@m-kopa/launchpad-cli 0.55.0 → 0.56.0

package/dist/cli.js

@@ -19,9 +19,10 @@ var __toESM = (mod, isNodeMode, target) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/version.ts
-var CLI_VERSION = "0.55.0";
+var CLI_VERSION = "0.56.0";
 
 // src/config.ts
+import { readFileSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 var DEFAULT_BOT_URL = "https://launchpad-portal-bot.mkopa-launchpad.workers.dev";
@@ -39,6 +40,8 @@ function loadConfig(env = process.env) {
   const stateDir = env.LAUNCHPAD_STATE_DIR ?? path.join(os.homedir(), ".launchpad", "state");
   const rawPlatformRepo = env.LAUNCHPAD_PLATFORM_REPO;
   const platformRepoPath = rawPlatformRepo !== undefined && rawPlatformRepo.length > 0 ? path.resolve(rawPlatformRepo) : null;
+  const configPath = env.LAUNCHPAD_CONFIG_PATH ?? path.join(os.homedir(), ".launchpad", "config.json");
+  const statusPageAutoOpen = readStatusPageAutoOpen(configPath);
   return {
     botUrl,
     authGatewayUrl,
@@ -47,9 +50,18 @@ function loadConfig(env = process.env) {
     sessionPath,
     cacheDir,
     stateDir,
-    platformRepoPath
+    platformRepoPath,
+    statusPageAutoOpen
   };
 }
+function readStatusPageAutoOpen(configPath) {
+  try {
+    const value = JSON.parse(readFileSync(configPath, "utf8"));
+    return !(typeof value === "object" && value !== null && value.statusPageAutoOpen === false);
+  } catch (error) {
+    return error.code === "ENOENT";
+  }
+}
 
 // src/http/error-envelope.ts
 var MAX_TEXT_CHARS = 16384;
@@ -1874,7 +1886,7 @@ import { existsSync as existsSync7 } from "node:fs";
 import * as path8 from "node:path";
 
 // src/bundle/orchestrate.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { join as join7 } from "node:path";
 
 // src/deploy/tar-pack.ts
@@ -2186,7 +2198,8 @@ function deployBundleError(envelope, body) {
     ...paths === undefined ? {} : { paths },
     ...typeof body.reason === "string" ? { reason: body.reason } : {},
     ...typeof body.minimum === "string" ? { minimum: body.minimum } : {},
-    ...typeof body.yours === "string" ? { yours: body.yours } : {}
+    ...typeof body.yours === "string" ? { yours: body.yours } : {},
+    ...typeof body.statusPageUrl === "string" ? { statusPageUrl: body.statusPageUrl } : {}
   };
 }
 function readStringArray(value) {
@@ -2210,7 +2223,7 @@ function isRecord2(value) {
 }
 
 // src/bundle/cwd-walker.ts
-import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync as readFileSync2, readdirSync } from "node:fs";
 import { join as join4, relative as relative2, sep } from "node:path";
 var DEFAULT_IGNORE = [
   ".git",
@@ -2316,7 +2329,7 @@ function loadIgnore(cwd) {
   }
   let content;
   try {
-    content = readFileSync(file, "utf8");
+    content = readFileSync2(file, "utf8");
   } catch {
     return { matches: () => false };
   }
@@ -2390,7 +2403,7 @@ function globToRegExp(glob) {
 }
 
 // src/bundle/cron-bundle.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 import { dirname as dirname4, join as join5, resolve as resolve5 } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { build as esbuild } from "esbuild";
@@ -2470,7 +2483,7 @@ function locateWorkerConfig(cwd, walkFiles, script) {
     const abs = resolve5(cwd, rel);
     let text;
     try {
-      text = readFileSync2(abs, "utf8");
+      text = readFileSync3(abs, "utf8");
     } catch {
       continue;
     }
@@ -2549,7 +2562,7 @@ async function buildWorkerArtifact(cwd, manifestYaml, walkFiles) {
 }
 
 // src/bundle/boundary.ts
-import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync2, lstatSync as lstatSync2, readFileSync as readFileSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 import { parse as parseYaml2 } from "yaml";
 
@@ -4390,7 +4403,7 @@ function applyBoundaryToFiles(args) {
   const ignorePath = join6(cwd, ".launchpadignore");
   if (existsSync2(ignorePath)) {
     try {
-      launchpadIgnore = parseLaunchpadIgnore(readFileSync3(ignorePath, "utf8"));
+      launchpadIgnore = parseLaunchpadIgnore(readFileSync4(ignorePath, "utf8"));
     } catch {}
   }
   const result = applyAppBoundary(contract, files, {
@@ -4401,7 +4414,7 @@ function applyBoundaryToFiles(args) {
         const stat = lstatSync2(abs);
         if (!stat.isFile() || stat.size > MAX_CONTENT_PROBE_BYTES)
           return;
-        return readFileSync3(abs, "utf8");
+        return readFileSync4(abs, "utf8");
       } catch {
         return;
       }
@@ -4453,7 +4466,7 @@ async function bundleAndDeploy(args) {
   const manifestPath = join7(cwd, "launchpad.yaml");
   let manifestYaml;
   try {
-    manifestYaml = readFileSync4(manifestPath, "utf8");
+    manifestYaml = readFileSync5(manifestPath, "utf8");
   } catch (e) {
     return {
       kind: "no-manifest",
@@ -4515,7 +4528,7 @@ async function bundleAndDeploy(args) {
 }
 
 // src/deploy/verify-deploy.ts
-import { readFileSync as readFileSync8, existsSync as existsSync4 } from "node:fs";
+import { readFileSync as readFileSync9, existsSync as existsSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 
 // src/deploy/redact-diagnostic.ts
@@ -4760,7 +4773,7 @@ async function verifyServed(args, deps = { fetch }) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 
 // src/deploy/manifest-state.ts
 async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
@@ -4770,6 +4783,7 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
     slug: raw.slug,
     hasAppFile: raw.hasAppFile,
     lastAppliedManifestSha: raw.lastAppliedManifestSha,
+    deployedManifestSha: raw.deployedManifestSha ?? raw.lastAppliedManifestSha,
     appRepoHeadSha: raw.appRepoHeadSha ?? null,
     openPr: raw.openPr,
     enforcedGroups: raw.enforcedGroups ?? null,
@@ -4779,7 +4793,7 @@ async function fetchManifestState(cfg, slug, opts = {}, fetcher = fetch) {
 
 // src/commands/infer-slug.ts
 import * as path7 from "node:path";
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
 import { parse as parseYaml3 } from "yaml";
 var DIRNAME_RE = /^launchpad-app-([a-z0-9][a-z0-9-]*[a-z0-9])$/;
 function inferSlugFromCwd(cwd) {
@@ -4802,7 +4816,7 @@ function inferSlugFromManifestFile(manifestPath) {
   if (!existsSync3(manifestPath))
     return null;
   try {
-    return resolveManifestSlug(parseYaml3(readFileSync5(manifestPath, "utf8")));
+    return resolveManifestSlug(parseYaml3(readFileSync6(manifestPath, "utf8")));
   } catch {
     return null;
   }
@@ -4818,7 +4832,7 @@ function inferSlug(opts) {
 }
 
