borgmcp 0.9.57 → 0.9.59

package/dist/token-store.d.ts

@@ -0,0 +1,126 @@
+/**
+ * gh#557 — token storage backends + selection.
+ *
+ * config.ts exposes the public token API (storeIdToken/getIdToken/...). This
+ * module supplies the interchangeable storage engines it sits on top of:
+ *
+ *   - KeychainBackend      — OS keychain via @napi-rs/keyring (the default;
+ *                            real platform at-rest encryption).
+ *   - EncryptedFileBackend — ~/.borg/credentials, all accounts in one
+ *                            AES-256-GCM blob, file 0600 / dir 0700. Engages
+ *                            only when no keychain is available. Obfuscation-
+ *                            grade (see token-crypto.ts).
+ *   - caller-managed       — BORG_TOKEN / BORG_TOKEN_FILE: an externally
+ *                            supplied id_token, used read-only with no store
+ *                            (the caller owns its lifecycle/freshness).
+ *
+ * Every engine takes its side-effecting dependencies (keyring entry factory,
+ * fs, machine key) by injection so the logic is unit-tested without a real
+ * keychain or disk.
+ */
+export type TokenBackendName = 'keychain' | 'encrypted-file';
+/**
+ * Account-agnostic key/value store over a backing engine. `account` is one
+ * of config.ts's three slots (id-token, refresh-token, expiry).
+ */
+export interface TokenBackend {
+    readonly name: TokenBackendName;
+    get(account: string): Promise<string | null>;
+    set(account: string, value: string): Promise<void>;
+    delete(account: string): Promise<void>;
+}
+/**
+ * The slice of @napi-rs/keyring's AsyncEntry this backend depends on. The
+ * return types mirror AsyncEntry exactly (deletePassword resolves to an
+ * implementation-defined value we ignore) so the real class is assignable.
+ */
+export interface KeyringEntry {
+    setPassword(value: string): Promise<void>;
+    getPassword(): Promise<string | null | undefined>;
+    deletePassword(): Promise<unknown>;
+}
+export type KeyringEntryFactory = (account: string) => KeyringEntry;
+/**
+ * Build the OS-keychain backend. Preserves config.ts's prior semantics:
+ * a missing entry reads as null, and delete is silent on a NoEntry error
+ * (idempotent clear) while other errors propagate (fail-loud).
+ */
+export declare function makeKeychainBackend(entryFactory?: KeyringEntryFactory): TokenBackend;
+/** The minimal fs surface the file backend needs (injected for tests). */
+export interface FileStoreFs {
+    readFile(filePath: string): Promise<string>;
+    writeFile(filePath: string, data: string, mode: number): Promise<void>;
+    mkdir(dir: string, mode: number): Promise<void>;
+    /** Atomically move `from`→`to` (overwrites). Used for crash-safe writes. */
+    rename(from: string, to: string): Promise<void>;
+    /**
+     * Atomically create `lockPath` ONLY if it does not exist (O_EXCL). Resolves
+     * `true` if it was created (lock acquired) or `false` if it already existed
+     * (lock held by another process). This is the inter-process serialization
+     * primitive — no native dependency.
+     */
+    createExclusive(lockPath: string, content: string): Promise<boolean>;
+    /** Remove a file; silent if already gone (lock release + stale-lock steal). */
+    removeFile(filePath: string): Promise<void>;
+    /** Age in ms (now − mtime) of a file, or null if it does not exist. */
+    fileAgeMs(filePath: string): Promise<number | null>;
+}
+export interface EncryptedFileBackendDeps {
+    filePath: string;
+    key: Buffer;
+    fs: FileStoreFs;
+    /** Backoff between lock-acquire retries; defaults to a real setTimeout sleep. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Monotonic clock for the acquire deadline; defaults to Date.now. */
+    now?: () => number;
+    /** Unique suffix for the write temp file; defaults to a random hex token. */
+    uniqueSuffix?: () => string;
+}
+/**
+ * Build the encrypted-file backend. All accounts live in one JSON object
+ * encrypted as a single AES-256-GCM envelope at `filePath`.
+ *
+ * A missing file reads as an empty map. A file that won't decrypt (wrong
+ * machine key after a hostname change, truncation, tampering) is ALSO
+ * treated as empty: the only consequence is the user re-runs `borg setup`,
+ * which is the right fail-safe for credential material — a hard crash on a
+ * corrupt dotfile would be worse UX than transparent re-auth.
+ *
+ * gh#570 — concurrency + atomicity. Multiple `borg` processes (e.g. sibling
+ * drone sessions on one host) can share `~/.borg/credentials`. Two fixes:
+ *  - Anti-lost-update (load-bearing): `set`/`delete` serialize their whole
+ *    read-modify-write cycle behind an O_EXCL lock file, so concurrent
+ *    writers no longer each read a stale map and clobber each other.
