borgmcp 2.1.0 → 2.1.1

package/src/assimilate-cmd.ts

@@ -46,6 +46,9 @@ import {
   CubeCreationConfirmationError,
   CubeCreationOutcomeUnknownError,
   LegacySessionCredentialCollisionError,
+  RepositoryAssociationOperationError,
+  RepositoryAssociationOutcomeUnknownError,
+  RepositoryAssociationResolutionError,
 } from './server-errors.js';
 import type { SeatStatus } from './seat-probe.js';
 import type { ServerSessionOperation } from './config.js';
@@ -54,12 +57,18 @@ import type { SeatBinding, BindPendingSeatOutcome } from './seats.js';
 import { createHash } from 'node:crypto';
 import { buildOpenCodeLaunchArgs, type LaunchApprovalDecision } from './cli-tool-approval.js';
 import { resolveWorkingRepo, type WorkingRepo } from './working-repo.js';
-import type { CreateCubeRepository, CubeTemplate } from 'borgmcp-shared/protocol';
+import type {
+  AssociateRepositoryCubeResponse,
+  CreateCubeRepository,
+  CubeTemplate,
+} from 'borgmcp-shared/protocol';
 import {
   initializeRepositoryCube,
+  RepositoryAssociationConfirmationError,
   RepositoryAssociationSaveError,
   validRepositoryCubeName,
   type RepositoryCubeCreation,
+  type RepositoryCubeResolution,
 } from './repository-cube-init.js';
 import type { GitRepositoryContext, RepositoryAssociation } from './repository-identity.js';
 
@@ -266,6 +275,18 @@ export interface AssimilateDeps {
     serverCapabilities?: readonly string[];
   } | null>;
 
+  resolveRepositoryCube: (
+    apiUrl: string,
+    token: string,
+    input: { workingRepoName: string; repository: CreateCubeRepository },
+    serverTrustIdentity?: string,
+  ) => Promise<RepositoryCubeResolution>;
+  associateRepositoryCube: (
+    apiUrl: string,
+    token: string,
+    input: { cubeId: string; workingRepoName: string; repository: CreateCubeRepository },
+    serverTrustIdentity?: string,
+  ) => Promise<AssociateRepositoryCubeResponse>;
   listCubes: (apiUrl: string, token: string, serverTrustIdentity?: string) => Promise<CubeSummary[]>;
   getCube: (apiUrl: string, token: string, cubeId: string, serverTrustIdentity?: string) => Promise<CubeDetail>;
   createCube: (
@@ -684,71 +705,12 @@ export async function runAssimilate(
 
