borgmcp 1.0.32 → 1.0.33

package/dist/assimilate-cmd.js

@@ -1,47 +1,48 @@
-import{dirname as Z,basename as E}from"node:path";import{randomUUID as ee}from"node:crypto";import{roleSlug as te,matchRoleByName as re,pickDefaultRole as ne}from"./role-resolver.js";import{deriveCubeName as oe,parseGitRemote as ie,sanitizeRemoteUrl as ae}from"./cube-name.js";import{validateName as F}from"./name-validator.js";import{renderAssimilationWelcome as le}from"./assimilate-welcome.js";import{shellEscape as se}from"./shell-escape.js";import{withCodexCwdArg as ce}from"./codex-remote.js";import{buildAgentKickoffPrompt as ue,recordCodexWakeTarget as me,socketPathFromRemoteArgs as de}from"./codex-launch.js";import{perWorktreeBranchName as Y,adoptWorktree as fe,computeWorktreePath as G}from"./worktree-lifecycle.js";import{codexBorgSessionConfigArgs as he}from"./launch-gate.js";import{resolveLaunchEnv as ge,resolveOllamaBaseUrl as we,parseModel as be}from"./model-presets.js";async function Oe(r,e){if(r.role!==void 0){const t=F(r.role);if(!t.ok)return e.stderr(t.error+`
+import{dirname as Z,basename as E}from"node:path";import{randomUUID as ee}from"node:crypto";import{roleSlug as te,matchRoleByName as re,pickDefaultRole as ne}from"./role-resolver.js";import{deriveCubeName as oe,parseGitRemote as ie,sanitizeRemoteUrl as ae}from"./cube-name.js";import{validateName as F}from"./name-validator.js";import{renderAssimilationWelcome as le}from"./assimilate-welcome.js";import{shellEscape as se}from"./shell-escape.js";import{withCodexCwdArg as ce}from"./codex-remote.js";import{buildAgentKickoffPrompt as ue,recordCodexWakeTarget as me,socketPathFromRemoteArgs as de}from"./codex-launch.js";import{perWorktreeBranchName as Y,adoptWorktree as fe,computeWorktreePath as G}from"./worktree-lifecycle.js";import{DroneEvictedError as he}from"./drone-lifecycle.js";import{codexBorgSessionConfigArgs as ge}from"./launch-gate.js";import{resolveLaunchEnv as we,resolveOllamaBaseUrl as be,parseModel as ke}from"./model-presets.js";async function Me(r,e){if(r.role!==void 0){const t=F(r.role);if(!t.ok)return e.stderr(t.error+`
 `),1}if(r.flags.worktree!==void 0){const t=F(r.flags.worktree);if(!t.ok)return e.stderr(t.error+`
 `),1}let i=await e.getCachedAuth();if(!i){if(!e.isTTY()&&!r.flags.yes)return e.stderr("borg setup required and stdin is non-interactive. Run `borg setup` first in an interactive terminal, then `borg assimilate`.\n"),1;i=await e.runSetup()}const a=e.findProjectRoot(e.cwd());let n;if(r.flags.cubeName)n=r.flags.cubeName;else{const t=e.runSync("git",["remote","get-url","origin"],a),o=t.status===0?t.stdout:null;if(n=oe(a,o),o){const u=ae(o),m=u?ie(u):null;u&&!m&&n&&e.stderr(`couldn't parse git remote '${u}' \u2014 using directory name '${n}' as cube name
 `)}}let l=null;if(n&&n.includes("@")&&n.includes(":")){const t=n.lastIndexOf(":");l={ownerEmail:n.substring(0,t),cubeName:n.substring(t+1)},n=l.cubeName}const x=e.cwd();e.stderr(`Checking your cubes\u2026
 `);let A;try{A=await e.listCubes(i.apiUrl,i.token)}catch(t){const o=t instanceof Error?t.message:String(t);if(o.includes("Authentication required")||o.includes("Authentication expired"))e.stderr(`Re-authenticating...
 `),i=await e.runSetup(),A=await e.listCubes(i.apiUrl,i.token);else throw t}const _=A.find(t=>t.name===n);if(!_&&l)return e.stderr(`No cube named '${l.cubeName}' accessible to you owned by '${l.ownerEmail}'. Did you accept their invite? See borgmcp.ai/dashboard.
-`),1;let c,N;if(_)c=await e.getCube(i.apiUrl,i.token,_.id),N=!1;else{let t;if(r.flags.template)t=r.flags.template;else if(r.flags.noTemplate)t=void 0;else if(e.isTTY())if(r.flags.yes)t="starter";else{const o=await e.listTemplates(i.apiUrl,i.token),u=["First drone joining a new cube. Apply a template?"];o.forEach((y,v)=>{const S=v===0?" (default)":"";u.push(`  ${v+1}) ${y.name}${S} \u2014 ${y.description}`)}),u.push(`  ${o.length+1}) skip \u2014 no template`);const m=(await e.prompt(u.join(`
+`),1;let c,N;if(_)c=await e.getCube(i.apiUrl,i.token,_.id),N=!1;else{let t;if(r.flags.template)t=r.flags.template;else if(r.flags.noTemplate)t=void 0;else if(e.isTTY())if(r.flags.yes)t="starter";else{const o=await e.listTemplates(i.apiUrl,i.token),u=["First drone joining a new cube. Apply a template?"];o.forEach((v,$)=>{const S=$===0?" (default)":"";u.push(`  ${$+1}) ${v.name}${S} \u2014 ${v.description}`)}),u.push(`  ${o.length+1}) skip \u2014 no template`);const m=(await e.prompt(u.join(`
 `)+`
 [1]: `)).trim(),k=m===""?1:parseInt(m,10);if(Number.isNaN(k)||k<1||k>o.length+1)return e.stderr(`invalid choice "${m}"
 `),1;t=k<=o.length?o[k-1].name:void 0}else{if(!r.flags.yes)return e.stderr(`cube creation needs a template choice but stdin is non-interactive.
 Pass --template <name>, --no-template, or --yes (defaults to starter).
 `),1;t="starter"}e.stderr(n?`Creating cube '${n}'\u2026
 `:`Creating your cube\u2026
-`),c=await e.createCube(i.apiUrl,i.token,t?{name:n??void 0,template:t}:{name:n??void 0}),N=!0}let d;if(r.role!==void 0){if(d=re(c.roles,r.role),!d){const t=c.roles.map(m=>m.name).join(", "),o=$e(r.role,c.roles.map(m=>m.name)),u=o?` Did you mean "${o}"?`:"";return e.stderr(`no role matching "${r.role}" in cube "${c.name}". Available: ${t}.${u}
+`),c=await e.createCube(i.apiUrl,i.token,t?{name:n??void 0,template:t}:{name:n??void 0}),N=!0}let d;if(r.role!==void 0){if(d=re(c.roles,r.role),!d){const t=c.roles.map(m=>m.name).join(", "),o=pe(r.role,c.roles.map(m=>m.name)),u=o?` Did you mean "${o}"?`:"";return e.stderr(`no role matching "${r.role}" in cube "${c.name}". Available: ${t}.${u}
 (Use --template <name> on first-drone setup or run \`borg_create-role\` from inside Claude.)
 `),1}}else if(d=ne(c.roles,{isFirstDrone:N}),!d)return e.stderr(`cube "${c.name}" has no default or human-seat role; cannot infer a role. Either pass a role argument explicitly (e.g. \`borg assimilate builder\`) or run \`borg_create-role\` from inside Claude to set up roles.
-`),1;const C=await e.getActiveCube();let $;if(C&&r.flags.here)if(C.cubeId===c.id)$=C.droneId;else return e.stderr(`this directory already hosts an active drone; remove --here or run from a fresh worktree
-`),1;const T=$!=null?await e.getLaunchModel(c.id,$):null,h=r.flags.model??T?.model??d.default_model??null,P=we(process.env,h!=null&&h===T?.model?T?.ollamaBaseUrl:void 0);if(h){const t=await e.checkModelReachable(h,e.fetch,P);if(!t.ok)return e.stderr(`${t.message}
+`),1;const C=await e.getActiveCube();let y;if(C&&r.flags.here)if(C.cubeId===c.id)y=C.droneId;else return e.stderr(`this directory already hosts an active drone; remove --here or run from a fresh worktree
+`),1;const T=y!=null?await e.getLaunchModel(c.id,y):null,h=r.flags.model??T?.model??d.default_model??null,P=be(process.env,h!=null&&h===T?.model?T?.ollamaBaseUrl:void 0);if(h){const t=await e.checkModelReachable(h,e.fetch,P);if(!t.ok)return e.stderr(`${t.message}
 `),1}const g=await e.resolveCli(r.flags.cli);e.stderr(`Joining cube '${c.name}' as ${d.name}\u2026
-`);let s;try{s=await e.assimilate(i.apiUrl,i.token,{cube_id:c.id,role_id:d.id,hostname:e.getHostname(),agent_kind:g,model:h,...$?{prior_drone_id:$}:{}})}catch(t){const o=t instanceof Error?t.message:String(t);return e.stderr(`assimilate failed: ${o}
+`);let s;try{s=await e.assimilate(i.apiUrl,i.token,{cube_id:c.id,role_id:d.id,hostname:e.getHostname(),agent_kind:g,model:h,...y?{prior_drone_id:y}:{}})}catch(t){if(t instanceof he&&y!=null)return e.stderr(`seat evicted \u2014 this worktree's saved seat was evicted from the cube. Re-assimilate fresh from a terminal, or remove this worktree.
+`),1;const o=t instanceof Error?t.message:String(t);return e.stderr(`assimilate failed: ${o}
 `),1}const p=c.roles.find(t=>t.id===s.role_id)??d;s.reattached?e.stderr(`re-attached to existing seat ${s.drone_label} (session token rotated, no new drone minted)
 `):p.id!==d.id&&e.stderr(`Note: your invite didn't grant the "${d.name}" role \u2014 assimilated as "${p.name}" instead.
 `);const z=r.flags.worktree!==void 0||C!==null&&!r.flags.here;let f=null;if(z){const t=e.runSync("git",["rev-parse","--verify","HEAD"],a);if(t.status!==0)return e.stderr(`sibling worktree spawn requires HEAD pointing at a commit.
   Fix: create at least one commit (\`git commit --allow-empty -m "initial"\`)
   OR:  pass --here to skip the sibling spawn and use the current directory
 `),1;e.runSync("git",["fetch","origin"],a);let o="origin/main";e.runSync("git",["rev-parse","--verify","origin/main"],a).status!==0&&e.runSync("git",["rev-parse","--verify","origin/master"],a).status===0&&(o="origin/master");const m=t.stdout.trim(),k=e.runSync("git",["rev-parse",o],a).stdout.trim();m!==k&&e.stderr(`note: local HEAD (${m.slice(0,7)}) differs from ${o} (${k.slice(0,7)}); new worktree will start on ${o}
-`);const y=E(a),v=r.flags.worktree??te(p.name);if(v.length===0)return e.stderr(`cannot derive a worktree name from role "${p.name}"; pass an explicit --worktree <name>
-`),1;const S=e.homedir();let b=G(S,y,v),H=2;for(;e.pathExists(b)||ve(e,a,b);)b=G(S,y,v,H),H++;e.mkdirp(Z(b));const O=Y(E(b),y),B=e.runSync("git",["worktree","add","-b",O,b,o],a);if(B.status!==0)return e.stderr(`git worktree add failed: ${q(B.stderr)}
+`);const v=E(a),$=r.flags.worktree??te(p.name);if($.length===0)return e.stderr(`cannot derive a worktree name from role "${p.name}"; pass an explicit --worktree <name>
+`),1;const S=e.homedir();let b=G(S,v,$),H=2;for(;e.pathExists(b)||$e(e,a,b);)b=G(S,v,$,H),H++;e.mkdirp(Z(b));const O=Y(E(b),v),B=e.runSync("git",["worktree","add","-b",O,b,o],a);if(B.status!==0)return e.stderr(`git worktree add failed: ${q(B.stderr)}
 `),1;e.stderr(`spawned sibling worktree at ${b} on branch ${O} (${o}); original dir is registered as active (edit ~/.config/borgmcp/cubes.json if stale).
-`),e.chdir(b),e.stderr(ke(b,O,a)),f=e.cwd()}try{await e.setActiveCube({cubeId:s.cube_id,droneId:s.drone_id,name:c.name,sessionToken:s.session_token,droneLabel:s.drone_label,apiUrl:i.apiUrl})}catch(t){const o=t instanceof Error?t.message:String(t);if(e.stderr(`setActiveCube failed: ${o}
+`),e.chdir(b),e.stderr(ye(b,O,a)),f=e.cwd()}try{await e.setActiveCube({cubeId:s.cube_id,droneId:s.drone_id,name:c.name,sessionToken:s.session_token,droneLabel:s.drone_label,apiUrl:i.apiUrl})}catch(t){const o=t instanceof Error?t.message:String(t);if(e.stderr(`setActiveCube failed: ${o}
 `),f){const u=e.runSync("git",["worktree","remove","--force",f],a);u.status===0?e.stderr(`rolled back spawned worktree at ${f}
 `):e.stderr(`manual cleanup needed: \`git worktree remove --force ${f}\` (rollback attempt failed: ${q(u.stderr).trim()||"unknown"})
 `)}return 1}e.setTerminalTitle(s.drone_label,c.name);const K=e.isTTY()&&!process.env.NO_COLOR&&!process.env.CI;e.stdout(le(p.name,c.name,K));const w=e.cwd();try{e.installProjectSessionHook(w)}catch{e.stderr(`warning: could not install the project-local SessionStart hook in ${w}; it will be re-attempted on the next borg launch
 `)}if(!f){e.runSync("git",["fetch","origin","--prune"],w);const t=Y(E(w),E(a)),o=fe(e.runSync,w,t,"origin/main");o.action==="adopted"?(e.stderr(`worktree: adopted branch ${t} at origin/main
-`),e.stderr(ye(w,t))):o.message&&e.stderr(`worktree sync: ${o.message}
+`),e.stderr(ve(w,t))):o.message&&e.stderr(`worktree sync: ${o.message}
 `)}await e.probeMcpReady()||e.stderr(`warning: borg-mcp readiness probe did not complete within the timeout; launching ${g} anyway \u2014 the kickoff prompt's ToolSearch fallback will recover if the MCP server takes longer to start.
-`);const J=e.getInboxPath(s.cube_id,s.drone_id),I=g==="codex"?`borg-wake-${ee()}`:null,V=g==="claude"?`If you haven't yet, arm a persistent Monitor running the command \`borg-inbox-monitor ${J}\` so each event's task-notification title summarizes the new cube log entry (drone label, role, and first ~80 chars of the message body) \u2014 letting you triage events without reading the full body. `:"";let U,W=[],R,L=null,j=null;h?await e.setLaunchModel(s.cube_id,s.drone_id,{model:h,ollamaBaseUrl:be(h).kind==="ollama"?P:null}):await e.clearLaunchModel(s.cube_id,s.drone_id);const M=ge(h,P),D={...process.env,...M.set,BORG_SESSION:"1"};for(const t of M.unset)delete D[t];if(g==="codex"){const t=await e.prepareCodexRemoteLaunch();t.warning?(e.stderr(`warning: ${t.warning}
-`),U="\u26A0 Codex wake-path capability check failed: remote-control is unavailable for this session. Run borg_regen manually whenever you return, and expect only fallback wakeups until relaunch."):U="Codex wake-path capability check passed: remote-control socket established for this session.",W=t.args,Object.keys(t.env).length>0&&Object.assign(D,t.env),L=de(t.args),j=t.server?.cleanup??null}R=[ue({cli:g,codexWakeNonce:I,monitorClause:V,codexWakePathClause:U})],g==="codex"&&(R=[...he(),...W,...ce(R,w)]);const Q=e.exec(g,R,w,D);g==="codex"&&L&&I&&me({deps:e,cubeId:s.cube_id,droneId:s.drone_id,socketPath:L,cwd:w,previewNeedle:I,launchedAtSeconds:Math.floor(Date.now()/1e3)});const X=await Q;if(j)try{j()}catch{}return f&&x!==f&&e.stderr(`
+`);const J=e.getInboxPath(s.cube_id,s.drone_id),I=g==="codex"?`borg-wake-${ee()}`:null,V=g==="claude"?`If you haven't yet, arm a persistent Monitor running the command \`borg-inbox-monitor ${J}\` so each event's task-notification title summarizes the new cube log entry (drone label, role, and first ~80 chars of the message body) \u2014 letting you triage events without reading the full body. `:"";let U,W=[],R,L=null,D=null;h?await e.setLaunchModel(s.cube_id,s.drone_id,{model:h,ollamaBaseUrl:ke(h).kind==="ollama"?P:null}):await e.clearLaunchModel(s.cube_id,s.drone_id);const M=we(h,P),j={...process.env,...M.set,BORG_SESSION:"1"};for(const t of M.unset)delete j[t];if(g==="codex"){const t=await e.prepareCodexRemoteLaunch();t.warning?(e.stderr(`warning: ${t.warning}
+`),U="\u26A0 Codex wake-path capability check failed: remote-control is unavailable for this session. Run borg_regen manually whenever you return, and expect only fallback wakeups until relaunch."):U="Codex wake-path capability check passed: remote-control socket established for this session.",W=t.args,Object.keys(t.env).length>0&&Object.assign(j,t.env),L=de(t.args),D=t.server?.cleanup??null}R=[ue({cli:g,codexWakeNonce:I,monitorClause:V,codexWakePathClause:U})],g==="codex"&&(R=[...ge(),...W,...ce(R,w)]);const Q=e.exec(g,R,w,j);g==="codex"&&L&&I&&me({deps:e,cubeId:s.cube_id,droneId:s.drone_id,socketPath:L,cwd:w,previewNeedle:I,launchedAtSeconds:Math.floor(Date.now()/1e3)});const X=await Q;if(D)try{D()}catch{}return f&&x!==f&&e.stderr(`
 Agent exited. You were working in ${f}; your shell is back in ${x}.
 To return:
   cd ${se(f)}
-`),X}function ke(r,e,i){return`
+`),X}function ye(r,e,i){return`
 WORKTREE STEERING: You are in worktree ${r} on branch ${e}. Do ALL work HERE \u2014 cut your feature branch (fix/.../feat/...) off ${e} in THIS worktree, use relative paths / your cwd. NEVER \`git -C ${i}\` or operate on the primary checkout ${i}: the same branch can't be checked out in two worktrees, so work created in the primary won't reach your wt-branch without manual surgery (cherry-pick/merge).
-`}function ye(r,e){return`
+`}function ve(r,e){return`
 WORKTREE STEERING: This checkout is now on branch ${e}. Do ALL work HERE in ${r} \u2014 cut your feature branch (fix/.../feat/...) off ${e}, use relative paths / your cwd.
-`}function q(r){return r.replace(/[\x00-\x1F\x7F]/g,"")}function ve(r,e,i){const a=r.runSync("git",["worktree","list","--porcelain"],e);return a.status!==0?!1:a.stdout.split(`
-`).some(n=>n===`worktree ${i}`)}function $e(r,e){if(e.length===0)return null;const i=r.toLowerCase();let a=null;for(const n of e){const l=pe(i,n.toLowerCase());l<=2&&(a===null||l<a.distance)&&(a={name:n,distance:l})}return a?a.name:null}function pe(r,e){if(r===e)return 0;if(r.length===0)return e.length;if(e.length===0)return r.length;const i=new Array(e.length+1),a=new Array(e.length+1);for(let n=0;n<=e.length;n++)i[n]=n;for(let n=1;n<=r.length;n++){a[0]=n;for(let l=1;l<=e.length;l++){const x=r[n-1]===e[l-1]?0:1;a[l]=Math.min(a[l-1]+1,i[l]+1,i[l-1]+x)}for(let l=0;l<=e.length;l++)i[l]=a[l]}return i[e.length]}export{Oe as runAssimilate,q as safeStderr,$e as suggestRoleName};
+`}function q(r){return r.replace(/[\x00-\x1F\x7F]/g,"")}function $e(r,e,i){const a=r.runSync("git",["worktree","list","--porcelain"],e);return a.status!==0?!1:a.stdout.split(`
+`).some(n=>n===`worktree ${i}`)}function pe(r,e){if(e.length===0)return null;const i=r.toLowerCase();let a=null;for(const n of e){const l=xe(i,n.toLowerCase());l<=2&&(a===null||l<a.distance)&&(a={name:n,distance:l})}return a?a.name:null}function xe(r,e){if(r===e)return 0;if(r.length===0)return e.length;if(e.length===0)return r.length;const i=new Array(e.length+1),a=new Array(e.length+1);for(let n=0;n<=e.length;n++)i[n]=n;for(let n=1;n<=r.length;n++){a[0]=n;for(let l=1;l<=e.length;l++){const x=r[n-1]===e[l-1]?0:1;a[l]=Math.min(a[l-1]+1,i[l]+1,i[l-1]+x)}for(let l=0;l<=e.length;l++)i[l]=a[l]}return i[e.length]}export{Me as runAssimilate,q as safeStderr,pe as suggestRoleName};

