borgmcp 2.0.2 → 2.0.4

package/src/assimilate-cmd.ts

@@ -42,7 +42,7 @@ import { installBorgPlugin } from './opencode-plugin.js';
 import { computeOpenCodePort, connectOpenCodeDrone, createOpenCodeLaunchKickoff, injectInitialKickoff } from './opencode-drone.js';
 import { ensureCliMcpConfigured } from './ensure-mcp-config.js';
 import { normalizeServerEndpoint } from './server-endpoint.js';
-import { BorgServerError } from './server-errors.js';
+import { BorgServerError, LegacySessionCredentialCollisionError } from './server-errors.js';
 import type { SeatStatus } from './seat-probe.js';
 import type { ServerSessionOperation } from './config.js';
 import type { ExpectedBinding, FinalizeServerSeatOutcome, PersistedLocalSeat } from './cubes.js';
@@ -92,7 +92,6 @@ export interface AssimilateResult {
   role_id: string;
   local_session?: {
     credential_ref: string;
-    expires_at: string | null;
   };
   // Idempotent-reattach discriminant: 'reused' when the server resolved the
   // client bearer to an existing seat, 'created' on a first/fresh attach.
@@ -126,7 +125,6 @@ export interface ActiveCube {
   /** Verified local-server CA identity; absent until a local server is selected. */
   serverTrustIdentity?: string;
   localSessionCredentialRef?: string;
-  localSessionExpiresAt?: string | null;
   // gh#899: assimilated role, persisted for connect-time tool-surface scoping
   // (mirrors cubes.ts ActiveCube; optional → backward-compatible).
   roleName?: string;
@@ -388,25 +386,25 @@ function reportServerFailure(
     );
     return 1;
   }
+  if (error instanceof LegacySessionCredentialCollisionError) {
+    deps.stderr(
+      `Local session credential collision detected.\n` +
+        `No local credentials were changed.\n` +
+        `Next: run borg assimilate --host ${error.origin} --enroll.\n`,
+    );
+    return 1;
+  }
   // A pin-matched typed 401: the server verified its own identity but rejected
-  // THIS worktree's session bearer (revoked, or taken over by another session).
+  // THIS worktree's session bearer with an explicit terminal outcome.
   // Distinct from a protocol/version mismatch and from a rejected enrollment:
   // only this worktree's saved local seat is affected, and recovery is scoped to
   // this worktree — no server/trust-anchor/cube/other-worktree reset, no restart
   // or version-alignment advice (#1082).
+  if (error instanceof BorgServerError && error.code === 'SESSION_REVOKED') {
+    return diagnoseSessionTermination(deps, apiUrl, 'revoked');
+  }
   if (error instanceof BorgServerError && error.code === 'SESSION_REJECTED') {
-    // Attach is PURE DIAGNOSIS on a rejection — it mutates nothing. This copy
-    // claims NO mutation of its own; it points at the dedicated OFFLINE
-    // `borg reset-local-seat` command (the only writer that clears a seat).
-    deps.stderr(
-      `This worktree's saved local seat on ${apiUrl} is no longer accepted — it was ` +
-        'revoked or taken over by another session. No Borg state changed. Run ' +
-        `${resetLocalSeatCommand(apiUrl)} to clear ONLY this worktree's saved seat ` +
-        '(offline; add `--yes` when non-interactive), then ask the server operator for a new ' +
-        'invitation — the server can stay running — and re-enroll with ' +
-        `${localAssimilateCommand(apiUrl, true)}.\n`,
-    );
-    return 1;
+    return diagnoseSessionTermination(deps, apiUrl, 'superseded');
   }
   if (error instanceof BorgServerError && error.code === 'INVITATION_REJECTED') {
     deps.stderr(
@@ -482,34 +480,19 @@ function resetLocalSeatCommand(apiUrl: string): string {
   return `\`borg reset-local-seat --host ${apiUrl}\``;
 }
 
