The Launch Log.

The site earns its footer

Launchpad's public site grew up: real Privacy and Terms pages written in plain words next to the legal ones, a Security page that documents the isolation model instead of gesturing at it, an About page structured like the README it is, and this Launch Log.

The footer now checks its own links against the filesystem in the gate, and its status light asks the API instead of assuming good news.

• Site — /privacy, /terms, /security, /about and /changelog shipped as first-class designed pages
• Site — /.well-known/security.txt published for coordinated disclosure
• Platform — /api/health endpoint backs the footer status light

The app grows a shell

A persistent app shell now wraps the signed-in experience, with dedicated Sites and Crew pages. Project cards stopped pretending: they show real screenshots of the app you built, with skeleton loading while the capture lands.

• Workspace — persistent shell with Sites and Crew pages
• Projects — real screenshots on project cards, skeletons while capturing (§8.9)

Mission control for your database

Connecting Supabase used to prove only that a connection existed. The explorer now shows what is actually in the database — tables, rows, policies — from inside the workspace.

Two live failures got honest messages: a paused project now says it is paused instead of blaming its keys, and a rotated refresh token no longer revokes the whole connection.

• Integrations — Supabase explorer shows real tables and rows (§22)
• Integrations — paused projects say so, instead of surfacing key errors
• Fix — rotated refresh tokens no longer sever the Supabase connection

The crew hatches

Custom Crew shipped (§23): named specialist agents with their own identities you can hatch, mention, and dispatch. The hero composer was rebuilt around them — icon tools, in-place modes, and a repo picker.

• Agent — crew identities, hatching, and per-agent API connections
• Workspace — hero composer rebuilt with icon tools and in-place modes

Pictures in the chat

The full image pipeline landed. Paste, drop, or attach an image in the composer and it flows through the chat route, into message blocks, and all the way to the agent's turn — resized, re-encoded to WebP, EXIF stripped.

• Agent — attachments flow through chat, message blocks, and the turn
• Platform — image sniffing, WebP re-encode, EXIF strip on upload
• Platform — base64 encoding option on sandbox writeFiles

The secret firewall

A hardening pass with teeth. The agent cannot read secret files even when asked nicely — and now neither can the bash tool, which had been standing outside the firewall. Publishing blocks secret files by name before they ever reach a bundle, and a private project now refuses to publish onto a public URL.

Also: Stop actually stops the turn now. It used to be more of a suggestion.

• Security — bash joined the secret-file firewall
• Security — secret files blocked from published bundles by name
• Security — private projects refuse public publish
• Fix — Stop cancels the running turn immediately

A ledger that explains itself

Every credit on your balance is now explained by a ledger entry, and a turn can only be charged once. Mid-cycle upgrades grant the difference, downgrades expire what the new tier can't hold (§10 rule 7), and deleting an account stops billing and takes its sites down.

The same pass rate-limited signups and failed logins by IP, and taught Launchpad to record its own errors.

• Billing — ledger integrity: every balance explained, no double charges
• Billing — upgrade proration and downgrade clawback per §10
• Security — signup and failed-login rate limits by IP
• Platform — first-party error reporting

Launchpad in your pocket

A native-feeling mobile shell: bottom tabs, a chat sheet with snap gestures, and overlays that survive the phone keyboard. Design Mode arrived alongside it — inspect any element in the preview and flip its classes from a popover, for zero credits.

• Mobile — bottom tabs, hamburger drawer, chat sheet with snap gestures
• Workspace — Design Mode inspect and class-flip visual edits
• Billing — descriptive visual edits cost 1 credit; direct flips cost 0

The gate

One command now decides whether Launchpad works: npm run gate. Hermetic on purpose — it strips every credential so it cannot pass by talking to something real. Adding it immediately found eight defects that had been hiding in the gaps between manual checks.

CI builds the app on every push, and a read-only check watches production row-level security.

• Platform — the verification gate, and the eight defects it caught
• Platform — CI builds on Linux with a production RLS check
• Security — preview iframe sandboxed, with a check that can see it

First light

Launchpad exists: a Next.js 15 app where you describe what you want on the left and watch it become a real app on the right. Chat, agent, mock sandbox, live preview — and twenty-plus numbered feature specs written before the code that implements them.

• Platform — Phase-1 scaffold: chat → agent → sandbox → preview loop
• Site — the brand: Launch Orange, Void, and the arrowhead
• Docs — the numbered specs in features/ became the source of truth