package/dist/cleanup-cmd.d.ts

@@ -34,16 +34,8 @@
  */
 import { type RunSync } from './worktree-lifecycle.js';
 import { type ActiveCube } from './cubes.js';
-/**
- * Eviction-probe verdict for ONE worktree's saved seat (gh#877 reuse).
- * Mapped 1:1 from the server's per-caller-seat discrimination:
- *   evicted  ← 410 DRONE_EVICTED  (the ONLY delete authority — S1)
- *   frozen   ← 423 DRONE_FROZEN   (reversible — KEEP)
- *   live     ← 200                (resolves — KEEP)
- *   indeterminate ← 401 / 404 / timeout / 5xx / network (transient or
- *                   pre-gh#877-deploy) → report-only, NEVER delete (S2/S3)
- */
-export type SeatStatus = 'evicted' | 'frozen' | 'live' | 'indeterminate';
+import { type SeatStatus } from './seat-probe.js';
+export type { SeatStatus };
 /** Per-worktree classification outcome. PRUNABLE is the ONLY delete class. */
 export type CleanupReason = 'PRUNABLE' | 'SURVIVES-dirty' | 'SURVIVES-clobber' | 'SURVIVES-unmerged' | 'SURVIVES-detached' | 'SURVIVES-frozen' | 'SURVIVES-live' | 'SURVIVES-self' | 'UNKNOWN-indeterminate' | 'UNKNOWN-no-seat' | 'LEGACY-manual-review';
 export interface CleanupRow {