 // src/groups/client.ts
-import { mkdirSync, readFileSync as readFileSync6, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync as readFileSync7, writeFileSync } from "node:fs";
 import { dirname as dirname5, join as join8 } from "node:path";
 var CACHE_TTL_MS = 60 * 60 * 1000;
 var CACHE_FILENAME = "groups.json";
@@ -4862,7 +4876,7 @@ async function fetchGroups(cfg, opts = {}) {
 function readCache(path8) {
   let raw;
   try {
-    raw = readFileSync6(path8, "utf8");
+    raw = readFileSync7(path8, "utf8");
   } catch {
     return null;
   }
@@ -5498,9 +5512,10 @@ async function runWatch(slug, io, deps = {}) {
   const cfg = loadConfig();
   const now = deps.now ?? (() => Date.now());
   const stdout = deps.stdout ?? process.stdout;
+  const readLifecycle = deps.fetchLifecycle ?? (() => fetchLifecycleView(cfg, slug));
   let first;
   try {
-    first = await fetchLifecycleView(cfg, slug);
+    first = await readLifecycle();
   } catch (e) {
     return mapWatchError(e, slug, io);
   }
@@ -5508,6 +5523,9 @@ async function runWatch(slug, io, deps = {}) {
     io.err(`launchpad watch: no app "${slug}" to watch (unknown slug, or first deploy not started)`);
     return 1;
   }
+  if (first.statusPageUrl !== undefined) {
+    io.out(`Status page: ${first.statusPageUrl}`);
+  }
   if (first.state === "destroyed" || first.state === "destroying" || first.state === "destroy_failed") {
     io.out(`${slug}: ${first.state} — nothing to watch.`);
     return 0;
@@ -5534,7 +5552,7 @@ async function runWatch(slug, io, deps = {}) {
   };
   try {
     const res = await runWatchLoop(slug, {
-      fetchLifecycle: () => fetchLifecycleView(cfg, slug),
+      fetchLifecycle: readLifecycle,
       now,
       sleep: makeRealSleep(),
       signal: controller.signal,
@@ -5571,6 +5589,19 @@ var statusCommand = {
   run: runStatus
 };
 var SLUG_RE3 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+function statusTruthFields(args) {
+  return {
+    slug: args.slug,
+    deployedSha: args.deployedSha,
+    headSha: args.headSha,
+    hasOpenPr: args.openPrNumber !== null,
+    openPrNumber: args.openPrNumber,
+    driftFields: [],
+    driftDetails: [],
+    ...args.deployment !== undefined ? { deployment: args.deployment } : {},
+    ...args.standingExceptions !== undefined ? { standingExceptions: args.standingExceptions } : {}
+  };
+}
 async function fetchLifecycle(cfg, slug) {
   try {
     return await apiJson(cfg, { path: `/apps/${slug}/lifecycle` });
@@ -5646,7 +5677,7 @@ async function runStatus(args, io) {
   }
   let localYaml = null;
   try {
-    localYaml = readFileSync7(parsed.file, "utf8");
+    localYaml = readFileSync8(parsed.file, "utf8");
   } catch (e) {
     if (!isEnoent(e)) {
       io.err(`launchpad status: cannot read local manifest at ${parsed.file}: ${describe12(e)}`);
@@ -5707,16 +5738,16 @@ async function runStatus(args, io) {
     const platformTracked = state.hasAppFile === true || live?.trigger === "bot";
     const out = {
       state: contentIsLive ? platformTracked ? "live_drift_unknown" : "live_content_untracked" : platformTracked && !deploymentKnown ? "live_drift_unknown" : liveButEmpty ? "live_no_content" : "no_deployed_manifest",
-      slug: parsed.slug,
       ...local === null ? { drift: null } : {},
-      deployedSha: state.lastAppliedManifestSha,
-      headSha: state.appRepoHeadSha,
-      hasOpenPr: state.openPr !== null,
-      openPrNumber: state.openPr?.number ?? null,
-      driftFields: [],
-      driftDetails: [],
-      ...deploymentKnown ? { deployment } : {},
-      ...standingExceptions !== null ? { standingExceptions } : {}
+      ...statusTruthFields({
+        slug: parsed.slug,
+        deployedSha: state.deployedManifestSha,
+        headSha: state.appRepoHeadSha,
+        openPrNumber: state.openPr?.number ?? null,
+        ...deploymentKnown ? { deployment } : {},
+        ...standingExceptions !== null ? { standingExceptions } : {}
+      }),
+      ...lifecycle?.statusPageUrl !== undefined ? { statusPageUrl: lifecycle.statusPageUrl } : {}
     };
     emit4(out, parsed.json, io);
     return 0;
@@ -5724,16 +5755,16 @@ async function runStatus(args, io) {
   if (local === null) {
     const out = {
       state: "live_drift_unknown",
-      slug: parsed.slug,
       drift: null,
-      deployedSha: state.lastAppliedManifestSha,
-      headSha: state.appRepoHeadSha,
-      hasOpenPr: state.openPr !== null,
-      openPrNumber: state.openPr?.number ?? null,
-      driftFields: [],
-      driftDetails: [],
-      ...deploymentKnown ? { deployment } : {},
-      ...standingExceptions !== null ? { standingExceptions } : {}
+      ...statusTruthFields({
+        slug: parsed.slug,
+        deployedSha: state.deployedManifestSha,
+        headSha: state.appRepoHeadSha,
+        openPrNumber: state.openPr?.number ?? null,
+        ...deploymentKnown ? { deployment } : {},
+        ...standingExceptions !== null ? { standingExceptions } : {}
+      }),
+      ...lifecycle?.statusPageUrl !== undefined ? { statusPageUrl: lifecycle.statusPageUrl } : {}
     };
     emit4(out, parsed.json, io);
     if (parsed.strict) {
@@ -5750,12 +5781,12 @@ async function runStatus(args, io) {
     const { parse: parseYaml4 } = await import("yaml");
     deployedObj = parseYaml4(state.manifestYaml);
   } catch (e) {
-    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} is not valid YAML: ${describe12(e)}`);
+    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} is not valid YAML: ${describe12(e)}`);
     return 2;
   }
   const deployedParse = parseManifest(deployedObj);
   if (deployedParse.kind !== "ok") {
-    io.err(`launchpad status: deployed manifest at ${state.lastAppliedManifestSha} failed schema validation:`);
+    io.err(`launchpad status: deployed manifest at ${state.deployedManifestSha} failed schema validation:`);
     for (const issue of deployedParse.issues) {
       io.err(`  - ${issue.path}: ${issue.message}`);
     }
@@ -5775,7 +5806,7 @@ async function runStatus(args, io) {
     cfg,
     refs: allowedEntraGroups(deployed.access),
     source: "deployed manifest",
-    manifestSha: state.lastAppliedManifestSha
+    manifestSha: state.deployedManifestSha
   });
   if (deployedGroups.kind === "error") {
     return renderStatusGroupError(deployedGroups.envelope, parsed.json, io);
@@ -5790,7 +5821,7 @@ async function runStatus(args, io) {
       cfg,
       refs: state.enforcedGroups,
       source: "enforced access",
-      manifestSha: state.lastAppliedManifestSha
+      manifestSha: state.deployedManifestSha
     });
     if (enforcedGroups.kind === "error") {
       return renderStatusGroupError(enforcedGroups.envelope, parsed.json, io);
@@ -5799,7 +5830,7 @@ async function runStatus(args, io) {
   }
   const localAssignmentGroups = (local.auth ?? "access") === "access" ? localGroups : null;
   const deployedAssignmentGroups = (deployed.auth ?? "access") === "access" ? deployedGroups : null;
-  const assignmentCheck = localAssignmentGroups === null && deployedAssignmentGroups === null ? { kind: "ok", issues: [] } : await findAssignmentIssues(cfg, localAssignmentGroups, deployedAssignmentGroups, state.lastAppliedManifestSha);
+  const assignmentCheck = localAssignmentGroups === null && deployedAssignmentGroups === null ? { kind: "ok", issues: [] } : await findAssignmentIssues(cfg, localAssignmentGroups, deployedAssignmentGroups, state.deployedManifestSha);
   if (assignmentCheck.kind === "error") {
     return renderStatusGroupError(assignmentCheck.envelope, parsed.json, io);
   }
@@ -5807,7 +5838,7 @@ async function runStatus(args, io) {
   const result = {
     state: drift.length === 0 ? "in_sync" : "drift",
     slug: parsed.slug,
-    deployedSha: state.lastAppliedManifestSha,
+    deployedSha: state.deployedManifestSha,
     headSha: state.appRepoHeadSha,
     hasOpenPr: state.openPr !== null,
     openPrNumber: state.openPr?.number ?? null,
@@ -5816,7 +5847,8 @@ async function runStatus(args, io) {
     ...deploymentKnown ? { deployment } : {},
     ...standingExceptions !== null ? { standingExceptions } : {},
     ...accessDrift !== undefined ? { accessDrift } : {},
-    ...groupIssues.length === 0 ? {} : { groupIssues }
+    ...groupIssues.length === 0 ? {} : { groupIssues },
+    ...lifecycle?.statusPageUrl !== undefined ? { statusPageUrl: lifecycle.statusPageUrl } : {}
   };
   emit4(result, parsed.json, io);
   if (parsed.strict && (result.state === "drift" || accessDrift?.inSync === false || groupIssues.length > 0)) {
@@ -6011,7 +6043,8 @@ function lifecycleOutput(slug, lc) {
     hasOpenPr: false,
     openPrNumber: null,
     driftFields: [],
-    driftDetails: []
+    driftDetails: [],
+    ...lc.statusPageUrl !== undefined ? { statusPageUrl: lc.statusPageUrl } : {}
   };
 }
 function emit4(out, asJson, io) {
@@ -6019,6 +6052,9 @@ function emit4(out, asJson, io) {
     io.out(JSON.stringify(out, null, 2));
     return;
   }
+  if (out.statusPageUrl !== undefined) {
+    io.out(`Status page: ${out.statusPageUrl}`);
+  }
   switch (out.state) {
     case "provisioning":
       io.out(`${out.slug}: provisioning (stage: ${out.stage ?? "starting"})` + (out.submissionId ? ` — submission ${out.submissionId}` : ""));
@@ -6343,7 +6379,7 @@ function readLocalEntrypoint(cwd) {
   for (const rel of ["index.html", join9("static", "index.html")]) {
     const p = join9(cwd, rel);
     if (existsSync4(p))
-      return new Uint8Array(readFileSync8(p));
+      return new Uint8Array(readFileSync9(p));
   }
   return null;
 }
@@ -6577,7 +6613,7 @@ async function verifyFirstDeployServed(args, liveUrl, io, deps) {
 
