borgmcp 1.1.14 → 2.0.1

package/src/shell-escape.ts

@@ -0,0 +1,22 @@
+// POSIX-safe shell-escaping for paste-intended emission.
+//
+// Sprint 18 (gh-tracked via dispatch 10:41:47Z): when the CLI emits a
+// `cd <path>` line for the user to copy-paste into their shell, the path is
+// a filesystem-controlled string with no character constraints (unlike
+// DB-CHECK-constrained role/cube names). Paths can legally contain spaces,
+// `$VAR`, backticks, `$(cmd)`, embedded single-quotes, and other shell
+// metacharacters that would execute on paste under naive emission.
+//
+// drone-11 SR-LANE (cube entry 2026-05-19T10:44:35Z) escalation: double-
+// quoting handles spaces but `$VAR` / backtick / `$(cmd)` still expand
+// inside double-quotes. Single-quotes with internal-quote escape (`'\''`
+// = close-quote / escaped-quote / re-open-quote) defang every shell
+// metachar including embedded `'`. POSIX-defined, copy-paste-runnable
+// across bash / zsh / dash / sh.
+//
+// Behavior: returns the input wrapped in single-quotes with any internal
+// `'` rewritten as `'\''`. Empty string returns `''`.
+
+export function shellEscape(s: string): string {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}

package/src/spawn.ts

@@ -0,0 +1,31 @@
+/**
+ * `borg spawn` — deprecation stub.
+ *
+ * Replaced by `borg assimilate [role] --worktree <name>` (see
+ * `assimilate-cmd.ts`). The new command folds worktree creation,
+ * cube creation, template application, and drone assimilation into one
+ * shell call. This file remains so existing
+ * scripts and tab-completion entries fail loudly with an actionable
+ * migration message rather than silently mis-routing.
+ *
+ * `validateName` continues to be re-exported from here for callers
+ * that still depend on the symbol (it lives in `name-validator.ts`
+ * now — single source of truth).
+ */
+
+export { validateName } from './name-validator.js';
+
+export async function runSpawn(): Promise<number> {
+  const msg =
+    'borg spawn is removed. Use:\n' +
+    '  borg assimilate [role] --worktree <name>\n' +
+    '\n' +
+    'Example: if you previously ran `borg spawn drone-2`, the equivalent is\n' +
+    '  borg assimilate --worktree drone-2\n' +
+    '(role is optional; defaults per first-drone rules)\n' +
+    '\n' +
+    'If you want a specific role:\n' +
+    '  borg assimilate builder --worktree drone-2\n';
+  process.stderr.write(msg);
+  return 2;
+}

package/src/startup-services.ts

@@ -0,0 +1,36 @@
+export type McpStartupTask = () => void | Promise<void>;
+
+/** Required named services: omission from index wiring is a type error. */
+export interface McpStartupServices {
+  sessionStartHook: McpStartupTask;
+  auditHook: McpStartupTask;
+  sseStream: McpStartupTask;
+  openCode: McpStartupTask;
+}
+
+/**
+ * Run normal long-lived MCP child startup work. The assimilation readiness
+ * child must reach the initialize response without acquiring leases, fetching
+ * SSE, mutating hooks, or starting timers because it is intentionally killed
+ * immediately after that response.
+ */
+export async function runMcpStartupServices(
+  readinessProbe: boolean,
+  services: McpStartupServices
+): Promise<void> {
+  if (readinessProbe) return;
+  const tasks = [
+    services.sessionStartHook,
+    services.auditHook,
+    services.sseStream,
+    services.openCode,
+  ];
+  for (const task of tasks) {
+    try {
+      await task();
+    } catch {
+      // Every background service is best-effort and independent. A failure in
+      // one must neither break MCP initialize nor suppress later services.
+    }
+  }
+}