      if (isErrno5(e) && e.code === "ENOENT")
         continue;
       throw e;
     }
@@ -1919,13 +1968,14 @@ function findSplit(p, enc) {
   }
   return null;
 }
-function isErrno3(e) {
+function isErrno5(e) {
   return e instanceof Error && typeof e.code === "string";
 }
 
 // src/bundle/upload.ts
 var ACCESS_RECONCILE_EXACT_SHA_V1 = "access-reconcile-exact-sha-v1";
-async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact, baseSha, overrideStale) {
+var SOURCE_PROVENANCE_V1 = "source-provenance-v1";
+async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact, baseSha, overrideStale, allowUnguarded = false) {
   const formData = new FormData;
   formData.append("manifest", manifestYaml);
   const buf = new ArrayBuffer(bundleTarGz.byteLength);
@@ -1948,12 +1998,14 @@ async function uploadBundle(cfg, slug, manifestYaml, bundleTarGz, workerArtifact
   const headers = {
     authorization: `Bearer ${accessToken}`,
     accept: "application/json",
-    "x-launchpad-capabilities": ACCESS_RECONCILE_EXACT_SHA_V1
+    "x-launchpad-capabilities": `${ACCESS_RECONCILE_EXACT_SHA_V1},${SOURCE_PROVENANCE_V1}`
   };
   if (baseSha)
     headers["x-launchpad-base-sha"] = baseSha;
   if (overrideStale)
     headers["x-launchpad-stale-override"] = overrideStale;
+  if (allowUnguarded)
+    headers["x-launchpad-allow-unguarded"] = "true";
   let res;
   try {
     res = await fetch(url, { method: "POST", headers, body: formData });
@@ -2104,6 +2156,7 @@ import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
 import { join as join4, relative as relative2, sep } from "node:path";
 var DEFAULT_IGNORE = [
   ".git",
+  ".launchpad",
   "node_modules",
   "dist",
   "build",
@@ -2467,9 +2520,9 @@ var AccessSchema = z.object({
   allowed_entra_group: z.string().min(1).optional(),
   allowed_entra_groups: z.array(z.string().min(1)).min(1).refine((arr) => new Set(arr).size === arr.length, { message: "allowed_entra_groups must not contain duplicates" }).optional(),
   session_duration: z.string().regex(SESSION_DURATION_REGEX, "must match Go duration format, e.g. 24h / 30m / 60s").optional()
-}).strict().superRefine((access2, ctx) => {
-  const hasSingular = access2.allowed_entra_group !== undefined;
-  const hasPlural = access2.allowed_entra_groups !== undefined;
+}).strict().superRefine((access, ctx) => {
+  const hasSingular = access.allowed_entra_group !== undefined;
+  const hasPlural = access.allowed_entra_groups !== undefined;
   if (!hasSingular && !hasPlural) {
     ctx.addIssue({
       code: z.ZodIssueCode.custom,
@@ -2485,11 +2538,11 @@ var AccessSchema = z.object({
     });
   }
 });
-function allowedEntraGroups(access2) {
-  if (access2.allowed_entra_groups !== undefined) {
-    return access2.allowed_entra_groups;
+function allowedEntraGroups(access) {
+  if (access.allowed_entra_groups !== undefined) {
+    return access.allowed_entra_groups;
   }
-  return [access2.allowed_entra_group];
+  return [access.allowed_entra_group];
 }
 var ContainerSchema = z.object({
   name: z.string().min(2).max(32).regex(SLUG_REGEX, "container name must be lowercase letters, digits, and hyphens"),
@@ -2957,6 +3010,13 @@ function checkDenyList(path7) {
   if (segments.includes(".claude")) {
     return { path: path7, rule: "claude-dir", message: `'${path7}' is under a .claude/ directory (AI-workspace state) — never shippable` };
   }
+  if (segments.includes(".launchpad")) {
+    return {
+      path: path7,
+      rule: "launchpad-dir",
+      message: `'${path7}' is under .launchpad/ (clone-local state) - never shippable`
+    };
+  }
   if (segments.includes(".git")) {
     return { path: path7, rule: "git-dir", message: `'${path7}' is under .git/ — never shippable` };
   }
@@ -4006,7 +4066,7 @@ ${lines}`
 
 // src/bundle/orchestrate.ts
 async function bundleAndDeploy(args) {
-  const { cfg, cwd, slug, overrideStale } = args;
+  const { cfg, cwd, slug, overrideStale, allowUnguarded = false } = args;
   const manifestPath = join7(cwd, "launchpad.yaml");
   let manifestYaml;
   try {
@@ -4052,7 +4112,7 @@ async function bundleAndDeploy(args) {
   }
   const workerArtifact = workerBuild.kind === "ok" ? workerBuild.artifact : undefined;
   const baseSha = await readBaseShaMarker(cwd);
-  const uploadResult = await uploadBundle(cfg, slug, manifestYaml, packResult.bytes, workerArtifact, baseSha, overrideStale);
+  const uploadResult = await uploadBundle(cfg, slug, manifestYaml, packResult.bytes, workerArtifact, baseSha, overrideStale, allowUnguarded);
   if (uploadResult.kind !== "ok") {
     return {
       kind: "upload-error",
@@ -6319,6 +6379,7 @@ function parseDeployFlags(args) {
   let allowStale = false;
   let rebaseOntoHead = false;
   let overrideStale = null;
+  let allowUnguarded = false;
   let i = 0;
   while (i < args.length) {
     const a = args[i] ?? "";
@@ -6451,6 +6512,11 @@ function parseDeployFlags(args) {
       i += 1;
       continue;
     }
+    if (a === "--allow-unguarded") {
+      allowUnguarded = true;
+      i += 1;
+      continue;
+    }
     if (a === "--rebase-onto-head") {
       rebaseOntoHead = true;
       i += 1;
@@ -6532,8 +6598,8 @@ function parseDeployFlags(args) {
   if (modeFlagsSeen > 1) {
     return "--new, --resume, --abandon, --dry-run, and --apply are mutually exclusive";
   }
-  if (mode !== "content" && (allowStale || rebaseOntoHead || overrideStale !== null)) {
-    return "--allow-stale / --rebase-onto-head / --override-stale are only valid for a content deploy";
+  if (mode !== "content" && (allowStale || rebaseOntoHead || overrideStale !== null || allowUnguarded)) {
+    return "--allow-stale / --rebase-onto-head / --override-stale / --allow-unguarded are only valid for a content deploy";
   }
   if (rebaseOntoHead && overrideStale !== null) {
     return "--rebase-onto-head and --override-stale are mutually exclusive — re-stamp to head, or override in place, not both";
@@ -6626,7 +6692,14 @@ function parseDeployFlags(args) {
       return `invalid slug "${slug}" — expected ${SLUG_RE4.source}`;
     }
     return {
-      mode: { kind: "content", slug, allowStale, rebaseOntoHead, overrideStale },
+      mode: {
+        kind: "content",
+        slug,
+        allowStale,
+        rebaseOntoHead,
+        overrideStale,
+        allowUnguarded
+      },
       message,
       timeoutSeconds
     };