package/dist/cleanup-cmd.js

@@ -1,13 +1,13 @@
-import{spawnSync as P}from"node:child_process";import{realpathSync as D}from"node:fs";import{sep as R}from"node:path";import{homedir as V}from"node:os";import c from"chalk";import{classifyDirty as I,isMerged as A,worktreesHome as L}from"./worktree-lifecycle.js";import{readAllProjectIdentities as W}from"./cubes.js";import{whoami as x}from"./remote-client.js";import{DroneEvictedError as _,DroneFrozenError as C}from"./drone-lifecycle.js";const $="origin/main",F=new Set(["node_modules","dist","build",".next","coverage",".wrangler",".playwright-mcp"]),O=new Set([".DS_Store","worker-configuration.d.ts"]),j=[".log",".tsbuildinfo",".tmp"];function z(r){const n=r.replace(/\/+$/,""),e=n.split("/").filter(s=>s.length>0);if(e.some(s=>F.has(s)))return!0;const t=e[e.length-1]??n;return!!(O.has(t)||j.some(s=>t.endsWith(s)))}function G(r,n){const e=r("git",["status","--porcelain","--ignored"],n);if(e.status!==0)return["<git status --ignored failed \u2014 cannot verify clean>"];const t=[];for(const s of e.stdout.split(`
-`)){if(!s.startsWith("!!"))continue;const i=s.slice(3).trim();i.length!==0&&(z(i)||t.push(i))}return t}const H={runSync:(r,n,e)=>{const t=P(r,n,{cwd:e,encoding:"utf-8"});return{status:t.status,stdout:t.stdout??"",stderr:t.stderr??""}},homeDir:()=>V(),cwd:()=>process.cwd(),listSeats:()=>W(),probeSeat:M,realpath:r=>D(r),stdout:r=>process.stdout.write(r),stderr:r=>process.stderr.write(r)};async function M(r,n){try{return await x(r,n),"live"}catch(e){return e instanceof _?"evicted":e instanceof C?"frozen":"indeterminate"}}function T(r,n,e){let t,s;try{t=r(n),s=r(e)}catch{return!1}if(s===t)return!1;const i=t.endsWith(R)?t:t+R;return s.startsWith(i)}function oe(r){return v(r).map(n=>n.path)}function v(r){const n=[];let e=null;for(const t of r.split(`
-`))t.startsWith("worktree ")?(e&&n.push(e),e={path:t.slice(9).trim(),branch:null}):t.startsWith("branch ")&&e&&(e.branch=t.slice(7).trim().replace(/^refs\/heads\//,""));return e&&n.push(e),n}async function K(r,n,e,t){const{runSync:s}=r,i=I(s,n),l=i.staged.length+i.unstaged.length+i.untracked.length;if(l>0)return{reason:"SURVIVES-dirty",detail:`${l} uncommitted file(s)`};const u=G(s,n);if(u.length>0)return{reason:"SURVIVES-clobber",detail:`gitignored local state: ${u.slice(0,3).join(", ")}${u.length>3?` (+${u.length-3})`:""}`};if(e===null)return{reason:"SURVIVES-detached",detail:"detached HEAD \u2014 cannot verify merged"};if(!A(s,n,e,$))return{reason:"SURVIVES-unmerged",detail:`${e} not merged into ${$}`};switch(await r.probeSeat(t.sessionToken,t.apiUrl)){case"evicted":return{reason:"PRUNABLE",detail:"410 DRONE_EVICTED (clean + merged)"};case"frozen":return{reason:"SURVIVES-frozen",detail:"423 DRONE_FROZEN (reversible)"};case"live":return{reason:"SURVIVES-live",detail:"seat resolves (drone alive)"};default:return{reason:"UNKNOWN-indeterminate",detail:"probe returned 401/network/transient (or gh#877 not yet deployed) \u2014 not deleting"}}}async function X(r){const{runSync:n,realpath:e}=r,t=r.cwd();if(n("git",["rev-parse","--show-toplevel"],t).status!==0)return{rows:[],error:`not in a git repository (cwd: ${t})`};const s=n("git",["fetch","origin","--prune"],t);if(s.status!==0)return{rows:[],error:`git fetch origin failed: ${s.stderr.trim()}`};const i=n("git",["worktree","list","--porcelain"],t);if(i.status!==0)return{rows:[],error:`git worktree list failed: ${i.stderr.trim()}`};const l=v(i.stdout),u=new Map(l.map(a=>[a.path,a.branch])),f=l.map(a=>a.path),b=f[0],w=r.homeDir(),p=L(w),o=y(e,t),d=b?y(e,b):null,E=await r.listSeats(),S=new Map;for(const{projectPath:a,cube:h}of E){const g=y(e,a);g&&S.set(g,h)}const m=[];for(const a of f){const h=y(e,a);if(!h||d&&h===d)continue;const g=S.get(h),U=T(e,p,a);if(h===o){m.push({worktreePath:a,wtBranch:null,reason:"SURVIVES-self",detail:"current worktree"});continue}if(!U){g&&m.push({worktreePath:a,wtBranch:null,reason:"LEGACY-manual-review",detail:"borg seat outside worktreesHome (pre-gh#556 sibling)"});continue}if(!g){m.push({worktreePath:a,wtBranch:null,reason:"UNKNOWN-no-seat",detail:"no cubes.json seat \u2014 manual review"});continue}const k=u.get(a)??null,{reason:B,detail:N}=await K(r,a,k,g);m.push({worktreePath:a,wtBranch:k,reason:B,detail:N})}return{rows:m}}function y(r,n){try{return r(n)}catch{return null}}async function se(r={},n={prune:!1}){const e={...H,...r},{stdout:t,stderr:s,runSync:i}=e,{rows:l,error:u}=await X(e);if(u)return s(c.red(`\u25FC borg cleanup: ${u}
-`)),1;const f=l.filter(o=>o.reason==="PRUNABLE"),b=l.filter(o=>o.reason!=="PRUNABLE");if(l.length===0)return t(c.blue(`\u25FC borg cleanup: no borg-managed worktrees found.
-`)),0;t(c.bold(`\u25FC borg cleanup report:
-`));for(const o of l){const d=o.reason==="PRUNABLE"?c.yellow(o.reason):c.gray(o.reason);t(`  ${d}  ${o.worktreePath}${o.detail?c.gray(`  \u2014 ${o.detail}`):""}
-`)}if(t(c.gray(`\u25FC ${f.length} prunable, ${b.length} kept.
-`)),!n.prune)return f.length>0&&t(c.gray("\u25FC Dry-run \u2014 nothing deleted. Re-run with `--prune` to remove the PRUNABLE worktree(s).\n")),0;if(f.length===0)return t(c.blue(`\u25FC Nothing to prune.
-`)),0;let w=0,p=0;for(const o of f){const d=i("git",["worktree","remove",o.worktreePath],e.cwd());if(d.status!==0){o.prune="remove-failed",p++,s(c.red(`  \u2717 worktree remove ${o.worktreePath}: ${d.stderr.trim()}
-`));continue}if(o.wtBranch){const E=i("git",["branch","-d",o.wtBranch],e.cwd());if(E.status!==0){o.prune="branch-delete-failed",s(c.yellow(`  \u26A0 removed worktree but \`git branch -d ${o.wtBranch}\` refused: ${E.stderr.trim()}
-`)),w++;continue}}o.prune="removed",w++,t(c.blue(`  \u2713 pruned ${o.worktreePath}${o.wtBranch?` + branch ${o.wtBranch}`:""}
-`))}return t(c.gray(`\u25FC Pruned ${w} worktree(s)${p>0?`, ${p} failed`:""}.
-`)),p>0?1:0}function ie(r){let n=!1;for(const e of r)if(e==="--prune")n=!0;else return{ok:!1,error:`unexpected argument: ${e}. Usage: borg cleanup [--prune]`};return{ok:!0,options:{prune:n}}}export{X as buildCleanupReport,G as clobberClassIgnored,z as isRegenerableIgnored,T as isStrictlyUnder,ie as parseCleanupArgs,v as parseWorktreeEntries,oe as parseWorktreeList,se as runCleanup};
+import{spawnSync as P}from"node:child_process";import{realpathSync as V}from"node:fs";import{sep as R}from"node:path";import{homedir as I}from"node:os";import c from"chalk";import{classifyDirty as A,isMerged as D,worktreesHome as L}from"./worktree-lifecycle.js";import{readAllProjectIdentities as W}from"./cubes.js";import{defaultProbeSeat as x}from"./seat-probe.js";const $="origin/main",_=new Set(["node_modules","dist","build",".next","coverage",".wrangler",".playwright-mcp",".claude"]),C=new Set([".DS_Store","worker-configuration.d.ts"]),F=[".log",".tsbuildinfo",".tmp"];function O(r){const n=r.replace(/\/+$/,""),t=n.split("/").filter(s=>s.length>0);if(t.some(s=>_.has(s)))return!0;const e=t[t.length-1]??n;return!!(C.has(e)||F.some(s=>e.endsWith(s)))}function j(r,n){const t=r("git",["status","--porcelain","--ignored"],n);if(t.status!==0)return["<git status --ignored failed \u2014 cannot verify clean>"];const e=[];for(const s of t.stdout.split(`
+`)){if(!s.startsWith("!!"))continue;const i=s.slice(3).trim();i.length!==0&&(O(i)||e.push(i))}return e}const G={runSync:(r,n,t)=>{const e=P(r,n,{cwd:t,encoding:"utf-8"});return{status:e.status,stdout:e.stdout??"",stderr:e.stderr??""}},homeDir:()=>I(),cwd:()=>process.cwd(),listSeats:()=>W(),probeSeat:x,realpath:r=>V(r),stdout:r=>process.stdout.write(r),stderr:r=>process.stderr.write(r)};function H(r,n,t){let e,s;try{e=r(n),s=r(t)}catch{return!1}if(s===e)return!1;const i=e.endsWith(R)?e:e+R;return s.startsWith(i)}function ee(r){return v(r).map(n=>n.path)}function v(r){const n=[];let t=null;for(const e of r.split(`
+`))e.startsWith("worktree ")?(t&&n.push(t),t={path:e.slice(9).trim(),branch:null}):e.startsWith("branch ")&&t&&(t.branch=e.slice(7).trim().replace(/^refs\/heads\//,""));return t&&n.push(t),n}async function M(r,n,t,e){const{runSync:s}=r,i=A(s,n),l=i.staged.length+i.unstaged.length+i.untracked.length;if(l>0)return{reason:"SURVIVES-dirty",detail:`${l} uncommitted file(s)`};const u=j(s,n);if(u.length>0)return{reason:"SURVIVES-clobber",detail:`gitignored local state: ${u.slice(0,3).join(", ")}${u.length>3?` (+${u.length-3})`:""}`};if(t===null)return{reason:"SURVIVES-detached",detail:"detached HEAD \u2014 cannot verify merged"};if(!D(s,n,t,$))return{reason:"SURVIVES-unmerged",detail:`${t} not merged into ${$}`};switch(await r.probeSeat(e.sessionToken,e.apiUrl)){case"evicted":return{reason:"PRUNABLE",detail:"410 DRONE_EVICTED (clean + merged)"};case"frozen":return{reason:"SURVIVES-frozen",detail:"423 DRONE_FROZEN (reversible)"};case"live":return{reason:"SURVIVES-live",detail:"seat resolves (drone alive)"};default:return{reason:"UNKNOWN-indeterminate",detail:"probe returned 401/network/transient (or gh#877 not yet deployed) \u2014 not deleting"}}}async function T(r){const{runSync:n,realpath:t}=r,e=r.cwd();if(n("git",["rev-parse","--show-toplevel"],e).status!==0)return{rows:[],error:`not in a git repository (cwd: ${e})`};const s=n("git",["fetch","origin","--prune"],e);if(s.status!==0)return{rows:[],error:`git fetch origin failed: ${s.stderr.trim()}`};const i=n("git",["worktree","list","--porcelain"],e);if(i.status!==0)return{rows:[],error:`git worktree list failed: ${i.stderr.trim()}`};const l=v(i.stdout),u=new Map(l.map(a=>[a.path,a.branch])),d=l.map(a=>a.path),b=d[0],w=r.homeDir(),p=L(w),o=y(t,e),f=b?y(t,b):null,E=await r.listSeats(),S=new Map;for(const{projectPath:a,cube:h}of E){const g=y(t,a);g&&S.set(g,h)}const m=[];for(const a of d){const h=y(t,a);if(!h||f&&h===f)continue;const g=S.get(h),U=H(t,p,a);if(h===o){m.push({worktreePath:a,wtBranch:null,reason:"SURVIVES-self",detail:"current worktree"});continue}if(!U){g&&m.push({worktreePath:a,wtBranch:null,reason:"LEGACY-manual-review",detail:"borg seat outside worktreesHome (pre-gh#556 sibling)"});continue}if(!g){m.push({worktreePath:a,wtBranch:null,reason:"UNKNOWN-no-seat",detail:"no cubes.json seat \u2014 manual review"});continue}const k=u.get(a)??null,{reason:B,detail:N}=await M(r,a,k,g);m.push({worktreePath:a,wtBranch:k,reason:B,detail:N})}return{rows:m}}function y(r,n){try{return r(n)}catch{return null}}async function te(r={},n={prune:!1}){const t={...G,...r},{stdout:e,stderr:s,runSync:i}=t,{rows:l,error:u}=await T(t);if(u)return s(c.red(`\u25FC borg cleanup: ${u}
+`)),1;const d=l.filter(o=>o.reason==="PRUNABLE"),b=l.filter(o=>o.reason!=="PRUNABLE");if(l.length===0)return e(c.blue(`\u25FC borg cleanup: no borg-managed worktrees found.
+`)),0;e(c.bold(`\u25FC borg cleanup report:
+`));for(const o of l){const f=o.reason==="PRUNABLE"?c.yellow(o.reason):c.gray(o.reason);e(`  ${f}  ${o.worktreePath}${o.detail?c.gray(`  \u2014 ${o.detail}`):""}
+`)}if(e(c.gray(`\u25FC ${d.length} prunable, ${b.length} kept.
+`)),!n.prune)return d.length>0&&e(c.gray("\u25FC Dry-run \u2014 nothing deleted. Re-run with `--prune` to remove the PRUNABLE worktree(s).\n")),0;if(d.length===0)return e(c.blue(`\u25FC Nothing to prune.
+`)),0;let w=0,p=0;for(const o of d){const f=i("git",["worktree","remove",o.worktreePath],t.cwd());if(f.status!==0){o.prune="remove-failed",p++,s(c.red(`  \u2717 worktree remove ${o.worktreePath}: ${f.stderr.trim()}
+`));continue}if(o.wtBranch){const E=i("git",["branch","-d",o.wtBranch],t.cwd());if(E.status!==0){o.prune="branch-delete-failed",s(c.yellow(`  \u26A0 removed worktree but \`git branch -d ${o.wtBranch}\` refused: ${E.stderr.trim()}
+`)),w++;continue}}o.prune="removed",w++,e(c.blue(`  \u2713 pruned ${o.worktreePath}${o.wtBranch?` + branch ${o.wtBranch}`:""}
+`))}return e(c.gray(`\u25FC Pruned ${w} worktree(s)${p>0?`, ${p} failed`:""}.
+`)),p>0?1:0}function re(r){let n=!1;for(const t of r)if(t==="--prune")n=!0;else return{ok:!1,error:`unexpected argument: ${t}. Usage: borg cleanup [--prune]`};return{ok:!0,options:{prune:n}}}export{T as buildCleanupReport,j as clobberClassIgnored,O as isRegenerableIgnored,H as isStrictlyUnder,re as parseCleanupArgs,v as parseWorktreeEntries,ee as parseWorktreeList,te as runCleanup};

