borgmcp 2.0.3 → 2.0.5

package/src/log-stream.ts

@@ -54,8 +54,7 @@ import {
   wakeCodexViaAppServer,
 } from './codex-app-wake.js';
 import { readBoundedResponseBody } from './server-response.js';
-import { BorgServerError, BorgServerUnreachableError } from './server-errors.js';
-import { recoverExpiredLocalSession } from './session-continuity.js';
+import { BorgServerError } from './server-errors.js';
 import {
   acquireStreamLease,
   readOwnershipSnapshot,
@@ -428,7 +427,6 @@ export interface RunLoopTestDeps {
   getActiveCube?: typeof getActiveCube;
   acquireStreamLease?: typeof acquireStreamLease;
   streamOnce?: typeof streamOnce;
-  recoverExpiredSession?: typeof recoverExpiredLocalSession;
   sleep?: (ms: number) => Promise<void>;
   maxIterations?: number;
 }
@@ -437,7 +435,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
   const _getActiveCube = testDeps.getActiveCube ?? getActiveCube;
   const _acquireStreamLease = testDeps.acquireStreamLease ?? acquireStreamLease;
   const _streamOnce = testDeps.streamOnce ?? streamOnce;
-  const _recoverExpiredSession = testDeps.recoverExpiredSession ?? recoverExpiredLocalSession;
   const _sleep = testDeps.sleep ?? sleep;
   const _maxIterations = testDeps.maxIterations ?? Infinity;
   let _iterations = 0;
@@ -447,7 +444,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
   let currentCubeId: string | null = null;
   let lease: StreamLease | null = null;
   let leaseKey: string | null = null;
-  let lastRecoveredToken: string | null = null;
 
   try {
     while (_iterations < _maxIterations) {
@@ -548,7 +544,6 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
       }
       // Clean disconnect (e.g. server-side rollout). Reset backoff.
       attempt = 0;
-      lastRecoveredToken = null;
       streamState.reconnectAttempts = 0;
     } catch (err: any) {
       if (ownerLost) {
@@ -576,27 +571,7 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
         );
         throw new TerminalStreamError();
       }
-      if (err instanceof BorgServerError) {
-        if (err.code !== 'AUTH_EXPIRED' || lastRecoveredToken === active.sessionToken) {
-          throw new TerminalStreamError();
-        }
-        try {
-          const renewed = await _recoverExpiredSession(active);
-          lastRecoveredToken = renewed.sessionToken;
-          attempt = 0;
-          streamState.reconnectAttempts = 0;
-          continue;
-        } catch (recoveryError) {
-          if (!(recoveryError instanceof BorgServerUnreachableError)) {
-            throw new TerminalStreamError();
-          }
-          // The replacement bearer is durable and intentionally survives an
-          // ambiguous transport failure. Fall through to the ordinary bounded
-          // reconnect backoff; the next AUTH_EXPIRED response resumes that exact
-          // replacement instead of permanently silencing the stream.
-          err = recoveryError;
-        }
-      }
+      if (err instanceof BorgServerError) throw new TerminalStreamError();
       streamState.connected = false;
       const delay =
         Math.min(RECONNECT_MIN_MS * 2 ** attempt, RECONNECT_MAX_MS) +
@@ -907,9 +882,6 @@ export async function streamOnce(
       } catch {
         code = undefined;
       }
-      if (code === ErrorCode.AUTH_EXPIRED) {
-        throw new BorgServerError('AUTH_EXPIRED', 'Borg server session expired');
-      }
       if (code === ErrorCode.SESSION_REJECTED) {
         throw new BorgServerError('SESSION_REJECTED', 'Borg server session was rejected');
       }