@@ -7599,7 +7672,12 @@ async function runDeploy(args, io) {
   const cwd = process.cwd();
   const manifestPath = path8.join(cwd, "launchpad.yaml");
   if (existsSync6(manifestPath)) {
-    const contentMode = flags.mode.kind === "content" ? flags.mode : { allowStale: false, rebaseOntoHead: false, overrideStale: null };
+    const contentMode = flags.mode.kind === "content" ? flags.mode : {
+      allowStale: false,
+      rebaseOntoHead: false,
+      overrideStale: null,
+      allowUnguarded: false
+    };
     return runModelADeploy({
       cwd,
       manifestPath,
@@ -7607,9 +7685,14 @@ async function runDeploy(args, io) {
       io,
       allowStale: contentMode.allowStale,
       rebaseOntoHead: contentMode.rebaseOntoHead,
-      overrideStale: contentMode.overrideStale
+      overrideStale: contentMode.overrideStale,
+      allowUnguarded: contentMode.allowUnguarded
     });
   }
+  if (flags.mode.kind === "content" && flags.mode.allowUnguarded) {
+    io.err("launchpad deploy: --allow-unguarded requires launchpad.yaml (Model A); legacy content deploys do not support this override.");
+    return 64;
+  }
   const parsed = parseArgs3(args);
   if (parsed === null) {
     io.err("launchpad deploy: malformed argv (run with --help)");
@@ -7723,7 +7806,7 @@ async function runDeploy(args, io) {
   }
 }
 function deployUsage() {
-  return `usage: launchpad deploy [--message <text>] [--slug <slug>]
+  return `usage: launchpad deploy [--message <text>] [--slug <slug>] [--allow-unguarded]
 ` + `       (slug comes from launchpad.yaml at cwd when present — Model A —
 ` + "        else from the current directory's `launchpad-app-<slug>` suffix)\n" + `
 ` + `provisioning modes:
@@ -7851,8 +7934,9 @@ function surfaceStaleBlock(body, io) {
     io.err(`launchpad deploy: BLOCKED — main moved since you cloned and the overlap cannot be proven` + (body.reason === undefined ? "" : ` (${body.reason})`) + `; treating as unsafe.`);
   }
   io.err("");
-  io.err("       To recover (after reconciling the listed file(s) with main):");
-  io.err("         launchpad deploy --rebase-onto-head");
+  io.err("       To recover safely:");
+  io.err("         launchpad pull");
+  io.err("         launchpad deploy");
   if (head !== null) {
     io.err("       Or, to deliberately overwrite them in place:");
     io.err(`         launchpad deploy --override-stale ${head.slice(0, 8)}`);
@@ -7970,12 +8054,26 @@ async function runModelADeploy(args) {
   const deployBaseline = noVerify ? null : await readDeploymentBaseline(realCommitWaitDeps(cfg), slug);
   let result;
   try {
+    if (args.allowUnguarded) {
+      io.err("warning: --allow-unguarded disables clone staleness protection for this deploy.");
+    }
     result = await bundleAndDeploy({
       cwd,
       cfg,
       slug,
-      overrideStale: args.overrideStale
+      overrideStale: args.overrideStale,
+      allowUnguarded: args.allowUnguarded
     });
+    if (result.kind === "upload-error" && result.status === 409 && result.body.error === "main_advanced") {
+      io.out("Managed main advanced during validation; recomputing and retrying once ...");
+      result = await bundleAndDeploy({
+        cwd,
+        cfg,
+        slug,
+        overrideStale: args.overrideStale,
+        allowUnguarded: args.allowUnguarded
+      });
+    }
     if (args.rebaseOntoHead && result.kind === "upload-error" && result.status === 409 && isStaleBlock(result.body)) {
       const head = result.body.head_sha;
       if (typeof head === "string" && isValidBaseSha(head)) {
@@ -7983,7 +8081,7 @@ async function runModelADeploy(args) {
         io.out(`Re-stamped base revision to current head ${head.slice(0, 12)}; retrying deploy …`);
         result = await bundleAndDeploy({ cwd, cfg, slug });
       } else {
-        io.err("launchpad deploy: --rebase-onto-head could not read a head SHA from the block; re-clone the app instead.");
+        io.err("launchpad deploy: --rebase-onto-head could not read a head SHA from the block; run `launchpad pull` and retry.");
         return 1;
       }
     }
@@ -8034,6 +8132,12 @@ async function runModelADeploy(args) {
         surfaceStaleBlock(body, io);
         return 1;
       }
+      if (result.status === 409 && errorCode === "untrusted_base") {
+        io.err("launchpad deploy: this working tree has no trusted source baseline.");
+        io.err("       Run `launchpad pull --bootstrap` to establish provenance for an unchanged legacy clone,");
+        io.err("       use a fresh Launchpad clone, or pass --allow-unguarded only for an intentional non-clone deploy.");
+        return 1;
+      }
       if (result.status === 409 && errorCode === "access_drift") {
         return handleAccessDrift({
           slug,
@@ -9950,16 +10054,16 @@ function buildManifest(inputs, detected) {
     metadata.description = inputs.description;
   }
   const deployment = { type: inputs.type };
-  const access2 = inputs.groups.length === 1 ? { allowed_entra_group: inputs.groups[0] } : { allowed_entra_groups: [...inputs.groups] };
+  const access = inputs.groups.length === 1 ? { allowed_entra_group: inputs.groups[0] } : { allowed_entra_groups: [...inputs.groups] };
   if (inputs.sessionDuration !== undefined && inputs.sessionDuration !== "") {
-    access2.session_duration = inputs.sessionDuration;
+    access.session_duration = inputs.sessionDuration;
   }
   const manifest = {
     apiVersion: "launchpad.m-kopa.us/v1alpha1",
     kind: "App",
     metadata,
     deployment,
-    access: access2
+    access
   };
   const resolvedAuth = inputs.auth ?? (inputs.type === "container" ? "access" : "gateway");
   if (resolvedAuth === "gateway") {
@@ -11007,10 +11111,474 @@ async function fetchManifestStatus(cfg, slug, fetcher = fetch) {
   return apiJson(cfg, { path: path12 }, fetcher);
 }
 
+// src/pull/source-sync.ts
+import * as fs6 from "node:fs/promises";
+import * as path12 from "node:path";
+import { constants as fsConstants } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { execFile } from "node:child_process";
+var CONFLICT_REPORT = `${MARKER_DIR}/pull-conflicts.json`;
+var CONFLICT_DIR = `${MARKER_DIR}/pull-conflicts`;
+var DELETE_NOTE = new TextEncoder().encode(`Upstream deleted this file.
+`);
+var UNSUPPORTED_NOTE = new TextEncoder().encode(`Upstream or baseline uses a Git entry type that launchpad pull cannot reconcile.