 // src/commands/deploy.ts
 import { parse as parseYaml6 } from "yaml";
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync11 } from "node:fs";
 
 // src/deploy/git-files.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -6834,6 +6870,7 @@ function parseDeployFlags(args) {
   let rebaseOntoHead = false;
   let overrideStale = null;
   let allowUnguarded = false;
+  let noOpen = false;
   let i = 0;
   while (i < args.length) {
     const a = args[i] ?? "";
@@ -7038,6 +7075,11 @@ function parseDeployFlags(args) {
       i += 1;
       continue;
     }
+    if (a === "--no-open") {
+      noOpen = true;
+      i += 1;
+      continue;
+    }
     if (a.startsWith("--verify-timeout=")) {
       const v = a.slice("--verify-timeout=".length);
       const n = Number(v);
@@ -7058,6 +7100,9 @@ function parseDeployFlags(args) {
   if (rebaseOntoHead && overrideStale !== null) {
     return "--rebase-onto-head and --override-stale are mutually exclusive — re-stamp to head, or override in place, not both";
   }
+  if (noOpen && mode !== "content" && mode !== "apply") {
+    return "--no-open is only valid for a content deploy or --apply";
+  }
   if (mode === "dry-run") {
     if (slug !== null)
       return "--dry-run does not accept --slug (slug is read from launchpad.yaml)";
@@ -7114,7 +7159,8 @@ function parseDeployFlags(args) {
         timeoutMinutes
       },
       message: null,
-      timeoutSeconds: null
+      timeoutSeconds: null,
+      ...noOpen ? { noOpen: true } : {}
     };
   }
   if (resumePrNumber !== null) {
@@ -7155,7 +7201,8 @@ function parseDeployFlags(args) {
         allowUnguarded
       },
       message,
-      timeoutSeconds
+      timeoutSeconds,
+      ...noOpen ? { noOpen: true } : {}
     };
   }
   if (mode === "resume" || mode === "abandon") {
@@ -7209,12 +7256,12 @@ import { existsSync as existsSync6, rmSync } from "node:fs";
 import { resolve as resolvePath, join as join10 } from "node:path";
 
 // src/manifest/load.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import { parse as parseYaml5, YAMLParseError } from "yaml";
 function loadManifest(path8) {
   let raw;
   try {
-    raw = readFileSync9(path8, "utf8");
+    raw = readFileSync10(path8, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -7249,6 +7296,38 @@ function formatIssues(error) {
   }));
 }
 