+ *  - Anti-corruption: every write goes to a unique temp file then `rename`s
+ *    into place, so a reader (which is intentionally lock-FREE) always sees a
+ *    complete old-or-new file, never a torn one.
+ */
+export declare function makeEncryptedFileBackend(deps: EncryptedFileBackendDeps): TokenBackend;
+/** User-facing BORG_TOKEN_STORE values (friendlier than the backend names). */
+export type ForcedStore = 'keychain' | 'file';
+export interface SelectTokenBackendDeps {
+    keyringAvailable: () => Promise<boolean>;
+    makeKeychain: () => TokenBackend;
+    makeFile: () => TokenBackend;
+    /** BORG_TOKEN_STORE override: skip probing and force a backend. */
+    forced?: ForcedStore;
+}
+/**
+ * Select the persistent backend: a forced choice (BORG_TOKEN_STORE=keychain|file)
+ * wins and skips the probe; otherwise probe the keychain and fall back to the
+ * encrypted file when it's unavailable.
+ */
+export declare function selectTokenBackend(deps: SelectTokenBackendDeps): Promise<TokenBackend>;
+export interface CallerManagedDeps {
+    env: NodeJS.ProcessEnv;
+    readFile: (filePath: string) => Promise<string>;
+}
+/**
+ * Resolve an externally-supplied id_token (no storage). BORG_TOKEN takes
+ * precedence; otherwise BORG_TOKEN_FILE is read from disk. Returns null when
+ * neither is configured. The value is trimmed (env vars and files commonly
+ * carry trailing newlines). The caller owns this token's freshness, so it
+ * bypasses the keychain AND the expiry check in config.ts.
+ */
+export declare function readCallerManagedIdToken(deps: CallerManagedDeps): Promise<string | null>;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAID;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAClD,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAC;AAKpE;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,GAAE,mBAAyC,GACtD,YAAY,CAmBd;AAID,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,4EAA4E;IAC5E,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,+EAA+E;IAC/E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,uEAAuE;IACvE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,WAAW,CAAC;IAChB,iFAAiF;IACjF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,wBAAwB,GAAG,YAAY,CAoGrF;AAID,+EAA+E;AAC/E,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,YAAY,EAAE,MAAM,YAAY,CAAC;IACjC,QAAQ,EAAE,MAAM,YAAY,CAAC;IAC7B,mEAAmE;IACnE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAIvB;AAID,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB"}

package/dist/token-store.js

@@ -0,0 +1,222 @@
+/**
+ * gh#557 — token storage backends + selection.
+ *
+ * config.ts exposes the public token API (storeIdToken/getIdToken/...). This
+ * module supplies the interchangeable storage engines it sits on top of:
+ *
+ *   - KeychainBackend      — OS keychain via @napi-rs/keyring (the default;
+ *                            real platform at-rest encryption).
+ *   - EncryptedFileBackend — ~/.borg/credentials, all accounts in one
+ *                            AES-256-GCM blob, file 0600 / dir 0700. Engages
+ *                            only when no keychain is available. Obfuscation-
+ *                            grade (see token-crypto.ts).
+ *   - caller-managed       — BORG_TOKEN / BORG_TOKEN_FILE: an externally
+ *                            supplied id_token, used read-only with no store
+ *                            (the caller owns its lifecycle/freshness).
+ *
+ * Every engine takes its side-effecting dependencies (keyring entry factory,
+ * fs, machine key) by injection so the logic is unit-tested without a real
+ * keychain or disk.
+ */
+import path from 'path';
+import crypto from 'crypto';
+import { AsyncEntry } from '@napi-rs/keyring';
+import { decryptString, encryptString } from './token-crypto.js';
+const SERVICE_NAME = 'borg-mcp';
+const defaultEntryFactory = (account) => new AsyncEntry(SERVICE_NAME, account);
+/**
+ * Build the OS-keychain backend. Preserves config.ts's prior semantics:
+ * a missing entry reads as null, and delete is silent on a NoEntry error
+ * (idempotent clear) while other errors propagate (fail-loud).
+ */
+export function makeKeychainBackend(entryFactory = defaultEntryFactory) {
+    return {
+        name: 'keychain',
+        async get(account) {
+            return (await entryFactory(account).getPassword()) ?? null;
+        },
+        async set(account, value) {
+            await entryFactory(account).setPassword(value);
+        },
+        async delete(account) {
+            try {
+                await entryFactory(account).deletePassword();
+            }
+            catch (err) {
+                const msg = String(err?.message ?? '');
+                if (/no entry|not found|no matching/i.test(msg))
+                    return;
+                throw err;
+            }
+        },
+    };
+}
+// gh#570 lock tuning. Token writes are tiny + infrequent, so a short retry
+// cadence + a generous staleness window are right: the staleness window only
+// has to exceed a real write (milliseconds), and a crashed lock-holder is
+// reclaimed after it.