+`);
+async function runSourceSync(args) {
+  await assertSafeCloneRoot(args.cwd);
+  const marker = await readBaseShaMarkerState(args.cwd);
+  if (marker.kind !== "valid") {
+    if (args.bootstrap === true)
+      return bootstrapProvenance(args);
+    args.io.err(`launchpad pull: this directory has ${marker.kind} source provenance and cannot be reconciled safely.`);
+    args.io.err("  Preserve this directory, then clone the app into a separate empty parent directory to recover a trusted baseline.");
+    return 1;
+  }
+  const compare = await apiJson(args.cfg, {
+    path: `/apps/${args.slug}/source/compare?base=${marker.sha}`
+  });
+  if (compare.baseSha !== marker.sha) {
+    throw new Error("source compare returned a different base SHA");
+  }
+  const paths = [
+    ...new Set([
+      ...compare.changed,
+      ...compare.deleted,
+      ...compare.unsupported ?? []
+    ])
+  ].sort();
+  if (paths.length === 0) {
+    await cleanupConflictState(args.cwd);
+    await writeBaseShaMarker(args.cwd, compare.headSha);
+    args.io.out(`Already current at ${compare.headSha.slice(0, 12)}.`);
+    return 0;
+  }
+  const stageRoot = path12.resolve(args.cwd, MARKER_DIR, `pull-stage-${process.pid}-${crypto.randomUUID()}`);
+  const baseDir = path12.join(stageRoot, "base");
+  const headDir = path12.join(stageRoot, "head");
+  await fs6.mkdir(baseDir, { recursive: true });
+  await fs6.mkdir(headDir, { recursive: true });
+  try {
+    await Promise.all([
+      fetchSnapshot(args.cfg, args.slug, compare.baseSha, baseDir),
+      fetchSnapshot(args.cfg, args.slug, compare.headSha, headDir)
+    ]);
+    return await reconcile({ ...args, compare, paths, baseDir, headDir });
+  } finally {
+    await fs6.rm(stageRoot, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+  }
+}
+async function fetchSnapshot(cfg, slug, sha, destination) {
+  await fetchSnapshotRef(cfg, slug, sha, destination, sha);
+}
+async function fetchSnapshotRef(cfg, slug, ref, destination, expectedSha) {
+  const response = await apiRaw(cfg, {
+    path: `/apps/${slug}/source-bundle?at=${ref}`
+  });
+  const pinnedSha = response.headers.get(BASE_SHA_HEADER);
+  if (pinnedSha === null || !/^[0-9a-f]{40}$/.test(pinnedSha) || expectedSha !== undefined && pinnedSha !== expectedSha || response.body === null) {
+    throw new Error(`source snapshot provenance mismatch at ${ref}`);
+  }
+  await extractToDir(response.body, destination, {
+    stripComponents: 1,
+    allowNonEmpty: true
+  });
+  return pinnedSha;
+}
+async function bootstrapProvenance(args) {
+  let status;
+  let tracked;
+  try {
+    status = await gitOutput(args.cwd, [
+      "status",
+      "--porcelain=v1",
+      "-z",
+      "--untracked-files=all"
+    ]);
+    tracked = splitNull(await gitOutput(args.cwd, ["ls-files", "-z"]));
+  } catch {
+    args.io.err("launchpad pull: --bootstrap requires a legacy Launchpad clone with its synthetic Git baseline.");
+    return 1;
+  }
+  if (status.length > 0) {
+    args.io.err("launchpad pull: --bootstrap refused because the legacy clone has local changes or untracked files.");
+    args.io.err("  Preserve this directory and obtain a separate current clone for comparison.");
+    return 1;
+  }
+  const stageRoot = path12.resolve(args.cwd, MARKER_DIR, `pull-bootstrap-${process.pid}-${crypto.randomUUID()}`);
+  await fs6.mkdir(stageRoot, { recursive: true });
+  try {
+    const headSha = await fetchSnapshotRef(args.cfg, args.slug, "main", stageRoot);
+    const headPaths = await listFiles(stageRoot);
+    if (!await treesEqual(args.cwd, tracked, stageRoot, headPaths)) {
+      args.io.err("launchpad pull: --bootstrap could not prove this legacy baseline matches current managed main.");
+      args.io.err("  The directory was not changed. Preserve it and obtain a separate current clone.");
+      return 1;
+    }
+    await writeBaseShaMarker(args.cwd, headSha);
+    args.io.out(`Trusted source provenance established at ${headSha.slice(0, 12)}.`);
+    return 0;
+  } finally {
+    await fs6.rm(stageRoot, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+  }
+}
+async function treesEqual(cwd, tracked, headDir, headPaths) {
+  if (tracked.length !== headPaths.length)
+    return false;
+  const expected = new Set(headPaths);
+  for (const relative5 of tracked) {
+    if (!expected.has(relative5))
+      return false;
+    if (!equal(await readEntry(path12.resolve(cwd, relative5)), await readEntry(path12.resolve(headDir, relative5)))) {
+      return false;
+    }
+  }
+  return true;
+}
+async function listFiles(root, relative5 = "") {
+  const files = [];
+  const entries = await fs6.readdir(path12.resolve(root, relative5), {
+    withFileTypes: true
+  });
+  for (const entry of entries) {
+    const child = relative5.length === 0 ? entry.name : `${relative5}/${entry.name}`;
+    if (entry.isDirectory())
+      files.push(...await listFiles(root, child));
+    else if (entry.isFile())
+      files.push(child);
+  }
+  return files.sort();
+}
+function gitOutput(cwd, args) {
+  return new Promise((resolve12, reject) => {
+    execFile("git", [...args], { cwd, encoding: "utf8" }, (error, stdout) => {
+      if (error !== null)
+        reject(error);
+      else
+        resolve12(stdout);
+    });
+  });
+}
+function splitNull(value) {
+  return value.split("\x00").filter((entry) => entry.length > 0).sort();
+}
+async function reconcile(args) {
+  const removals = await cleanAncestorRemovals(args);
+  const planned = await Promise.all(args.paths.map((relative5) => planPath(args, relative5, removals)));
+  const conflicts = planned.flatMap((entry) => entry.conflict === undefined ? [] : [entry.conflict]);
+  if (conflicts.length > 0) {
+    const report = {
+      version: 1,
+      slug: args.slug,
+      baseSha: args.compare.baseSha,
+      headSha: args.compare.headSha,
+      conflicts
+    };
+    await writeJsonAtomic(args.cwd, CONFLICT_REPORT, report);
+    await resetConflictArtifacts(args.cwd);
+    for (const entry of planned) {
+      if (entry.conflict !== undefined) {
+        await writeConflictArtifact(args.cwd, entry);
+      }
+    }
+  }
+  let applied = 0;
+  for (const entry of planned) {
+    if (!entry.apply)
+      continue;
+    await applyUpstream(args.cwd, entry);
+    applied += 1;
+  }
+  if (conflicts.length > 0) {
+    args.io.err(`launchpad pull: ${conflicts.length} conflict(s); ${applied} clean upstream change(s) applied.`);
+    for (const conflict of conflicts.slice(0, 20)) {
+      args.io.err(`  - ${conflict.path}: ${conflict.reason}`);
+      args.io.err(`    upstream copy: ${conflict.artifact}`);
+    }
+    if (conflicts.length > 20) {
+      args.io.err(`  ... and ${conflicts.length - 20} more in ${CONFLICT_REPORT}`);
+    }
+    args.io.err("Resolve each original path using its upstream artifact, then run `launchpad pull` again.");
+    return 1;
+  }