package/dist/launch-all-cmd.js

@@ -1,29 +1,33 @@
-import{discoverDroneCandidates as y}from"./launch-all-discovery.js";import{resolveBorgPath as v}from"./launch-all-command.js";import{sweepStaleLocks as x,isLockLive as I}from"./launch-all-locks.js";import{runTmuxBackend as S}from"./backends/launch-all-tmux.js";import{runWindowsBackend as A}from"./backends/launch-all-windows.js";import{runPastelistBackend as L}from"./backends/launch-all-pastelist.js";const $=`borg launch-all: tmux not found.
+import{discoverDroneCandidates as y}from"./launch-all-discovery.js";import{resolveBorgPath as x}from"./launch-all-command.js";import{sweepStaleLocks as L,isLockLive as I}from"./launch-all-locks.js";import{runTmuxBackend as S}from"./backends/launch-all-tmux.js";import{runWindowsBackend as A}from"./backends/launch-all-windows.js";import{runPastelistBackend as T}from"./backends/launch-all-pastelist.js";const v=`borg launch-all: tmux not found.
   macOS:  brew install tmux
   Debian: sudo apt install tmux
   Fedora: sudo dnf install tmux
-`;function T(t){try{return t.runSync("tmux",["-V"]),!0}catch{return!1}}function D(t){try{return/microsoft|wsl/i.test(t.runSync("uname",["-r"]))}catch{return!1}}function N(t){return/^drone-\d+$/i.test(t)||t.toLowerCase()==="drone"}async function C(t,e){if(t.cubeName!==void 0){const s=(await e.readAllProjectIdentities()).filter(l=>l.cube.name===t.cubeName);return s.length===0?{error:`no cube named '${t.cubeName}' found in cubes.json \u2014 has any drone assimilated into it?`}:{cubeId:s[0].cube.cubeId,name:t.cubeName}}const o=await e.getActiveCube();return o?{cubeId:o.cubeId,name:o.name}:{error:"no active cube in this directory; run `borg assimilate` first, or pass a cube name explicitly"}}function O(t,e){const o=t.flags.mode;if(e.platform()==="win32"&&!D(e))return e.stderr(`native Windows is not supported for interactive launch; using pastelist mode instead (WSL + tmux is the recommended Windows path)
-`),{backend:"pastelist"};if(o==="windows")return{backend:"windows"};if(o==="pastelist")return{backend:"pastelist"};const s=T(e);return o==="tmux"?s?{backend:"tmux"}:{hardFail:$}:s?{backend:"tmux"}:(e.stderr($+`Falling back to pastelist mode (paste the commands below).
+`;function D(t){try{return t.runSync("tmux",["-V"]),!0}catch{return!1}}function N(t){try{return/microsoft|wsl/i.test(t.runSync("uname",["-r"]))}catch{return!1}}function p(t){return/^drone-\d+$/i.test(t)||t.toLowerCase()==="drone"}async function C(t,e){if(t.cubeName!==void 0){const s=(await e.readAllProjectIdentities()).filter(l=>l.cube.name===t.cubeName);return s.length===0?{error:`no cube named '${t.cubeName}' found in cubes.json \u2014 has any drone assimilated into it?`}:{cubeId:s[0].cube.cubeId,name:t.cubeName}}const o=await e.getActiveCube();return o?{cubeId:o.cubeId,name:o.name}:{error:"no active cube in this directory; run `borg assimilate` first, or pass a cube name explicitly"}}function O(t,e){const o=t.flags.mode;if(e.platform()==="win32"&&!N(e))return e.stderr(`native Windows is not supported for interactive launch; using pastelist mode instead (WSL + tmux is the recommended Windows path)
+`),{backend:"pastelist"};if(o==="windows")return{backend:"windows"};if(o==="pastelist")return{backend:"pastelist"};const s=D(e);return o==="tmux"?s?{backend:"tmux"}:{hardFail:v}:s?{backend:"tmux"}:(e.stderr(v+`Falling back to pastelist mode (paste the commands below).
 `),{backend:"pastelist"})}function W(t,e){return t.flags.noAttach||!e.isTTY()?"none":e.getEnv("TMUX")?"switch":"attach"}function F(t,e){e.stdout(`  tmux attach -t ${t}          # re-attach later
 `),e.stdout(`  tmux list-windows -t ${t}    # list all drone windows
 `),e.stdout(`  tmux kill-session -t ${t}    # stop all drones
-`)}function P(t){return`borg-${t.replace(/[^a-zA-Z0-9_-]/g,"-")}`}async function B(t,e,o,f,s,l=Date.now,d=a=>new Promise(i=>setTimeout(i,a))){const a=new Map;for(const u of s)a.set(u,"unconfirmed");const i=l()+1e4;for(let u=0;u<20&&!(l()>=i);u++){let r;try{r=await t.getRoster(e,o,f)}catch{break}for(const c of r.drones)a.get(c.id)==="unconfirmed"&&c.seen_since===!0&&a.set(c.id,"verified");if([...a.values()].every(c=>c==="verified"))break;await d(500)}return a}async function p(t,e,o={}){const f=o.now??Date.now,s=o.nowISO??(()=>new Date().toISOString()),l=o.borgPath??v(),d=await C(t,e);if("error"in d)return e.stderr(`borg launch-all: ${d.error}
-`),1;const{cubeId:a,name:i}=d;x(e,a,f());const u=await y({targetCubeId:a,only:t.flags.only},e);if(u.length===0)return t.flags.only!==void 0?(e.stdout(`No worktrees matched --only '${t.flags.only}' for cube '${i}'
-`),N(t.flags.only)||e.stderr(`note: --only '${t.flags.only}' is matched best-effort by drone label; role-name matching needs a drone session and is not available here.
+`)}function P(t){return`borg-${t.replace(/[^a-zA-Z0-9_-]/g,"-")}`}async function U(t,e,o,f,s,l=Date.now,m=a=>new Promise(i=>setTimeout(i,a))){const a=new Map;for(const u of s)a.set(u,"unconfirmed");const i=l()+1e4;for(let u=0;u<20&&!(l()>=i);u++){let d;try{d=await t.getRoster(e,o,f)}catch{break}for(const r of d.drones)a.get(r.id)==="unconfirmed"&&r.seen_since===!0&&a.set(r.id,"verified");if([...a.values()].every(r=>r==="verified"))break;await m(500)}return a}async function j(t,e,o={}){const f=o.now??Date.now,s=o.nowISO??(()=>new Date().toISOString()),l=o.borgPath??x(),m=await C(t,e);if("error"in m)return e.stderr(`borg launch-all: ${m.error}
+`),1;const{cubeId:a,name:i}=m;L(e,a,f());const u=await y({targetCubeId:a,only:t.flags.only},e);if(u.length===0)return t.flags.only!==void 0?(e.stdout(`No worktrees matched --only '${t.flags.only}' for cube '${i}'
+`),p(t.flags.only)||e.stderr(`note: --only '${t.flags.only}' is matched best-effort by drone label; role-name matching needs a drone session and is not available here.
 `)):e.stdout(`No worktrees found for cube '${i}' \u2014 have you run \`borg assimilate --worktree\` to create any drone seats?
-`),0;const r=[];for(const n of u){const h=I(e,a,n.worktreeDir,f());if(h.live&&!t.flags.force){e.stderr(`skipping ${n.droneLabel} (${n.worktreeDir}): appears live. Use --force to re-launch.
-`);continue}h.live&&t.flags.force&&e.stderr(`--force: re-launching ${n.droneLabel} (${n.worktreeDir}); the running session's token will be displaced.
-`),r.push(n)}if(r.length===0)return e.stdout(`All ${u.length} drone(s) for cube '${i}' appear live; nothing to launch (use --force to re-launch).
+`),0;const d=[];for(const n of u){const c=I(e,a,n.worktreeDir,f());if(c.live&&!t.flags.force){e.stderr(`skipping ${n.droneLabel} (${n.worktreeDir}): appears live. Use --force to re-launch.
+`);continue}c.live&&t.flags.force&&e.stderr(`--force: re-launching ${n.droneLabel} (${n.worktreeDir}); the running session's token will be displaced.
+`),d.push(n)}if(d.length===0)return e.stdout(`All ${u.length} drone(s) for cube '${i}' appear live; nothing to launch (use --force to re-launch).
+`),0;const r=[];for(const n of d){let c;try{c=await e.probeSeat(n.sessionToken,n.apiUrl)}catch{c="indeterminate"}if(c==="evicted"){e.stderr(`skipping ${n.droneLabel} (${n.worktreeDir}): seat no longer in cube (evicted) \u2014 run \`borg cleanup --prune\` to remove the worktree, or \`borg assimilate\` to re-seat fresh.
+`);continue}if(c==="frozen"){e.stderr(`skipping ${n.droneLabel} (${n.worktreeDir}): seat frozen (subscription downgrade) \u2014 paused, not relaunching; it resumes automatically when billing is restored.
+`);continue}c==="indeterminate"&&e.stderr(`note: could not confirm ${n.droneLabel}'s seat is live (network/transient) \u2014 launching anyway.
+`),r.push(n)}if(r.length===0)return e.stdout(`All ${d.length} discovered drone(s) for cube '${i}' have evicted/frozen seats; nothing to launch.
 `),0;if(t.flags.dryRun){e.stdout(`borg launch-all (dry-run): would launch ${r.length} drone(s) for cube '${i}':
 `);for(const n of r)e.stdout(`  ${n.droneLabel}  ${n.worktreeDir}
 `);return 0}if(r.length>6&&!t.flags.yes&&(await e.prompt(`About to launch ${r.length} drones for cube '${i}'. Continue? [y/N]: `)).trim().toLowerCase()!=="y")return e.stdout(`Aborted.
-`),0;const c=O(t,e);if("hardFail"in c)return e.stderr(c.hardFail),1;const m=P(i),b=s();try{if(c.backend==="tmux"){const n=W(t,e);await S(r,{sessionName:m,borgPath:l,attachMode:n,launchedAtISO:b},e),n==="none"&&(e.isTTY()||e.stderr(`Launching in detached mode \u2014 stdout is non-TTY. Attach manually with: tmux attach -t ${m}
-`),F(m,e))}else if(c.backend==="windows")await A(r,{borgPath:l,platform:e.platform(),launchedAtISO:b},e);else return L(r,l,e),0}catch(n){return e.stderr(`borg launch-all: ${n instanceof Error?n.message:String(n)}
-`),1}const k=r[0].sessionToken,g=r[0].apiUrl;let w=null;k&&g?w=await B(e,k,g,b,r.map(n=>n.droneId),o.now,o.sleep):e.stderr(`roster reconciliation skipped \u2014 no session token available
+`),0;const h=O(t,e);if("hardFail"in h)return e.stderr(h.hardFail),1;const b=P(i),w=s();try{if(h.backend==="tmux"){const n=W(t,e);await S(r,{sessionName:b,borgPath:l,attachMode:n,launchedAtISO:w},e),n==="none"&&(e.isTTY()||e.stderr(`Launching in detached mode \u2014 stdout is non-TTY. Attach manually with: tmux attach -t ${b}
+`),F(b,e))}else if(h.backend==="windows")await A(r,{borgPath:l,platform:e.platform(),launchedAtISO:w},e);else return T(r,l,e),0}catch(n){return e.stderr(`borg launch-all: ${n instanceof Error?n.message:String(n)}
+`),1}const k=r[0].sessionToken,$=r[0].apiUrl;let g=null;k&&$?g=await U(e,k,$,w,r.map(n=>n.droneId),o.now,o.sleep):e.stderr(`roster reconciliation skipped \u2014 no session token available
 `),e.stdout(`
 borg launch-all: launched ${r.length} drones for cube '${i}'
 