+const LOCK_RETRY_DELAY_MS = 25;
+const LOCK_MAX_WAIT_MS = 2000;
+const LOCK_STALE_MS = 10_000;
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function defaultUniqueSuffix() {
+    // PID + random keeps two concurrent writers' temp files distinct so the
+    // temp write itself never races. crypto is already a client dependency.
+    return `${process.pid}.${crypto.randomBytes(6).toString('hex')}`;
+}
+/**
+ * Build the encrypted-file backend. All accounts live in one JSON object
+ * encrypted as a single AES-256-GCM envelope at `filePath`.
+ *
+ * A missing file reads as an empty map. A file that won't decrypt (wrong
+ * machine key after a hostname change, truncation, tampering) is ALSO
+ * treated as empty: the only consequence is the user re-runs `borg setup`,
+ * which is the right fail-safe for credential material — a hard crash on a
+ * corrupt dotfile would be worse UX than transparent re-auth.
+ *
+ * gh#570 — concurrency + atomicity. Multiple `borg` processes (e.g. sibling
+ * drone sessions on one host) can share `~/.borg/credentials`. Two fixes:
+ *  - Anti-lost-update (load-bearing): `set`/`delete` serialize their whole
+ *    read-modify-write cycle behind an O_EXCL lock file, so concurrent
+ *    writers no longer each read a stale map and clobber each other.
+ *  - Anti-corruption: every write goes to a unique temp file then `rename`s
+ *    into place, so a reader (which is intentionally lock-FREE) always sees a
+ *    complete old-or-new file, never a torn one.
+ */
+export function makeEncryptedFileBackend(deps) {
+    const { filePath, key, fs } = deps;
+    const sleep = deps.sleep ?? defaultSleep;
+    const now = deps.now ?? Date.now;
+    const uniqueSuffix = deps.uniqueSuffix ?? defaultUniqueSuffix;
+    const lockPath = `${filePath}.lock`;
+    async function readMap() {
+        let raw;
+        try {
+            raw = await fs.readFile(filePath);
+        }
+        catch {
+            return {}; // missing file → no stored tokens yet
+        }
+        try {
+            const json = decryptString(raw.trim(), key);
+            const parsed = JSON.parse(json);
+            return parsed && typeof parsed === 'object' ? parsed : {};
+        }
+        catch {
+            return {}; // undecryptable / corrupt → fail safe to re-auth
+        }
+    }
+    async function writeMap(map) {
+        await fs.mkdir(path.dirname(filePath), 0o700);
+        // Atomic write: encrypt → temp → rename. rename preserves the temp's 0600.
+        const tmpPath = `${filePath}.${uniqueSuffix()}.tmp`;
+        await fs.writeFile(tmpPath, encryptString(JSON.stringify(map), key), 0o600);
+        try {
+            await fs.rename(tmpPath, filePath);
+        }
+        catch (err) {
+            // rename failed (disk full / permission). Remove the orphaned temp so
+            // repeated failures don't accumulate .tmp files, then rethrow so the
+            // caller still fails loud. Cleanup is best-effort — a failed unlink must
+            // not mask the original error.
+            try {
+                await fs.removeFile(tmpPath);
+            }
+            catch {
+                /* ignore cleanup failure — the original rename error takes precedence */
+            }
+            throw err;
+        }
+    }
+    /**
+     * Run `fn` while holding the O_EXCL lock, serializing read-modify-write
+     * across processes. A lock left by a crashed holder is reclaimed once it is
+     * older than LOCK_STALE_MS. If the lock can't be acquired within
+     * LOCK_MAX_WAIT_MS, proceed best-effort (steal it): the worst case is the
+     * original benign lost-update, never a stuck auth.
+     */
+    async function withFileLock(fn) {
+        const deadline = now() + LOCK_MAX_WAIT_MS;
+        let held = false;
+        while (!held) {
+            held = await fs.createExclusive(lockPath, `${process.pid}@${now()}`);
+            if (held)
+                break;
+            const age = await fs.fileAgeMs(lockPath);
+            if (age !== null && age > LOCK_STALE_MS) {
+                await fs.removeFile(lockPath); // reclaim a stale (crashed-holder) lock
+                continue;
+            }
+            if (now() >= deadline) {
+                await fs.removeFile(lockPath); // last resort: steal + proceed best-effort
+                held = await fs.createExclusive(lockPath, `${process.pid}@${now()}`);
+                break;
+            }
+            await sleep(LOCK_RETRY_DELAY_MS);
+        }
+        try {
+            return await fn();
+        }
+        finally {
+            if (held)
+                await fs.removeFile(lockPath);
+        }
+    }
+    return {
+        name: 'encrypted-file',
+        async get(account) {
+            // Lock-free: temp+rename guarantees readMap sees a complete file.