-/**
- * Pin-matched SESSION_REJECTED diagnosis (#1082). PURE DIAGNOSIS — attach makes
- * ZERO local mutation on a rejected seat (ratified client-seat-reset-state-model
- * clause 1). The local server verified its OWN pinned identity (this is reached
- * only after a successful pinned-TLS attach — a pin MISMATCH throws a distinct
- * trust error and never lands here), then rejected THIS worktree's saved session
- * bearer (revoked, or taken over by another session). We stop and recommend the
- * dedicated OFFLINE `borg reset-local-seat` command, which is the ONLY writer
- * that clears a worktree's saved seat. Nothing here contacts the server further,
- * emits unselected egress, or touches local state. The recovery is
- * live-safe: the operator is never told to stop/restart the server.
- */
-function diagnoseSessionRejected(
+// Pin-matched terminal session diagnosis. This is intentionally output-only:
+// only the explicit offline reset command may clear the saved local seat.
+function diagnoseSessionTermination(
   deps: AssimilateDeps,
   apiUrl: string,
+  outcome: 'revoked' | 'superseded',
 ): number {
-  const worktree = deps.findProjectRoot(deps.cwd());
-  deps.stderr(
-    `This worktree's saved local seat on ${apiUrl} is no longer accepted — it was ` +
-      'revoked or taken over by another session. No Borg state was changed: your pinned ' +
-      'server trust, this and every other worktree, and their cubes are all untouched.\n',
-  );
+  const message = outcome === 'revoked'
+    ? 'Local session was revoked.'
+    : 'Local session was superseded by a newer enrollment.';
   deps.stderr(
-    `To clear ONLY this worktree's saved local seat (worktree ${worktree}), run ` +
-      `${resetLocalSeatCommand(apiUrl)} (add \`--yes\` when non-interactive). That command is ` +
-      'offline — it revokes nothing server-side. Then ask the server operator for a new ' +
-      'invitation (the server can stay running) and re-enroll with ' +
-      `${localAssimilateCommand(apiUrl, true)}.\n`,
+    `${message}\n` +
+      `Next: run borg reset-local-seat, then borg assimilate --host ${apiUrl} --enroll.\n`,
   );
   return 1;
 }
@@ -534,9 +517,28 @@ export async function runAssimilate(
     }
   }
 
+  // Read local seat state before authority discovery, which may probe the local
+  // server. A retired replacement collision must not send either saved bearer or
+  // perform any other network request.
+  let existing: ActiveCube | null = null;
+  let hasPersistedIdentity = false;
+  let localSeatReadError: unknown;
+  try {
+    existing = await deps.getActiveCube();
+    hasPersistedIdentity = existing !== null || await deps.hasPersistedActiveCube();
+  } catch (error) {
+    if (error instanceof LegacySessionCredentialCollisionError) {
+      return reportServerFailure(deps, error.origin, error);
+    }
+    localSeatReadError = error;
+  }
+
   // ----- Step 1: Select and authenticate the local server -----
   const authority = await selectAssimilationAuthority(args.flags, deps);
   if (!authority) return 1;
+  if (localSeatReadError !== undefined) {
+    return reportServerFailure(deps, authority.apiUrl, localSeatReadError);
+  }
 
   // ----- Repository + cube-name preflight -----
   // Resolve and, where necessary, confirm local presentation data before an
@@ -766,8 +768,6 @@ export async function runAssimilate(
   // retain its original role so the attach request reuses the exact durable
   // retry binding instead of selecting another unoccupied role and minting a
   // duplicate seat.
-  const existing = await deps.getActiveCube();
-  const hasPersistedIdentity = existing !== null || await deps.hasPersistedActiveCube();
   const wantSibling =
     args.flags.worktree !== undefined || (existing !== null && !args.flags.here);
   // `let`: the bound-pending resume path (CR#2) OVERRIDES this from the stored
@@ -943,8 +943,11 @@ export async function runAssimilate(
       // rejection; it points at the offline `borg reset-local-seat` command.
       // Distinct from unreachable/404/5xx/trust-mismatch, which stay
       // indeterminate below.
+      if (status === 'revoked') {
+        return diagnoseSessionTermination(deps, auth.apiUrl, 'revoked');
+      }
       if (status === 'rejected') {
-        return diagnoseSessionRejected(deps, auth.apiUrl);
+        return diagnoseSessionTermination(deps, auth.apiUrl, 'superseded');
       }
       // CR #6: distinct causes get cause-accurate, non-destructive recovery —
       // never the generic "restart the server" advice.
@@ -1192,17 +1195,18 @@ export async function runAssimilate(
       );
       return 1;
     }
-    // Pin-matched SESSION_REJECTED (revoked / taken-over seat): PURE DIAGNOSIS.
+    // Pin-matched terminal session outcomes are pure diagnosis.
     // Reached only after a successful pinned-TLS attach, so it is pin-matched by
     // construction — a pin mismatch throws a distinct trust error and never
     // enters this branch. Attach mutates NOTHING; it recommends the offline
     // `borg reset-local-seat` command.
-    if (
-      err instanceof BorgServerError &&
-      err.code === 'SESSION_REJECTED' &&
-      reattachPriorId != null
-    ) {
-      return diagnoseSessionRejected(deps, authority.apiUrl);
+    if (err instanceof BorgServerError && reattachPriorId != null) {
+      if (err.code === 'SESSION_REVOKED') {
+        return diagnoseSessionTermination(deps, authority.apiUrl, 'revoked');
+      }
+      if (err.code === 'SESSION_REJECTED') {
+        return diagnoseSessionTermination(deps, authority.apiUrl, 'superseded');
+      }
     }
     if (authority.kind === 'server') {
       return reportServerFailure(deps, authority.apiUrl, err);
@@ -1389,7 +1393,6 @@ export async function runAssimilate(
     apiUrl: auth.apiUrl,
     serverTrustIdentity: auth.serverTrustIdentity,
     localSessionCredentialRef: result.local_session!.credential_ref,
-    localSessionExpiresAt: result.local_session!.expires_at,
     // gh#899: persist the assimilated role so the connect-time ListTools
     // handler can role-scope the native tool surface.
     roleName: assignedRole.name,