   let initialized;
   try {
-    if (!auth.serverCapabilities.includes('create_cube') && !existing) {
-      const repository = await deps.getRepositoryIdentity(repositoryContext);
-      const association = await deps.getRepositoryAssociation(auth.serverTrustIdentity, repository);
-      if (association) {
-        initialized = await initializeRepositoryCube({
-          mode, context: repositoryContext, serverOrigin: auth.apiUrl, flags: args.flags,
-        }, {
-          isTTY: deps.isTTY,
-          prompt: deps.prompt,
-          write: deps.stderr,
-          getIdentity: async () => repository,
-          getAssociation: async () => association,
-          saveAssociation: (identity, saved) =>
-            deps.saveRepositoryAssociation(auth.serverTrustIdentity, identity, saved),
-          getCube: (cubeId) => deps.getCube(auth.apiUrl, auth.token, cubeId, auth.serverTrustIdentity),
-          createCube: (params) => deps.createCube(auth.apiUrl, auth.token, params, auth.serverTrustIdentity),
-        });
-      } else {
-        const candidateName = args.flags.cubeName ?? repositoryContext.derivedName;
-        const accessible = await deps.listCubes(auth.apiUrl, auth.token, auth.serverTrustIdentity);
-        const matches = accessible.filter((cube) => cube.name === candidateName);
-        if (matches.length !== 1) {
-          deps.stderr(matches.length === 0
-            ? `This enrolled client cannot create a cube on ${auth.apiUrl}. Ask the server operator to grant access to a cube, then rerun ${localAssimilateCommand(auth.apiUrl)}.\n`
-            : `More than one accessible cube is named '${candidateName}'. Nothing was changed. Ask the server operator for an unambiguous repository cube grant.\n`);
-          return 1;
-        }
-        const cube = await deps.getCube(auth.apiUrl, auth.token, matches[0].id, auth.serverTrustIdentity);
-        const association = {
-          cubeId: cube.id,
-          name: cube.name,
-          workingRepoName: repositoryContext.derivedName,
-          template: 'default' as const,
-        };
-        try {
-          await deps.saveRepositoryAssociation(auth.serverTrustIdentity, repository, association);
-        } catch {
-          throw new RepositoryAssociationSaveError();
-        }
-        const response = {
-          result: 'resolved' as const,
-          cube_id: cube.id,
-          name: cube.name,
-          working_repo_name: repositoryContext.derivedName,
-          repository,
-          template: 'default' as const,
-          human_seat_role_id: cube.roles.find((role) => role.is_human_seat)?.id ?? '',
-          default_worker_role_id: cube.roles.find((role) => role.is_default)?.id ?? '',
-          access: 'manage' as const,
-        };
-        deps.stderr(
-          `Cube already initialized.\n  Name: ${cube.name}\n  Template: Default (legacy)\n` +
-          `  Repository: ${repositoryContext.root}\n  Server: ${auth.apiUrl}\n` +
-          (mode === 'cube-init'
-            ? `No drone was created.\nNext: borg assimilate --host ${shellEscape(auth.apiUrl)}\n`
-            : 'Continuing with role and seat setup...\n'),
-        );
-        initialized = { kind: 'success' as const, creation: { response, cube }, existing: true };
-      }
-    } else {
     initialized = await initializeRepositoryCube({
       mode,
       context: repositoryContext,
       serverOrigin: auth.apiUrl,
       flags: args.flags,
+      canCreate: auth.serverCapabilities.includes('create_cube'),
     }, {
       isTTY: deps.isTTY,
       prompt: deps.prompt,
@@ -757,11 +719,62 @@ export async function runAssimilate(
       getAssociation: (repository) => deps.getRepositoryAssociation(auth.serverTrustIdentity, repository),
       saveAssociation: (repository, association) =>
         deps.saveRepositoryAssociation(auth.serverTrustIdentity, repository, association),
+      resolveAssociation: (repository, workingRepoName) => deps.resolveRepositoryCube(
+        auth.apiUrl,
+        auth.token,
+        { repository, workingRepoName },
+        auth.serverTrustIdentity,
+      ),
+      listCubes: () => deps.listCubes(auth.apiUrl, auth.token, auth.serverTrustIdentity),
+      associateCube: (params) => deps.associateRepositoryCube(
+        auth.apiUrl,
+        auth.token,
+        params,
+        auth.serverTrustIdentity,
+      ),
       getCube: (cubeId) => deps.getCube(auth.apiUrl, auth.token, cubeId, auth.serverTrustIdentity),
       createCube: (params) => deps.createCube(auth.apiUrl, auth.token, params, auth.serverTrustIdentity),
     });
-    }
   } catch (error) {