+  await cleanupConflictState(args.cwd);
+  await writeBaseShaMarker(args.cwd, args.compare.headSha);
+  args.io.out(`Updated ${applied} path(s) to managed main ${args.compare.headSha.slice(0, 12)}; local-only work was preserved.`);
+  return 0;
+}
+async function cleanAncestorRemovals(args) {
+  const removals = new Set;
+  for (const relative5 of args.compare.deleted) {
+    assertSafePath(relative5);
+    const checked = await checkParents(args.cwd, relative5, removals);
+    if (checked.kind === "blocked")
+      continue;
+    const base = await readEntry(path12.resolve(args.baseDir, relative5));
+    const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
+    if (local.kind !== "missing" && cleanLocal(base, local))
+      removals.add(relative5);
+  }
+  return removals;
+}
+async function planPath(args, relative5, removals) {
+  assertSafePath(relative5);
+  const checked = await checkParents(args.cwd, relative5, removals);
+  const base = await readEntry(path12.resolve(args.baseDir, relative5));
+  const upstreamDeleted = args.compare.deleted.includes(relative5);
+  const head = upstreamDeleted ? { kind: "missing" } : await readEntry(path12.resolve(args.headDir, relative5));
+  const unsupported = (args.compare.unsupported ?? []).includes(relative5);
+  if (checked.kind === "blocked") {
+    return conflictPlan(relative5, checked.target, { kind: "missing" }, head, upstreamDeleted, checked.reason);
+  }
+  const local = checked.projectedMissing ? { kind: "missing" } : await readEntry(checked.target);
+  if (unsupported) {
+    return conflictPlan(relative5, checked.target, local, head, false, "upstream or baseline path uses an unsupported Git entry type");
+  }
+  if (alreadyResolved(local, head, upstreamDeleted)) {
+    return { relative: relative5, target: checked.target, local, head, upstreamDeleted, apply: false };
+  }
+  if (unsupportedHead(head, upstreamDeleted)) {
+    return conflictPlan(relative5, checked.target, local, head, true, "unsupported upstream file type");
+  }
+  if (cleanLocal(base, local)) {
+    return { relative: relative5, target: checked.target, local, head, upstreamDeleted, apply: true };
+  }
+  return conflictPlan(relative5, checked.target, local, head, upstreamDeleted, conflictReason(base, local, upstreamDeleted));
+}
+function conflictPlan(relative5, target, local, head, upstreamDeleted, reason) {
+  const suffix = upstreamDeleted ? ".upstream-deleted" : ".upstream";
+  const digest = createHash3("sha256").update(relative5).digest("hex");
+  return {
+    relative: relative5,
+    target,
+    local,
+    head,
+    upstreamDeleted,
+    apply: false,
+    conflict: {
+      path: relative5,
+      reason,
+      artifact: `${CONFLICT_DIR}/${digest}${suffix}`,
+      upstreamDeleted
+    }
+  };
+}
+function alreadyResolved(local, head, upstreamDeleted) {
+  return equal(local, head) || upstreamDeleted && local.kind === "missing";
+}
+function unsupportedHead(head, upstreamDeleted) {
+  return head.kind === "other" || !upstreamDeleted && head.kind === "missing";
+}
+function cleanLocal(base, local) {
+  return equal(local, base) || base.kind === "missing" && local.kind === "missing";
+}
+async function applyUpstream(cwd, entry) {
+  const checked = await checkParents(cwd, entry.relative, new Set);
+  if (checked.kind === "blocked")
+    throw new Error(checked.reason);
+  if (entry.upstreamDeleted) {
+    if (entry.local.kind !== "missing")
+      await fs6.unlink(checked.target);
+    return;
+  }
+  if (entry.head.kind === "file") {
+    await writeAtomic(cwd, entry.relative, entry.head.bytes, entry.head.mode);
+  }
+}
+function conflictReason(base, local, upstreamDeleted) {
+  if (local.kind === "other")
+    return "local path is not a regular file";
+  if (base.kind === "missing")
+    return "local untracked file collides with an upstream addition";
+  if (local.kind === "missing")
+    return "local deletion conflicts with an upstream change";
+  if (upstreamDeleted)
+    return "locally modified file was deleted upstream";
+  return "local and upstream changes differ";
+}
+async function writeConflictArtifact(cwd, entry) {
+  if (entry.conflict === undefined)
+    return;
+  const bytes = entry.head.kind === "file" ? entry.head.bytes : entry.upstreamDeleted ? DELETE_NOTE : UNSUPPORTED_NOTE;
+  await writeAtomic(cwd, entry.conflict.artifact, bytes, entry.head.kind === "file" ? entry.head.mode : 420, true);
+}
+async function readEntry(file) {
+  const initial = await lstatIfPresent(file);
+  if (initial === null)
+    return { kind: "missing" };
+  if (!initial.isFile() || initial.isSymbolicLink())
+    return { kind: "other" };
+  const opened = await openWithoutFollowing(file);
+  if (opened.kind !== "open")
+    return opened;
+  try {
+    const stat = await opened.handle.stat();
+    if (!stat.isFile())
+      return { kind: "other" };
+    return {
+      kind: "file",
+      bytes: new Uint8Array(await opened.handle.readFile()),
+      mode: stat.mode & 511
+    };
+  } finally {
+    await opened.handle.close();
+  }
+}
+async function lstatIfPresent(file) {
+  try {
+    return await fs6.lstat(file);
+  } catch (error) {
+    if (isErrno6(error) && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function openWithoutFollowing(file) {
+  try {
+    return {
+      kind: "open",
+      handle: await fs6.open(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW)
+    };
+  } catch (error) {
+    if (isErrno6(error) && error.code === "ENOENT")
+      return { kind: "missing" };
+    if (isErrno6(error) && error.code === "ELOOP")
+      return { kind: "other" };
+    throw error;
+  }
+}
+function equal(left, right) {
+  if (left.kind !== right.kind)
+    return false;
+  if (left.kind !== "file" || right.kind !== "file")
+    return true;
+  if (left.mode !== right.mode || left.bytes.length !== right.bytes.length)
+    return false;
+  return left.bytes.every((byte, index) => byte === right.bytes[index]);
+}
+async function writeAtomic(cwd, relative5, bytes, mode, allowMetadata = false) {
+  const checked = await checkParents(cwd, relative5, new Set, allowMetadata);
+  if (checked.kind === "blocked")
+    throw new Error(checked.reason);
+  const file = checked.target;
+  await fs6.mkdir(path12.dirname(file), { recursive: true });
+  const rechecked = await checkParents(cwd, relative5, new Set, allowMetadata);
+  if (rechecked.kind === "blocked")
+    throw new Error(rechecked.reason);
+  const temporary = `${file}.launchpad-tmp-${process.pid}-${crypto.randomUUID()}`;
+  try {
+    await fs6.writeFile(temporary, bytes, { mode });
+    await fs6.chmod(temporary, mode);
+    await fs6.rename(temporary, file);
+  } catch (error) {
+    await fs6.rm(temporary, { force: true }).catch(() => {
+      return;
+    });
+    throw error;
+  }
+}
+async function writeJsonAtomic(cwd, relative5, value) {