+// src/status-page-output.ts
+async function surfaceStatusPageUrl(url, io, options) {
+  if (typeof url !== "string" || url.length === 0)
+    return;
+  io.out(`Status page: ${url}`);
+  const env = options.env ?? process.env;
+  const isTty = options.isTty ?? process.stdout.isTTY === true;
+  if (options.noOpen || !options.autoOpenEnabled || !isTty || env.CI !== undefined) {
+    return;
+  }
+  if (!isAllowedStatusPageUrl(url, options.allowedHost)) {
+    io.err("warning: refused to open an untrusted status page URL");
+    return;
+  }
+  try {
+    await (options.open ?? openBrowser)(url);
+  } catch (error) {
+    io.err(`warning: couldn't open the status page automatically: ${describe13(error)}`);
+  }
+}
+function isAllowedStatusPageUrl(url, allowedHost) {
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "https:" && (allowedHost === undefined || parsed.hostname === allowedHost);
+  } catch {
+    return false;
+  }
+}
+function describe13(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // src/deploy/apply.ts
 var DEFAULT_TIMEOUT_MINUTES = 90;
 var DEFAULT_POLL_INTERVAL_SECONDS = 10;
@@ -7383,6 +7462,11 @@ async function runDeployApply(opts, io, deps = {}) {
     io.err(`launchpad deploy --apply: protocol failure from /apps/${slug}/manifest/apply: ` + `requested ${manifestSha}, received ${String(apply.manifestSha)}`);
     return 2;
   }
+  await surfaceStatusPageUrl(apply.statusPageUrl, io, {
+    noOpen: opts.noOpen === true,
+    autoOpenEnabled: cfg.statusPageAutoOpen,
+    allowedHost: cfg.statusPageHost
+  });
   io.out("");
   io.out(`PR opened: ${apply.prUrl}`);
   io.out(`Branch:    ${apply.branch}`);
@@ -7457,7 +7541,7 @@ async function pollUntilApplied(args) {
           breakDots();
           return { kind: "failed", reason: e.message };
         }
-        args.io.err(`! apply-status fetch failed (will retry): ${describe13(e)}`);
+        args.io.err(`! apply-status fetch failed (will retry): ${describe14(e)}`);
         await sleep(args.pollIntervalSec * 1000);
         continue;
       }
@@ -7504,7 +7588,7 @@ async function pollUntilApplied(args) {
           path: `/apps/${args.slug}/manifest/state`
         }, args.fetcher);
       } catch (e) {
-        args.io.err(`! state fetch failed (will retry): ${describe13(e)}`);
+        args.io.err(`! state fetch failed (will retry): ${describe14(e)}`);
         await sleep(args.pollIntervalSec * 1000);
         continue;
       }
@@ -7578,7 +7662,7 @@ function deletePinIfPresent(cfg, slug, io) {
     rmSync(pinPath, { force: true });
     io.out(`  (cleaned up obsolete pin file ${pinPath})`);
   } catch (e) {
-    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe13(e)}`);
+    io.err(`! warning: failed to delete obsolete pin file ${pinPath}: ${describe14(e)}`);
   }
 }
 async function loadSlugForResume(opts, io) {
@@ -7602,7 +7686,7 @@ async function defaultPrompt(question) {
     rl.close();
   }
 }
-function describe13(e) {
+function describe14(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError(e, slug, io) {
@@ -7626,7 +7710,7 @@ function mapHttpError(e, slug, io) {
     io.err(`launchpad deploy --apply: ${e.message}`);
     return 1;
   }
-  io.err(`launchpad deploy --apply failed: ${describe13(e)}`);
+  io.err(`launchpad deploy --apply failed: ${describe14(e)}`);
   return 2;
 }
 function renderManifestError(loaded, io) {
@@ -7669,7 +7753,7 @@ function renderAccessDriftSummary(slug, body) {
   return lines;
 }
 async function handleAccessDrift(params) {
-  const { slug, manifestPath, body, io, deps, outcome } = params;
+  const { slug, manifestPath, body, io, deps, noOpen, outcome } = params;
   if (outcome === undefined) {
     for (const line of renderAccessDriftSummary(slug, body))
       io.err(line);
@@ -7685,6 +7769,7 @@ async function handleAccessDrift(params) {
     platformRepo: null,
     rePin: false,
     yes: true,
+    noOpen,
     ...outcome === undefined ? {} : { atSha: outcome.manifest_sha },
     ...outcome?.pr === undefined ? {} : {
       preopenedPr: {
@@ -7725,7 +7810,7 @@ async function runDeployDryRun(opts, io, deps = {}) {
   try {
     manifestSha = (deps.gitHeadSha ?? defaultGitHeadSha)(process.cwd());
   } catch (e) {
-    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe14(e)}`;
+    const msg = `failed to resolve git HEAD in ${process.cwd()}: ${describe15(e)}`;
     if (opts.json) {
       io.out(JSON.stringify({ ok: false, kind: "git-error", message: msg }));
     } else {
@@ -7774,7 +7859,7 @@ function defaultGitHeadSha(cwd) {
   });
   return out.trim();
 }
-function describe14(e) {
+function describe15(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function mapHttpError2(e, slug, json, io) {
@@ -8086,7 +8171,7 @@ function validateContainerFilesystem(manifestPath, capability) {
     try {
       stat = lstatSync3(current);
     } catch (error) {
-      return failure("container_image_unreadable", relative3(root, current), `cannot inspect container image path: ${describe15(error)}`);
+      return failure("container_image_unreadable", relative3(root, current), `cannot inspect container image path: ${describe16(error)}`);
     }
     if (stat.isSymbolicLink()) {
       return failure("container_image_symlink", relative3(root, current), "container image path must not contain symbolic links");
@@ -8096,7 +8181,7 @@ function validateContainerFilesystem(manifestPath, capability) {
   try {
     finalPath = realpathSync(current);
   } catch (error) {
-    return failure("container_image_unreadable", relative3(root, current), `cannot resolve container image path: ${describe15(error)}`);
+    return failure("container_image_unreadable", relative3(root, current), `cannot resolve container image path: ${describe16(error)}`);
   }
   const rootPrefix = resolve9(root) + sep2;
   if (!resolve9(finalPath).startsWith(rootPrefix)) {
@@ -8110,7 +8195,7 @@ function validateContainerFilesystem(manifestPath, capability) {
 function failure(reason, path8, message) {
   return { kind: "error", reason, path: path8, message };
 }
-function describe15(error) {
+function describe16(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
@@ -8179,7 +8264,8 @@ async function runDeploy(args, io) {
       yes: flags.mode.yes,
       ...flags.mode.atSha !== null ? { atSha: flags.mode.atSha } : {},
       ...flags.mode.resumePrNumber !== null ? { resumePrNumber: flags.mode.resumePrNumber } : {},
-      ...flags.mode.timeoutMinutes !== null ? { timeoutMinutes: flags.mode.timeoutMinutes } : {}
+      ...flags.mode.timeoutMinutes !== null ? { timeoutMinutes: flags.mode.timeoutMinutes } : {},
+      noOpen: flags.noOpen === true
     }, io);
   }
   if (flags.mode.kind === "abandon") {
@@ -8215,7 +8301,8 @@ async function runDeploy(args, io) {
       allowStale: contentMode.allowStale,
       rebaseOntoHead: contentMode.rebaseOntoHead,
       overrideStale: contentMode.overrideStale,
-      allowUnguarded: contentMode.allowUnguarded
+      allowUnguarded: contentMode.allowUnguarded,
+      noOpen: flags.noOpen === true
     });
   }
   if (flags.mode.kind === "content" && flags.mode.allowUnguarded) {
@@ -8256,7 +8343,7 @@ async function runDeploy(args, io) {
     const contentManifestPath = path8.join(process.cwd(), "launchpad.yaml");
     if (existsSync7(contentManifestPath)) {
       try {
-        contentManifestYaml = readFileSync10(contentManifestPath, "utf8");
+        contentManifestYaml = readFileSync11(contentManifestPath, "utf8");
       } catch {
         contentManifestYaml = null;
       }
@@ -8289,6 +8376,11 @@ async function runDeploy(args, io) {
       headers,
       jsonBody: undefined
     }, makeBytesFetcher(packed.bytes, `/apps/${slug}/deploy-pr`));
+    await surfaceStatusPageUrl(response.statusPageUrl, io, {
+      noOpen: flags.noOpen === true,
+      autoOpenEnabled: cfg.statusPageAutoOpen,
+      allowedHost: cfg.statusPageHost
+    });
     io.out("");
     io.out(`PR opened: ${response.reviewUrl}`);
     io.out(`Branch:    ${response.branch}`);
@@ -8334,12 +8426,12 @@ async function runDeploy(args, io) {
       io.err(`launchpad deploy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad deploy failed: ${describe16(e)}`);
+    io.err(`launchpad deploy failed: ${describe17(e)}`);
     return 1;
   }
 }
 function deployUsage() {
-  return `usage: launchpad deploy [--message <text>] [--slug <slug>] [--allow-unguarded]
+  return `usage: launchpad deploy [--message <text>] [--slug <slug>] [--allow-unguarded] [--no-open]
 ` + `       (slug comes from launchpad.yaml at cwd when present — Model A —
 ` + "        else from the current directory's `launchpad-app-<slug>` suffix)\n" + `
 ` + `provisioning modes:
@@ -8377,6 +8469,10 @@ function parseArgs3(args) {
       i += 2;
       continue;
     }
+    if (a === "--no-open") {
+      i += 1;
+      continue;
+    }
     return null;
   }
   return { slug, message };
@@ -8405,7 +8501,7 @@ function formatBytes2(n) {
     return `${(n / 1024).toFixed(1)}KB`;
   return `${(n / (1024 * 1024)).toFixed(1)}MB`;
 }
-function describe16(e) {
+function describe17(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function surfaceDeployExtras(body, io, slug, allowStale = false) {
@@ -8491,7 +8587,7 @@ function withTimeout(p, ms) {
 async function surfaceManifestDiff(cfg, slug, manifestPath, io) {
   let localYaml;
   try {
-    localYaml = readFileSync10(manifestPath, "utf8");
+    localYaml = readFileSync11(manifestPath, "utf8");
   } catch {
     return;
   }
@@ -8528,7 +8624,7 @@ async function advanceBaseShaMarker(cwd, sha, io) {
       return;
     await writeBaseShaMarker(cwd, sha);
   } catch (e) {
-    io.err(`warning: couldn't update the local base-sha marker (${describe16(e)}); ` + `a future deploy may re-warn about staleness. Harmless — your deploy landed.`);
+    io.err(`warning: couldn't update the local base-sha marker (${describe17(e)}); ` + `a future deploy may re-warn about staleness. Harmless — your deploy landed.`);
   }
 }
 async function runModelADeploy(args) {
@@ -8536,7 +8632,7 @@ async function runModelADeploy(args) {
   let slug;
   let appType = "static";
   try {
-    const manifestObj = parseYaml6(readFileSync10(manifestPath, "utf8"));
+    const manifestObj = parseYaml6(readFileSync11(manifestPath, "utf8"));
     const metaSlug = resolveManifestSlug(manifestObj);
     if (metaSlug === null) {
       io.err(`launchpad deploy: launchpad.yaml is missing metadata.slug (v2) / metadata.name (v1). ` + `Run \`launchpad init\` again to regenerate the manifest.`);
@@ -8566,7 +8662,7 @@ async function runModelADeploy(args) {
       }
     }
   } catch (e) {
-    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe16(e)}`);
+    io.err(`launchpad deploy: failed to read ${manifestPath}: ${describe17(e)}`);
     return 1;
   }
   const noVerify = args.argv.includes("--no-verify");
@@ -8596,7 +8692,7 @@ async function runModelADeploy(args) {
   try {
     cfg = loadConfig();
   } catch (e) {
-    io.err(`launchpad deploy: ${describe16(e)}`);
+    io.err(`launchpad deploy: ${describe17(e)}`);
     return 1;
   }
   try {
@@ -8646,7 +8742,7 @@ async function runModelADeploy(args) {
       io.err("       run `launchpad login` to refresh your session.");
       return 1;
     }
-    io.err(`launchpad deploy: unexpected error: ${describe16(e)}`);
+    io.err(`launchpad deploy: unexpected error: ${describe17(e)}`);
     return 1;
   }
   switch (result.kind) {
@@ -8667,6 +8763,11 @@ async function runModelADeploy(args) {
       return 1;
     case "upload-error": {
       const body = result.body;
+      await surfaceStatusPageUrl(body.statusPageUrl, io, {
+        noOpen: args.noOpen,
+        autoOpenEnabled: cfg.statusPageAutoOpen,
+        allowedHost: cfg.statusPageHost
+      });
       const errorCode = body.error;
       if (result.status === 426 && typeof body.minimum === "string" && typeof body.yours === "string") {
         io.err(upgradeRequiredMessage(body.minimum, body.yours));
@@ -8703,6 +8804,7 @@ async function runModelADeploy(args) {
           manifestPath,
           body,
           io,
+          noOpen: args.noOpen,
           deps: { runApply: runDeployApply }
         });
       }
@@ -8720,6 +8822,7 @@ async function runModelADeploy(args) {
           body,
           outcome,
           io,
+          noOpen: args.noOpen,
           deps: { runApply: runDeployApply }
         });
         if (accessExit !== 0)
@@ -8763,6 +8866,11 @@ async function runModelADeploy(args) {
         io.err(`warning: ${w}`);
       }
       const success = result.result;
+      await surfaceStatusPageUrl(success.statusPageUrl, io, {
+        noOpen: args.noOpen,
+        autoOpenEnabled: cfg.statusPageAutoOpen,
+        allowedHost: cfg.statusPageHost
+      });
       if ("outcome" in success) {
         io.out("Nothing to deploy — your app is already live at this content.");
         if (typeof success.head_sha === "string") {
@@ -8807,6 +8915,7 @@ async function runModelADeploy(args) {
           body: {},
           outcome: success.reconcile,
           io,
+          noOpen: args.noOpen,
           deps: { runApply: runDeployApply }
         });
         if (accessExit !== 0)
@@ -8858,7 +8967,7 @@ function pendingReconcileOutcome(body) {
 }
 