+    if (error instanceof RepositoryAssociationOutcomeUnknownError) {
+      deps.stderr(
+        'Repository cube association outcome is unknown.\n' +
+        'The server may have created the repository binding; no local repository association was saved and no drone was created.\n' +
+        'Run the same command again; Borg will first resolve the authoritative server association without creating a cube.\n',
+      );
+      return 1;
+    }
+    if (error instanceof RepositoryAssociationResolutionError) {
+      deps.stderr(
+        'Repository cube association could not be resolved.\n' +
+        'Verify that the server is reachable and the client and server versions match, then run the same command again.\n' +
+        'No cube, repository binding, or drone was created.\n',
+      );
+      return 1;
+    }
+    if (error instanceof RepositoryAssociationOperationError) {
+      const recovery = error.failure === 'repository-already-associated'
+        ? 'This repository is already associated with another cube. Run the same command again to use the existing managed association, or ask the server operator to correct the repository binding.'
+        : error.failure === 'cube-already-associated'
+          ? 'The selected cube is already associated with another repository. Choose a different cube, or run the command from the repository already linked to that cube.'
+          : error.failure === 'access-denied'
+            ? 'This enrolled client does not have permission to manage the selected cube. Ask the server operator to grant this client management access, then run the same command again.'
+            : 'The selected cube does not have valid authoritative roles. Ask the server operator to repair its role configuration, or choose another cube.';
+      deps.stderr(
+        'Repository cube association could not be completed.\n' +
+        `${recovery}\n` +
+        'No cube, repository binding, or drone was created.\n',
+      );
+      return 1;
+    }
+    if (error instanceof RepositoryAssociationConfirmationError) {
+      deps.stderr(
+        'Repository cube association could not be confirmed.\n' +
+        'The server may have created the repository binding; no local repository association was saved and no drone was created.\n' +
+        'Run the same command again; Borg will resolve authoritative server state before creating or associating a cube.\n',
+      );
+      return 1;
+    }
     if (error instanceof RepositoryAssociationSaveError) {
       deps.stderr(
         'The repository cube was confirmed, but Borg could not save its local repository association.\n' +
@@ -772,18 +785,17 @@ export async function runAssimilate(
     }
     if (error instanceof CubeCreationOutcomeUnknownError) {
       deps.stderr(
-        'Cube creation outcome is unknown.\n' +
-        'No local repository association was saved.\n' +
-        'Run the same command again; the server will resolve the original request or return a conflict.\n',
+        'Cube creation outcome is unconfirmed.\n' +
+        'The server may have created the cube and repository binding; no local repository association was saved and no drone was created.\n' +
+        'Run the same command again; Borg will resolve authoritative server state before creating a cube.\n',
       );
       return 1;
     }
     if (error instanceof CubeCreationConfirmationError) {
       deps.stderr(
         'Cube creation could not be confirmed.\n' +
-        `${error.message}\n` +
-        'No local repository association was saved.\n' +
-        'Resolve the conflict, then run the same command again.\n',
+        'The server may have created the cube and repository binding; no local repository association was saved and no drone was created.\n' +
+        'Run the same command again; Borg will resolve authoritative server state before creating a cube.\n',
       );
       return 1;
     }
@@ -797,7 +809,11 @@ export async function runAssimilate(
     if (error instanceof BorgServerError) {
       return reportServerFailure(deps, auth.apiUrl, error);
     }
-    deps.stderr('Could not create cube.\nThe selected Borg server rejected the request.\nNothing was changed.\n');
+    deps.stderr(
+      'Repository cube initialization failed.\n' +
+      'The server may have created or associated a cube; local repository state may be incomplete and no drone was created.\n' +
+      'Run the same command again; Borg will resolve authoritative server state before creating or associating a cube.\n',
+    );
     return 1;
   }
   if (initialized.kind === 'stop') return initialized.code;