+            const map = await readMap();
+            return Object.prototype.hasOwnProperty.call(map, account) ? map[account] : null;
+        },
+        set(account, value) {
+            return withFileLock(async () => {
+                const map = await readMap();
+                map[account] = value;
+                await writeMap(map);
+            });
+        },
+        delete(account) {
+            return withFileLock(async () => {
+                const map = await readMap();
+                if (Object.prototype.hasOwnProperty.call(map, account)) {
+                    delete map[account];
+                    await writeMap(map);
+                }
+            });
+        },
+    };
+}
+/**
+ * Select the persistent backend: a forced choice (BORG_TOKEN_STORE=keychain|file)
+ * wins and skips the probe; otherwise probe the keychain and fall back to the
+ * encrypted file when it's unavailable.
+ */
+export async function selectTokenBackend(deps) {
+    if (deps.forced === 'keychain')
+        return deps.makeKeychain();
+    if (deps.forced === 'file')
+        return deps.makeFile();
+    return (await deps.keyringAvailable()) ? deps.makeKeychain() : deps.makeFile();
+}
+/**
+ * Resolve an externally-supplied id_token (no storage). BORG_TOKEN takes
+ * precedence; otherwise BORG_TOKEN_FILE is read from disk. Returns null when
+ * neither is configured. The value is trimmed (env vars and files commonly
+ * carry trailing newlines). The caller owns this token's freshness, so it
+ * bypasses the keychain AND the expiry check in config.ts.
+ */
+export async function readCallerManagedIdToken(deps) {
+    const inline = deps.env.BORG_TOKEN?.trim();
+    if (inline)
+        return inline;
+    const file = deps.env.BORG_TOKEN_FILE?.trim();
+    if (file) {
+        const contents = await deps.readFile(file);
+        return contents.trim();
+    }
+    return null;
+}
+//# sourceMappingURL=token-store.js.map

package/dist/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,YAAY,GAAG,UAAU,CAAC;AA8BhC,MAAM,mBAAmB,GAAwB,CAAC,OAAO,EAAE,EAAE,CAC3D,IAAI,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,eAAoC,mBAAmB;IAEvD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,OAAO,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;YACtB,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;gBACvC,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACxD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAsCD,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,sBAAsB;AACtB,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB;IAC1B,wEAAwE;IACxE,wEAAwE;IACxE,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA8B;IACrE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,QAAQ,OAAO,CAAC;IAEpC,KAAK,UAAU,OAAO;QACpB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,sCAAsC;QACnD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,iDAAiD;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,GAAe;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,YAAY,EAAE,MAAM,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,qEAAqE;YACrE,yEAAyE;YACzE,+BAA+B;YAC/B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,YAAY,CAAI,EAAoB;QACjD,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,gBAAgB,CAAC;QAC1C,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YACrE,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,aAAa,EAAE,CAAC;gBACxC,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,wCAAwC;gBACvE,SAAS;YACX,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,2CAA2C;gBAC1E,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrE,MAAM;YACR,CAAC;YACD,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI;gBAAE,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,CAAC;QACD,GAAG,CAAC,OAAO,EAAE,KAAK;YAChB,OAAO,YAAY,CAAC,KAAK,IAAI,EAAE;gBAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;gBACrB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,OAAO;YACZ,OAAO,YAAY,CAAC,KAAK,IAAI,EAAE;gBAC7B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;oBACvD,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpB,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B;IAE5B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACnD,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;AACjF,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "borgmcp",
-  "version": "0.9.57",
+  "version": "0.9.59",
   "description": "Coordinate AI coding agents in shared cubes. Works with Claude Code and Codex. Create projects, assign roles, and share a live activity log.",
   "type": "module",
   "main": "dist/index.js",
@@ -40,15 +40,7 @@
   ],
   "author": "Theodor Storm <theodor@byteventures.se>",
   "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/theodorstorm/borg-mcp",
-    "directory": "client"
-  },
   "homepage": "https://borgmcp.ai",
-  "bugs": {
-    "url": "https://github.com/theodorstorm/borg-mcp/issues"
-  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.4",
     "@napi-rs/keyring": "^1.3.0",