 // src/commands/redeploy.ts
-import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync8, readFileSync as readFileSync12 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 import { parse as parseYaml7 } from "yaml";
 var SLUG_RE6 = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
@@ -8939,7 +9048,7 @@ function readLocalAppType(cwd, file) {
   if (!existsSync8(manifestPath))
     return null;
   try {
-    const obj = parseYaml7(readFileSync11(manifestPath, "utf8"));
+    const obj = parseYaml7(readFileSync12(manifestPath, "utf8"));
     return coerceAppType(obj?.deployment?.type);
   } catch {
     return null;
@@ -9121,7 +9230,7 @@ async function runEnvvars(args, io) {
       io.err(`launchpad envvars: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad envvars failed: ${describe17(e)}`);
+    io.err(`launchpad envvars failed: ${describe18(e)}`);
     return 1;
   }
 }
@@ -9218,12 +9327,12 @@ function renderList(envVars, io) {
     io.out(fmt(row));
   }
 }
-function describe17(e) {
+function describe18(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/generate.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync13, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname7, resolve as resolve10, relative as relative4 } from "node:path";
 var generateCommand = {
   name: "generate",
@@ -9328,7 +9437,7 @@ function applyOne(artefact, path10, out, force) {
 }
 function readIfExists(path10) {
   try {
-    return { kind: "ok", content: readFileSync12(path10, "utf8") };
+    return { kind: "ok", content: readFileSync13(path10, "utf8") };
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT")
@@ -9552,13 +9661,13 @@ function decodeJwtPayload(token) {
   try {
     json = Buffer.from(b64UrlToB64(payload), "base64").toString("utf8");
   } catch (e) {
-    throw new JwtParseError(`could not base64-decode JWT payload: ${describe18(e)}`);
+    throw new JwtParseError(`could not base64-decode JWT payload: ${describe19(e)}`);
   }
   let parsed;
   try {
     parsed = JSON.parse(json);
   } catch (e) {
-    throw new JwtParseError(`JWT payload is not JSON: ${describe18(e)}`);
+    throw new JwtParseError(`JWT payload is not JSON: ${describe19(e)}`);
   }
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new JwtParseError(`JWT payload is not an object`);
@@ -9569,7 +9678,7 @@ function b64UrlToB64(s) {
   const padded = s.padEnd(s.length + (4 - s.length % 4) % 4, "=");
   return padded.replace(/-/g, "+").replace(/_/g, "/");
 }
-function describe18(e) {
+function describe19(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -9596,7 +9705,7 @@ async function runGroupsWhoami(args, io) {
   try {
     payload = decodeJwtPayload(session.accessToken);
   } catch (e) {
-    const message = e instanceof JwtParseError ? e.message : describe19(e);
+    const message = e instanceof JwtParseError ? e.message : describe20(e);
     if (json) {
       io.out(JSON.stringify({ ok: false, kind: "jwt-parse-error", message }));
     } else {
@@ -9677,7 +9786,7 @@ function parseFlags2(args) {
   }
   return { kind: "ok", json };
 }
-function describe19(e) {
+function describe20(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -9780,7 +9889,7 @@ async function loadGroups(io, refresh, json) {
       }
       return { kind: "error", code: 3 };
     }
-    renderFetchError(io, describe20(e), json);
+    renderFetchError(io, describe21(e), json);
     return { kind: "error", code: 2 };
   }
 }
@@ -9817,7 +9926,7 @@ async function lookupTenantWide(key) {
       return { kind: "unauthenticated", message: e.message };
     if (e instanceof ForbiddenError)
       return { kind: "forbidden", message: e.message };
-    return { kind: "error", message: describe20(e) };
+    return { kind: "error", message: describe21(e) };
   }
 }
 function renderLookupFailure(io, json, hit) {
@@ -10061,18 +10170,18 @@ function renderTable2(io, groups) {
   for (const r of rows)
     io.out(fmt(r));
 }
-function describe20(e) {
+function describe21(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/commands/init.ts
 import { createInterface } from "node:readline/promises";
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync15, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname8, resolve as resolve11 } from "node:path";
 import { stringify as yamlStringify } from "yaml";
 