package/src/assimilate-deps.ts

@@ -25,10 +25,12 @@ import {
 } from './remote-client.js';
 import {
   DEFAULT_LOCAL_SERVER_ORIGIN,
+  associateLocalBorgServerRepositoryCube,
   connectLocalBorgServer,
   createLocalBorgServerCube,
   enrollLocalBorgServer,
   probeLocalBorgServer,
+  resolveLocalBorgServerRepositoryCube,
   resumeLocalBorgServerEnrollment,
   sendBorgServerAttach,
 } from './server-handshake.js';
@@ -45,7 +47,7 @@ import {
 } from './cubes.js';
 import { loadBorgServerTrust } from './server-trust.js';
 import { defaultProbeSeat } from './seat-probe.js';
-import { BorgServerError } from './server-errors.js';
+import { BorgServerError, CubeCreationConfirmationError } from './server-errors.js';
 import {
   findProjectRoot as cubesFindProjectRoot,
   getActiveCube as cubesGetActive,
@@ -238,6 +240,29 @@ export function buildDefaultAssimilateDeps(
         ...(onPending === undefined ? {} : { onPending }),
       }),
 
+    resolveRepositoryCube: async (apiUrl, token, input, serverTrustIdentity) => {
+      if (serverTrustIdentity === undefined) {
+        throw new Error('Selected Borg server authority state is missing or unreadable');
+      }
+      return resolveLocalBorgServerRepositoryCube(
+        apiUrl,
+        serverTrustIdentity,
+        token,
+        input,
+      );
+    },
+    associateRepositoryCube: async (apiUrl, token, input, serverTrustIdentity) => {
+      if (serverTrustIdentity === undefined) {
+        throw new Error('Selected Borg server authority state is missing or unreadable');
+      }
+      return associateLocalBorgServerRepositoryCube(
+        apiUrl,
+        serverTrustIdentity,
+        token,
+        input,
+      );
+    },
+
     listCubes: async (apiUrl, token, serverTrustIdentity) => {
       if (serverTrustIdentity === undefined) {
         throw new Error('Selected Borg server authority state is missing or unreadable');
@@ -284,18 +309,23 @@ export function buildDefaultAssimilateDeps(
             template: params.template,
           },
         );
-        const cube = await remoteGetCube(created.cube_id, {
-          apiUrl,
-          authToken: token,
-          serverTrustIdentity,
-        });
+        let cube;
+        try {
+          cube = await remoteGetCube(created.cube_id, {
+            apiUrl,
+            authToken: token,
+            serverTrustIdentity,
+          });
+        } catch {
+          throw new CubeCreationConfirmationError('The server returned a cube result that could not be read back.');
+        }
         if (
           cube.id !== created.cube_id ||
           cube.name !== created.name ||
           !Array.isArray(cube.roles) ||
           !cube.roles.some((role: { id?: string }) => role.id === created.default_worker_role_id)
         ) {
-          throw new Error('Borg server returned cube details outside the creation result');
+          throw new CubeCreationConfirmationError('The server returned cube details outside the creation result.');
         }
         return {
           response: created,

package/src/cli-help.ts

@@ -71,7 +71,7 @@ export function cubeInitHelpText(): string {
     `  --enroll                         Prompt for a hidden enrollment invitation\n` +
     `  --cube-name <name>               Repository cube name (otherwise edit the proposed name)\n` +
     `  --template software-dev|starter  New-cube template (default: software-dev)\n` +
-    `  --yes, -y                        Skip confirmation prompts\n` +
+    `  --yes, -y                        Accept new-cube defaults; never adopt by name\n` +
     `  --help, -h                       Show this help\n`
   );
 }
@@ -101,11 +101,12 @@ export function assimilateHelpText(version: string): string {
     `  --no-template              Unsupported for repository cube creation\n` +
     `  --cli claude|codex|opencode         Agent CLI to launch (default: claude)\n` +
     `  --model claude:<model>   Legacy Claude model override (configure models in the agent CLI)\n` +
-    `  --yes, -y                  Skip confirmation prompts\n\n` +
+    `  --yes, -y                  Accept new-cube defaults; never adopt by name\n\n` +
     `Creation shows repository context, name, template, and one confirmation. An existing\n` +
-    `repository association skips all prompts. An enrolled owner client may create an\n` +
-    `idempotent repository cube; ordinary clients\n` +
-    `require an explicit cube grant. Agent seats begin only after enrollment. Preview only.\n` +
+    `repository association skips all prompts. One accessible exact-name legacy cube requires\n` +
+    `explicit interactive adoption; ambiguous matches fail closed. An enrolled owner client may\n` +
+    `create an idempotent repository cube; ordinary clients require an explicit cube grant.\n` +
+    `Agent seats begin only after enrollment. Preview only.\n` +
     `See docs/LOCAL_SERVER.md for self-hosted setup and current status.\n\n` +
     `For local or provider-specific models, configure the selected agent CLI directly.\n` +
     `OpenCode supports Ollama and other providers through its own model configuration.\n`