-`);for(const n of r){const h=w?w.get(n.droneId)==="verified"?"VERIFIED":"unconfirmed (may still be joining)":"launched";e.stdout(`  ${n.droneLabel}  ${n.worktreeDir}  ${h}
+`);for(const n of r){const c=g?g.get(n.droneId)==="verified"?"VERIFIED":"unconfirmed (may still be joining)":"launched";e.stdout(`  ${n.droneLabel}  ${n.worktreeDir}  ${c}
 `)}return e.stdout(`
-Attach: tmux attach -t ${m}
-`),0}export{p as runLaunchAll};
+Attach: tmux attach -t ${b}
+`),0}export{j as runLaunchAll};

package/dist/launch-all-deps.d.ts

@@ -1,4 +1,5 @@
 import type { ActiveCube } from './cubes.js';
+import { type SeatStatus } from './seat-probe.js';
 /** Subprocess runner — sync, returns stdout, THROWS on non-zero exit or ENOENT. */
 export type RunSyncFn = (cmd: string, args: string[]) => string;
 export interface LaunchAllDeps {
@@ -54,6 +55,12 @@ export interface LaunchAllDeps {
             name: string;
         }>;
     }>;
+    /**
+     * Probe ONE saved seat's server-side liveness using ITS OWN token (gh#877
+     * reuse via seat-probe.ts). Lets launch-all skip evicted/frozen seats instead
+     * of relaunching them (which silently re-mints a fresh drone — resurrection).
+     */
+    probeSeat: (sessionToken: string, apiUrl: string) => Promise<SeatStatus>;
     /** Saved CLI preference for a worktree path (launch.json). */
     getCliPreferenceForPath: (projectPath: string) => Promise<'claude' | 'codex' | null>;
     /** All persisted project identities from cubes.json. */

package/dist/launch-all-deps.js

@@ -1 +1 @@
-import{spawnSync as o}from"node:child_process";import{existsSync as n,mkdirSync as s,readFileSync as c,writeFileSync as u,unlinkSync as a,statSync as d,readdirSync as l}from"node:fs";import{homedir as p}from"node:os";import{createInterface as m}from"node:readline/promises";import{readAllProjectIdentities as f,getProjectCliPreferenceForPath as y,findProjectRoot as h,getActiveCube as g}from"./cubes.js";import{getRoster as w,getCube as S,getValidToken as P,API_URL as A}from"./remote-client.js";function I(){return{runSync:(t,r,e)=>{const i=o(t,r,{encoding:"utf-8",cwd:e?.cwd});if(i.error)throw i.error;if(i.status!==0)throw new Error(`${t} exited ${i.status}: ${(i.stderr??"").toString().trim()}`);return(i.stdout??"").toString()},runSyncExitCode:(t,r)=>o(t,r,{encoding:"utf-8"}).status??1,attachInteractive:(t,r)=>{o(t,r,{stdio:"inherit"})},cwd:()=>process.cwd(),pathExists:t=>n(t),homedir:()=>p(),mkdirp:t=>{s(t,{recursive:!0})},readFileOpt:t=>{try{return c(t,"utf-8")}catch{return null}},writeFile:(t,r,e)=>{u(t,r,{mode:e??384})},unlinkOpt:t=>{try{a(t)}catch{}},statMtime:t=>{try{return d(t).mtimeMs}catch{return null}},listDir:t=>{try{return l(t)}catch{return[]}},getCachedAuth:async()=>{try{return{token:await P(),apiUrl:A}}catch{return null}},getRoster:(t,r,e)=>w(t,r,e),getCube:(t,r,e)=>S(e),getCliPreferenceForPath:t=>y(t),readAllProjectIdentities:()=>f(),findProjectRoot:t=>h(t),getActiveCube:()=>g(),prompt:async t=>{const r=m({input:process.stdin,output:process.stdout});try{return(await r.question(t)).trim()}finally{r.close()}},isTTY:()=>process.stdin.isTTY===!0,getEnv:t=>process.env[t],platform:()=>process.platform,stderr:t=>{process.stderr.write(t)},stdout:t=>{process.stdout.write(t)}}}export{I as buildDefaultLaunchAllDeps};
+import{spawnSync as i}from"node:child_process";import{existsSync as n,mkdirSync as s,readFileSync as c,writeFileSync as u,unlinkSync as a,statSync as d,readdirSync as l}from"node:fs";import{homedir as p}from"node:os";import{createInterface as m}from"node:readline/promises";import{readAllProjectIdentities as f,getProjectCliPreferenceForPath as y,findProjectRoot as h,getActiveCube as g}from"./cubes.js";import{getRoster as w,getCube as S,getValidToken as P,API_URL as b}from"./remote-client.js";import{defaultProbeSeat as A}from"./seat-probe.js";function x(){return{runSync:(t,r,e)=>{const o=i(t,r,{encoding:"utf-8",cwd:e?.cwd});if(o.error)throw o.error;if(o.status!==0)throw new Error(`${t} exited ${o.status}: ${(o.stderr??"").toString().trim()}`);return(o.stdout??"").toString()},runSyncExitCode:(t,r)=>i(t,r,{encoding:"utf-8"}).status??1,attachInteractive:(t,r)=>{i(t,r,{stdio:"inherit"})},cwd:()=>process.cwd(),pathExists:t=>n(t),homedir:()=>p(),mkdirp:t=>{s(t,{recursive:!0})},readFileOpt:t=>{try{return c(t,"utf-8")}catch{return null}},writeFile:(t,r,e)=>{u(t,r,{mode:e??384})},unlinkOpt:t=>{try{a(t)}catch{}},statMtime:t=>{try{return d(t).mtimeMs}catch{return null}},listDir:t=>{try{return l(t)}catch{return[]}},getCachedAuth:async()=>{try{return{token:await P(),apiUrl:b}}catch{return null}},getRoster:(t,r,e)=>w(t,r,e),getCube:(t,r,e)=>S(e),probeSeat:(t,r)=>A(t,r),getCliPreferenceForPath:t=>y(t),readAllProjectIdentities:()=>f(),findProjectRoot:t=>h(t),getActiveCube:()=>g(),prompt:async t=>{const r=m({input:process.stdin,output:process.stdout});try{return(await r.question(t)).trim()}finally{r.close()}},isTTY:()=>process.stdin.isTTY===!0,getEnv:t=>process.env[t],platform:()=>process.platform,stderr:t=>{process.stderr.write(t)},stdout:t=>{process.stdout.write(t)}}}export{x as buildDefaultLaunchAllDeps};

package/dist/seat-probe.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Eviction-probe verdict for ONE worktree's saved seat. Mapped 1:1 from the
+ * server's per-caller-seat discrimination:
+ *   evicted       ← 410 DRONE_EVICTED  (terminal; the SOLE delete authority — gh#882 S1)
+ *   frozen        ← 423 DRONE_FROZEN   (reversible — subscription downgrade)
+ *   live          ← 200                (resolves)
+ *   indeterminate ← 401 / 404 / timeout / 5xx / network (transient, or a
+ *                   pre-gh#877-deploy worker that still 401s an evicted seat)
+ */
+export type SeatStatus = 'evicted' | 'frozen' | 'live' | 'indeterminate';
+/**
+ * Default seat probe: a lightweight drone-authed `whoami` with the seat's OWN
+ * saved token. authedFetch throws the typed lifecycle errors on the structured
+ * codes (410→DroneEvictedError, 423→DroneFrozenError); anything else is
+ * INDETERMINATE — and (for the destructive cleanup path) must NEVER authorize a
+ * delete. The launch path treats indeterminate as launch-anyway (fail-OPEN).
+ */
+export declare function defaultProbeSeat(sessionToken: string, apiUrl: string): Promise<SeatStatus>;
+//# sourceMappingURL=seat-probe.d.ts.map

package/dist/seat-probe.js

@@ -0,0 +1 @@
+import{whoami as n}from"./remote-client.js";import{DroneEvictedError as o,DroneFrozenError as i}from"./drone-lifecycle.js";async function c(e,t){try{return await n(e,t),"live"}catch(r){return r instanceof o?"evicted":r instanceof i?"frozen":"indeterminate"}}export{c as defaultProbeSeat};