 // src/detect/index.ts
-import { existsSync as existsSync9, readFileSync as readFileSync13, statSync } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync14, statSync } from "node:fs";
 import { join as join13 } from "node:path";
 function detectAppShape(cwd) {
   const hasPackageJson = existsSync9(join13(cwd, "package.json"));
@@ -10177,7 +10286,7 @@ function detectBuildCommand(cwd, pm) {
   }
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync13(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync14(pkgJsonPath, "utf8"));
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10212,7 +10321,7 @@ var OUT_DIR_REGEX = /\bbuild\s*:\s*\{[^{}]*?\boutDir\s*:\s*['"]([^'"]+)['"]/s;
 function detectDestinationDir(cwd, vite) {
   let text;
   try {
-    text = readFileSync13(vite.path, "utf8");
+    text = readFileSync14(vite.path, "utf8");
   } catch (e) {
     return {
       kind: "ambiguous",
@@ -10699,7 +10808,7 @@ function renderYaml(manifest) {
 function ensureGitignoreEntries(path10, entries) {
   let current = "";
   if (existsSync10(path10)) {
-    current = readFileSync14(path10, "utf8");
+    current = readFileSync15(path10, "utf8");
   }
   const lines = current.split(/\r?\n/);
   const present = new Set(lines.map((l) => l.trim()));
@@ -10772,13 +10881,13 @@ async function runLogin(args, io, deps) {
       io.out(`Access token expires in ~${expiresIn}s; refreshes silently.`);
       return 0;
     } catch (e) {
-      io.err(`Gateway login failed: ${describe21(e)}`);
+      io.err(`Gateway login failed: ${describe22(e)}`);
       io.err("Falling back to the legacy Cloudflare Access flow (DEPRECATED — this fallback will be removed when the dual-auth window closes).");
       io.err("");
       return await runLegacyLogin(io, cfg.botUrl, cfg.sessionPath, deps);
     }
   } catch (e) {
-    io.err(`launchpad login failed: ${describe21(e)}`);
+    io.err(`launchpad login failed: ${describe22(e)}`);
     return 1;
   }
 }
@@ -10820,7 +10929,7 @@ function printLoginHelp(io) {
   io.out("  0   signed in / session stored");
   io.out("  1   login failed (network, browser, or gateway error)");
 }
-function describe21(e) {
+function describe22(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10857,14 +10966,14 @@ async function runLogout(args, io, deps) {
         });
         io.out("Server-side session revoked.");
       } catch (e) {
-        io.err(`warning: could not revoke the session server-side (${describe22(e)}) — clearing the local session anyway. Any in-flight access token expires within 15 minutes.`);
+        io.err(`warning: could not revoke the session server-side (${describe23(e)}) — clearing the local session anyway. Any in-flight access token expires within 15 minutes.`);
       }
     }
     const had = await clearSession(cfg.sessionPath);
     io.out(had ? `Logged out. Session cleared at ${cfg.sessionPath}` : "Already logged out.");
     return 0;
   } catch (e) {
-    io.err(`launchpad logout failed: ${describe22(e)}`);
+    io.err(`launchpad logout failed: ${describe23(e)}`);
     return 1;
   }
 }
@@ -10884,7 +10993,7 @@ function printLogoutHelp(io) {
   io.out("  0   logged out (or already logged out)");
   io.out("  1   could not clear the local session (file IO / config error)");
 }
-function describe22(e) {
+function describe23(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -10954,7 +11063,7 @@ async function runLogs(args, io) {
       io.err(`launchpad logs: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad logs failed: ${describe23(e)}`);
+    io.err(`launchpad logs failed: ${describe24(e)}`);
     return 1;
   }
 }
@@ -11034,7 +11143,7 @@ function formatRelative2(iso) {
     return `${hr}h ago`;
   return `${Math.floor(hr / 24)}d ago`;
 }
-function describe23(e) {
+function describe24(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -11083,7 +11192,7 @@ async function runMerge(args, io) {
       try {
         body = await res.json();
       } catch (e) {
-        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe24(e)}`);
+        io.err(`launchpad merge: bot returned 2xx with malformed body: ${describe25(e)}`);
         return 1;
       }
       io.out("");
@@ -11123,7 +11232,7 @@ async function runMerge(args, io) {
       io.err(`launchpad merge: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad merge failed: ${describe24(e)}`);
+    io.err(`launchpad merge failed: ${describe25(e)}`);
     return 1;
   }
 }
@@ -11222,7 +11331,7 @@ function renderBotError(status, env, io, prNumber = null) {
       io.err(`launchpad merge: bot returned ${status} ${code}${detail !== undefined ? `: ${detail}` : ""}`);
   }
 }
-function describe24(e) {
+function describe25(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -11485,7 +11594,7 @@ async function runDestroy(args, io, prompt, isTty) {
       io.err(`launchpad destroy: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad destroy failed: ${describe25(e)}`);
+    io.err(`launchpad destroy failed: ${describe26(e)}`);
     return 1;
   }
 }
@@ -11685,7 +11794,7 @@ function printUsage4(io) {
   ].join(`
 `));
 }
-function describe25(e) {
+function describe26(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -12255,7 +12364,7 @@ async function runPull(args, io) {
       io.err(`launchpad pull: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad pull failed: ${describe26(e)}`);
+    io.err(`launchpad pull failed: ${describe27(e)}`);
     return 1;
   }
 }
@@ -12363,7 +12472,7 @@ function printUsage5(io) {
   ].join(`
 `));
 }
-function describe26(e) {
+function describe27(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -12698,7 +12807,7 @@ async function runReview(args, io) {
       io.err(`launchpad review: ${e.message}`);
       return 1;
     }
-    io.err(`launchpad review failed: ${describe27(e)}`);
+    io.err(`launchpad review failed: ${describe28(e)}`);
     return 1;
   }
 }
@@ -12776,12 +12885,12 @@ function severityRank(s) {
       return 3;
   }
 }
-function describe27(e) {
+function describe28(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
 // src/deploy/rollback.ts
-import { existsSync as existsSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync5 } from "node:fs";
 import { resolve as resolvePath3 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -12836,7 +12945,7 @@ async function runRollback(opts, io, deps = {}) {
       cwd: process.cwd()
     });
   } catch (e) {
-    io.err(`launchpad rollback: git rev-parse failed to start: ${describe28(e)}`);
+    io.err(`launchpad rollback: git rev-parse failed to start: ${describe29(e)}`);
     return 2;
   }
   if (revParse.exitCode !== 0) {
@@ -12851,7 +12960,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     show = await runner.run("git", ["show", `${verifiedSha}:${manifestRelpath}`], { cwd: process.cwd() });
   } catch (e) {
-    io.err(`launchpad rollback: git show failed to start: ${describe28(e)}`);
+    io.err(`launchpad rollback: git show failed to start: ${describe29(e)}`);
     return 2;
   }
   if (show.exitCode !== 0) {
@@ -12885,7 +12994,7 @@ async function runRollback(opts, io, deps = {}) {
   try {
     writeFileSync5(manifestPath, historicalYaml, "utf8");
   } catch (e) {
-    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe28(e)}`);
+    io.err(`launchpad rollback: failed to write ${manifestPath}: ${describe29(e)}`);
     return 2;
   }
   io.out(`Restored ${manifestPath} from ${verifiedSha.slice(0, 12)}.`);
@@ -12910,7 +13019,7 @@ function readCurrentManifest(path14) {
     return null;
   let raw;
   try {
-    raw = readFileSync15(path14, "utf8");
+    raw = readFileSync16(path14, "utf8");
   } catch {
     return null;
   }
@@ -12967,7 +13076,7 @@ async function defaultPrompt4(question) {
     rl.close();
   }
 }
-function describe28(e) {
+function describe29(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError3(result, io) {
@@ -13066,7 +13175,7 @@ function parseArgs12(args) {
 }
 