+  await writeAtomic(cwd, relative5, new TextEncoder().encode(`${JSON.stringify(value, null, 2)}
+`), 384, true);
+}
+async function resetConflictArtifacts(cwd) {
+  const checked = await checkParents(cwd, CONFLICT_DIR, new Set, true);
+  if (checked.kind === "blocked")
+    throw new Error(checked.reason);
+  await fs6.rm(checked.target, { recursive: true, force: true });
+}
+async function cleanupConflictState(cwd) {
+  await resetConflictArtifacts(cwd);
+  const report = await checkParents(cwd, CONFLICT_REPORT, new Set, true);
+  if (report.kind === "blocked")
+    throw new Error(report.reason);
+  await fs6.rm(report.target, { force: true });
+}
+function assertSafePath(relative5) {
+  if (!isSafeSourcePath(relative5)) {
+    throw new Error(`unsafe source path returned by bot: ${relative5}`);
+  }
+}
+function isSafeSourcePath(relative5) {
+  return isSafeRelativePath(relative5) && !relative5.startsWith(`${MARKER_DIR}/`);
+}
+function isSafeRelativePath(relative5) {
+  const normalized = path12.posix.normalize(relative5);
+  return relative5.length > 0 && !relative5.includes("\\") && !path12.isAbsolute(relative5) && normalized === relative5 && normalized !== ".." && !normalized.startsWith("../");
+}
+function resolveInsideClone(cwd, relative5) {
+  const root = path12.resolve(cwd);
+  const target = path12.resolve(root, relative5);
+  const fromRoot = path12.relative(root, target);
+  if (fromRoot.length === 0 || path12.isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${path12.sep}`)) {
+    throw new Error(`unsafe source path returned by bot: ${relative5}`);
+  }
+  return target;
+}
+async function checkParents(cwd, relative5, projectedRemovals, allowMetadata = false) {
+  if (allowMetadata) {
+    if (!isSafeRelativePath(relative5)) {
+      throw new Error(`unsafe metadata path: ${relative5}`);
+    }
+  } else {
+    assertSafePath(relative5);
+  }
+  const target = resolveInsideClone(cwd, relative5);
+  const components = relative5.split("/");
+  let current = path12.resolve(cwd);
+  for (let index = 0;index < components.length - 1; index += 1) {
+    current = path12.join(current, components[index]);
+    const ancestor = components.slice(0, index + 1).join("/");
+    const stat = await lstatIfPresent(current);
+    if (stat === null)
+      return { kind: "safe", target, projectedMissing: true };
+    if (projectedRemovals.has(ancestor)) {
+      return { kind: "safe", target, projectedMissing: true };
+    }
+    if (stat.isSymbolicLink()) {
+      return {
+        kind: "blocked",
+        target,
+        reason: `local parent is a symbolic link: ${ancestor}`
+      };
+    }
+    if (!stat.isDirectory()) {
+      return {
+        kind: "blocked",
+        target,
+        reason: `local parent is not a directory: ${ancestor}`
+      };
+    }
+  }
+  return { kind: "safe", target, projectedMissing: false };
+}
+async function assertSafeCloneRoot(cwd) {
+  const root = await fs6.lstat(path12.resolve(cwd));
+  if (!root.isDirectory() || root.isSymbolicLink()) {
+    throw new Error("launchpad pull requires a real clone directory");
+  }
+  try {
+    const metadata = await fs6.lstat(path12.resolve(cwd, MARKER_DIR));
+    if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+      throw new Error("launchpad pull refuses a non-directory or symlinked .launchpad path");
+    }
+  } catch (error) {
+    if (!isErrno6(error) || error.code !== "ENOENT")
+      throw error;
+  }
+}
+function isErrno6(error) {
+  return error instanceof Error && "code" in error;
+}
+
 // src/commands/pull.ts
 var pullCommand = {
   name: "pull",
-  summary: "read the deployed launchpad.yaml for an app",
+  summary: "sync upstream source into a clone without overwriting local work",
   run: runPull
 };
 var SLUG_RE11 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -11023,6 +11591,15 @@ async function runPull(args, io) {
   }
   try {
     const cfg = loadConfig();
+    if (!parsed.manifest) {
+      return await runSourceSync({
+        cfg,
+        cwd: process.cwd(),
+        slug: parsed.slug,
+        io,
+        bootstrap: parsed.bootstrap
+      });
+    }
     if (parsed.status) {
       const noStatusMsg = `launchpad pull: no status block deployed for "${parsed.slug}" yet — ` + `the bot writes it after the first apply.`;
       let res;
@@ -11105,6 +11682,8 @@ function parseArgs10(args, cwd = process.cwd(), warn) {
   let slug = null;
   let out = null;
   let status = false;
+  let manifest = false;
+  let bootstrap = false;
   let i = 0;
   while (i < args.length) {
     const a = args[i] ?? "";
@@ -11113,6 +11692,16 @@ function parseArgs10(args, cwd = process.cwd(), warn) {
       i += 1;
       continue;
     }
+    if (a === "--manifest") {
+      manifest = true;
+      i += 1;
+      continue;
+    }
+    if (a === "--bootstrap") {
+      bootstrap = true;
+      i += 1;
+      continue;
+    }
     if (a === "--slug") {
       const v = args[i + 1];
       if (v === undefined)
@@ -11151,23 +11740,38 @@ function parseArgs10(args, cwd = process.cwd(), warn) {
   if (!SLUG_RE11.test(slug)) {
     return `invalid slug "${slug}" — expected ${SLUG_RE11.source}`;
   }
-  return { slug, out, status };
+  const modeError = validateModeFlags({ manifest, status, out, bootstrap });
+  if (modeError !== null)
+    return modeError;
+  return { slug, out, status, manifest, bootstrap };
+}
+function validateModeFlags(args) {
+  if (!args.manifest && args.status)
+    return "--status requires --manifest";
+  if (!args.manifest && args.out !== null)
+    return "--out requires --manifest";
+  if (args.manifest && args.bootstrap) {
+    return "--bootstrap cannot be combined with --manifest";
+  }
+  return null;
 }
 function printUsage5(io) {
   io.err([
-    "usage: launchpad pull [<slug>] [--slug <slug>] [--out <path>] [--status]",
+    "usage: launchpad pull [<slug>] [--slug <slug>] [--bootstrap]",
+    "       launchpad pull --manifest [<slug>] [--out <path>] [--status]",
     "",
-    "       Reads the deployed launchpad.yaml for an app via the bot.",
-    "       No local platform-repo or terraform required.",
+    "       By default, safely syncs managed source into the current clone.",
+    "       --manifest keeps the previous deployed-manifest read behavior.",
     "",
     "       With no slug, it is inferred from the local launchpad.yaml's",
     "       declared slug first, then from a launchpad-app-<slug>/",
     "       directory name. Explicit --slug or positional override.",
     "",
-    "       --status   read the role-redacted status block (what your",
+    "       --status   with --manifest, read the role-redacted status block",
+    "                  (what your",
     "                  role may see) instead of the spec manifest.",
     "",
-    "       Without --out, the output is written to stdout."
+    "       In manifest mode, omitting --out writes YAML to stdout."
