borgmcp 2.1.0 → 2.2.0

package/src/repository-cube-init.ts

@@ -3,15 +3,23 @@ import {
   LEGACY_DEFAULT_TEMPLATE_LABEL,
 } from 'borgmcp-shared/templates';
 import type {
+  AssociateRepositoryCubeResponse,
   CreateCubeRepository,
   CreateCubeResponse,
   CubeTemplate,
+  ResolvedRepositoryCube,
+  ResolveRepositoryCubeResponse,
 } from 'borgmcp-shared/protocol';
 import { shellEscape } from './shell-escape.js';
 import type {
   GitRepositoryContext,
   RepositoryAssociation,
 } from './repository-identity.js';
+import {
+  BorgServerError,
+  CubeCreationConfirmationError,
+  CubeCreationOutcomeUnknownError,
+} from './server-errors.js';
 
 export interface RepositoryCubeDetail {
   id: string;
@@ -25,6 +33,8 @@ export interface RepositoryCubeCreation {
   cube: RepositoryCubeDetail;
 }
 
+export type RepositoryCubeResolution = ResolveRepositoryCubeResponse;
+
 export interface RepositoryCubeInitFlags {
   cubeName?: string;
   template?: string;
@@ -39,6 +49,13 @@ export interface RepositoryCubeInitDeps {
   getIdentity(context: GitRepositoryContext): Promise<CreateCubeRepository>;
   getAssociation(repository: CreateCubeRepository): Promise<RepositoryAssociation | null>;
   saveAssociation(repository: CreateCubeRepository, association: RepositoryAssociation): Promise<void>;
+  resolveAssociation(repository: CreateCubeRepository, workingRepoName: string): Promise<RepositoryCubeResolution>;
+  listCubes(): Promise<Array<{ id: string; name: string }>>;
+  associateCube(input: {
+    cubeId: string;
+    workingRepoName: string;
+    repository: CreateCubeRepository;
+  }): Promise<AssociateRepositoryCubeResponse>;
   getCube(cubeId: string): Promise<RepositoryCubeDetail>;
   createCube(input: {
     name: string;
@@ -59,6 +76,13 @@ export class RepositoryAssociationSaveError extends Error {
   }
 }
 
+export class RepositoryAssociationConfirmationError extends Error {
+  constructor() {
+    super('The Borg server did not confirm the repository cube association.');
+    this.name = 'RepositoryAssociationConfirmationError';
+  }
+}
+
 export class PromptInterruptedError extends Error {
   constructor() {
     super('prompt interrupted');
@@ -79,15 +103,19 @@ function presentation(template: CubeTemplate) {
   return NEW_CUBE_TEMPLATE_PRESENTATIONS.find((candidate) => candidate.name === template)!;
 }
 