package/dist/templates.d.ts

@@ -44,7 +44,7 @@ export interface MessageTaxonomyClass {
 export type MessageTaxonomy = MessageTaxonomyClass[];
 export declare const GIT_OPERATIONAL_DISCIPLINE_BUILDER = "\n\n**Git operational discipline (empirically-motivated):**\n\nThese rules come from a real production-primary-branch-corruption incident, where chained git ops + a soft-reset with divergent-ancestor staging silently deleted a merged PR's work from origin/main. Same failure class is repeatable by any drone touching git state.\n\n- **Pre-commit reflex: always run `git diff --staged --stat` before `git commit`.** Verify file count, LOC direction (+/-), and paths match intent. Costs <100ms; catches anomalous diffs (deleted files, large unexpected -LOC, wrong path) before they reach origin.\n- **Never chain `&&` across git-state-touching ops.** `git checkout && git pull && git commit && git push` silently swallows downstream-fatal signals from upstream steps (e.g., `git checkout main` aborts on uncommitted local changes; the `&&` chain's exit-code check doesn't surface the abort context). Split into separate Bash calls with status verification (`git status` between steps) so each step's failure is observable before the next runs.\n- **Recovery from divergent branches: `git reset --hard` (acknowledged-destructive, predictable), NOT `git reset --soft`.** Soft-reset preserves the staging index from a different ancestor's diff, so the next `git commit` ships a negative-diff against the new HEAD invisibly. `--hard` is loud about its destruction; `--soft` is silent about it. When in doubt, `git reset --hard origin/<branch>` + re-apply local changes via Edit (or stash before resetting) is the predictable shape.\n- **Force-pushes are bounded operations.** Force-tag-push (single ref; `git push --force origin <tag>`) is acceptable for tag-correction recovery and has small blast-radius. Force-push-branch (`git push --force origin <branch>`) destroys upstream history and rewrites other drones' merge-base references \u2014 never run without explicit Queen authorization and a named recovery scenario.";
 export declare const GIT_OPERATIONAL_DISCIPLINE_COORDINATOR = "\n\n**Git operational discipline (empirically-motivated):**\n\nThese rules come from a real production-primary-branch-corruption incident, where chained git ops + a soft-reset with divergent-ancestor staging silently deleted a merged PR's work from origin/main. Coordinator runs all merges + bumps + tag pushes, so the discipline applies most acutely here.\n\n- **Pre-commit reflex: always run `git diff --staged --stat` before `git commit`.** Verify file count, LOC direction (+/-), and paths match intent. Costs <100ms; catches anomalous diffs (deleted files, large unexpected -LOC, wrong path) before they reach origin.\n- **Never chain `&&` across git-state-touching ops.** `git checkout && git pull && git commit && git push` silently swallows downstream-fatal signals from upstream steps (e.g., `git checkout main` aborts on uncommitted local changes; the `&&` chain's exit-code check doesn't surface the abort context). Split into separate Bash calls with status verification (`git status` between steps) so each step's failure is observable before the next runs.\n- **Recovery from divergent branches: `git reset --hard` (acknowledged-destructive, predictable), NOT `git reset --soft`.** Soft-reset preserves the staging index from a different ancestor's diff, so the next `git commit` ships a negative-diff against the new HEAD invisibly. `--hard` is loud about its destruction; `--soft` is silent about it. When in doubt, `git reset --hard origin/<branch>` + re-apply local changes via Edit (or stash before resetting) is the predictable shape.\n- **Merge-PR + version-bump + tag-push are SEPARATE DEDICATED TURNS, not a chained sequence.** Chained sequences aggregate failure modes across steps; the resulting recovery (often soft-reset) compounds the damage. Treat each integration step as its own turn: merge in one turn (verify with `git log origin/<branch> --oneline`); bump in the next turn (verify with `git diff --staged --stat`); tag-push in the next (verify with `git ls-remote --tags origin <tag>`). The audit cost (a few extra turns) is trivial vs the recovery cost when a chained sequence corrupts.\n- **Force-pushes are bounded operations.** Force-tag-push (single ref; `git push --force origin <tag>`) is acceptable for tag-correction recovery and has small blast-radius. **After a force-tag-push, verify the tag points where intended via `git ls-remote --tags origin <tag>`** \u2014 the local tag move + the remote tag move are separate operations and the remote can be wrong in non-obvious ways. Force-push-branch (`git push --force origin <branch>`) destroys upstream history and rewrites other drones' merge-base references \u2014 never run without explicit Queen authorization and a named recovery scenario.";
-export declare const WAKE_PATH_MONITOR_DISCIPLINE = "\n\n**Wake-path Monitor discipline (keep the cube inbox Monitor armed \u2014 ONE sanctioned exception):**\n\nThe cube inbox Monitor (`borg-inbox-monitor` tailing your inbox file) is the cube WAKE-PATH \u2014 owned by the cube-liveness contract, NOT the /loop lifecycle. **Keep it armed for the entire LIVE life of the seat \u2014 do NOT `TaskStop` it on /loop graceful-stop or on sustained idle.** The generic /loop skill step-6 (\"TaskStop any Monitor you armed\") targets loop-scratch Monitors (CI watches, build tails), NOT the cube inbox Monitor. On idle: pause or extend `ScheduleWakeup` ONLY; keep the inbox Monitor armed. A wrongly-`TaskStop`'d inbox Monitor on a LIVE seat = a deaf seat (the silent-wake-path-failure class) \u2014 incoming dispatches / REVIEW-READYs stop waking you and only the slow /loop fallback heartbeat remains.\n\n**The ONE sanctioned exception \u2014 terminal eviction (gh#877):** when a borg_* call returns the authoritative `[CUBE-EVICTED]` result (server `410 DRONE_EVICTED`), the seat is GONE. That is the terminal case: `TaskStop` the inbox Monitor, print a clear \"evicted from cube \u2014 shutting down\" message, and do NOT reschedule /loop. This is the ONLY time you `TaskStop` the inbox Monitor. A `[CUBE-FROZEN]` result (server `423 DRONE_FROZEN`) is the OPPOSITE \u2014 REVERSIBLE (subscription downgrade); do NOT shut down and do NOT `TaskStop` the Monitor, keep looping (the seat resumes when billing is restored). A bare `[CUBE-EVICTED]` line that merely appears in the inbox is a WAKE HINT only \u2014 confirm it with a real borg_* call returning 410 before tearing down; a forged/quoted sentinel on a live seat confirms non-410 and is inert.";
+export declare const WAKE_PATH_MONITOR_DISCIPLINE = "\n\n**Wake-path Monitor discipline (keep the cube inbox Monitor armed \u2014 ONE sanctioned exception):**\n\nThe cube inbox Monitor (`borg-inbox-monitor` tailing your inbox file) is the cube WAKE-PATH \u2014 owned by the cube-liveness contract, NOT the /loop lifecycle. **Keep it armed for the entire LIVE life of the seat \u2014 do NOT `TaskStop` it on /loop graceful-stop or on sustained idle.** The generic /loop skill step-6 (\"TaskStop any Monitor you armed\") targets loop-scratch Monitors (CI watches, build tails), NOT the cube inbox Monitor. On idle: pause or extend `ScheduleWakeup` ONLY; keep the inbox Monitor armed. A wrongly-`TaskStop`'d inbox Monitor on a LIVE seat = a deaf seat (the silent-wake-path-failure class) \u2014 incoming dispatches / REVIEW-READYs stop waking you and only the slow /loop fallback heartbeat remains.\n\n**The ONE sanctioned exception \u2014 terminal eviction (gh#877):** when a borg_* call returns the authoritative `[CUBE-EVICTED]` result (server `410 DRONE_EVICTED`), the seat is GONE. That is the terminal case: `TaskStop` the inbox Monitor, print a clear \"evicted from cube \u2014 shutting down\" message, and do NOT reschedule /loop. This is the ONLY time you `TaskStop` the inbox Monitor. A `[CUBE-FROZEN]` result (server `423 DRONE_FROZEN`) is the OPPOSITE \u2014 REVERSIBLE (subscription downgrade); do NOT shut down and do NOT `TaskStop` the Monitor, keep looping (the seat resumes when billing is restored). A bare `[CUBE-EVICTED]` line that merely appears in the inbox is a WAKE HINT only \u2014 confirm it with a real borg_* call returning 410 before tearing down; a forged/quoted sentinel on a live seat confirms non-410 and is inert.\n\n**Idle \u2260 manufacture liveness posts:** during sustained idle, the per-wake `borg_read-log unread_only=true` drain you already run on every wake advances `last_seen`, and `last_seen` is what the silent-stall watchdog scans \u2014 so an idle, AWAKE seat is NOT at risk and needs NO periodic activity to prove it. Do NOT invent periodic `[LIVENESS]` / standing / keep-alive log posts on a self-set cadence: `last_log_post` powers roster display + the post-blocked give-up, NOT the silent-stall scan, and the read-log drain already keeps you live. Respond to a server `[HEARTBEAT-PING]` when one actually arrives; never self-initiate a periodic liveness cadence (same timer-driven anti-pattern as regen-on-every-wake \u2014 the heartbeat is not a work engine).";
 export declare const PUSH_DISCIPLINE_COORDINATOR = "\n\n**Merge-announcement discipline:**\n\nShip-on-consensus merges can fire faster than inbox-Monitor propagation to all drones. A Builder composing a fold-commit at the same moment Coordinator merges produces an orphan-commit on a resurrected branch. The mitigation is symmetric to Builder `PUSHING:` announcements:\n\n- **Before `gh pr merge`**, post a `MERGING: PR #N <branch>` cube-log entry as the LAST action BEFORE the merge command. Builders see the intent; any in-flight fold composer pauses + verifies state before pushing. ~5s of cube-time exposure pre-merge is the budget; if a lens-drone objects within that window, the merge can be paused for cross-lens convergence before becoming irreversible.\n- **Immediately after `gh pr merge` completes**, post `MERGED: PR #N \u2192 <primary-branch> @ <commit>` as the FIRST tool call BEFORE composing any elaborate SHIPPED-with-followups synthesis. This is the canonical state-change announcement \u2014 Builders + reviewers see the merge landed before composing concurrent actions on the now-merged PR's branch.\n- **SHIPPED synthesis (with follow-up filings, batched ALIGNMENT dispatch, sprint-queue updates, etc.) goes in a separate post AFTER the `MERGED:` atomic entry.** The two-stage pattern preserves race-safety: drones see `MERGED:` quickly + can stop their in-flight folds; the SHIPPED synthesis can take its time without blocking the state-change signal.\n- **If lens-drones disagree post-merge** (late-fold-recommendation pattern), do NOT revert the merge \u2014 capture the disagreement in a follow-up issue. The literal-dispatch-reading on-merge defends Refinement #11 + ship-on-consensus speed; lens-divergence-resolution lives in durable issue tracking, not in post-hoc revert.";
 export declare const PUSH_DISCIPLINE_BUILDER = "\n\n**Pre-push announcement discipline:**\n\nThe initial `git push` to a feature branch (the one that produces `REVIEW-READY: <branch>`) carries implicit Coordinator approval \u2014 the dispatch that authorized the work also authorizes the first push to the branch tracking that dispatch. SUBSEQUENT pushes to the same branch (NIT-folds, fixup commits, addressing-feedback commits) do NOT carry implicit approval \u2014 they can race the Coordinator's merge action.\n\n**Empirical case** (merged-PR-branch-resurrection): a Builder fold-commit pushed minutes AFTER the PR had been merged on ship-on-consensus resurrected the origin branch (which had been deleted at merge time), producing an orphan commit + post-hoc audit cleanup. Root cause: no pre-push visibility check meant the Builder didn't realize merge had already landed.\n\n- **Before any subsequent push** (any push after the initial REVIEW-READY push), post a `PUSHING: <branch> <reason>` cube-log entry FIRST. Reason captures intent (e.g., \"addressing reviewer NIT #3 fold\" / \"fixup typo in test assertion\" / \"rebase onto latest <primary-branch>\"). Gives Coordinator visibility before the new commit lands.\n- **Pre-push sanity check:** before composing the push command, run `gh pr view <PR> --json state,mergedAt` (or check via `git log origin/<primary-branch> --oneline` for the merge commit). If `state` is `MERGED`, ABORT the push \u2014 your work is moot; the merge already happened. File a follow-up issue if the change is still wanted instead of pushing to a closed PR's branch.\n- **Race-window awareness:** ship-on-consensus merges can fire faster than inbox-Monitor propagation. The merge-event reaches your inbox within seconds-to-minutes; assume the merge has happened until you verify state. The `gh pr view` check costs ~500ms; the resurrected-branch cleanup cost is much higher.\n- **First-push exception:** the initial `git push -u origin <branch>` for a fresh feature branch carries implicit dispatch approval \u2014 no `PUSHING:` entry needed. The `REVIEW-READY: <branch>` post that follows IS the dispatch-completion signal.";
 export declare const UNIVERSAL_SAFETY_DISCIPLINES: string[];

package/dist/templates.js

@@ -150,7 +150,7 @@ ${n}`,a="\n\n**Git operational discipline (empirically-motivated):**\n\nThese ru
 
