borgmcp 1.0.5 → 1.0.7

package/dist/config.js

@@ -1,190 +1 @@
-/**
- * Secure token storage.
- *
- * The public API (storeIdToken / getIdToken / getRefreshToken / clearTokens /
- * isAuthenticated) is unchanged; what changed in gh#557 is what sits beneath
- * it. Three storage paths, in precedence order:
- *
- *   1. Caller-managed (read-only): if BORG_TOKEN / BORG_TOKEN_FILE supplies an
- *      id_token, it's served verbatim — no keychain, no expiry check, no
- *      refresh_token. The caller owns the token's lifecycle (CI, containers,
- *      `borg --token-file`).
- *   2. OS keychain (default): @napi-rs/keyring — real platform at-rest
- *      encryption (macOS Keychain / Windows Credential Vault / libsecret).
- *   3. Encrypted file (fallback): ~/.borg/credentials, AES-256-GCM under a
- *      machine-derived key, 0600. Engages only when no keychain is available
- *      (headless Linux without Secret Service). Obfuscation-grade — see
- *      token-crypto.ts.
- *
- * The persistent backend (2 or 3) is selected once per process and memoized.
- * BORG_TOKEN_STORE=keychain|file forces the choice and skips the probe.
- */
-import os from 'os';
-import path from 'path';
-import { promises as fsp } from 'fs';
-import { isKeyringAvailable } from './auth-env.js';
-import { deriveMachineKey } from './token-crypto.js';
-import { makeKeychainBackend, makeEncryptedFileBackend, selectTokenBackend, readCallerManagedIdToken, } from './token-store.js';
-const ID_TOKEN_ACCOUNT = 'google-id-token';
-const REFRESH_TOKEN_ACCOUNT = 'google-refresh-token';
-const TOKEN_EXPIRY_ACCOUNT = 'token-expiry';
-/** Where the encrypted-file fallback lives when no keychain is available. */
-function credentialsPath() {
-    return path.join(os.homedir(), '.borg', 'credentials');
-}
-/** Production fs adapter for the encrypted-file backend. */
-const nodeFs = {
-    readFile: (filePath) => fsp.readFile(filePath, 'utf8'),
-    writeFile: async (filePath, data, mode) => {
-        // `mode` on writeFile only applies when the file is CREATED; chmod after
-        // guarantees 0600 even when rewriting an existing credentials file.
-        await fsp.writeFile(filePath, data, { mode });
-        await fsp.chmod(filePath, mode);
-    },
-    mkdir: async (dir, mode) => {
-        await fsp.mkdir(dir, { recursive: true, mode });
-    },
-    // gh#570: atomic write (temp→rename) + O_EXCL lock primitives.
-    rename: (from, to) => fsp.rename(from, to),
-    createExclusive: async (lockPath, content) => {
-        try {
-            // 'wx' = O_CREAT | O_EXCL | O_WRONLY → fails with EEXIST if the lock
-            // already exists, giving us the atomic acquire primitive.
-            await fsp.writeFile(lockPath, content, { flag: 'wx', mode: 0o600 });
-            return true;
-        }
-        catch (err) {
-            if (err?.code === 'EEXIST')
-                return false;
-            throw err;
-        }
-    },
-    removeFile: async (filePath) => {
-        try {
-            await fsp.unlink(filePath);
-        }
-        catch (err) {
-            if (err?.code !== 'ENOENT')
-                throw err; // silent if already gone
-        }
-    },
-    fileAgeMs: async (filePath) => {
-        try {
-            const stat = await fsp.stat(filePath);
-            return Date.now() - stat.mtimeMs;
-        }
-        catch (err) {
-            if (err?.code === 'ENOENT')
-                return null;
-            throw err;
-        }
-    },
-};
-/** Map the user-facing BORG_TOKEN_STORE value to a forced backend, if valid. */
-function parseForcedStore(value) {
-    const v = value?.trim().toLowerCase();
-    if (v === 'keychain')
-        return 'keychain';
-    if (v === 'file' || v === 'encrypted-file')
-        return 'file';
-    return undefined;
-}
-// Memoized persistent-backend selection (one keychain probe per process).