-async function ask(deps: RepositoryCubeInitDeps, message: string): Promise<{ value: string } | { stop: number }> {
+async function ask(
+  deps: RepositoryCubeInitDeps,
+  message: string,
+  operation: 'creation' | 'adoption' = 'creation',
+): Promise<{ value: string } | { stop: number }> {
   try {
     return { value: await deps.prompt(message) };
   } catch (error) {
     if (error instanceof PromptInterruptedError) {
-      deps.write('\nCube creation cancelled. Nothing was changed.\n');
+      deps.write(`\nCube ${operation} cancelled. No cube, repository binding, or drone was created.\n`);
       return { stop: 130 };
     }
-    deps.write('Input ended before cube creation. Nothing was changed.\n');
+    deps.write(`Input ended before cube ${operation}. No cube, repository binding, or drone was created.\n`);
     return { stop: 1 };
   }
 }
@@ -101,10 +129,11 @@ function renderResult(
     serverOrigin: string;
     mode: 'assimilate' | 'cube-init';
     creationOptionsUnused: boolean;
+    adopted?: boolean;
   },
 ): void {
   const lines = [
-    input.existing ? 'Cube already initialized.' : 'Cube created.',
+    input.adopted ? 'Existing cube associated with this repository.' : input.existing ? 'Cube already initialized.' : 'Cube created.',
     `  Name: ${input.response.name}`,
     `  Template: ${presentation(input.response.template).label}`,
     `  Repository: ${input.root}`,
@@ -129,22 +158,15 @@ export async function initializeRepositoryCube(input: {
   context: GitRepositoryContext;
   serverOrigin: string;
   flags: RepositoryCubeInitFlags;
+  canCreate?: boolean;
 }, deps: RepositoryCubeInitDeps): Promise<RepositoryCubeInitResult> {
   const repository = await deps.getIdentity(input.context);
   const association = await deps.getAssociation(repository);
-  const creationOptionsUnused = association !== null && (
-    input.flags.cubeName !== undefined || input.flags.template !== undefined || input.flags.yes === true
-  );
+  const creationOptionsRequested = input.flags.cubeName !== undefined ||
+    input.flags.template !== undefined || input.flags.noTemplate === true || input.flags.yes === true;
+  const creationOptionsUnused = association !== null && creationOptionsRequested;
   if (association) {
     const cube = await deps.getCube(association.cubeId);
-    const authoritativeAssociation = { ...association, name: cube.name };
-    if (cube.name !== association.name) {
-      try {
-        await deps.saveAssociation(repository, authoritativeAssociation);
-      } catch {
-        throw new RepositoryAssociationSaveError();
-      }
-    }
     const response: CreateCubeResponse = {
       result: 'resolved',
       cube_id: association.cubeId,
@@ -167,6 +189,123 @@ export async function initializeRepositoryCube(input: {
     return { kind: 'success', creation: { response, cube }, existing: true };
   }
 