package/src/remote-client.ts

@@ -712,7 +712,7 @@ async function authedFetch(
           parsed.error !== null && typeof parsed.error === 'object' &&
           parsed.error.code === ROLE_SECTION_CONFLICT_CODE
         ) {
-          // Shared 0.6.3 intentionally omits this server-local code. Re-validate the whole
+          // The shared protocol intentionally omits this server-local code. Re-validate the whole
           // envelope through the strict shared decoder with only the recognized
           // code substituted; no server-provided diagnostic is ever surfaced.
           decodeProtocolErrorEnvelope({

package/src/repository-cube-init.ts

@@ -3,15 +3,23 @@ import {
   LEGACY_DEFAULT_TEMPLATE_LABEL,
 } from 'borgmcp-shared/templates';
 import type {
+  AssociateRepositoryCubeResponse,
   CreateCubeRepository,
   CreateCubeResponse,
   CubeTemplate,
+  ResolvedRepositoryCube,
+  ResolveRepositoryCubeResponse,
 } from 'borgmcp-shared/protocol';
 import { shellEscape } from './shell-escape.js';
 import type {
   GitRepositoryContext,
   RepositoryAssociation,
 } from './repository-identity.js';
+import {
+  BorgServerError,
+  CubeCreationConfirmationError,
+  CubeCreationOutcomeUnknownError,
+} from './server-errors.js';
 
 export interface RepositoryCubeDetail {
   id: string;
@@ -25,6 +33,8 @@ export interface RepositoryCubeCreation {
   cube: RepositoryCubeDetail;
 }
 
+export type RepositoryCubeResolution = ResolveRepositoryCubeResponse;
+
 export interface RepositoryCubeInitFlags {
   cubeName?: string;
   template?: string;
@@ -39,6 +49,13 @@ export interface RepositoryCubeInitDeps {
   getIdentity(context: GitRepositoryContext): Promise<CreateCubeRepository>;
   getAssociation(repository: CreateCubeRepository): Promise<RepositoryAssociation | null>;
   saveAssociation(repository: CreateCubeRepository, association: RepositoryAssociation): Promise<void>;
+  resolveAssociation(repository: CreateCubeRepository, workingRepoName: string): Promise<RepositoryCubeResolution>;
+  listCubes(): Promise<Array<{ id: string; name: string }>>;
+  associateCube(input: {
+    cubeId: string;
+    workingRepoName: string;
+    repository: CreateCubeRepository;
+  }): Promise<AssociateRepositoryCubeResponse>;
   getCube(cubeId: string): Promise<RepositoryCubeDetail>;
   createCube(input: {
     name: string;
@@ -59,6 +76,13 @@ export class RepositoryAssociationSaveError extends Error {
   }
 }
 
+export class RepositoryAssociationConfirmationError extends Error {
+  constructor() {
+    super('The Borg server did not confirm the repository cube association.');
+    this.name = 'RepositoryAssociationConfirmationError';
+  }
+}
+
 export class PromptInterruptedError extends Error {
   constructor() {
     super('prompt interrupted');
@@ -79,15 +103,19 @@ function presentation(template: CubeTemplate) {
   return NEW_CUBE_TEMPLATE_PRESENTATIONS.find((candidate) => candidate.name === template)!;
 }
 