-let backendPromise = null;
-function getBackend() {
-    if (!backendPromise) {
-        backendPromise = selectTokenBackend({
-            keyringAvailable: () => isKeyringAvailable(),
-            makeKeychain: () => makeKeychainBackend(),
-            makeFile: () => makeEncryptedFileBackend({
-                filePath: credentialsPath(),
-                key: deriveMachineKey({
-                    hostname: os.hostname(),
-                    username: os.userInfo().username,
-                    platform: process.platform,
-                }),
-                fs: nodeFs,
-            }),
-            forced: parseForcedStore(process.env.BORG_TOKEN_STORE),
-        });
-    }
-    return backendPromise;
-}
-/** Caller-managed id_token (BORG_TOKEN / BORG_TOKEN_FILE), or null. */
-function callerManagedIdToken() {
-    return readCallerManagedIdToken({
-        env: process.env,
-        readFile: (filePath) => fsp.readFile(filePath, 'utf8'),
-    });
-}
-/**
- * Store Google OAuth ID token securely in the selected backend.
- */
-export async function storeIdToken(idToken, expiresAt) {
-    const backend = await getBackend();
-    await backend.set(ID_TOKEN_ACCOUNT, idToken);
-    await backend.set(TOKEN_EXPIRY_ACCOUNT, expiresAt.toString());
-}
-/**
- * Store Google OAuth refresh token securely in the selected backend.
- */
-export async function storeRefreshToken(refreshToken) {
-    const backend = await getBackend();
-    await backend.set(REFRESH_TOKEN_ACCOUNT, refreshToken);
-}
-/**
- * Retrieve the Google OAuth ID token.
- *
- * A caller-managed token (BORG_TOKEN / BORG_TOKEN_FILE) takes precedence and
- * is returned verbatim — the caller owns its freshness, so the expiry buffer
- * does not apply. Otherwise reads the persistent backend and returns null if
- * not stored or within the 5-minute expiry buffer.
- */
-export async function getIdToken() {
-    const callerManaged = await callerManagedIdToken();
-    if (callerManaged)
-        return callerManaged;
-    const backend = await getBackend();
-    const token = await backend.get(ID_TOKEN_ACCOUNT);
-    const expiryStr = await backend.get(TOKEN_EXPIRY_ACCOUNT);
-    if (!token || !expiryStr) {
-        return null;
-    }
-    const expiresAt = parseInt(expiryStr, 10);
-    const now = Date.now();
-    // Check if token is expired (with 5 minute buffer).
-    if (expiresAt - now < 5 * 60 * 1000) {
-        return null;
-    }
-    return token;
-}
-/**
- * Retrieve the Google OAuth refresh token. There is no refresh_token in
- * caller-managed mode (the externally-supplied id_token has no refresh
- * counterpart), so this returns null whenever a caller-managed token is set.
- */
-export async function getRefreshToken() {
-    if (await callerManagedIdToken())
-        return null;
-    const backend = await getBackend();
-    return backend.get(REFRESH_TOKEN_ACCOUNT);
-}
-/**
- * Clear all stored tokens from the selected backend. Idempotent — clearing
- * an already-empty store is a no-op. Does not touch caller-managed env vars
- * (those are the caller's to manage).
- */
-export async function clearTokens() {
-    const backend = await getBackend();
-    await backend.delete(ID_TOKEN_ACCOUNT);
-    await backend.delete(REFRESH_TOKEN_ACCOUNT);
-    await backend.delete(TOKEN_EXPIRY_ACCOUNT);
-}
-/**
- * Check if user has valid authentication.