+  const saveResolvedAssociation = async (
+    response: ResolvedRepositoryCube,
+    options: { adopted: boolean; creationOptionsUnused: boolean },
+  ): Promise<RepositoryCubeInitResult> => {
+    if (
+      response.repository.kind !== repository.kind ||
+      response.repository.value !== repository.value ||
+      response.working_repo_name !== input.context.derivedName
+    ) {
+      throw new RepositoryAssociationConfirmationError();
+    }
+    const cube = await deps.getCube(response.cube_id);
+    if (
+      cube.id !== response.cube_id ||
+      cube.name !== response.name ||
+      !cube.roles.some((role) => role.id === response.human_seat_role_id) ||
+      !cube.roles.some((role) => role.id === response.default_worker_role_id)
+    ) {
+      throw new RepositoryAssociationConfirmationError();
+    }
+    try {
+      await deps.saveAssociation(repository, {
+        cubeId: response.cube_id,
+        name: response.name,
+        workingRepoName: response.working_repo_name,
+        template: response.template,
+      });
+    } catch {
+      throw new RepositoryAssociationSaveError();
+    }
+    renderResult(deps, {
+      existing: true,
+      adopted: options.adopted,
+      response,
+      root: input.context.root,
+      serverOrigin: input.serverOrigin,
+      mode: input.mode,
+      creationOptionsUnused: options.creationOptionsUnused,
+    });
+    return { kind: 'success', creation: { response, cube }, existing: true };
+  };
+
+  const serverAssociation = await deps.resolveAssociation(repository, input.context.derivedName);
+  if (serverAssociation.result === 'resolved') {
+    return saveResolvedAssociation(serverAssociation, {
+      adopted: false,
+      creationOptionsUnused: creationOptionsRequested,
+    });
+  }
+
+  const proposedName = input.flags.cubeName?.trim() ?? input.context.derivedName;
+  if (!validRepositoryCubeName(proposedName)) {
+    deps.write(`${NAME_ERROR}\n`);
+    return { kind: 'stop', code: 1 };
+  }
+  const accessibleCubes = await deps.listCubes();
+  const adoptExactMatch = async (name: string): Promise<RepositoryCubeInitResult | null> => {
+    const matches = accessibleCubes.filter((cube) => cube.name === name);
+    if (matches.length === 0) return null;
+    if (matches.length > 1) {
+      deps.write(`More than one accessible cube is named '${name}'. No cube, repository binding, or drone was created. Ask the server operator for an unambiguous repository cube grant.\n`);
+      return { kind: 'stop', code: 1 };
+    }
+    if (!deps.isTTY() || input.flags.yes) {
+      deps.write(
+        'Adopting an existing cube requires interactive confirmation; --yes is not accepted here.\n' +
+        'Rerun without --yes in an interactive terminal. No cube, repository binding, or drone was created.\n',
+      );
+      return { kind: 'stop', code: 1 };
+    }
+    deps.write(
+      `Found an existing cube matching this repository:\n` +
+      `  cube:       ${matches[0].name}\n` +
+      `  repository: ${input.context.root}\n` +
+      `  server:     ${input.serverOrigin}\n`,
+    );
+    while (true) {
+      const answer = await ask(deps, 'Link this repository to that cube? [y/N]: ', 'adoption');
+      if ('stop' in answer) return { kind: 'stop', code: answer.stop };
+      const confirmation = answer.value.trim().toLowerCase();
+      if (confirmation === 'y' || confirmation === 'yes') break;
+      if (confirmation === '' || confirmation === 'n' || confirmation === 'no') {
+        deps.write('No cube, repository binding, or drone was created.\n');
+        return { kind: 'stop', code: 0 };
+      }
+      deps.write('Enter y or n.\n');
+    }
+    const associated = await deps.associateCube({
+      cubeId: matches[0].id,
+      workingRepoName: input.context.derivedName,
+      repository,
+    });
+    if (associated.cube_id !== matches[0].id) {
+      throw new RepositoryAssociationConfirmationError();
+    }
+    try {
+      const confirmed = await deps.resolveAssociation(repository, input.context.derivedName);
+      if (confirmed.result !== 'resolved' || confirmed.cube_id !== associated.cube_id) {
+        throw new RepositoryAssociationConfirmationError();
+      }
+      return await saveResolvedAssociation(confirmed, { adopted: true, creationOptionsUnused: creationOptionsRequested });
+    } catch (error) {
+      if (error instanceof RepositoryAssociationSaveError) throw error;
+      throw new RepositoryAssociationConfirmationError();
+    }
+  };
+
+  const proposedAdoption = await adoptExactMatch(proposedName);
+  if (proposedAdoption) return proposedAdoption;
+
+  if (input.canCreate === false) {
+    deps.write(
+      `This enrolled client cannot create a cube on ${input.serverOrigin}. Ask the server operator to grant access to a cube, then rerun borg assimilate --host ${shellEscape(input.serverOrigin)}.\n`,
+    );
+    return { kind: 'stop', code: 1 };
+  }
+
   if (input.flags.noTemplate) {
     deps.write('--no-template is not supported for repository cube creation. Use --template software-dev or --template starter.\n');
     return { kind: 'stop', code: 1 };
@@ -201,6 +340,10 @@ export async function initializeRepositoryCube(input: {
     deps.write(`${NAME_ERROR}\n`);
     return { kind: 'stop', code: 1 };
   }
+  if (name !== proposedName) {
+    const editedNameAdoption = await adoptExactMatch(name);
+    if (editedNameAdoption) return editedNameAdoption;
+  }
 
   let template = input.flags.template as 'software-dev' | 'starter' | undefined;
   if (!template && deps.isTTY() && !input.flags.yes) {
@@ -241,7 +384,7 @@ export async function initializeRepositoryCube(input: {
         break;
       }
       if (confirmation === 'n' || confirmation === 'no') {
-        deps.write('Cube creation cancelled. Nothing was changed.\n');
+        deps.write('Cube creation cancelled. No cube, repository binding, or drone was created.\n');
         return { kind: 'stop', code: 0 };
       }
       deps.write('Enter y or n.\n');
@@ -250,24 +393,60 @@ export async function initializeRepositoryCube(input: {
 
