@m-kopa/launchpad-cli

The user-facing CLI for Launchpad. Talks to the portal-bot endpoints shipped under SCOPE-M-760 / T4 (/apps/<slug>/source-bundle, /apps/<slug>/deploy-pr, /apps/<slug>/review/<prNumber>, /apps/<slug>/merge/<prNumber>).

Status

Released, published to public npm. The CLI delivers the full SCOPE-M-760 command surface plus follow-on commands; every release is documented in CHANGELOG.md.

npm i -g @m-kopa/launchpad-cli     # or: bun add -g / pnpm add -g
launchpad login                     # authenticate against the M-KOPA SSO
launchpad skills install            # install the Claude Code slash-commands

@m-kopa/launchpad-cli is published to public npmjs — npm i -g @m-kopa/launchpad-cli works on any machine with no ~/.npmrc setup, no auth token, and no antivirus block (a registry install carries no embedded payload, unlike the legacy self-contained installer). Once installed, launchpad update keeps it current. Access to apps is still gated by M-KOPA SSO at launchpad login; only the install is public.

| Command | What it does | | ------- | ------------ | | login / logout | Start / clear a Cloudflare Access OAuth session | | whoami | Show the current session identity + per-app role | | apps | List the apps the caller can access | | create | File a new app from the terminal (mirrors the portal wizard) | | clone <slug> | Fetch an app's source into a local git repo | | deploy | Package the working tree + open/update a review PR | | review | Show a PR's review state + findings | | merge | Squash-merge a review-passed PR | | envvars | List / set / remove Pages environment variables | | logs | Show recent deployment history | | skills | Install / update the Claude Code skill bundle | | update | Self-update the CLI to the latest published release |

Run launchpad --help for the list, or launchpad <command> --help for per-command usage.

Auth

The CLI uses Cloudflare Access Managed OAuth (PKCE) — see .planning/research/cf-access-cli-auth.md for the full flow. launchpad login opens a browser, completes the PKCE handshake, and stores the session at ~/.launchpad/session.json (mode 0600). Subsequent commands refresh the access token silently until the grant session expires, at which point the CLI prompts a re-login.

Local dev

cd packages/launchpad-cli
bun install
bun run typecheck
bun run lint
bun run test
bun run build
node dist/cli.js --help

Skills bundle

The CLI ships a bundle of Claude Code skills under skills/, copied into a user's ~/.claude/skills/ by launchpad skills install. A public npm npm i -g @m-kopa/launchpad-cli install needs one explicit launchpad skills install afterward; the legacy platform installer (https://get.launchpad.m-kopa.us) runs that step automatically. See docs/runbooks/launchpad-skills-bundle.md for both channels.

| Skill | Source | | ----- | ------ | | launchpad-onboard | this repo | | launchpad-deploy | this repo | | launchpad-deploy-status | this repo | | launchpad-content-pr | this repo | | marquee-share | M-KOPA/marquee (vendored — see below) |

The marquee-share skill (cross-repo, vendored)

marquee-share is not authored here. Its canonical source is the M-KOPA/marquee repository, under skill/. It is vendored into skills/marquee-share/ so the CLI can install a working skill straight from the published npm package — the CLI cannot reach another repo at install time.

The vendored copy must never be hand-edited; it would silently drift from the canonical source. The single supported way to refresh it is the sync script:

packages/launchpad-cli/scripts/sync-marquee-share-skill.sh <marquee-checkout> [git-ref]

Run this at marquee-share release time, review the diff, and commit. The script records the source commit in skills/marquee-share/SYNC.md. --check reports the currently pinned commit. This keeps the bundle a deliberate, reviewed mirror rather than a hand-maintained second copy.

Versioning

Pre-1.0 consumer-pinning policy (per ADR 0005): consumers must pin exact versions until v1.0.0. Caret ranges are forbidden. Each minor-version bump may carry breaking changes.