- */
-export async function isAuthenticated() {
-    const token = await getIdToken();
-    return token !== null;
-}
-//# sourceMappingURL=config.js.map
+import o from"os";import m from"path";import{promises as r}from"fs";import{isKeyringAvailable as w}from"./auth-env.js";import{deriveMachineKey as p}from"./token-crypto.js";import{makeKeychainBackend as y,makeEncryptedFileBackend as h,selectTokenBackend as g,readCallerManagedIdToken as T}from"./token-store.js";const i="google-id-token",c="google-refresh-token",s="token-expiry";function E(){return m.join(o.homedir(),".borg","credentials")}const F={readFile:e=>r.readFile(e,"utf8"),writeFile:async(e,t,n)=>{await r.writeFile(e,t,{mode:n}),await r.chmod(e,n)},mkdir:async(e,t)=>{await r.mkdir(e,{recursive:!0,mode:t})},rename:(e,t)=>r.rename(e,t),createExclusive:async(e,t)=>{try{return await r.writeFile(e,t,{flag:"wx",mode:384}),!0}catch(n){if(n?.code==="EEXIST")return!1;throw n}},removeFile:async e=>{try{await r.unlink(e)}catch(t){if(t?.code!=="ENOENT")throw t}},fileAgeMs:async e=>{try{const t=await r.stat(e);return Date.now()-t.mtimeMs}catch(t){if(t?.code==="ENOENT")return null;throw t}}};function b(e){const t=e?.trim().toLowerCase();if(t==="keychain")return"keychain";if(t==="file"||t==="encrypted-file")return"file"}let l=null;function a(){return l||(l=g({keyringAvailable:()=>w(),makeKeychain:()=>y(),makeFile:()=>h({filePath:E(),key:p({hostname:o.hostname(),username:o.userInfo().username,platform:process.platform}),fs:F}),forced:b(process.env.BORG_TOKEN_STORE)})),l}function u(){return T({env:process.env,readFile:e=>r.readFile(e,"utf8")})}async function K(e,t){const n=await a();await n.set(i,e),await n.set(s,t.toString())}async function _(e){await(await a()).set(c,e)}async function x(){const e=await u();if(e)return e;const t=await a(),n=await t.get(i),d=await t.get(s);if(!n||!d)return null;const f=parseInt(d,10),k=Date.now();return f-k<300*1e3?null:n}async function R(){return await u()?null:(await a()).get(c)}async function M(){const e=await a();await e.delete(i),await e.delete(c),await e.delete(s)}async function S(){return await x()!==null}export{M as clearTokens,x as getIdToken,R as getRefreshToken,S as isAuthenticated,K as storeIdToken,_ as storeRefreshToken};

package/dist/console-prefix.js

@@ -1,86 +1 @@
-/**
- * Drone self-identification prefix for client-emitted console messages.
- *
- * Per gh#25: when a drone session emits a console error (e.g.
- * "Authentication expired. Run: borg assimilate"), the Queen has no way to
- * tell which drone window the message came from without scanning every
- * open terminal. Window title alone (set by terminal-title.ts) is
- * insufficient — the Queen reads the active terminal's output stream,
- * not its title bar.
- *
- * This module exports a one-shot initializer that resolves the prefix
- * from the local cube state cache, plus a synchronous getter that
- * call sites use to wrap each console.error.
- *
- * Format (matches the terminal-title.ts middle-dot convention so
- * surfaces stay internally consistent):
- *   `[<drone-label> · <cube-name>]`  (assimilated)
- *   `[unassimilated · <repo-basename>]` (no cube cached)
- */
-import { basename } from 'node:path';
-import chalk from 'chalk';
-import { getActiveCube } from './cubes.js';
-let cachedPrefix = null;
-/**
- * Resolve the drone-self-identification prefix from cube state and
- * cache it for subsequent synchronous reads. Idempotent — calling
- * multiple times returns the same value. Falls back silently to the
- * unassimilated shape on any read error so console emission is never
- * blocked.