package/src/private-root.ts

@@ -0,0 +1,42 @@
+import { chmod, lstat, mkdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+
+export const borgConfigRoot = (): string => join(homedir(), '.config', 'borgmcp');
+
+/** Ensure Borg's local state root exists with owner-only directory permissions. */
+export async function ensurePrivateBorgConfigRoot(root = borgConfigRoot()): Promise<void> {
+  if (!isAbsolute(root) || resolve(root) !== root) {
+    throw new Error('Borg private-state directory path is not canonical');
+  }
+
+  let metadata: Awaited<ReturnType<typeof lstat>>;
+  try {
+    metadata = await lstat(root);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    metadata = await lstat(root);
+  }
+
+  if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+    throw new Error('Borg private-state directory must be a real directory');
+  }
+  const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+  if (uid !== null && metadata.uid !== uid) {
+    throw new Error('Borg private-state directory is not owned by the current user');
+  }
+
+  const mode = metadata.mode & 0o777;
+  if ((mode & 0o022) !== 0) {
+    throw new Error('Borg private-state directory is writable by other users');
+  }
+  if (mode !== 0o700) {
+    await chmod(root, 0o700);
+  }
+
+  const final = await lstat(root);
+  if (!final.isDirectory() || (final.mode & 0o777) !== 0o700) {
+    throw new Error('Borg private-state directory is not private');
+  }
+}

package/src/remote-client.ts

@@ -47,7 +47,6 @@ import {
 } from './local-server-cursor.js';
 import { readBoundedResponseBody } from './server-response.js';
 import { resolveLocalLogRecipients } from './local-log-routing.js';
-import { ensureLocalSessionFresh, recoverExpiredLocalSession } from './session-continuity.js';
 
 export interface RemoteConnection {
   apiUrl: string;
@@ -229,15 +228,12 @@ async function localServerRequest<T>(
   method: 'GET' | 'POST' | 'PUT' | 'PATCH',
   payload?: Record<string, unknown>,
 ): Promise<T | null> {
-  let current = active.localSessionCredentialRef && active.localSessionExpiresAt
-    ? await ensureLocalSessionFresh(active)
-    : active;
-  const request = (candidate: ActiveCube) => decodeLocalProtocolResponse<T>((signal) => authedFetch(path, {
+  return decodeLocalProtocolResponse<T>((signal) => authedFetch(path, {
       method,
       signal,
-      droneSession: candidate.sessionToken,
-      apiUrl: candidate.apiUrl,
-      serverTrustIdentity: candidate.serverTrustIdentity,
+      droneSession: active.sessionToken,
+      apiUrl: active.apiUrl,
+      serverTrustIdentity: active.serverTrustIdentity,
       redirect: 'error',
       ...(payload === undefined
         ? { headers: { Accept: 'application/json' } }
@@ -246,14 +242,6 @@ async function localServerRequest<T>(
           body: JSON.stringify(createProtocolEnvelope(randomUUID(), payload)),
         }),
     }), true);
-  try {
-    return await request(current);
-  } catch (error) {
-    if (!(error instanceof BorgServerError) || error.code !== 'AUTH_EXPIRED') throw error;
-    if (current.sessionToken !== active.sessionToken) throw error;
-    current = await recoverExpiredLocalSession(current);
-    return request(current);
-  }
 }
 
 export interface LocalManageOperation {
@@ -621,16 +609,16 @@ async function authedFetch(
     } catch {
       rejectedCode = undefined;
     }
-    if (droneSession !== undefined && rejectedCode === ErrorCode.AUTH_EXPIRED) {
+    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REJECTED) {
       throw new BorgServerError(
-        'AUTH_EXPIRED',
-        'the selected Borg server session expired',
+        'SESSION_REJECTED',
+        'the selected Borg server superseded this worktree session with a newer enrollment',
       );
     }
-    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REJECTED) {
+    if (droneSession !== undefined && rejectedCode === ErrorCode.SESSION_REVOKED) {
       throw new BorgServerError(
-        'SESSION_REJECTED',
-        'the selected Borg server rejected this worktree session (revoked or taken over)',
+        'SESSION_REVOKED',
+        'the selected Borg server revoked this worktree session',
       );
     }
     throw new BorgServerError(