package/src/assimilate-deps.ts

@@ -352,7 +352,6 @@ export function buildDefaultAssimilateDeps(): AssimilateDeps {
           result: prepared.result,
           local_session: {
             credential_ref: prepared.credentialRef,
-            expires_at: prepared.session.expiresAt,
           },
           // Handles for the cube-lock-held FINALIZE (assimilate-cmd Step 8).
           finalize: {

package/src/claude.ts

@@ -14,6 +14,7 @@
  *                         fresh drone inside it (see spawn.ts)
  *   borg sync           → Advance the current worktree across the 5
  *                         lifecycle states (see sync.ts, gh#33)
+ *   borg server <cmd>   → Forward a lifecycle command to borg-mcp-server
  */
 
 import { spawn } from 'child_process';
@@ -78,8 +79,12 @@ import { ensureCliMcpConfigured } from './ensure-mcp-config.js';
 import { installBorgPlugin } from './opencode-plugin.js';
 import { connectOpenCodeDrone, computeOpenCodePort, createOpenCodeLaunchKickoff, injectInitialKickoff } from './opencode-drone.js';
 import { buildOpenCodeLaunchArgs, defaultApprovalIo, resolveLaunchBorgApprovals } from './cli-tool-approval.js';
+import { runEarlyServerFacade } from './server-facade.js';
 
 async function main() {
+  const serverExitCode = await runEarlyServerFacade(process.argv);
+  if (serverExitCode !== null) process.exit(serverExitCode);
+
   // `--debug` / BORG_DEBUG: enable HTTP request/response logging to stderr
   // (observability for failures like the cross-account assimilate 404).
   // Done first so debug covers everything below; strips `--debug` from argv

package/src/cleanup-cmd.ts

@@ -69,7 +69,8 @@ export type CleanupReason =
   | 'SURVIVES-clobber'
   | 'SURVIVES-unmerged'
   | 'SURVIVES-detached'
-  | 'SURVIVES-rejected'
+  | 'SURVIVES-revoked'
+  | 'SURVIVES-superseded'
   | 'SURVIVES-live'
   | 'SURVIVES-self'
   | 'UNKNOWN-indeterminate'
@@ -345,7 +346,9 @@ async function classifyWorktree(
     case 'evicted':
       return { reason: 'PRUNABLE', detail: '410 DRONE_EVICTED (clean + merged)' };
     case 'rejected':
-      return { reason: 'SURVIVES-rejected', detail: 'pin-matched 401 (revoked/taken over) — recoverable via re-enroll, never delete' };
+      return { reason: 'SURVIVES-superseded', detail: 'session superseded by a newer enrollment — recoverable via re-enroll, never delete' };
+    case 'revoked':
+      return { reason: 'SURVIVES-revoked', detail: 'session revoked — recoverable via re-enroll, never delete' };
     case 'live':
       return { reason: 'SURVIVES-live', detail: 'seat resolves (drone alive)' };
     case 'indeterminate':

package/src/cli-help.ts

@@ -36,12 +36,28 @@ export function topLevelHelpText(version: string): string {
     `  borg launch-all [cube]   Launch all drone worktrees of a cube (default: active cube)\n` +
     `  borg launch-all [cube] --cli claude|codex|opencode\n` +
     `                           Launch all drone worktrees with that agent CLI\n` +
+    `  borg server <command> [arguments]\n` +
     `  borg --cli claude|codex|opencode  Launch that agent CLI directly\n` +
     `  borg --version           Show installed version\n\n` +
     `All other arguments are passed through to the selected agent CLI.\n`
   );
 }
 