- */
-export async function initConsolePrefix() {
-    if (cachedPrefix !== null)
-        return cachedPrefix;
-    try {
-        const active = await getActiveCube();
-        if (active?.droneLabel && active?.name) {
-            cachedPrefix = `[${active.droneLabel} · ${active.name}]`;
-            return cachedPrefix;
-        }
-    }
-    catch {
-        // Fall through to unassimilated fallback.
-    }
-    cachedPrefix = `[unassimilated · ${basename(process.cwd())}]`;
-    return cachedPrefix;
-}
-/**
- * Synchronous prefix getter. Returns the cached value if initialized,
- * otherwise the unassimilated fallback — safe to call before
- * initConsolePrefix() resolves.
- */
-export function droneIdPrefix() {
-    if (cachedPrefix !== null)
-        return cachedPrefix;
-    return `[unassimilated · ${basename(process.cwd())}]`;
-}
-/**
- * Prefix + trailing space, styled dim/gray so the prefix is metadata
- * and the message body retains visual emphasis. Use as
- * `${consolePrefix()}<message>`.
- */
-export function consolePrefix() {
-    return chalk.gray(droneIdPrefix()) + ' ';
-}
-/**
- * Drop-in replacement for `console.error` that prepends the drone
- * self-id prefix. If the first arg is a string, the prefix is
- * concatenated to it; otherwise the prefix is emitted as its own arg
- * (handles the `console.error('label:', value)` shape).
- */
-export function cerr(...args) {
-    if (args.length === 0) {
-        console.error(consolePrefix());
-        return;
-    }
-    if (typeof args[0] === 'string') {
-        console.error(consolePrefix() + args[0], ...args.slice(1));
-    }
-    else {
-        console.error(consolePrefix(), ...args);
-    }
-}
-export function _resetCachedPrefixForTests() {
-    cachedPrefix = null;
-}
-//# sourceMappingURL=console-prefix.js.map
+import{basename as o}from"node:path";import t from"chalk";import{getActiveCube as i}from"./cubes.js";let r=null;async function s(){if(r!==null)return r;try{const e=await i();if(e?.droneLabel&&e?.name)return r=`[${e.droneLabel} \xB7 ${e.name}]`,r}catch{}return r=`[unassimilated \xB7 ${o(process.cwd())}]`,r}function c(){return r!==null?r:`[unassimilated \xB7 ${o(process.cwd())}]`}function n(){return t.gray(c())+" "}function a(...e){if(e.length===0){console.error(n());return}typeof e[0]=="string"?console.error(n()+e[0],...e.slice(1)):console.error(n(),...e)}function m(){r=null}export{m as _resetCachedPrefixForTests,a as cerr,n as consolePrefix,c as droneIdPrefix,s as initConsolePrefix};

package/dist/cube-name.js

@@ -1,65 +1 @@
-const MAX_URL_LEN = 2048;
-const CONTROL_CHAR_RE = /[\x00-\x1F\x7F]/;
-/**
- * Trim + reject control chars + cap length. Returns null on rejection
- * so callers fall through to no-remote derivation.
- */
-export function sanitizeRemoteUrl(raw) {
-    const trimmed = raw.trim();
-    if (trimmed.length === 0 || trimmed.length > MAX_URL_LEN)
-        return null;
-    if (CONTROL_CHAR_RE.test(trimmed))
-        return null;
-    return trimmed;
-}
-/**
- * Extract the repo name from a git remote URL. Handles SSH/HTTPS/git/file
- * forms and embedded credentials. Returns null when nothing parseable
- * is present.
- *
- * Strategy: strip protocol + credentials, then take the last path segment
- * after the final `/` or `:`, stripping a trailing `.git`.
- */
-export function parseGitRemote(url) {
-    if (!url)
-        return null;
-    let s = url.replace(/^[a-z]+:\/\//, '');
-    s = s.replace(/^[^@\/]*@/, '');
-    const lastSep = Math.max(s.lastIndexOf('/'), s.lastIndexOf(':'));
-    if (lastSep === -1)
-        return null;
-    let name = s.slice(lastSep + 1);
-    name = name.replace(/\.git$/, '');
-    return name.length > 0 ? name : null;
-}
-/**
- * Normalize an arbitrary string into a valid cube name:
- * lowercase, underscores+spaces → hyphens, strip [^a-z0-9-], truncate 64.