package/src/seat-probe.ts

@@ -19,9 +19,9 @@ import {
  * preserved (CR #6 / CR5 — the probe must NOT collapse them). Each verdict is
  * derived from the actual error TYPE/CODE, never from a mutable error-text regex:
  *   evicted            ← 410 DRONE_EVICTED (terminal; the SOLE delete authority — gh#882 S1)
- *   rejected           ← pin-matched drone-SESSION 401 carrying the EXACT typed
- *                        SESSION_REJECTED code (revoked / taken over; recover via
- *                        the offline `borg reset-local-seat` — never here)
+ *   revoked            ← pin-matched drone-SESSION 401 carrying SESSION_REVOKED
+ *   rejected           ← pin-matched drone-SESSION 401 carrying SESSION_REJECTED
+ *                        (superseded by a newer enrollment)
  *   credential-rejected← any OTHER 401 on the drone session (bare/untyped or a
  *                        non-SESSION typed code): the saved credential is no longer
  *                        accepted, but this is NON-DESTRUCTIVE — re-enroll, NEVER a
@@ -40,6 +40,7 @@ import {
  */
 export type SeatStatus =
   | 'evicted'
+  | 'revoked'
   | 'rejected'
   | 'live'
   | 'credential-rejected'
@@ -99,6 +100,7 @@ export async function defaultProbeSeat(
     // the error TYPE, never from message text (the security boundary).
     if (err instanceof BorgServerTrustError) return 'trust-mismatch';
     if (err instanceof BorgServerError) {
+      if (err.code === 'SESSION_REVOKED') return 'revoked';
       if (err.code === 'SESSION_REJECTED') return 'rejected';
       // Every non-SESSION 401 (bare/untyped or a different typed code) is a
       // credential rejection — non-destructive, distinct from a takeover.

package/src/seats.ts

@@ -21,6 +21,7 @@ import os from 'os';
 import path from 'path';
 import { createHash } from 'node:crypto';
 import { readStoreFile, withStore } from './seat-store.js';
+import { LegacySessionCredentialCollisionError } from './server-errors.js';
 
 export const SEATS_FILE = path.join(os.homedir(), '.config', 'borgmcp', 'seats.json');
 const SEATS_VERSION = 1 as const;
@@ -47,7 +48,6 @@ export interface SeatRecord {
   // server metadata (active only)
   droneId?: string;
   sessionId?: string;
-  expiresAt?: string;
   // binding + display (set atomically at FINALIZE; absent while pending)
   worktree?: string;
   name?: string;
@@ -55,9 +55,6 @@ export interface SeatRecord {
   roleName?: string;
   roleClass?: 'queen' | 'worker';
   isHumanSeat?: boolean;
-  // One crash-safe replacement may coexist with an ACTIVE session until the
-  // server confirms the same-seat restore. It is never hydratable or bound.
-  replacement?: { credential: string };
 }
 