-async function ask(deps: RepositoryCubeInitDeps, message: string): Promise<{ value: string } | { stop: number }> {
+async function ask(
+  deps: RepositoryCubeInitDeps,
+  message: string,
+  operation: 'creation' | 'adoption' = 'creation',
+): Promise<{ value: string } | { stop: number }> {
   try {
     return { value: await deps.prompt(message) };
   } catch (error) {
     if (error instanceof PromptInterruptedError) {
-      deps.write('\nCube creation cancelled. Nothing was changed.\n');
+      deps.write(`\nCube ${operation} cancelled. No cube, repository binding, or drone was created.\n`);
       return { stop: 130 };
     }
-    deps.write('Input ended before cube creation. Nothing was changed.\n');
+    deps.write(`Input ended before cube ${operation}. No cube, repository binding, or drone was created.\n`);
     return { stop: 1 };
   }
 }
@@ -101,10 +129,11 @@ function renderResult(
     serverOrigin: string;
     mode: 'assimilate' | 'cube-init';
     creationOptionsUnused: boolean;
+    adopted?: boolean;
   },
 ): void {
   const lines = [
-    input.existing ? 'Cube already initialized.' : 'Cube created.',
+    input.adopted ? 'Existing cube associated with this repository.' : input.existing ? 'Cube already initialized.' : 'Cube created.',
     `  Name: ${input.response.name}`,
     `  Template: ${presentation(input.response.template).label}`,
     `  Repository: ${input.root}`,
@@ -129,22 +158,15 @@ export async function initializeRepositoryCube(input: {
   context: GitRepositoryContext;
   serverOrigin: string;
   flags: RepositoryCubeInitFlags;
+  canCreate?: boolean;
 }, deps: RepositoryCubeInitDeps): Promise<RepositoryCubeInitResult> {
   const repository = await deps.getIdentity(input.context);
   const association = await deps.getAssociation(repository);
-  const creationOptionsUnused = association !== null && (
-    input.flags.cubeName !== undefined || input.flags.template !== undefined || input.flags.yes === true
-  );
+  const creationOptionsRequested = input.flags.cubeName !== undefined ||
+    input.flags.template !== undefined || input.flags.noTemplate === true || input.flags.yes === true;
+  const creationOptionsUnused = association !== null && creationOptionsRequested;
   if (association) {
     const cube = await deps.getCube(association.cubeId);
-    const authoritativeAssociation = { ...association, name: cube.name };
-    if (cube.name !== association.name) {
-      try {
-        await deps.saveAssociation(repository, authoritativeAssociation);
-      } catch {
-        throw new RepositoryAssociationSaveError();
-      }
-    }
     const response: CreateCubeResponse = {
       result: 'resolved',
       cube_id: association.cubeId,
@@ -167,6 +189,123 @@ export async function initializeRepositoryCube(input: {
     return { kind: 'success', creation: { response, cube }, existing: true };
   }
 