- */
-export function normalizeCubeName(raw) {
-    return raw
-        .toLowerCase()
-        .replace(/[_\s]+/g, '-')
-        .replace(/[^a-z0-9-]/g, '')
-        .slice(0, 64);
-}
-/**
- * Compose the full derivation: sanitize + parse + normalize, with
- * project-root basename as fallback. Returns null when no valid name
- * can be derived.
- */
-export function deriveCubeName(projectRoot, gitRemoteUrl) {
-    if (gitRemoteUrl) {
-        const sanitized = sanitizeRemoteUrl(gitRemoteUrl);
-        if (sanitized) {
-            const repo = parseGitRemote(sanitized);
-            if (repo) {
-                const normalized = normalizeCubeName(repo);
-                if (normalized.length > 0)
-                    return normalized;
-            }
-        }
-    }
-    return null;
-}
-//# sourceMappingURL=cube-name.js.map
+const c=2048,i=/[\x00-\x1F\x7F]/;function o(t){const e=t.trim();return e.length===0||e.length>2048||i.test(e)?null:e}function a(t){if(!t)return null;let e=t.replace(/^[a-z]+:\/\//,"");e=e.replace(/^[^@\/]*@/,"");const r=Math.max(e.lastIndexOf("/"),e.lastIndexOf(":"));if(r===-1)return null;let n=e.slice(r+1);return n=n.replace(/\.git$/,""),n.length>0?n:null}function u(t){return t.toLowerCase().replace(/[_\s]+/g,"-").replace(/[^a-z0-9-]/g,"").slice(0,64)}function s(t,e){if(e){const r=o(e);if(r){const n=a(r);if(n){const l=u(n);if(l.length>0)return l}}}return null}export{s as deriveCubeName,u as normalizeCubeName,a as parseGitRemote,o as sanitizeRemoteUrl};

package/dist/cubes.js

@@ -1,269 +1,4 @@
-/**
- * Per-project active-cube persistence for Borg MCP client
- *
- * Stores the currently-assimilated cube (name + drone session token + drone
- * label + apiUrl) PER PROJECT in ~/.config/borgmcp/cubes.json. The "project"
- * is identified by walking up from cwd to find a .git directory; if none is
- * found, cwd itself is used as the project key.
- *
- * The session token is a bearer credential for drone-scoped REST endpoints,
- * but it is not as sensitive as the OAuth tokens (which still live in the
- * OS keychain via config.ts) — it only authorizes access within the cube
- * the user has already been admitted to.
- *
- * apiUrl is captured at assimilate time so subprocess invocations (e.g. the
- * SessionStart hook firing borg-regen) don't need BORG_API_URL in their env
- * to know which worker to talk to.
- */
-import { existsSync } from 'node:fs';
-import { mkdir, readFile, writeFile, unlink } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-const CUBES_DIR = join(homedir(), '.config', 'borgmcp');
-const CUBES_FILE = join(CUBES_DIR, 'cubes.json');
-const LAUNCH_FILE = join(CUBES_DIR, 'launch.json');
-const CODEX_WAKE_TARGETS_FILE = join(CUBES_DIR, 'codex-wake-targets.json');
-const INBOX_DIR = join(CUBES_DIR, 'inboxes');
-/**
- * Walk up from cwd looking for a .git directory. If found, return that
- * directory. If not found by filesystem root, return the original cwd.
- * The returned absolute path is the "project key" used to scope cube state.