 interface SeatsFile {
@@ -122,8 +119,8 @@ function isValidOperation(value: unknown): value is SeatOperation {
  * checked — the ref is well-formed and self-consistent (the map key equals the
  * record's derived ref), state ∈ {pending,active}, the credential is a non-empty
  * string, the operation is well-shaped, an ACTIVE record carries ALL its required
- * server + binding fields, and a PENDING record carries NO active-only fields
- * (session id / expiry). A single invalid entry ⇒ the whole store is rejected
+ * server + binding fields, and a PENDING record carries NO active-only session
+ * id. A single invalid entry ⇒ the whole store is rejected
  * (fail closed at the caller, bytes preserved) — never a silent cast.
  */
 function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
@@ -151,32 +148,12 @@ function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
   if (r.worktree !== undefined && typeof r.worktree !== 'string') return false;
   if (r.droneId !== undefined && (typeof r.droneId !== 'string' || !UUID_RE.test(r.droneId))) return false;
   if (r.sessionId !== undefined && (typeof r.sessionId !== 'string' || !UUID_RE.test(r.sessionId))) return false;
-  if (
-    r.expiresAt !== undefined &&
-    (typeof r.expiresAt !== 'string' || !Number.isFinite(Date.parse(r.expiresAt)))
-  ) {
-    return false;
-  }
-  if (r.replacement !== undefined) {
-    if (
-      r.state !== 'active' ||
-      r.replacement === null ||
-      typeof r.replacement !== 'object' ||
-      Array.isArray(r.replacement) ||
-      Object.keys(r.replacement as object).length !== 1 ||
-      typeof (r.replacement as { credential?: unknown }).credential !== 'string' ||
-      !/^[A-Za-z0-9_-]{43}$/.test((r.replacement as { credential: string }).credential)
-    ) {
-      return false;
-    }
-  }
   // State-consistency invariants (no inconsistent active|pending).
   if (r.state === 'active') {
     // An ACTIVE record MUST carry its full server session + worktree binding.
     if (
       typeof r.droneId !== 'string' ||
       typeof r.sessionId !== 'string' ||
-      typeof r.expiresAt !== 'string' ||
       typeof r.worktree !== 'string' ||
       typeof r.name !== 'string' ||
       typeof r.droneLabel !== 'string'
@@ -185,7 +162,7 @@ function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
     }
   } else {
     // A PENDING record must NOT carry active-only server session fields.
-    if (r.sessionId !== undefined || r.expiresAt !== undefined) return false;
+    if (r.sessionId !== undefined) return false;
   }
   // The map key must equal the record's derived ref (no cross-key aliasing).
   return seatRef(value as SeatRecord) === ref;
@@ -214,6 +191,37 @@ function parseStore(raw: string): SeatsFile | null {
     ) {
       const seats = candidate.seats as Record<string, unknown>;
       for (const [ref, record] of Object.entries(seats)) {
+        if (
+          record !== null &&
+          typeof record === 'object' &&
+          !Array.isArray(record) &&
+          Object.prototype.hasOwnProperty.call(record, 'replacement')
+        ) {
+          const { replacement, ...withoutReplacement } = record as Record<string, unknown>;
+          const exactReplacement =
+            replacement !== null &&
+            typeof replacement === 'object' &&
+            !Array.isArray(replacement) &&
+            Object.keys(replacement).length === 1 &&
+            typeof (replacement as { credential?: unknown }).credential === 'string' &&
+            /^[A-Za-z0-9_-]{43}$/.test((replacement as { credential: string }).credential);
+          let canonicalOrigin = false;
+          try {
+            const origin = new URL(String(withoutReplacement.origin));
+            canonicalOrigin = origin.protocol === 'https:' && origin.origin === withoutReplacement.origin;
+          } catch {
+            canonicalOrigin = false;
+          }
+          if (
+            withoutReplacement.state === 'active' &&
+            exactReplacement &&
+            canonicalOrigin &&
+            isValidSeatRecord(ref, withoutReplacement)
+          ) {
+            throw new LegacySessionCredentialCollisionError(withoutReplacement.origin as string);
+          }
+          return null;
+        }
         if (!isValidSeatRecord(ref, record)) return null;
       }
       return { version: SEATS_VERSION, seats: seats as Record<string, SeatRecord> };
@@ -297,17 +305,6 @@ export async function getActiveSeatCredential(
   return record.credential;
 }
 
-/** Exact ACTIVE record for the internal continuity coordinator. */
-export async function getActiveSeat(
-  ref: string,
-  binding: { origin: string; trustIdentity: string; cubeId: string },
-): Promise<SeatRecord | null> {
-  if (!REF_RE.test(ref)) return null;
-  const store = await readStore();
-  const record = store.seats[ref];
-  return recordMatches(record, ref, binding) && record.state === 'active' ? record : null;
-}
-
 // ─── PREPARE / mint (no worktree yet) ────────────────────────────────────────
 
 /**
@@ -471,7 +468,6 @@ export async function activateAndBindSeat(input: {
   operation: SeatOperation;
   droneId: string;
   sessionId: string;
-  expiresAt: string;
   expectedPendingDigest: string;
   worktree: string;
   name: string;
@@ -483,9 +479,6 @@ export async function activateAndBindSeat(input: {
   if (!UUID_RE.test(input.droneId) || !UUID_RE.test(input.sessionId)) {
     throw new Error('invalid Borg server session identity');
   }
-  if (typeof input.expiresAt !== 'string' || !Number.isFinite(Date.parse(input.expiresAt))) {
-    throw new Error('invalid Borg server session expiry');
-  }
   const ref = seatRef(input);
   const binding = { origin: input.origin, trustIdentity: input.trustIdentity, cubeId: input.cubeId };
   return withStore<SeatsFile, ActivateSeatOutcome>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
@@ -497,7 +490,6 @@ export async function activateAndBindSeat(input: {
       state: 'active',
       droneId: input.droneId,
       sessionId: input.sessionId,
-      expiresAt: input.expiresAt,
       worktree: input.worktree,
       name: input.name,
       droneLabel: input.droneLabel,
@@ -510,149 +502,6 @@ export async function activateAndBindSeat(input: {
   });
 }
 