 // src/secrets/push.ts
-import { existsSync as existsSync12, readFileSync as readFileSync16 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync17 } from "node:fs";
 import { resolve as resolvePath4 } from "node:path";
 import { createInterface as createInterface4 } from "node:readline/promises";
 import { stdin as input2, stdout as output2 } from "node:process";
@@ -13130,9 +13239,9 @@ async function runSecretsPush(opts, io, deps = {}) {
   }
   let envText;
   try {
-    envText = readFileSync16(envPath, "utf8");
+    envText = readFileSync17(envPath, "utf8");
   } catch (e) {
-    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe29(e)}`);
+    io.err(`launchpad secrets push: failed to read ${envPath}: ${describe30(e)}`);
     return 2;
   }
   const parsed = parseEnv(envText);
@@ -13316,10 +13425,10 @@ function mapPushError(e, slug, name, io) {
     io.err(`✗ secrets push ${name}: ${e.message}`);
     return 1;
   }
-  io.err(`✗ secrets push ${name} failed: ${describe29(e)}`);
+  io.err(`✗ secrets push ${name} failed: ${describe30(e)}`);
   return 2;
 }
-function describe29(e) {
+function describe30(e) {
   return e instanceof Error ? e.message : String(e);
 }
 function renderManifestError4(result, io) {
@@ -13455,7 +13564,7 @@ function renderManifestError5(result, io) {
 }
 
 // src/secrets/set.ts
-import { existsSync as existsSync13, readFileSync as readFileSync17 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync18 } from "node:fs";
 import { resolve as resolvePath6 } from "node:path";
 import { parse as parseYaml8 } from "yaml";
 var CELL_LABEL2 = {
@@ -13472,7 +13581,7 @@ function loadSet(fleetFile, setName, io) {
   }
   let obj;
   try {
-    obj = parseYaml8(readFileSync17(path14, "utf8"));
+    obj = parseYaml8(readFileSync18(path14, "utf8"));
   } catch (e) {
     io.err(`✗ ${path14}`);
     io.err(`  YAML parse error: ${e instanceof Error ? e.message : String(e)}`);
@@ -13564,7 +13673,7 @@ async function runSecretsPushSet(opts, io, deps = {}) {
   }
   let envText;
   try {
-    envText = readFileSync17(envPath, "utf8");
+    envText = readFileSync18(envPath, "utf8");
   } catch (e) {
     io.err(`launchpad secrets push --set: failed to read ${envPath}: ${e instanceof Error ? e.message : String(e)}`);
     return 2;
@@ -14034,7 +14143,7 @@ import { promises as fs7, existsSync as existsSync15 } from "node:fs";
 // src/skills-bundle.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join15 } from "node:path";
-import { readFileSync as readFileSync18, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync19, readdirSync as readdirSync2 } from "node:fs";
 var SKILL_PREFIX = "launchpad-";
 function skillsTargetDir() {
   return process.env.LAUNCHPAD_SKILLS_TARGET_DIR ?? join15(homedir2(), ".claude", "skills");
@@ -14055,7 +14164,7 @@ function readInstalledSkills() {
 }
 function readSkillVersion(path14) {
   try {
-    const text = readFileSync18(path14, "utf8");
+    const text = readFileSync19(path14, "utf8");
     const fenceEnd = text.indexOf(`
 ---`, 4);
     const front = fenceEnd === -1 ? text.slice(0, 1024) : text.slice(0, fenceEnd);
@@ -14109,7 +14218,7 @@ async function runSkills(args, io) {
         return 64;
     }
   } catch (e) {
-    io.err(`launchpad skills ${action}: ${describe30(e)}`);
+    io.err(`launchpad skills ${action}: ${describe31(e)}`);
     return 1;
   }
 }
@@ -14239,7 +14348,7 @@ async function isDir(path14) {
     return false;
   }
 }
-function describe30(e) {
+function describe31(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -14249,7 +14358,7 @@ import { promisify } from "node:util";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { dirname as dirname11, resolve as resolve16, relative as relative6, isAbsolute as isAbsolute3, join as join17 } from "node:path";
 import { homedir as homedir3, tmpdir } from "node:os";
-import { readFileSync as readFileSync19, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
+import { readFileSync as readFileSync20, mkdtempSync, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "node:fs";
 