- */
-export function findProjectRoot(cwd = process.cwd()) {
-    let dir = resolve(cwd);
-    while (true) {
-        if (existsSync(join(dir, '.git')))
-            return dir;
-        const parent = dirname(dir);
-        if (parent === dir)
-            return resolve(cwd); // hit root, fall back to cwd
-        dir = parent;
-    }
-}
-/**
- * Per-(cube, drone) inbox file path. Each drone gets its own file so that
- * multiple drones in the same cube don't trample each other's writes when
- * they each receive the same long-poll batch. The file lives under a
- * per-cube subdir keyed by cube ID, then by drone ID (a UUID, globally
- * unique).
- *
- * Validates cubeId/droneId as UUIDs before using them in a filesystem
- * path. The values come from cubes.json (populated from server response),
- * so the input is trusted in normal operation — but a regex guard is
- * cheap defense against a corrupted file or future bug that would
- * otherwise let `../` slip through into the inbox path.
- */
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-export function inboxPathForDrone(cubeId, droneId) {
-    if (!UUID_RE.test(cubeId))
-        throw new Error(`Invalid cubeId: ${cubeId}`);
-    if (!UUID_RE.test(droneId))
-        throw new Error(`Invalid droneId: ${droneId}`);
-    return join(INBOX_DIR, cubeId, `${droneId}.log`);
-}
-/**
- * Type guard: true iff the parsed JSON looks like the new schema. Anything
- * else (old single-cube schema, malformed, missing) is treated as "no state".
- */
-function isCubesFile(data) {
-    return (data !== null &&
-        typeof data === 'object' &&
-        typeof data.projects === 'object' &&
-        data.projects !== null &&
-        !Array.isArray(data.projects));
-}
-/**
- * Read the cubes.json file. Returns null if the file does not exist, is
- * unparseable, or is in the old single-cube schema (per the project's no-
- * backward-compat stance, the old shape is treated as absent — it will be
- * overwritten the next time setActiveCube() runs).
- */
-async function readCubesFile() {
-    let raw;
-    try {
-        raw = await readFile(CUBES_FILE, 'utf8');
-    }
-    catch (error) {
-        if (error?.code === 'ENOENT')
-            return null;
-        throw error;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    if (!isCubesFile(parsed))
-        return null;
-    return parsed;
-}
-/**
- * Write the cubes.json file, ensuring the parent directory exists.
- */
-async function writeCubesFile(data) {
-    await mkdir(dirname(CUBES_FILE), { recursive: true });
-    await writeFile(CUBES_FILE, JSON.stringify(data, null, 2) + '\n', {
-        mode: 0o600,
-    });
-}
-function isLaunchFile(data) {
-    return (data !== null &&
-        typeof data === 'object' &&
-        typeof data.projects === 'object' &&
-        data.projects !== null &&
-        !Array.isArray(data.projects));
-}
-async function readLaunchFile() {
-    let raw;
-    try {
-        raw = await readFile(LAUNCH_FILE, 'utf8');
-    }
-    catch (error) {
-        if (error?.code === 'ENOENT')
-            return null;
-        throw error;
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        return isLaunchFile(parsed) ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-async function writeLaunchFile(data) {
-    await mkdir(dirname(LAUNCH_FILE), { recursive: true });
-    await writeFile(LAUNCH_FILE, JSON.stringify(data, null, 2) + '\n', {
-        mode: 0o600,
-    });
-}
-function codexWakeTargetKey(cubeId, droneId) {
-    if (!UUID_RE.test(cubeId))
-        throw new Error(`Invalid cubeId: ${cubeId}`);
-    if (!UUID_RE.test(droneId))
-        throw new Error(`Invalid droneId: ${droneId}`);
-    return `${cubeId}:${droneId}`;
-}
-function isCodexWakeTargetsFile(data) {
-    return (data !== null &&
-        typeof data === 'object' &&
-        typeof data.targets === 'object' &&
-        data.targets !== null &&
-        !Array.isArray(data.targets));
-}
-async function readCodexWakeTargetsFile() {
-    let raw;
-    try {
-        raw = await readFile(CODEX_WAKE_TARGETS_FILE, 'utf8');
-    }
-    catch (error) {
-        if (error?.code === 'ENOENT')
-            return null;
-        throw error;
-    }
-    try {
-        const parsed = JSON.parse(raw);
-        return isCodexWakeTargetsFile(parsed) ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
-async function writeCodexWakeTargetsFile(data) {
-    await mkdir(dirname(CODEX_WAKE_TARGETS_FILE), { recursive: true });
-    await writeFile(CODEX_WAKE_TARGETS_FILE, JSON.stringify(data, null, 2) + '\n', {
-        mode: 0o600,
-    });
-}
-/**
- * Get the currently-active cube for the current project, or null if not
- * assimilated in this project. Entries written by older client versions
- * that lack the `cubeId` field are treated as absent — re-assimilate to
- * refresh.