   ].join(`
 `));
 }
@@ -11436,7 +12040,7 @@ var watchCommand = {
 };
 
 // src/commands/review.ts
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 var reviewCommand = {
   name: "review",
   summary: "show the review state for a PR (slug-scoped)",
@@ -11456,7 +12060,7 @@ async function runReview(args, io) {
   } else {
     const inferred = inferSlug({ cwd: process.cwd(), warn: (l) => io.err(l) });
     if (inferred === null) {
-      io.err(`launchpad review: could not infer slug from cwd (${path12.basename(process.cwd())});
+      io.err(`launchpad review: could not infer slug from cwd (${path13.basename(process.cwd())});
 ` + `       pass --slug <slug>, or cd into a directory named launchpad-app-<slug>.`);
       return 64;
     }
@@ -11713,16 +12317,16 @@ async function runRollback(opts, io, deps = {}) {
     yes: true
   }, io, applyDeps);
 }
-function readCurrentManifest(path13) {
-  if (!existsSync10(path13))
+function readCurrentManifest(path14) {
+  if (!existsSync10(path14))
     return null;
   let raw;
   try {
-    raw = readFileSync15(path13, "utf8");
+    raw = readFileSync15(path14, "utf8");
   } catch {
     return null;
   }
-  const parsed = parseManifest2(raw, path13);
+  const parsed = parseManifest2(raw, path14);
   if (parsed.kind !== "ok")
     return null;
   return summarise(parsed.manifest);
@@ -12272,23 +12876,23 @@ var CELL_LABEL2 = {
   not_deployed: "NOT_DEPLOYED"
 };
 function loadSet(fleetFile, setName, io) {
-  const path13 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
-  if (!existsSync12(path13)) {
-    io.err(`✗ ${path13}`);
+  const path14 = resolvePath6(process.cwd(), fleetFile ?? "fleet-secret-sets.yaml");
+  if (!existsSync12(path14)) {
+    io.err(`✗ ${path14}`);
     io.err("  fleet-secret-sets.yaml not found. Run from the platform repo root or pass --fleet-file.");
     return 2;
   }
   let obj;
   try {
-    obj = parseYaml8(readFileSync17(path13, "utf8"));
+    obj = parseYaml8(readFileSync17(path14, "utf8"));
   } catch (e) {
-    io.err(`✗ ${path13}`);
+    io.err(`✗ ${path14}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
   const parsed = parseFleetSecretSets(obj);
   if (!parsed.ok) {
-    io.err(`✗ ${path13}`);
+    io.err(`✗ ${path14}`);
     io.err(`  ${parsed.issues.length} schema issue(s):`);
     for (const i of parsed.issues)
       io.err(`    ${i.path}: ${i.message}`);
@@ -12297,7 +12901,7 @@ function loadSet(fleetFile, setName, io) {
   const set = parsed.manifest.secretSets.find((s) => s.name === setName);
   if (set === undefined) {
     const names = parsed.manifest.secretSets.map((s) => s.name).join(", ");
-    io.err(`✗ secret-set "${setName}" not found in ${path13}`);
+    io.err(`✗ secret-set "${setName}" not found in ${path14}`);
     io.err(`  declared sets: ${names}`);
     return 1;
   }
@@ -12517,7 +13121,7 @@ function setPushExit(e) {
 
 // src/commands/secrets-template.ts
 import { existsSync as existsSync13, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 async function runSecretsTemplate(args, io) {
   const flags = parseFlags4(args);
   if (flags.kind === "usage-error") {
@@ -12525,7 +13129,7 @@ async function runSecretsTemplate(args, io) {
     io.err("Usage: launchpad secrets template [--file <path>] [--out <path>] " + "[--stdout] [--force] [--include-platform-managed]");
     return 64;
   }
-  const manifestPath = resolve11(process.cwd(), flags.file ?? "launchpad.yaml");
+  const manifestPath = resolve12(process.cwd(), flags.file ?? "launchpad.yaml");
   const result = loadManifest(manifestPath);
   const renderResult = renderManifest(result, io);
   if (renderResult.kind !== "ok") {
@@ -12539,7 +13143,7 @@ async function runSecretsTemplate(args, io) {
     }
     return 0;
   }
-  const outPath = resolve11(process.cwd(), flags.out);
+  const outPath = resolve12(process.cwd(), flags.out);
   if (existsSync13(outPath) && !flags.force) {
     io.err(`launchpad secrets template: ${outPath} already exists`);
     io.err("Pass --force to overwrite, or --stdout to print without writing.");
@@ -12836,16 +13440,16 @@ function printHelp3(io) {
 
 // src/commands/skills.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname8, join as join14, resolve as resolve12 } from "node:path";
-import { promises as fs6, existsSync as existsSync14 } from "node:fs";
+import { dirname as dirname9, join as join15, resolve as resolve13 } from "node:path";
+import { promises as fs7, existsSync as existsSync14 } from "node:fs";
 
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 import { readFileSync as readFileSync18, readdirSync as readdirSync2 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
-  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join13(homedir2(), ".claude", "skills");
+  return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join14(homedir2(), ".claude", "skills");
 }
 function readInstalledSkills() {
   try {
@@ -12855,15 +13459,15 @@ function readInstalledSkills() {
       return { present: false, version: null };
     return {
       present: true,
-      version: readSkillVersion(join13(dir, bundle.name, "SKILL.md"))
+      version: readSkillVersion(join14(dir, bundle.name, "SKILL.md"))
     };
   } catch {
     return { present: false, version: null };
   }
 }
-function readSkillVersion(path13) {
+function readSkillVersion(path14) {
   try {
-    const text = readFileSync18(path13, "utf8");
+    const text = readFileSync18(path14, "utf8");
     const fenceEnd = text.indexOf(`
 ---`, 4);
     const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
@@ -12940,13 +13544,13 @@ function resolveInstallEnv() {
   return { bundleDir, userSkillsDir };
 }
 function defaultBundleDir() {
-  const here = dirname8(fileURLToPath(import.meta.url));
+  const here = dirname9(fileURLToPath(import.meta.url));
   const candidates = [
-    resolve12(here, "..", "skills"),
-    resolve12(here, "..", "..", "skills")
+    resolve13(here, "..", "skills"),
+    resolve13(here, "..", "..", "skills")
   ];
   for (const c of candidates) {
-    if (existsSync14(join14(c, "launchpad-onboard", "SKILL.md"))) {
+    if (existsSync14(join15(c, "launchpad-onboard", "SKILL.md"))) {
       return c;
     }
   }
@@ -12962,19 +13566,19 @@ async function doInstall(io) {
     return 1;
   }
   if (!await isDir(env.userSkillsDir)) {
-    await fs6.mkdir(env.userSkillsDir, { recursive: true });
+    await fs7.mkdir(env.userSkillsDir, { recursive: true });
     io.out(`Created ${env.userSkillsDir}.`);
   }
   let installed = 0;
   for (const skill of BUNDLED_SKILLS) {
-    const src = join14(env.bundleDir, skill);
+    const src = join15(env.bundleDir, skill);
     if (!await isDir(src)) {