+/** Product Design-approved client-owned copy for `borg server --help`. */
+export function serverHelpText(): string {
+  return (
+    `Usage: borg server <command> [arguments]\n\n` +
+    `Commands:\n` +
+    `  setup    Prepare local server identity and data; does not start the server.\n` +
+    `  start    Start the verified server in the foreground.\n` +
+    `  stop     Stop the managed local server.\n` +
+    `  status   Report verified runtime evidence.\n` +
+    `  update   Verify and activate a local server artifact.\n` +
+    `  invite   Create a single-use invitation in an interactive terminal.\n\n` +
+    `Run borg server <command> --help for server command options.\n`
+  );
+}
+
 /**
  * Help text for `borg assimilate --help` — the home for the full assimilate flag
  * set. Model/provider configuration belongs to the selected agent CLI.
@@ -87,7 +103,7 @@ export function resetLocalSeatHelpText(version: string): string {
     `just this worktree's saved local seat — its credential and cube binding together — from the\n` +
     `local seat store on this machine. Server, trust anchor, cube, and every sibling worktree are\n` +
     `left untouched.\n\n` +
-    `Use it after \`borg assimilate\` reports this worktree's seat was revoked or taken over\n` +
+    `Use it after \`borg assimilate\` reports this worktree's session was revoked or superseded\n` +
     `(a pin-matched rejection), then ask the operator for a new invitation and re-enroll.\n\n` +
     `Usage:\n` +
     `  borg reset-local-seat                 Reset this worktree's saved seat (TTY confirms [y/N])\n` +

package/src/config.ts

@@ -1,14 +1,11 @@
 /**
  * Secure local-server credential storage.
  *
- * The self-hosted-server credential group (enrollment credentials, pending
- * enrollment/cube-creation records, and the per-seat drone-session bearers)
- * rests ONLY in the 0600 credential file store (Queen rescope) — parity with the
- * server's own TLS private keys. The OS keychain is gone; the raw secret never
- * leaves the 0600 file, and a single store flock serializes every read-compare-write.
+ * Parent enrollment credentials and pending enrollment/cube-creation records
+ * rest ONLY in the canonical 0600 credential file. Per-seat session credentials
+ * remain in the separate seat store. A single flock serializes every parent-store
+ * read-compare-write shared by client enrollment and same-machine server setup.
  */
-import os from 'os';
-import path from 'path';
 import { createHash, randomBytes, randomUUID } from 'crypto';
 import type { ServerCapability } from 'borgmcp-shared/protocol';
 import { withStoreLock } from './seat-store.js';
@@ -16,14 +13,15 @@ import {
   makeFileBackend,
   type TokenBackend,
 } from './token-store.js';
+import { BORG_USER_ROOT, SERVER_CREDENTIALS_FILE } from './credential-paths.js';
 