- */
-export async function getActiveCube() {
-    const data = await readCubesFile();
-    if (!data)
-        return null;
-    const key = findProjectRoot();
-    const entry = data.projects[key];
-    if (!entry || typeof entry.cubeId !== 'string' || !entry.cubeId)
-        return null;
-    if (typeof entry.droneId !== 'string' || !entry.droneId)
-        return null;
-    return entry;
-}
-/**
- * Set the active cube for the current project. Preserves entries for all
- * other projects.
- */
-export async function setActiveCube(active) {
-    const existing = (await readCubesFile()) ?? { projects: {} };
-    existing.projects[findProjectRoot()] = active;
-    await writeCubesFile(existing);
-}
-export function activeCubeWithFreshRegenIdentity(active, result) {
-    const name = result.cube?.name ?? active.name;
-    const droneLabel = result.drone?.label ?? active.droneLabel;
-    if (name === active.name && droneLabel === active.droneLabel)
-        return active;
-    return { ...active, name, droneLabel };
-}
-/**
- * Clear the active cube for the current project. If the projects map
- * becomes empty as a result, remove the file entirely rather than leave
- * an empty {projects:{}} skeleton.
- */
-export async function clearActiveCube() {
-    const existing = await readCubesFile();
-    if (!existing)
-        return;
-    const key = findProjectRoot();
-    if (!(key in existing.projects))
-        return;
-    delete existing.projects[key];
-    if (Object.keys(existing.projects).length === 0) {
-        try {
-            await unlink(CUBES_FILE);
-        }
-        catch (error) {
-            if (error?.code !== 'ENOENT')
-                throw error;
-        }
-        return;
-    }
-    await writeCubesFile(existing);
-}
-export async function getProjectCliPreference() {
-    const data = await readLaunchFile();
-    if (!data)
-        return null;
-    const entry = data.projects[findProjectRoot()];
-    return entry?.cli === 'claude' || entry?.cli === 'codex' ? entry.cli : null;
-}
-export async function setProjectCliPreference(cli) {
-    const existing = (await readLaunchFile()) ?? { projects: {} };
-    existing.projects[findProjectRoot()] = { cli };
-    await writeLaunchFile(existing);
-}
-export async function setCodexWakeTarget(cubeId, droneId, target) {
-    const existing = (await readCodexWakeTargetsFile()) ?? { targets: {} };
-    existing.targets[codexWakeTargetKey(cubeId, droneId)] = {
-        ...target,
-        updatedAt: new Date().toISOString(),
-    };
-    await writeCodexWakeTargetsFile(existing);
-}
-export async function getCodexWakeTarget(cubeId, droneId) {
-    const existing = await readCodexWakeTargetsFile();
-    if (!existing)
-        return null;
-    const target = existing.targets[codexWakeTargetKey(cubeId, droneId)];
-    if (!target || typeof target.threadId !== 'string' || typeof target.socketPath !== 'string') {
-        return null;
-    }
-    return target;
-}
-//# sourceMappingURL=cubes.js.map