+  const saveResolvedAssociation = async (
+    response: ResolvedRepositoryCube,
+    options: { adopted: boolean; creationOptionsUnused: boolean },
+  ): Promise<RepositoryCubeInitResult> => {
+    if (
+      response.repository.kind !== repository.kind ||
+      response.repository.value !== repository.value ||
+      response.working_repo_name !== input.context.derivedName
+    ) {
+      throw new RepositoryAssociationConfirmationError();
+    }
+    const cube = await deps.getCube(response.cube_id);
+    if (
+      cube.id !== response.cube_id ||
+      cube.name !== response.name ||
+      !cube.roles.some((role) => role.id === response.human_seat_role_id) ||
+      !cube.roles.some((role) => role.id === response.default_worker_role_id)
+    ) {
+      throw new RepositoryAssociationConfirmationError();
+    }
+    try {
+      await deps.saveAssociation(repository, {
+        cubeId: response.cube_id,
+        name: response.name,
+        workingRepoName: response.working_repo_name,
+        template: response.template,
+      });
+    } catch {
+      throw new RepositoryAssociationSaveError();
+    }
+    renderResult(deps, {
+      existing: true,
+      adopted: options.adopted,
+      response,
+      root: input.context.root,
+      serverOrigin: input.serverOrigin,
+      mode: input.mode,
+      creationOptionsUnused: options.creationOptionsUnused,
+    });
+    return { kind: 'success', creation: { response, cube }, existing: true };
+  };
+
+  const serverAssociation = await deps.resolveAssociation(repository, input.context.derivedName);
+  if (serverAssociation.result === 'resolved') {
+    return saveResolvedAssociation(serverAssociation, {
+      adopted: false,
+      creationOptionsUnused: creationOptionsRequested,
+    });
+  }
+
+  const proposedName = input.flags.cubeName?.trim() ?? input.context.derivedName;
+  if (!validRepositoryCubeName(proposedName)) {
+    deps.write(`${NAME_ERROR}\n`);
+    return { kind: 'stop', code: 1 };
+  }
+  const accessibleCubes = await deps.listCubes();
+  const adoptExactMatch = async (name: string): Promise<RepositoryCubeInitResult | null> => {
+    const matches = accessibleCubes.filter((cube) => cube.name === name);
+    if (matches.length === 0) return null;
+    if (matches.length > 1) {
+      deps.write(`More than one accessible cube is named '${name}'. No cube, repository binding, or drone was created. Ask the server operator for an unambiguous repository cube grant.\n`);
+      return { kind: 'stop', code: 1 };
+    }
+    if (!deps.isTTY() || input.flags.yes) {
+      deps.write(
+        'Adopting an existing cube requires interactive confirmation; --yes is not accepted here.\n' +
+        'Rerun without --yes in an interactive terminal. No cube, repository binding, or drone was created.\n',
+      );
+      return { kind: 'stop', code: 1 };
+    }
+    deps.write(
+      `Found an existing cube matching this repository:\n` +
+      `  cube:       ${matches[0].name}\n` +
+      `  repository: ${input.context.root}\n` +
+      `  server:     ${input.serverOrigin}\n`,
+    );
+    while (true) {
+      const answer = await ask(deps, 'Link this repository to that cube? [y/N]: ', 'adoption');
+      if ('stop' in answer) return { kind: 'stop', code: answer.stop };
+      const confirmation = answer.value.trim().toLowerCase();
+      if (confirmation === 'y' || confirmation === 'yes') break;
+      if (confirmation === '' || confirmation === 'n' || confirmation === 'no') {
+        deps.write('No cube, repository binding, or drone was created.\n');
+        return { kind: 'stop', code: 0 };
+      }
+      deps.write('Enter y or n.\n');
+    }
+    const associated = await deps.associateCube({
+      cubeId: matches[0].id,
+      workingRepoName: input.context.derivedName,
+      repository,
+    });
+    if (associated.cube_id !== matches[0].id) {
+      throw new RepositoryAssociationConfirmationError();
+    }
+    try {
+      const confirmed = await deps.resolveAssociation(repository, input.context.derivedName);
+      if (confirmed.result !== 'resolved' || confirmed.cube_id !== associated.cube_id) {
+        throw new RepositoryAssociationConfirmationError();
+      }
+      return await saveResolvedAssociation(confirmed, { adopted: true, creationOptionsUnused: creationOptionsRequested });
+    } catch (error) {
+      if (error instanceof RepositoryAssociationSaveError) throw error;
+      throw new RepositoryAssociationConfirmationError();
+    }
+  };
+
+  const proposedAdoption = await adoptExactMatch(proposedName);
+  if (proposedAdoption) return proposedAdoption;
+
+  if (input.canCreate === false) {
+    deps.write(
+      `This enrolled client cannot create a cube on ${input.serverOrigin}. Ask the server operator to grant access to a cube, then rerun borg assimilate --host ${shellEscape(input.serverOrigin)}.\n`,
+    );
+    return { kind: 'stop', code: 1 };
+  }
+
   if (input.flags.noTemplate) {
     deps.write('--no-template is not supported for repository cube creation. Use --template software-dev or --template starter.\n');
     return { kind: 'stop', code: 1 };
@@ -201,6 +340,10 @@ export async function initializeRepositoryCube(input: {
     deps.write(`${NAME_ERROR}\n`);
     return { kind: 'stop', code: 1 };
   }
+  if (name !== proposedName) {
+    const editedNameAdoption = await adoptExactMatch(name);
+    if (editedNameAdoption) return editedNameAdoption;
+  }
 