 const SERVER_CREDENTIAL_RECORD_VERSION = 2 as const;
 const SERVER_PENDING_ENROLLMENT_RECORD_VERSION = 1 as const;
 const SERVER_CUBE_RETRY_RECORD_VERSION = 1 as const;
 // The 0600 credential store (Queen rescope: replaces the OS keychain). A single
-// file holds every server credential/session/enrollment record; a single flock
+// file holds every parent credential/enrollment record; a single flock
 // serializes every mutator + observer that must (SR-seven #4).
-const CREDENTIALS_FILE = path.join(os.homedir(), '.config', 'borgmcp', 'credentials.json');
+const CREDENTIALS_FILE = SERVER_CREDENTIALS_FILE;
 const CREDENTIALS_LOCK = `${CREDENTIALS_FILE}.lock`;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
@@ -199,15 +197,39 @@ function serverCubeRetryAccount(
 // parity with the server's TLS keys; no OS keychain, no obfuscation-grade
 // fallback). The single store lock (CREDENTIALS_LOCK) serializes the RCW.
 let serverCredentialBackendPromise: Promise<TokenBackend> | null = null;
+let testBackendInjected = false;
+let testLockTail: Promise<void> = Promise.resolve();
+async function withCredentialStoreLock<T>(operation: () => Promise<T>): Promise<T> {
+  if (!testBackendInjected) {
+    return withStoreLock(CREDENTIALS_LOCK, operation, {
+      secureRoot: BORG_USER_ROOT,
+      rootMode: 'owner-controlled',
+    });
+  }
+  const prior = testLockTail;
+  let release!: () => void;
+  testLockTail = new Promise<void>((resolveLock) => { release = resolveLock; });
+  await prior;
+  try {
+    return await operation();
+  } finally {
+    release();
+  }
+}
 async function getServerCredentialBackend(): Promise<TokenBackend> {
   if (!serverCredentialBackendPromise) {
-    serverCredentialBackendPromise = Promise.resolve(makeFileBackend(CREDENTIALS_FILE));
+    serverCredentialBackendPromise = Promise.resolve(makeFileBackend(CREDENTIALS_FILE, {
+      secureRoot: BORG_USER_ROOT,
+      rootMode: 'owner-controlled',
+    }));
   }
   return serverCredentialBackendPromise;
 }
 
 /** Test-only credential-store backend injection. */
 export function __setServerCredentialBackendForTest(backend: TokenBackend | null): void {
+  testBackendInjected = backend !== null;
+  testLockTail = Promise.resolve();
   serverCredentialBackendPromise = backend ? Promise.resolve(backend) : null;
 }
 
@@ -252,7 +274,7 @@ async function writeServerCredentialRecord(
  */
 export async function storeServerCredential(record: ServerCredentialRecord): Promise<void> {
   const backend = await getServerCredentialBackend();
-  await withStoreLock(CREDENTIALS_LOCK, () => writeServerCredentialRecord(backend, record));
+  await withCredentialStoreLock(() => writeServerCredentialRecord(backend, record));
 }
 
 /** Read an authority-bound active client record, failing closed on corruption. */
@@ -346,7 +368,7 @@ export async function getPendingServerEnrollment(
   validateServerCredentialBinding(origin, trustIdentity);
   const backend = await getServerCredentialBackend();
   const account = serverPendingEnrollmentAccount(origin, trustIdentity);
-  return withStoreLock(CREDENTIALS_LOCK, async () => {
+  return withCredentialStoreLock(async () => {
     const stored = await backend.get(account);
     if (!stored) return null;
     try {
@@ -375,7 +397,7 @@ export async function getOrCreatePendingServerEnrollment(
   validateClientName(input.clientName);
   const backend = await getServerCredentialBackend();
   const account = serverPendingEnrollmentAccount(input.origin, input.trustIdentity);
-  return withStoreLock(CREDENTIALS_LOCK, async () => {
+  return withCredentialStoreLock(async () => {
     const stored = await backend.get(account);
     if (stored) {
       try {
@@ -432,7 +454,7 @@ export async function activatePendingServerEnrollment(
   const serverCapabilities = validateServerCapabilities(input.serverCapabilities);
   const backend = await getServerCredentialBackend();
   const pendingAccount = serverPendingEnrollmentAccount(input.origin, input.trustIdentity);
-  await withStoreLock(CREDENTIALS_LOCK, async () => {
+  await withCredentialStoreLock(async () => {
     const stored = await backend.get(pendingAccount);
     if (!stored) throw new Error('pending Borg server enrollment is missing');
     try {
@@ -469,7 +491,7 @@ export async function clearPendingServerEnrollment(
   validateUuid(retryKey, 'enrollment retry key');
   const backend = await getServerCredentialBackend();
   const account = serverPendingEnrollmentAccount(origin, trustIdentity);
-  await withStoreLock(CREDENTIALS_LOCK, async () => {
+  await withCredentialStoreLock(async () => {
     const stored = await backend.get(account);
     if (!stored) return;
     try {
@@ -510,7 +532,7 @@ export async function getOrCreatePendingServerCubeCreation(
     input.clientId,
     repositoryBinding,
   );
-  return withStoreLock(CREDENTIALS_LOCK, async () => {
+  return withCredentialStoreLock(async () => {
     const stored = await backend.get(account);
     if (stored) {
       try {
@@ -572,7 +594,7 @@ export async function clearPendingServerCubeCreation(
     record.clientId,
     record.repositoryBinding,
   );
-  await withStoreLock(CREDENTIALS_LOCK, async () => {
+  await withCredentialStoreLock(async () => {
     const stored = await backend.get(account);
     if (!stored) return;
     try {
@@ -588,7 +610,7 @@ export async function clearPendingServerCubeCreation(
 export async function clearServerCredential(origin: string, trustIdentity: string): Promise<void> {
   const backend = await getServerCredentialBackend();
   const pendingAccount = serverPendingEnrollmentAccount(origin, trustIdentity);
-  await withStoreLock(CREDENTIALS_LOCK, async () => {
+  await withCredentialStoreLock(async () => {
     await backend.delete(serverCredentialAccount(origin, trustIdentity));
     await backend.delete(pendingAccount);
   });