       io.err(`launchpad skills install: bundled skill "${skill}" missing from ${env.bundleDir} — package is incomplete.`);
       return 1;
     }
-    const dest = join14(env.userSkillsDir, skill);
-    await fs6.rm(dest, { recursive: true, force: true });
-    await fs6.cp(src, dest, { recursive: true });
+    const dest = join15(env.userSkillsDir, skill);
+    await fs7.rm(dest, { recursive: true, force: true });
+    await fs7.cp(src, dest, { recursive: true });
     installed++;
     io.out(`✓ ${skill} → ${dest}`);
   }
@@ -12990,15 +13594,15 @@ async function doUninstall(io) {
     io.out(`launchpad skills uninstall: ${env.userSkillsDir} does not exist — nothing to do.`);
     return 0;
   }
-  const entries = await fs6.readdir(env.userSkillsDir, { withFileTypes: true });
+  const entries = await fs7.readdir(env.userSkillsDir, { withFileTypes: true });
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
     if (!isBundleManaged(entry.name))
       continue;
-    const target = join14(env.userSkillsDir, entry.name);
-    await fs6.rm(target, { recursive: true, force: true });
+    const target = join15(env.userSkillsDir, entry.name);
+    await fs7.rm(target, { recursive: true, force: true });
     removed++;
     io.out(`✗ removed ${target}`);
   }
@@ -13012,7 +13616,7 @@ async function doList(io) {
     io.out("(none — ~/.claude/skills/ does not exist)");
     return 0;
   }
-  const entries = await fs6.readdir(env.userSkillsDir, { withFileTypes: true });
+  const entries = await fs7.readdir(env.userSkillsDir, { withFileTypes: true });
   const managedDirs = entries.filter((e) => e.isDirectory() && isBundleManaged(e.name)).map((e) => e.name).sort();
   if (managedDirs.length === 0) {
     io.out("(none — run `launchpad skills install`)");
@@ -13020,16 +13624,16 @@ async function doList(io) {
   }
   const width = managedDirs.reduce((n, s) => Math.max(n, s.length), 0);
   for (const name of managedDirs) {
-    const skillFile = join14(env.userSkillsDir, name, "SKILL.md");
+    const skillFile = join15(env.userSkillsDir, name, "SKILL.md");
     const version = await readVersion(skillFile);
     io.out(`  ${name.padEnd(width + 2)}${version ?? "(no version)"}`);
   }
   return 0;
 }
-async function readVersion(path13) {
+async function readVersion(path14) {
   let text;
   try {
-    text = await fs6.readFile(path13, "utf8");
+    text = await fs7.readFile(path14, "utf8");
   } catch {
     return null;
   }
@@ -13039,9 +13643,9 @@ async function readVersion(path13) {
   const m = /^version:\s*(.+?)\s*$/m.exec(front);
   return m === null ? null : m[1] ?? null;
 }
-async function isDir(path13) {
+async function isDir(path14) {
   try {
-    const stat = await fs6.stat(path13);
+    const stat = await fs7.stat(path14);
     return stat.isDirectory();
   } catch {
     return false;
@@ -13052,16 +13656,16 @@ function describe29(e) {
 }
 
 // src/commands/update.ts
-import { execFile, spawn as spawn5 } from "node:child_process";
+import { execFile as execFile2, spawn as spawn5 } from "node:child_process";
 import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { dirname as dirname9, resolve as resolve13, relative as relative4, isAbsolute as isAbsolute2, join as join15 } from "node:path";
+import { dirname as dirname10, resolve as resolve14, relative as relative5, isAbsolute as isAbsolute3, join as join16 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
 import { readFileSync as readFileSync19, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
-import { createHash as createHash3, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash4, randomBytes as randomBytes5 } from "node:crypto";
 var CHANNEL_BASE = "https://get.launchpad.m-kopa.us";
 var CLI_AUTH_URL = `${CHANNEL_BASE}/__cli_auth`;
 var CLI_TOKEN_URL = `${CHANNEL_BASE}/__cli_token`;
@@ -13072,7 +13676,7 @@ function base64url(b) {
 }
 function pkcePair() {
   const verifier = base64url(randomBytes5(32));
-  const challenge = base64url(createHash3("sha256").update(verifier).digest());
+  const challenge = base64url(createHash4("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
 async function startLoopback(state, timeoutMs) {
@@ -13100,9 +13704,9 @@ async function startLoopback(state, timeoutMs) {
       resolveCode(code);
     }
   });
-  const bound = await new Promise((resolve13) => {
-    server.once("error", () => resolve13(false));
-    server.listen(0, "127.0.0.1", () => resolve13(true));
+  const bound = await new Promise((resolve14) => {
+    server.once("error", () => resolve14(false));
+    server.listen(0, "127.0.0.1", () => resolve14(true));
   });
   if (!bound)
     return null;
@@ -13173,12 +13777,12 @@ async function runChannelLoopbackUpdate(deps) {
 }
 
 // src/commands/update.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync = promisify(execFile2);
 var PKG = "@m-kopa/launchpad-cli";
 var REGISTRY = "https://registry.npmjs.org";
 var CHANNEL_VERSION_URL = "https://get.launchpad.m-kopa.us/version.json";
 var CHANNEL_INSTALL_URL = "https://get.launchpad.m-kopa.us";
-var CHANNEL_MARKER = join15(homedir3(), ".launchpad", "channel");
+var CHANNEL_MARKER = join16(homedir3(), ".launchpad", "channel");
 var EXIT_UPDATE_AVAILABLE = 10;
 var UPGRADE_ARGS = {
   npm: ["install", "-g", `${PKG}@latest`],
@@ -13307,8 +13911,8 @@ async function openSystemBrowser(url) {
   await execFileAsync(opener, [url]);
 }
 async function runInstallerScript(script) {
-  const dir = mkdtempSync(join15(tmpdir(), "launchpad-update-"));
-  const file = join15(dir, "install.sh");
+  const dir = mkdtempSync(join16(tmpdir(), "launchpad-update-"));
+  const file = join16(dir, "install.sh");
   try {
     writeFileSync7(file, script, { mode: 448 });
     return await new Promise((resolvePromise) => {
@@ -13395,7 +13999,7 @@ function errStderr(e) {
   return "";
 }
 async function detectPackageManager2() {
-  const pkgRoot = resolve13(dirname9(fileURLToPath2(import.meta.url)), "..", "..");
+  const pkgRoot = resolve14(dirname10(fileURLToPath2(import.meta.url)), "..", "..");
   const candidates = [];
   const npmRoot = await pmRoot("npm");
   if (npmRoot !== null)
@@ -13403,7 +14007,7 @@ async function detectPackageManager2() {
   const pnpmRoot = await pmRoot("pnpm");
   if (pnpmRoot !== null)
     candidates.push(["pnpm", pnpmRoot]);
-  candidates.push(["bun", resolve13(homedir3(), ".bun/install/global/node_modules")]);
+  candidates.push(["bun", resolve14(homedir3(), ".bun/install/global/node_modules")]);
   const matches = candidates.filter(([, root]) => pathContains(root, pkgRoot));
   return matches.length === 1 ? matches[0][0] : null;
 }
@@ -13417,8 +14021,8 @@ async function pmRoot(pm) {
   }
 }