-export type PrepareSeatReplacementOutcome =
-  | { ok: true; credential: string; digest: string }
-  | { ok: false; reason: 'expectation-mismatch' };
-
-/**
- * Preserve the exact ACTIVE seat while preparing one durable replacement bearer.
- * A lost response or process restart reuses the stored replacement; a changed
- * authority, drone, or active bearer fails before any mutation.
- */
-export async function prepareSeatReplacement(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedDroneId: string;
-  expectedActiveDigest: string;
-  replacementCredential: string;
-}): Promise<PrepareSeatReplacementOutcome> {
-  if (!REF_RE.test(input.ref) || !/^[A-Za-z0-9_-]{43}$/.test(input.replacementCredential)) {
-    return { ok: false, reason: 'expectation-mismatch' };
-  }
-  return withStore<SeatsFile, PrepareSeatReplacementOutcome>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (
-      !recordMatches(record, input.ref, input.binding) ||
-      record.state !== 'active' ||
-      record.droneId !== input.expectedDroneId ||
-      digestOf(record.credential) !== input.expectedActiveDigest
-    ) {
-      return { ok: false as const, reason: 'expectation-mismatch' as const };
-    }
-    if (record.replacement) {
-      return {
-        ok: true as const,
-        credential: record.replacement.credential,
-        digest: digestOf(record.replacement.credential),
-      };
-    }
-    record.replacement = { credential: input.replacementCredential };
-    await txn.commit();
-    return {
-      ok: true as const,
-      credential: input.replacementCredential,
-      digest: digestOf(input.replacementCredential),
-    };
-  });
-}
-
-export type PromoteSeatReplacementOutcome = 'promoted' | 'missing' | 'replaced';
-
-/** Update only the committed expiry for an exact same-bearer session renewal. */
-export async function refreshActiveSeatSession(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedDroneId: string;
-  expectedActiveDigest: string;
-  expectedSessionId: string;
-  expiresAt: string;
-}): Promise<boolean> {
-  if (!UUID_RE.test(input.expectedDroneId) || !UUID_RE.test(input.expectedSessionId)) {
-    throw new Error('invalid Borg server session identity');
-  }
-  if (!Number.isFinite(Date.parse(input.expiresAt))) {
-    throw new Error('invalid Borg server session expiry');
-  }
-  return withStore<SeatsFile, boolean>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (
-      !recordMatches(record, input.ref, input.binding) ||
-      record.state !== 'active' ||
-      record.droneId !== input.expectedDroneId ||
-      record.sessionId !== input.expectedSessionId ||
-      digestOf(record.credential) !== input.expectedActiveDigest
-    ) {
-      return false;
-    }
-    record.expiresAt = input.expiresAt;
-    await txn.commit();
-    return true;
-  });
-}
-
-/** Atomically promote only the response-bound replacement onto the same ACTIVE seat. */
-export async function promoteSeatReplacement(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedDroneId: string;
-  expectedActiveDigest: string;
-  expectedReplacementDigest: string;
-  sessionId: string;
-  expiresAt: string;
-}): Promise<PromoteSeatReplacementOutcome> {
-  if (!UUID_RE.test(input.expectedDroneId) || !UUID_RE.test(input.sessionId)) {
-    throw new Error('invalid Borg server session identity');
-  }
-  if (!Number.isFinite(Date.parse(input.expiresAt))) {
-    throw new Error('invalid Borg server session expiry');
-  }
-  return withStore<SeatsFile, PromoteSeatReplacementOutcome>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (!recordMatches(record, input.ref, input.binding) || record.state !== 'active') return 'missing';
-    if (
-      record.droneId !== input.expectedDroneId ||
-      digestOf(record.credential) !== input.expectedActiveDigest ||
-      !record.replacement ||
-      digestOf(record.replacement.credential) !== input.expectedReplacementDigest
-    ) {
-      return 'replaced';
-    }
-    const { replacement, ...active } = record;
-    txn.data.seats[input.ref] = {
-      ...active,
-      credential: replacement.credential,
-      sessionId: input.sessionId,
-      expiresAt: input.expiresAt,
-    };
-    await txn.commit();
-    return 'promoted';
-  });
-}
-
-/** Remove only the caller's exact pending replacement, never the ACTIVE seat. */
-export async function scrubSeatReplacement(input: {
-  ref: string;
-  binding: { origin: string; trustIdentity: string; cubeId: string };
-  expectedActiveDigest: string;
-  expectedReplacementDigest: string;
-}): Promise<boolean> {
-  return withStore<SeatsFile, boolean>(SEATS_FILE, emptyStore, parseStore, async (txn) => {
-    const record = txn.data.seats[input.ref];
-    if (
-      !recordMatches(record, input.ref, input.binding) ||
-      record.state !== 'active' ||
-      digestOf(record.credential) !== input.expectedActiveDigest ||
-      !record.replacement ||
-      digestOf(record.replacement.credential) !== input.expectedReplacementDigest
-    ) {
-      return false;
-    }
-    delete record.replacement;
-    await txn.commit();
-    return true;
-  });
-}
-
 // ─── CR#2: bind a PENDING record to a preserved worktree (no activation) ─────
 