package/src/credential-paths.ts

@@ -0,0 +1,8 @@
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const canonicalHome = realpathSync(homedir());
+
+export const BORG_USER_ROOT = join(canonicalHome, '.borg');
+export const SERVER_CREDENTIALS_FILE = join(BORG_USER_ROOT, 'credentials');

package/src/cubes.ts

@@ -62,7 +62,6 @@ export interface ActiveCube {
   serverTrustIdentity?: string;
   /** Opaque local-session keychain reference; never a bearer. */
   localSessionCredentialRef?: string;
-  localSessionExpiresAt?: string | null;
   // gh#899: the assimilated role, persisted so the connect-time ListTools
   // handler can role-scope the NATIVE tool surface (UX/context only — never an
   // auth boundary). Absent on pre-gh#899 cubes.json entries → the filter
@@ -280,7 +279,6 @@ async function hydrateActiveCube(record: SeatRecord): Promise<ActiveCube | null>
     apiUrl: record.origin,
     serverTrustIdentity: record.trustIdentity,
     localSessionCredentialRef: ref,
-    ...(record.expiresAt !== undefined ? { localSessionExpiresAt: record.expiresAt } : {}),
     ...(record.roleName !== undefined ? { roleName: record.roleName } : {}),
     ...(record.roleClass !== undefined ? { roleClass: record.roleClass } : {}),
     ...(record.isHumanSeat !== undefined ? { isHumanSeat: record.isHumanSeat } : {}),
@@ -392,7 +390,6 @@ export interface PersistedLocalSeat {
   apiUrl: string;
   serverTrustIdentity: string;
   localSessionCredentialRef: string;
-  localSessionExpiresAt?: string | null;
   roleName?: string;
   roleClass?: 'queen' | 'worker';
   isHumanSeat?: boolean;
@@ -432,7 +429,6 @@ export async function readPersistedLocalSeat(): Promise<PersistedLocalSeat | nul
     localSessionCredentialRef: seatRef(record),
     operation: record.operation,
     state: record.state,
-    ...(record.expiresAt !== undefined ? { localSessionExpiresAt: record.expiresAt } : {}),
     ...(record.roleName !== undefined ? { roleName: record.roleName } : {}),
     ...(record.roleClass !== undefined ? { roleClass: record.roleClass } : {}),
     ...(record.isHumanSeat !== undefined ? { isHumanSeat: record.isHumanSeat } : {}),

package/src/launch-all-cmd.ts

@@ -276,6 +276,7 @@ export async function runLaunchAll(
   //     LOCK-live (seemingly-running) session.
   const launchable: DroneCandidate[] = [];
   let evictedCount = 0;
+  let revokedCount = 0;
   let rejectedCount = 0;
   let trustMismatchCount = 0;
   let credentialRejectedCount = 0;
@@ -294,15 +295,19 @@ export async function runLaunchAll(
       );
       continue;
     }
+    if (status === 'revoked') {
+      revokedCount += 1;
+      deps.stderr(
+        `Local session was revoked.\n` +
+          `Next: run borg reset-local-seat, then borg assimilate --host ${c.apiUrl} --enroll.\n`
+      );
+      continue;
+    }
     if (status === 'rejected') {
       rejectedCount += 1;
       deps.stderr(
-        `skipping ${c.droneLabel} (${c.worktreeDir}): saved seat no longer accepted (revoked or ` +
-          `taken over). Recover from that worktree: ` +
-          `1) \`borg reset-local-seat --host ${c.apiUrl}\` (add --yes non-interactively) to clear ` +
-          `ONLY that worktree's saved seat; ` +
-          `2) ask the server operator to mint a fresh scoped invitation (the server stays running); ` +
-          `3) \`borg assimilate --host ${c.apiUrl} --enroll\`.\n`
+        `Local session was superseded by a newer enrollment.\n` +
+          `Next: run borg reset-local-seat, then borg assimilate --host ${c.apiUrl} --enroll.\n`
       );
       continue;
     }
@@ -355,8 +360,11 @@ export async function runLaunchAll(
     if (evictedCount > 0) {
       causes.push(`${evictedCount} evicted`);
     }
+    if (revokedCount > 0) {
+      causes.push(`${revokedCount} revoked`);
+    }
     if (rejectedCount > 0) {
-      causes.push(`${rejectedCount} with a saved seat no longer accepted (revoked/taken over)`);
+      causes.push(`${rejectedCount} superseded`);
     }
     if (trustMismatchCount > 0) {
       causes.push(`${trustMismatchCount} with a changed (terminal) server identity`);