+import{existsSync as E}from"node:fs";import{mkdir as l,readFile as f,writeFile as p,unlink as m}from"node:fs/promises";import{homedir as C}from"node:os";import{dirname as c,join as o,resolve as d}from"node:path";const s=o(C(),".config","borgmcp"),a=o(s,"cubes.json"),y=o(s,"launch.json"),w=o(s,"codex-wake-targets.json"),F=o(s,"inboxes");function i(t=process.cwd()){let e=d(t);for(;;){if(E(o(e,".git")))return e;const r=c(e);if(r===e)return d(t);e=r}}const u=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function _(t,e){if(!u.test(t))throw new Error(`Invalid cubeId: ${t}`);if(!u.test(e))throw new Error(`Invalid droneId: ${e}`);return o(F,t,`${e}.log`)}function N(t){return t!==null&&typeof t=="object"&&typeof t.projects=="object"&&t.projects!==null&&!Array.isArray(t.projects)}async function g(){let t;try{t=await f(a,"utf8")}catch(r){if(r?.code==="ENOENT")return null;throw r}let e;try{e=JSON.parse(t)}catch{return null}return N(e)?e:null}async function j(t){await l(c(a),{recursive:!0}),await p(a,JSON.stringify(t,null,2)+`
+`,{mode:384})}function I(t){return t!==null&&typeof t=="object"&&typeof t.projects=="object"&&t.projects!==null&&!Array.isArray(t.projects)}async function h(){let t;try{t=await f(y,"utf8")}catch(e){if(e?.code==="ENOENT")return null;throw e}try{const e=JSON.parse(t);return I(e)?e:null}catch{return null}}async function O(t){await l(c(y),{recursive:!0}),await p(y,JSON.stringify(t,null,2)+`
+`,{mode:384})}function x(t,e){if(!u.test(t))throw new Error(`Invalid cubeId: ${t}`);if(!u.test(e))throw new Error(`Invalid droneId: ${e}`);return`${t}:${e}`}function k(t){return t!==null&&typeof t=="object"&&typeof t.targets=="object"&&t.targets!==null&&!Array.isArray(t.targets)}async function b(){let t;try{t=await f(w,"utf8")}catch(e){if(e?.code==="ENOENT")return null;throw e}try{const e=JSON.parse(t);return k(e)?e:null}catch{return null}}async function A(t){await l(c(w),{recursive:!0}),await p(w,JSON.stringify(t,null,2)+`
+`,{mode:384})}async function $(){const t=await g();if(!t)return null;const e=i(),r=t.projects[e];return!r||typeof r.cubeId!="string"||!r.cubeId||typeof r.droneId!="string"||!r.droneId?null:r}async function v(t){const e=await g()??{projects:{}};e.projects[i()]=t,await j(e)}function P(t,e){const r=e.cube?.name??t.name,n=e.drone?.label??t.droneLabel;return r===t.name&&n===t.droneLabel?t:{...t,name:r,droneLabel:n}}async function D(){const t=await g();if(!t)return;const e=i();if(e in t.projects){if(delete t.projects[e],Object.keys(t.projects).length===0){try{await m(a)}catch(r){if(r?.code!=="ENOENT")throw r}return}await j(t)}}async function J(){const t=await h();if(!t)return null;const e=t.projects[i()];return e?.cli==="claude"||e?.cli==="codex"?e.cli:null}async function R(t){const e=await h()??{projects:{}};e.projects[i()]={cli:t},await O(e)}async function U(t,e,r){const n=await b()??{targets:{}};n.targets[x(t,e)]={...r,updatedAt:new Date().toISOString()},await A(n)}async function B(t,e){const r=await b();if(!r)return null;const n=r.targets[x(t,e)];return!n||typeof n.threadId!="string"||typeof n.socketPath!="string"?null:n}export{P as activeCubeWithFreshRegenIdentity,D as clearActiveCube,i as findProjectRoot,$ as getActiveCube,B as getCodexWakeTarget,J as getProjectCliPreference,_ as inboxPathForDrone,v as setActiveCube,U as setCodexWakeTarget,R as setProjectCliPreference};