 - **Coordinator/Queen-by-delegation autonomous seat:** ~7 min \xB1 1 min jitter (uniform-random integer in [360, 480] seconds) for the ScheduleWakeup safety-net while in autonomous mode. Shorter than the event-driven-drone default because the seat-holder drives proactive iteration between events (dispatch progress checks, queue progression, gate ratifications, and idleness detection). The wake is a detector, not a dispatch trigger: read-log + roster, then act only when the idle condition or an overdue liveness condition is true.
 - **Other drones (event-driven: Builder, Code Reviewer, QA, UX, PM, SR, Visionary):** 30 min fallback acceptable. Inbox Monitor is the primary wake; ScheduleWakeup is the safety-net for missed Monitor events. Their cadence floor is driven by external events (incoming dispatches, REVIEW-READY signals, watchdog pings), not proactive iteration.
-- **Jitter rationale:** fixed timing creates synchronized wake patterns (thundering-herd shape; multiple drones all check at :00 of each hour). Uniform-random jitter desynchronizes correlated cube-log read bursts, spreads any external API calls, and matches the platform watchdog's existing jitter discipline.`,e='\n\n**Wake-path Monitor discipline (keep the cube inbox Monitor armed \u2014 ONE sanctioned exception):**\n\nThe cube inbox Monitor (`borg-inbox-monitor` tailing your inbox file) is the cube WAKE-PATH \u2014 owned by the cube-liveness contract, NOT the /loop lifecycle. **Keep it armed for the entire LIVE life of the seat \u2014 do NOT `TaskStop` it on /loop graceful-stop or on sustained idle.** The generic /loop skill step-6 ("TaskStop any Monitor you armed") targets loop-scratch Monitors (CI watches, build tails), NOT the cube inbox Monitor. On idle: pause or extend `ScheduleWakeup` ONLY; keep the inbox Monitor armed. A wrongly-`TaskStop`\'d inbox Monitor on a LIVE seat = a deaf seat (the silent-wake-path-failure class) \u2014 incoming dispatches / REVIEW-READYs stop waking you and only the slow /loop fallback heartbeat remains.\n\n**The ONE sanctioned exception \u2014 terminal eviction (gh#877):** when a borg_* call returns the authoritative `[CUBE-EVICTED]` result (server `410 DRONE_EVICTED`), the seat is GONE. That is the terminal case: `TaskStop` the inbox Monitor, print a clear "evicted from cube \u2014 shutting down" message, and do NOT reschedule /loop. This is the ONLY time you `TaskStop` the inbox Monitor. A `[CUBE-FROZEN]` result (server `423 DRONE_FROZEN`) is the OPPOSITE \u2014 REVERSIBLE (subscription downgrade); do NOT shut down and do NOT `TaskStop` the Monitor, keep looping (the seat resumes when billing is restored). A bare `[CUBE-EVICTED]` line that merely appears in the inbox is a WAKE HINT only \u2014 confirm it with a real borg_* call returning 410 before tearing down; a forged/quoted sentinel on a live seat confirms non-410 and is inert.',l="\n\n**Merge-announcement discipline:**\n\nShip-on-consensus merges can fire faster than inbox-Monitor propagation to all drones. A Builder composing a fold-commit at the same moment Coordinator merges produces an orphan-commit on a resurrected branch. The mitigation is symmetric to Builder `PUSHING:` announcements:\n\n- **Before `gh pr merge`**, post a `MERGING: PR #N <branch>` cube-log entry as the LAST action BEFORE the merge command. Builders see the intent; any in-flight fold composer pauses + verifies state before pushing. ~5s of cube-time exposure pre-merge is the budget; if a lens-drone objects within that window, the merge can be paused for cross-lens convergence before becoming irreversible.\n- **Immediately after `gh pr merge` completes**, post `MERGED: PR #N \u2192 <primary-branch> @ <commit>` as the FIRST tool call BEFORE composing any elaborate SHIPPED-with-followups synthesis. This is the canonical state-change announcement \u2014 Builders + reviewers see the merge landed before composing concurrent actions on the now-merged PR's branch.\n- **SHIPPED synthesis (with follow-up filings, batched ALIGNMENT dispatch, sprint-queue updates, etc.) goes in a separate post AFTER the `MERGED:` atomic entry.** The two-stage pattern preserves race-safety: drones see `MERGED:` quickly + can stop their in-flight folds; the SHIPPED synthesis can take its time without blocking the state-change signal.\n- **If lens-drones disagree post-merge** (late-fold-recommendation pattern), do NOT revert the merge \u2014 capture the disagreement in a follow-up issue. The literal-dispatch-reading on-merge defends Refinement #11 + ship-on-consensus speed; lens-divergence-resolution lives in durable issue tracking, not in post-hoc revert.",d='\n\n**Pre-push announcement discipline:**\n\nThe initial `git push` to a feature branch (the one that produces `REVIEW-READY: <branch>`) carries implicit Coordinator approval \u2014 the dispatch that authorized the work also authorizes the first push to the branch tracking that dispatch. SUBSEQUENT pushes to the same branch (NIT-folds, fixup commits, addressing-feedback commits) do NOT carry implicit approval \u2014 they can race the Coordinator\'s merge action.\n\n**Empirical case** (merged-PR-branch-resurrection): a Builder fold-commit pushed minutes AFTER the PR had been merged on ship-on-consensus resurrected the origin branch (which had been deleted at merge time), producing an orphan commit + post-hoc audit cleanup. Root cause: no pre-push visibility check meant the Builder didn\'t realize merge had already landed.\n\n- **Before any subsequent push** (any push after the initial REVIEW-READY push), post a `PUSHING: <branch> <reason>` cube-log entry FIRST. Reason captures intent (e.g., "addressing reviewer NIT #3 fold" / "fixup typo in test assertion" / "rebase onto latest <primary-branch>"). Gives Coordinator visibility before the new commit lands.\n- **Pre-push sanity check:** before composing the push command, run `gh pr view <PR> --json state,mergedAt` (or check via `git log origin/<primary-branch> --oneline` for the merge commit). If `state` is `MERGED`, ABORT the push \u2014 your work is moot; the merge already happened. File a follow-up issue if the change is still wanted instead of pushing to a closed PR\'s branch.\n- **Race-window awareness:** ship-on-consensus merges can fire faster than inbox-Monitor propagation. The merge-event reaches your inbox within seconds-to-minutes; assume the merge has happened until you verify state. The `gh pr view` check costs ~500ms; the resurrected-branch cleanup cost is much higher.\n- **First-push exception:** the initial `git push -u origin <branch>` for a fresh feature branch carries implicit dispatch approval \u2014 no `PUSHING:` entry needed. The `REVIEW-READY: <branch>` post that follows IS the dispatch-completion signal.',R=[e],I=[c,a,l,d],w='## Coordinator dispatch discipline\n\nThree principles for any DISPATCH/ROUTING/ASSIGN/PING-class post asking a specific drone for action:\n\n- **Make it reachable**: verify any named SHA/branch/PR on origin BEFORE posting; post as its own cube log entry (never appended to MERGED/SHIPPED \u2014 the Monitor preview cuts at ~80 chars); lead with the actionable verb in the first 80 characters.\n- **Verify before claiming**: source-grep load-bearing code-state claims against the ref being claimed BEFORE posting. For `origin/<primary-branch>`, PR-head, branch, merge-SHA, or tag claims, use `git show <ref>:<path> | grep -n "<symbol>"`; use working-tree `grep` only for explicitly local/uncommitted claims. Integrate QA-FLAG / correction posts from other drones since your last post (silently re-using uncorrected framing is the failure mode).\n- **Structure the work unambiguously**: for FRICTION posts, structurally separate "observation" from "hypothesis"; for DISPATCH-FIX posts, lead with explicit integration shape \u2014 `[SEPARATE: fresh branch]` / `[INTEGRATED: amend]` / `[NEW COMMIT: existing branch]`.\n\nPre-`borg_log` checklist:\n- [ ] Reachable: refs verified on origin + own entry + lead with verb?\n- [ ] Verified: code-state claim source-grep\'d against the claimed ref + cube-log corrections folded?\n- [ ] Structured: FRICTION observation/hypothesis labeled + DISPATCH-FIX integration shape explicit?\n',v={name:"software-dev",description:"Multi-agent software development. Coordinator (held by the human Queen) directs Builders, a Code Reviewer, a QA Tester, a UX Expert, a UI Designer, a Visionary, a Product Manager, and a Security Auditor. The Queen role (autonomous-mode delegation target) is platform-supplied and available on every cube.",cube_directive:w,message_taxonomy:[{class:"status-claim",prefixes:["STARTING","ACK","PONG","READY","PUSHING"],routing:"directed",default_to:["coordinator","queen"]},{class:"completion-status",prefixes:["DONE","SHIPPED"],routing:"directed",default_to:["coordinator","queen"],lifecycle:"completion"},{class:"review-request",prefixes:["REVIEW-READY"],routing:"directed",default_to:["coordinator","queen","code-reviewer","security-auditor","qa-tester","ux-expert"]},{class:"review-feedback",prefixes:["REVIEW-FEEDBACK","QA-FAIL","SECURITY-FEEDBACK","UX-FEEDBACK","PM-FEEDBACK"],routing:"directed",default_to:["coordinator","queen"]},{class:"completion-gate",prefixes:["REVIEW-APPROVED","QA-PASS","SECURITY-APPROVED","UX-APPROVED","PM-APPROVED"],routing:"directed",default_to:["coordinator","queen"],lifecycle:"completion"},{class:"blocked-signal",prefixes:["BLOCKED"],routing:"directed",default_to:["coordinator","queen"]},{class:"dispatch-routing",prefixes:["DISPATCH","ASSIGN","ROUTING"],routing:"directed",default_to:["coordinator","queen"],lifecycle:"dispatch"},{class:"ping",prefixes:["PING"],routing:"directed",default_to:["coordinator","queen"]},{class:"finding",prefixes:["PROPOSAL","FINDING","HYPOTHESIS","RECAP","ALIGNMENT"],routing:"directed",default_to:["coordinator","queen"]},{class:"merge-status",prefixes:["MERGING","MERGED"],routing:"directed",default_to:["coordinator","queen"]},{class:"cube-wide",prefixes:["DECISION","HALT"],routing:"broadcast"}],roles:[{name:"Coordinator",is_human_seat:!0,can_broadcast:!0,short_description:"Human-seat role. Decides what gets built, what gets reviewed, and which drone does what. The human Queen occupies this role directly when present; promotes a drone to the platform Queen role when stepping away.",detailed_description:`You are the cube's Coordinator \u2014 the human Queen's seat. The other drones act autonomously; you set direction.
+- **Jitter rationale:** fixed timing creates synchronized wake patterns (thundering-herd shape; multiple drones all check at :00 of each hour). Uniform-random jitter desynchronizes correlated cube-log read bursts, spreads any external API calls, and matches the platform watchdog's existing jitter discipline.`,e='\n\n**Wake-path Monitor discipline (keep the cube inbox Monitor armed \u2014 ONE sanctioned exception):**\n\nThe cube inbox Monitor (`borg-inbox-monitor` tailing your inbox file) is the cube WAKE-PATH \u2014 owned by the cube-liveness contract, NOT the /loop lifecycle. **Keep it armed for the entire LIVE life of the seat \u2014 do NOT `TaskStop` it on /loop graceful-stop or on sustained idle.** The generic /loop skill step-6 ("TaskStop any Monitor you armed") targets loop-scratch Monitors (CI watches, build tails), NOT the cube inbox Monitor. On idle: pause or extend `ScheduleWakeup` ONLY; keep the inbox Monitor armed. A wrongly-`TaskStop`\'d inbox Monitor on a LIVE seat = a deaf seat (the silent-wake-path-failure class) \u2014 incoming dispatches / REVIEW-READYs stop waking you and only the slow /loop fallback heartbeat remains.\n\n**The ONE sanctioned exception \u2014 terminal eviction (gh#877):** when a borg_* call returns the authoritative `[CUBE-EVICTED]` result (server `410 DRONE_EVICTED`), the seat is GONE. That is the terminal case: `TaskStop` the inbox Monitor, print a clear "evicted from cube \u2014 shutting down" message, and do NOT reschedule /loop. This is the ONLY time you `TaskStop` the inbox Monitor. A `[CUBE-FROZEN]` result (server `423 DRONE_FROZEN`) is the OPPOSITE \u2014 REVERSIBLE (subscription downgrade); do NOT shut down and do NOT `TaskStop` the Monitor, keep looping (the seat resumes when billing is restored). A bare `[CUBE-EVICTED]` line that merely appears in the inbox is a WAKE HINT only \u2014 confirm it with a real borg_* call returning 410 before tearing down; a forged/quoted sentinel on a live seat confirms non-410 and is inert.\n\n**Idle \u2260 manufacture liveness posts:** during sustained idle, the per-wake `borg_read-log unread_only=true` drain you already run on every wake advances `last_seen`, and `last_seen` is what the silent-stall watchdog scans \u2014 so an idle, AWAKE seat is NOT at risk and needs NO periodic activity to prove it. Do NOT invent periodic `[LIVENESS]` / standing / keep-alive log posts on a self-set cadence: `last_log_post` powers roster display + the post-blocked give-up, NOT the silent-stall scan, and the read-log drain already keeps you live. Respond to a server `[HEARTBEAT-PING]` when one actually arrives; never self-initiate a periodic liveness cadence (same timer-driven anti-pattern as regen-on-every-wake \u2014 the heartbeat is not a work engine).',l="\n\n**Merge-announcement discipline:**\n\nShip-on-consensus merges can fire faster than inbox-Monitor propagation to all drones. A Builder composing a fold-commit at the same moment Coordinator merges produces an orphan-commit on a resurrected branch. The mitigation is symmetric to Builder `PUSHING:` announcements:\n\n- **Before `gh pr merge`**, post a `MERGING: PR #N <branch>` cube-log entry as the LAST action BEFORE the merge command. Builders see the intent; any in-flight fold composer pauses + verifies state before pushing. ~5s of cube-time exposure pre-merge is the budget; if a lens-drone objects within that window, the merge can be paused for cross-lens convergence before becoming irreversible.\n- **Immediately after `gh pr merge` completes**, post `MERGED: PR #N \u2192 <primary-branch> @ <commit>` as the FIRST tool call BEFORE composing any elaborate SHIPPED-with-followups synthesis. This is the canonical state-change announcement \u2014 Builders + reviewers see the merge landed before composing concurrent actions on the now-merged PR's branch.\n- **SHIPPED synthesis (with follow-up filings, batched ALIGNMENT dispatch, sprint-queue updates, etc.) goes in a separate post AFTER the `MERGED:` atomic entry.** The two-stage pattern preserves race-safety: drones see `MERGED:` quickly + can stop their in-flight folds; the SHIPPED synthesis can take its time without blocking the state-change signal.\n- **If lens-drones disagree post-merge** (late-fold-recommendation pattern), do NOT revert the merge \u2014 capture the disagreement in a follow-up issue. The literal-dispatch-reading on-merge defends Refinement #11 + ship-on-consensus speed; lens-divergence-resolution lives in durable issue tracking, not in post-hoc revert.",d='\n\n**Pre-push announcement discipline:**\n\nThe initial `git push` to a feature branch (the one that produces `REVIEW-READY: <branch>`) carries implicit Coordinator approval \u2014 the dispatch that authorized the work also authorizes the first push to the branch tracking that dispatch. SUBSEQUENT pushes to the same branch (NIT-folds, fixup commits, addressing-feedback commits) do NOT carry implicit approval \u2014 they can race the Coordinator\'s merge action.\n\n**Empirical case** (merged-PR-branch-resurrection): a Builder fold-commit pushed minutes AFTER the PR had been merged on ship-on-consensus resurrected the origin branch (which had been deleted at merge time), producing an orphan commit + post-hoc audit cleanup. Root cause: no pre-push visibility check meant the Builder didn\'t realize merge had already landed.\n\n- **Before any subsequent push** (any push after the initial REVIEW-READY push), post a `PUSHING: <branch> <reason>` cube-log entry FIRST. Reason captures intent (e.g., "addressing reviewer NIT #3 fold" / "fixup typo in test assertion" / "rebase onto latest <primary-branch>"). Gives Coordinator visibility before the new commit lands.\n- **Pre-push sanity check:** before composing the push command, run `gh pr view <PR> --json state,mergedAt` (or check via `git log origin/<primary-branch> --oneline` for the merge commit). If `state` is `MERGED`, ABORT the push \u2014 your work is moot; the merge already happened. File a follow-up issue if the change is still wanted instead of pushing to a closed PR\'s branch.\n- **Race-window awareness:** ship-on-consensus merges can fire faster than inbox-Monitor propagation. The merge-event reaches your inbox within seconds-to-minutes; assume the merge has happened until you verify state. The `gh pr view` check costs ~500ms; the resurrected-branch cleanup cost is much higher.\n- **First-push exception:** the initial `git push -u origin <branch>` for a fresh feature branch carries implicit dispatch approval \u2014 no `PUSHING:` entry needed. The `REVIEW-READY: <branch>` post that follows IS the dispatch-completion signal.',R=[e],I=[c,a,l,d],w='## Coordinator dispatch discipline\n\nThree principles for any DISPATCH/ROUTING/ASSIGN/PING-class post asking a specific drone for action:\n\n- **Make it reachable**: verify any named SHA/branch/PR on origin BEFORE posting; post as its own cube log entry (never appended to MERGED/SHIPPED \u2014 the Monitor preview cuts at ~80 chars); lead with the actionable verb in the first 80 characters.\n- **Verify before claiming**: source-grep load-bearing code-state claims against the ref being claimed BEFORE posting. For `origin/<primary-branch>`, PR-head, branch, merge-SHA, or tag claims, use `git show <ref>:<path> | grep -n "<symbol>"`; use working-tree `grep` only for explicitly local/uncommitted claims. Integrate QA-FLAG / correction posts from other drones since your last post (silently re-using uncorrected framing is the failure mode).\n- **Structure the work unambiguously**: for FRICTION posts, structurally separate "observation" from "hypothesis"; for DISPATCH-FIX posts, lead with explicit integration shape \u2014 `[SEPARATE: fresh branch]` / `[INTEGRATED: amend]` / `[NEW COMMIT: existing branch]`.\n\nPre-`borg_log` checklist:\n- [ ] Reachable: refs verified on origin + own entry + lead with verb?\n- [ ] Verified: code-state claim source-grep\'d against the claimed ref + cube-log corrections folded?\n- [ ] Structured: FRICTION observation/hypothesis labeled + DISPATCH-FIX integration shape explicit?\n',v={name:"software-dev",description:"Multi-agent software development. Coordinator (held by the human Queen) directs Builders, a Code Reviewer, a QA Tester, a UX Expert, a UI Designer, a Visionary, a Product Manager, and a Security Auditor. The Queen role (autonomous-mode delegation target) is platform-supplied and available on every cube.",cube_directive:w,message_taxonomy:[{class:"status-claim",prefixes:["STARTING","ACK","PONG","READY","PUSHING"],routing:"directed",default_to:["coordinator","queen"]},{class:"completion-status",prefixes:["DONE","SHIPPED"],routing:"directed",default_to:["coordinator","queen"],lifecycle:"completion"},{class:"review-request",prefixes:["REVIEW-READY"],routing:"directed",default_to:["coordinator","queen","code-reviewer","security-auditor","qa-tester","ux-expert"]},{class:"review-feedback",prefixes:["REVIEW-FEEDBACK","QA-FAIL","SECURITY-FEEDBACK","UX-FEEDBACK","PM-FEEDBACK"],routing:"directed",default_to:["coordinator","queen"]},{class:"completion-gate",prefixes:["REVIEW-APPROVED","QA-PASS","SECURITY-APPROVED","UX-APPROVED","PM-APPROVED"],routing:"directed",default_to:["coordinator","queen"],lifecycle:"completion"},{class:"blocked-signal",prefixes:["BLOCKED"],routing:"directed",default_to:["coordinator","queen"]},{class:"dispatch-routing",prefixes:["DISPATCH","ASSIGN","ROUTING"],routing:"directed",default_to:["coordinator","queen"],lifecycle:"dispatch"},{class:"ping",prefixes:["PING"],routing:"directed",default_to:["coordinator","queen"]},{class:"finding",prefixes:["PROPOSAL","FINDING","HYPOTHESIS","RECAP","ALIGNMENT"],routing:"directed",default_to:["coordinator","queen"]},{class:"merge-status",prefixes:["MERGING","MERGED"],routing:"directed",default_to:["coordinator","queen"]},{class:"cube-wide",prefixes:["DECISION","HALT"],routing:"broadcast"}],roles:[{name:"Coordinator",is_human_seat:!0,can_broadcast:!0,short_description:"Human-seat role. Decides what gets built, what gets reviewed, and which drone does what. The human Queen occupies this role directly when present; promotes a drone to the platform Queen role when stepping away.",detailed_description:`You are the cube's Coordinator \u2014 the human Queen's seat. The other drones act autonomously; you set direction.
 