 function pathContains(root, child) {
-  const rel = relative4(root, child);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+  const rel = relative5(root, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function runUpgrade(pm) {
   return new Promise((resolvePromise) => {
@@ -13541,7 +14145,7 @@ function printHelp5(io) {
 
 // src/commands/validate.ts
 import { existsSync as existsSync15, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname10, resolve as resolve14 } from "node:path";
+import { dirname as dirname11, resolve as resolve15 } from "node:path";
 var validateCommand = {
   name: "validate",
   summary: "validate launchpad.yaml against the v1alpha1 schema",
@@ -13555,13 +14159,13 @@ async function runValidate(args, io) {
     return 64;
   }
   const { file, json, strictGroups } = parseResult;
-  const path13 = resolve14(process.cwd(), file ?? "launchpad.yaml");
-  const result = loadManifest(path13);
+  const path14 = resolve15(process.cwd(), file ?? "launchpad.yaml");
+  const result = loadManifest(path14);
   if (result.kind !== "ok") {
     return json ? renderJsonError(result, io) : renderHumanError(result, io);
   }
-  const boundary = checkBoundary(path13, result.manifest.app !== undefined);
-  const serveErrors = checkStaticServeDir(path13, result.manifest);
+  const boundary = checkBoundary(path14, result.manifest.app !== undefined);
+  const serveErrors = checkStaticServeDir(path14, result.manifest);
   if (serveErrors.length > 0) {
     boundary.errors = [...boundary.errors, ...serveErrors];
   }
@@ -13569,7 +14173,7 @@ async function runValidate(args, io) {
   return json ? renderJsonOk(result, groupCheck, boundary, io) : renderHumanOk(result, groupCheck, boundary, io);
 }
 function checkBoundary(manifestPath, declared) {
-  const dir = dirname10(manifestPath);
+  const dir = dirname11(manifestPath);
   let files;
   try {
     files = walkCwd(dir).files;
@@ -13601,8 +14205,8 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app destination_dir '${serveDir}' is unsafe — use a confined relative subdirectory (e.g. '${STATIC_SERVE_DIR}'). ` + `Serving '.' or an absolute/parent path would publish files outside your app's content.`
     ];
   }
-  const dir = dirname10(manifestPath);
-  const abs = resolve14(dir, serveDir);
+  const dir = dirname11(manifestPath);
+  const abs = resolve15(dir, serveDir);
   if (!existsSync15(abs)) {
     return [
       `static app serves '${serveDir}/' but that directory does not exist — nothing would be served. ` + `Create ${serveDir}/index.html (or run \`launchpad init\` to scaffold it).`
@@ -13628,7 +14232,7 @@ function checkStaticServeDir(manifestPath, manifest) {
       `static app's served directory '${serveDir}/' is empty — the deploy would serve an empty site.`
     ];
   }
-  if (!existsSync15(resolve14(abs, "index.html"))) {
+  if (!existsSync15(resolve15(abs, "index.html"))) {
     return [
       `static app's served directory '${serveDir}/' has no index.html — the deploy would serve a directory with no entrypoint.`
     ];
@@ -14497,7 +15101,7 @@ var listOwnersCommand = makeListOwnersCommand();
 // src/update-notifier.ts
 import { spawn as spawn6 } from "node:child_process";
 import { homedir as homedir4 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import {
   existsSync as existsSync16,
   mkdirSync as mkdirSync4,
@@ -14507,7 +15111,7 @@ import {
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
-var CACHE_FILE = join16(homedir4(), ".launchpad", "update-check.json");
+var CACHE_FILE = join17(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
     const raw = JSON.parse(readFileSync21(CACHE_FILE, "utf8"));
@@ -14523,12 +15127,12 @@ function readCache2() {
 }
 function writeCache2(state) {
   try {
-    mkdirSync4(join16(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join17(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(CACHE_FILE, `${JSON.stringify(state)}
 `, { mode: 384 });
   } catch {}
 }
-var SKILLS_HINT_MARKER = join16(homedir4(), ".launchpad", "skills-hint-shown");
+var SKILLS_HINT_MARKER = join17(homedir4(), ".launchpad", "skills-hint-shown");
 function absentHintShown() {
   try {
     return existsSync16(SKILLS_HINT_MARKER);
@@ -14538,7 +15142,7 @@ function absentHintShown() {
 }
 function markAbsentHintShown() {
   try {
-    mkdirSync4(join16(homedir4(), ".launchpad"), { recursive: true });
+    mkdirSync4(join17(homedir4(), ".launchpad"), { recursive: true });
     writeFileSync8(SKILLS_HINT_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -14641,7 +15245,7 @@ var refreshUpdateCacheCommand = {
 // src/telemetry.ts
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
@@ -14650,8 +15254,8 @@ var POSTHOG_PROJECT_KEY = "phc_CYaCuETanWc36TMTiB7cdkdnmPPhFZCkDGmWGLaNkXnb";
 var CAPTURE_PATH = "/i/v0/e/";
 var SEND_TIMEOUT_MS = 3000;
 var APP = "launchpad-cli";
-var DEVICE_ID_FILE = join17(homedir5(), ".launchpad", "telemetry-id.json");
-var FIRST_RUN_MARKER = join17(homedir5(), ".launchpad", "telemetry-notice-shown");
+var DEVICE_ID_FILE = join18(homedir5(), ".launchpad", "telemetry-id.json");
+var FIRST_RUN_MARKER = join18(homedir5(), ".launchpad", "telemetry-notice-shown");
 function buildEvent(ctx, identity, nowMs) {
   const properties = {
     app: APP,
@@ -14725,7 +15329,7 @@ function getOrCreateDeviceId() {
   } catch {}
   const id = randomUUID();
   try {
-    mkdirSync5(join17(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join18(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(DEVICE_ID_FILE, `${JSON.stringify({ deviceId: id })}
 `, {
       mode: 384
@@ -14803,7 +15407,7 @@ function firstRunNoticeShown() {
 }
 function markFirstRunNotice() {
   try {
-    mkdirSync5(join17(homedir5(), ".launchpad"), { recursive: true });
+    mkdirSync5(join18(homedir5(), ".launchpad"), { recursive: true });
     writeFileSync9(FIRST_RUN_MARKER, `${Date.now()}
 `, { mode: 384 });
   } catch {}
@@ -14871,14 +15475,14 @@ import { platform } from "node:os";
 // src/report/breadcrumb.ts
 import { writeFileSync as writeFileSync10, readFileSync as readFileSync23, mkdirSync as mkdirSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join18, dirname as dirname11 } from "node:path";
+import { join as join19, dirname as dirname12 } from "node:path";
 function breadcrumbPath() {
-  return join18(homedir6(), ".launchpad", "last-run.json");
+  return join19(homedir6(), ".launchpad", "last-run.json");
 }
 function writeBreadcrumb(verb, exit) {
   try {
     const p = breadcrumbPath();
-    mkdirSync6(dirname11(p), { recursive: true });
+    mkdirSync6(dirname12(p), { recursive: true });
     writeFileSync10(p, JSON.stringify({ verb, exit, ts: Date.now() }), "utf8");
   } catch {}
 }