 // src/commands/channel-auth.ts
 import { createServer as createServer2 } from "node:http";
@@ -14524,7 +14633,7 @@ function resolveLatestVersion() {
 }
 function detectInstallChannel() {
   try {
-    return readFileSync19(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
+    return readFileSync20(CHANNEL_MARKER, "utf8").trim() === "platform" ? "platform" : "github";
   } catch {
     return "github";
   }
@@ -14732,7 +14841,7 @@ function printHelp5(io) {
 }
 
 // src/commands/validate.ts
-import { existsSync as existsSync16, readFileSync as readFileSync20, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync21, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
 import { dirname as dirname12, resolve as resolve17 } from "node:path";
 var validateCommand = {
   name: "validate",
@@ -14780,7 +14889,7 @@ function checkBoundary(manifestPath, declared) {
   }
   let manifestYaml;
   try {
-    manifestYaml = readFileSync20(manifestPath, "utf8");
+    manifestYaml = readFileSync21(manifestPath, "utf8");
   } catch {
     manifestYaml = null;
   }
@@ -14814,7 +14923,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   try {
     isDir2 = statSync2(abs).isDirectory();
   } catch (e) {
-    return [`failed to inspect static served directory '${serveDir}/': ${describe31(e)}`];
+    return [`failed to inspect static served directory '${serveDir}/': ${describe32(e)}`];
   }
   if (!isDir2) {
     return [`static app serves '${serveDir}/' but that path is not a directory.`];
@@ -14823,7 +14932,7 @@ function checkStaticServeDir(manifestPath, manifest) {
   try {
     entries = readdirSync3(abs);
   } catch (e) {
-    return [`failed to read static served directory '${serveDir}/': ${describe31(e)}`];
+    return [`failed to read static served directory '${serveDir}/': ${describe32(e)}`];
   }
   if (entries.length === 0) {
     return [
@@ -14878,7 +14987,7 @@ async function checkGroup(allowedGroup, cfg) {
     if (e instanceof ForbiddenError) {
       return { kind: "forbidden", message: e.message };
     }
-    return { kind: "network", message: describe31(e) };
+    return { kind: "network", message: describe32(e) };
   }
 }
 async function checkGroups(groups) {
@@ -15093,7 +15202,7 @@ function parseArgs13(args) {
   }
   return { kind: "ok", file, json, strictGroups };
 }
-function describe31(e) {
+function describe32(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -15146,7 +15255,7 @@ async function runWhoami(args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad whoami failed: ${describe32(e)}`);
+    io.err(`launchpad whoami failed: ${describe33(e)}`);
     return 1;
   }
 }
@@ -15176,11 +15285,11 @@ async function runShare(args, io) {
       io.err(e.message);
       return 1;
     }
-    io.err(`launchpad whoami --share failed: ${describe32(e)}`);
+    io.err(`launchpad whoami --share failed: ${describe33(e)}`);
     return 1;
   }
 }
-function describe32(e) {
+function describe33(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
@@ -15346,7 +15455,7 @@ async function runEditor(action, args, io, deps) {
       io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
       return 1;
     }
-    io.err(`launchpad ${verb} failed: ${describe33(e)}`);
+    io.err(`launchpad ${verb} failed: ${describe34(e)}`);
     return 1;
   }
 }
@@ -15380,7 +15489,7 @@ async function sendMutation(action, slug, target, version, cfg, deps) {
     nonThrowingStatuses: [409]
   });
 }
-function describe33(e) {
+function describe34(e) {
   return e instanceof Error ? e.message : String(e);
 }
 var grantEditorCommand = makeEditorCommand("grant");
@@ -15586,7 +15695,7 @@ async function runOwner(action, args, io, deps) {
       io.err(`launchpad ${verb}: no app "${slug}" — check the slug with \`launchpad apps\`.`);
       return 1;
     }
-    io.err(`launchpad ${verb} failed: ${describe34(e)}`);
+    io.err(`launchpad ${verb} failed: ${describe35(e)}`);
     return 1;
   }
 }
@@ -15620,7 +15729,7 @@ async function sendMutation2(action, slug, target, version, cfg, deps) {
     nonThrowingStatuses: [409]
   });
 }
-function describe34(e) {
+function describe35(e) {
   return e instanceof Error ? e.message : String(e);
 }
 var addOwnerCommand = makeOwnerCommand("add");
@@ -15785,7 +15894,7 @@ import { join as join18 } from "node:path";
 import {
   existsSync as existsSync17,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   writeFileSync as writeFileSync8
 } from "node:fs";
 var INTERNAL_REFRESH_VERB = "__refresh-update-cache";
@@ -15794,7 +15903,7 @@ var OPT_OUT_ENV = "LAUNCHPAD_NO_UPDATE_NOTIFIER";
 var CACHE_FILE = join18(homedir4(), ".launchpad", "update-check.json");
 function readCache2() {
   try {
-    const raw = JSON.parse(readFileSync21(CACHE_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync22(CACHE_FILE, "utf8"));
     if (typeof raw === "object" && raw !== null && typeof raw.checkedAt === "number") {
       const latest = raw.latest;
       return {
@@ -15926,7 +16035,7 @@ var refreshUpdateCacheCommand = {
 import { spawn as spawn7 } from "node:child_process";
 import { homedir as homedir5 } from "node:os";
 import { join as join19 } from "node:path";
-import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync22, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync5, readFileSync as readFileSync23, writeFileSync as writeFileSync9 } from "node:fs";
 import { randomUUID } from "node:crypto";
 var INTERNAL_EMIT_VERB = "__emit-telemetry";
 var POSTHOG_HOST = "https://us.i.posthog.com";
@@ -16002,7 +16111,7 @@ async function resolveIdentityReal() {
 }
 function getOrCreateDeviceId() {
   try {
-    const raw = JSON.parse(readFileSync22(DEVICE_ID_FILE, "utf8"));
+    const raw = JSON.parse(readFileSync23(DEVICE_ID_FILE, "utf8"));
     const id2 = raw?.deviceId;
     if (typeof id2 === "string" && id2)
       return id2;
@@ -16153,7 +16262,7 @@ import { createInterface as createInterface7 } from "node:readline/promises";
 import { platform } from "node:os";
 
 // src/report/breadcrumb.ts
-import { writeFileSync as writeFileSync10, readFileSync as readFileSync23, mkdirSync as mkdirSync6 } from "node:fs";
+import { writeFileSync as writeFileSync10, readFileSync as readFileSync24, mkdirSync as mkdirSync6 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join20, dirname as dirname13 } from "node:path";
 function breadcrumbPath() {
@@ -16168,7 +16277,7 @@ function writeBreadcrumb(verb, exit) {
 }
 function readBreadcrumb() {
   try {
-    const raw = JSON.parse(readFileSync23(breadcrumbPath(), "utf8"));
+    const raw = JSON.parse(readFileSync24(breadcrumbPath(), "utf8"));
     if (typeof raw !== "object" || raw === null)
       return null;
     const r = raw;