   let template = input.flags.template as 'software-dev' | 'starter' | undefined;
   if (!template && deps.isTTY() && !input.flags.yes) {
@@ -241,7 +384,7 @@ export async function initializeRepositoryCube(input: {
         break;
       }
       if (confirmation === 'n' || confirmation === 'no') {
-        deps.write('Cube creation cancelled. Nothing was changed.\n');
+        deps.write('Cube creation cancelled. No cube, repository binding, or drone was created.\n');
         return { kind: 'stop', code: 0 };
       }
       deps.write('Enter y or n.\n');
@@ -250,24 +393,60 @@ export async function initializeRepositoryCube(input: {
 
   deps.write('Creating cube...\n');
   const workingRepoName = input.context.derivedName;
-  const creation = await deps.createCube({ name, workingRepoName, repository, template });
+  let creation: RepositoryCubeCreation;
+  try {
+    creation = await deps.createCube({ name, workingRepoName, repository, template });
+  } catch (error) {
+    if (
+      error instanceof BorgServerError ||
+      error instanceof CubeCreationConfirmationError ||
+      error instanceof CubeCreationOutcomeUnknownError
+    ) {
+      throw error;
+    }
+    throw new CubeCreationOutcomeUnknownError();
+  }
+  let confirmed: RepositoryCubeResolution;
+  try {
+    confirmed = await deps.resolveAssociation(repository, workingRepoName);
+  } catch {
+    throw new CubeCreationConfirmationError('The server did not return authoritative repository association state.');
+  }
+  if (
+    confirmed.result !== 'resolved' ||
+    confirmed.repository.kind !== repository.kind ||
+    confirmed.repository.value !== repository.value ||
+    confirmed.working_repo_name !== workingRepoName ||
+    confirmed.cube_id !== creation.response.cube_id ||
+    confirmed.name !== creation.response.name ||
+    creation.cube.id !== confirmed.cube_id ||
+    creation.cube.name !== confirmed.name ||
+    !creation.cube.roles.some((role) => role.id === confirmed.human_seat_role_id) ||
+    !creation.cube.roles.some((role) => role.id === confirmed.default_worker_role_id)
+  ) {
+    throw new CubeCreationConfirmationError('The server did not confirm the created cube through authoritative repository resolution.');
+  }
   try {
     await deps.saveAssociation(repository, {
-      cubeId: creation.response.cube_id,
-      name: creation.response.name,
-      workingRepoName: creation.response.working_repo_name,
-      template: creation.response.template,
+      cubeId: confirmed.cube_id,
+      name: confirmed.name,
+      workingRepoName: confirmed.working_repo_name,
+      template: confirmed.template,
     });
   } catch {
     throw new RepositoryAssociationSaveError();
   }
   renderResult(deps, {
     existing: creation.response.result === 'resolved',
-    response: creation.response,
+    response: confirmed,
     root: input.context.root,
     serverOrigin: input.serverOrigin,
     mode: input.mode,
     creationOptionsUnused: false,
   });
-  return { kind: 'success', creation, existing: creation.response.result === 'resolved' };
+  return {
+    kind: 'success',
+    creation: { response: confirmed, cube: creation.cube },
+    existing: creation.response.result === 'resolved',
+  };
 }