package/src/log-stream.ts

@@ -54,8 +54,7 @@ import {
   wakeCodexViaAppServer,
 } from './codex-app-wake.js';
 import { readBoundedResponseBody } from './server-response.js';
-import { BorgServerError, BorgServerUnreachableError } from './server-errors.js';
-import { recoverExpiredLocalSession } from './session-continuity.js';
+import { BorgServerError } from './server-errors.js';
 import {
   acquireStreamLease,
   readOwnershipSnapshot,
@@ -428,7 +427,6 @@ export interface RunLoopTestDeps {
   getActiveCube?: typeof getActiveCube;
   acquireStreamLease?: typeof acquireStreamLease;
   streamOnce?: typeof streamOnce;
-  recoverExpiredSession?: typeof recoverExpiredLocalSession;
   sleep?: (ms: number) => Promise<void>;
   maxIterations?: number;
 }
@@ -437,7 +435,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
   const _getActiveCube = testDeps.getActiveCube ?? getActiveCube;
   const _acquireStreamLease = testDeps.acquireStreamLease ?? acquireStreamLease;
   const _streamOnce = testDeps.streamOnce ?? streamOnce;
-  const _recoverExpiredSession = testDeps.recoverExpiredSession ?? recoverExpiredLocalSession;
   const _sleep = testDeps.sleep ?? sleep;
   const _maxIterations = testDeps.maxIterations ?? Infinity;
   let _iterations = 0;
@@ -447,7 +444,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
   let currentCubeId: string | null = null;
   let lease: StreamLease | null = null;
   let leaseKey: string | null = null;
-  let lastRecoveredToken: string | null = null;
 
   try {
     while (_iterations < _maxIterations) {
@@ -548,7 +544,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
       }
       // Clean disconnect (e.g. server-side rollout). Reset backoff.
       attempt = 0;
-      lastRecoveredToken = null;
       streamState.reconnectAttempts = 0;
     } catch (err: any) {
       if (ownerLost) {
@@ -576,27 +571,7 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
         );
         throw new TerminalStreamError();
       }
-      if (err instanceof BorgServerError) {
-        if (err.code !== 'AUTH_EXPIRED' || lastRecoveredToken === active.sessionToken) {
-          throw new TerminalStreamError();
-        }
-        try {
-          const renewed = await _recoverExpiredSession(active);
-          lastRecoveredToken = renewed.sessionToken;
-          attempt = 0;
-          streamState.reconnectAttempts = 0;
-          continue;
-        } catch (recoveryError) {
-          if (!(recoveryError instanceof BorgServerUnreachableError)) {
-            throw new TerminalStreamError();
-          }
-          // The replacement bearer is durable and intentionally survives an
-          // ambiguous transport failure. Fall through to the ordinary bounded
-          // reconnect backoff; the next AUTH_EXPIRED response resumes that exact
-          // replacement instead of permanently silencing the stream.
-          err = recoveryError;
-        }
-      }
+      if (err instanceof BorgServerError) throw new TerminalStreamError();
       streamState.connected = false;
       const delay =
         Math.min(RECONNECT_MIN_MS * 2 ** attempt, RECONNECT_MAX_MS) +
@@ -907,9 +882,6 @@ export async function streamOnce(
       } catch {
         code = undefined;
       }
-      if (code === ErrorCode.AUTH_EXPIRED) {
-        throw new BorgServerError('AUTH_EXPIRED', 'Borg server session expired');
-      }
       if (code === ErrorCode.SESSION_REJECTED) {
         throw new BorgServerError('SESSION_REJECTED', 'Borg server session was rejected');
       }