 export type BindPendingSeatOutcome = 'bound' | 'missing' | 'replaced';

package/src/server-errors.ts

@@ -5,8 +5,7 @@ export type BorgServerErrorCode =
   | 'CREATE_CUBE_DENIED'
   | 'ATTACH_CONFLICT'
   | 'SESSION_REJECTED'
-  | 'SESSION_REVOKED'
-  | 'AUTH_EXPIRED';
+  | 'SESSION_REVOKED';
 
 /** Safe, non-secret state code for deterministic authority recovery copy. */
 export class BorgServerError extends Error {
@@ -92,4 +91,12 @@ export class BorgServerUnreachableError extends Error {
     this.name = 'BorgServerUnreachableError';
   }
 }
+
+/** Exact retired TTL-replacement state: two saved bearers and no safe implicit winner. */
+export class LegacySessionCredentialCollisionError extends Error {
+  constructor(public readonly origin: string) {
+    super('Local session credential collision detected');
+    this.name = 'LegacySessionCredentialCollisionError';
+  }
+}
 import type { ErrorCode } from 'borgmcp-shared/protocol';

package/src/server-facade.ts

@@ -2,7 +2,7 @@ import { spawn as spawnChild, type SpawnOptions } from 'node:child_process';
 import { constants } from 'node:os';
 import { serverHelpText } from './cli-help.js';
 
-export const SERVER_LIFECYCLE_COMMANDS = ['setup', 'start', 'status', 'update', 'invite'] as const;
+export const SERVER_LIFECYCLE_COMMANDS = ['setup', 'start', 'stop', 'status', 'update', 'invite'] as const;
 export type ServerLifecycleCommand = typeof SERVER_LIFECYCLE_COMMANDS[number];
 
 export type ParsedServerFacadeArgs =
@@ -86,7 +86,7 @@ function inertCommand(command: string): string {
 export function unknownServerCommandText(command: string): string {
   return (
     `Unknown server command: ${inertCommand(command)}.\n` +
-    `Available commands: setup, start, status, update, invite.\n` +
+    `Available commands: setup, start, stop, status, update, invite.\n` +
     `Next: run borg server --help.\n`
   );
 }

package/src/server-handshake.ts

@@ -175,13 +175,12 @@ export interface ServerAttachResult {
   session: {
     credentialRef: string;
     sessionId: string;
-    expiresAt: string;
   };
   result: 'created' | 'reused';
 }
 