 Your job:
 - Read the activity log on every regen. Decide what work is pending, what's stalled, what's done.
@@ -367,4 +367,4 @@ Workflow:
 - Review the work. Does it match the ask? Is it correct?
 - Post APPROVED if it passes. Post FEEDBACK with specific issues if it doesn't.
 
-You don't implement fixes \u2014 post FEEDBACK and the Worker addresses it.${i}${o}${e}`}]},h={starter:E,"software-dev":v};function A(t){return h[t]??null}function k(){return Object.keys(h)}function S(t,s){return t&&t.trim()!==""?t:s?.cube_directive??t}function P(t,s){return t&&t.trim()!==""||!s.cube_directive?null:s.cube_directive}function C(t,s){return t===void 0?s?.message_taxonomy??null:t}export{a as GIT_OPERATIONAL_DISCIPLINE_BUILDER,c as GIT_OPERATIONAL_DISCIPLINE_COORDINATOR,d as PUSH_DISCIPLINE_BUILDER,l as PUSH_DISCIPLINE_COORDINATOR,I as ROLE_SCOPED_SAFETY_DISCIPLINES,h as TEMPLATES,R as UNIVERSAL_SAFETY_DISCIPLINES,e as WAKE_PATH_MONITOR_DISCIPLINE,A as getTemplate,k as listTemplateNames,P as resolveCubeDirectiveForApply,S as resolveCubeDirectiveForCreate,C as resolveMessageTaxonomyForCreate};
+You don't implement fixes \u2014 post FEEDBACK and the Worker addresses it.${i}${o}${e}`}]},h={starter:E,"software-dev":v};function A(t){return h[t]??null}function k(){return Object.keys(h)}function S(t,s){return t&&t.trim()!==""?t:s?.cube_directive??t}function P(t,s){return t&&t.trim()!==""||!s.cube_directive?null:s.cube_directive}function T(t,s){return t===void 0?s?.message_taxonomy??null:t}export{a as GIT_OPERATIONAL_DISCIPLINE_BUILDER,c as GIT_OPERATIONAL_DISCIPLINE_COORDINATOR,d as PUSH_DISCIPLINE_BUILDER,l as PUSH_DISCIPLINE_COORDINATOR,I as ROLE_SCOPED_SAFETY_DISCIPLINES,h as TEMPLATES,R as UNIVERSAL_SAFETY_DISCIPLINES,e as WAKE_PATH_MONITOR_DISCIPLINE,A as getTemplate,k as listTemplateNames,P as resolveCubeDirectiveForApply,S as resolveCubeDirectiveForCreate,T as resolveMessageTaxonomyForCreate};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "borgmcp",
-  "version": "1.0.32",
+  "version": "1.0.33",
   "description": "Coordinate AI coding agents in shared cubes. Works with Claude Code and Codex. Create projects, assign roles, and share a live activity log.",
   "type": "module",
   "main": "dist/index.js",