 /**
- * Attach an enrolled client principal to one granted cube/role over protocol v2.
+ * Attach an enrolled client principal to one granted cube/role over protocol v3.
  * The client CSPRNG-generates the session bearer and persists it PENDING in the
  * OS keychain (keyed by the stable per-seat identity) BEFORE this request, so an
  * interrupted/lost response is recovered by re-sending the exact same bearer —
@@ -202,7 +201,7 @@ export interface PreparedServerAttach {
   cube: ServerAttachResult['cube'];
   role: ServerAttachResult['role'];
   drone: ServerAttachResult['drone'];
-  session: { sessionId: string; expiresAt: string };
+  session: { sessionId: string };
   result: 'created' | 'reused';
   credentialRef: string;
   pendingBearerDigest: string;
@@ -304,12 +303,6 @@ export async function sendBorgServerAttach(
             'Borg server rejected the session: the seat is already bound to another session',
           );
         }
-        if (rejectedCode === ErrorCode.AUTH_EXPIRED) {
-          throw new BorgServerError(
-            'AUTH_EXPIRED',
-            'Borg server session expired',
-          );
-        }
         if (rejectedCode === ErrorCode.SESSION_REVOKED) {
           throw new BorgServerError(
             'SESSION_REVOKED',
@@ -358,7 +351,6 @@ export async function sendBorgServerAttach(
       drone: decoded.drone,
       session: {
         sessionId: decoded.session.id,
-        expiresAt: decoded.session.expires_at,
       },
       result: decoded.result,
       credentialRef,
@@ -374,7 +366,6 @@ export async function sendBorgServerAttach(
           ...seatInput,
           droneId: decoded.drone.id,
           sessionId: decoded.session.id,
-          expiresAt: decoded.session.expires_at,
           expectedPendingDigest: pendingBearerDigest,
           worktree: binding.worktree,
           name: binding.name,

package/dist/session-continuity.d.ts

@@ -1,33 +0,0 @@
-import { type ActiveCube } from './cubes.js';
-import { prepareSeatReplacement, promoteSeatReplacement, refreshActiveSeatSession, scrubSeatReplacement, type SeatRecord } from './seats.js';
-export declare const SESSION_RENEWAL_LEAD_MS: number;
-interface AttachOutcome {
-    result: 'created' | 'reused';
-    droneId: string;
-    sessionId: string;
-    expiresAt: string;
-}
-interface SessionContinuityDeps {
-    now(): number;
-    randomCredential(): string;
-    getSeat(ref: string, binding: {
-        origin: string;
-        trustIdentity: string;
-        cubeId: string;
-    }): Promise<SeatRecord | null>;
-    getActive(): Promise<ActiveCube | null>;
-    getParentCredential(origin: string, trustIdentity: string): Promise<string | null>;
-    sendAttach(record: SeatRecord, bearer: string, parentCredential: string): Promise<AttachOutcome>;
-    prepareReplacement: typeof prepareSeatReplacement;
-    refreshSession: typeof refreshActiveSeatSession;
-    promoteReplacement: typeof promoteSeatReplacement;
-    scrubReplacement: typeof scrubSeatReplacement;
-}
-export declare function ensureLocalSessionFresh(active: ActiveCube): Promise<ActiveCube>;
-export declare function recoverExpiredLocalSession(active: ActiveCube): Promise<ActiveCube>;
-/** @internal */
-export declare function __renewLocalSessionForTest(active: ActiveCube, mode: 'proactive' | 'expired', deps: SessionContinuityDeps): Promise<ActiveCube>;
-/** @internal */
-export declare function __resetSessionContinuityForTest(): void;
-export {};
-//# sourceMappingURL=session-continuity.d.ts.map

package/dist/session-continuity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-continuity.d.ts","sourceRoot":"","sources":["../src/session-continuity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAK5D,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EAEpB,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAElD,UAAU,aAAa;IACrB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,qBAAqB;IAC7B,GAAG,IAAI,MAAM,CAAC;IACd,gBAAgB,IAAI,MAAM,CAAC;IAC3B,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrH,SAAS,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnF,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjG,kBAAkB,EAAE,OAAO,sBAAsB,CAAC;IAClD,cAAc,EAAE,OAAO,wBAAwB,CAAC;IAChD,kBAAkB,EAAE,OAAO,sBAAsB,CAAC;IAClD,gBAAgB,EAAE,OAAO,oBAAoB,CAAC;CAC/C;AA8ND,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAE/E;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAElF;AAED,gBAAgB;AAChB,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,gBAAgB;AAChB,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}