   deps.write('Creating cube...\n');
   const workingRepoName = input.context.derivedName;
-  const creation = await deps.createCube({ name, workingRepoName, repository, template });
+  let creation: RepositoryCubeCreation;
+  try {
+    creation = await deps.createCube({ name, workingRepoName, repository, template });
+  } catch (error) {
+    if (
+      error instanceof BorgServerError ||
+      error instanceof CubeCreationConfirmationError ||
+      error instanceof CubeCreationOutcomeUnknownError
+    ) {
+      throw error;
+    }
+    throw new CubeCreationOutcomeUnknownError();
+  }
+  let confirmed: RepositoryCubeResolution;
+  try {
+    confirmed = await deps.resolveAssociation(repository, workingRepoName);
+  } catch {
+    throw new CubeCreationConfirmationError('The server did not return authoritative repository association state.');
+  }
+  if (
+    confirmed.result !== 'resolved' ||
+    confirmed.repository.kind !== repository.kind ||
+    confirmed.repository.value !== repository.value ||
+    confirmed.working_repo_name !== workingRepoName ||
+    confirmed.cube_id !== creation.response.cube_id ||
+    confirmed.name !== creation.response.name ||
+    creation.cube.id !== confirmed.cube_id ||
+    creation.cube.name !== confirmed.name ||
+    !creation.cube.roles.some((role) => role.id === confirmed.human_seat_role_id) ||
+    !creation.cube.roles.some((role) => role.id === confirmed.default_worker_role_id)
+  ) {
+    throw new CubeCreationConfirmationError('The server did not confirm the created cube through authoritative repository resolution.');
+  }
   try {
     await deps.saveAssociation(repository, {
-      cubeId: creation.response.cube_id,
-      name: creation.response.name,
-      workingRepoName: creation.response.working_repo_name,
-      template: creation.response.template,
+      cubeId: confirmed.cube_id,
+      name: confirmed.name,
+      workingRepoName: confirmed.working_repo_name,
+      template: confirmed.template,
     });
   } catch {
     throw new RepositoryAssociationSaveError();
   }
   renderResult(deps, {
     existing: creation.response.result === 'resolved',
-    response: creation.response,
+    response: confirmed,
     root: input.context.root,
     serverOrigin: input.serverOrigin,
     mode: input.mode,
     creationOptionsUnused: false,
   });
-  return { kind: 'success', creation, existing: creation.response.result === 'resolved' };
+  return {
+    kind: 'success',
+    creation: { response: confirmed, cube: creation.cube },
+    existing: creation.response.result === 'resolved',
+  };
 }

package/src/server-errors.ts

@@ -106,6 +106,33 @@ export class CubeCreationConfirmationError extends Error {
   }
 }
 
+export type RepositoryAssociationFailure =
+  | 'repository-already-associated'
+  | 'cube-already-associated'
+  | 'access-denied'
+  | 'invalid-cube';
+
+export class RepositoryAssociationOperationError extends Error {
+  constructor(public readonly failure: RepositoryAssociationFailure) {
+    super('Borg server rejected the repository cube association');
+    this.name = 'RepositoryAssociationOperationError';
+  }
+}
+
+export class RepositoryAssociationOutcomeUnknownError extends Error {
+  constructor() {
+    super('Repository cube association outcome is unknown.');
+    this.name = 'RepositoryAssociationOutcomeUnknownError';
+  }
+}
+
+export class RepositoryAssociationResolutionError extends Error {
+  constructor() {
+    super('Repository cube association could not be resolved.');
+    this.name = 'RepositoryAssociationResolutionError';
+  }
+}
+
 /** Exact retired TTL-replacement state: two saved bearers and no safe implicit winner. */
 export class LegacySessionCredentialCollisionError extends Error {
   constructor(public readonly origin: string) {

package/src/server-facade.ts

@@ -2,7 +2,7 @@ import { spawn as spawnChild, type SpawnOptions } from 'node:child_process';
 import { constants } from 'node:os';
 import { cubeInitHelpText, isHelpFlag, serverHelpText } from './cli-help.js';
 
-export const SERVER_LIFECYCLE_COMMANDS = ['setup', 'start', 'stop', 'status', 'update', 'invite'] as const;
+export const SERVER_LIFECYCLE_COMMANDS = ['setup', 'start', 'stop', 'status', 'update', 'invite', 'dashboard'] as const;
 export type ServerLifecycleCommand = typeof SERVER_LIFECYCLE_COMMANDS[number];
 
 export type ParsedServerFacadeArgs =
@@ -48,6 +48,7 @@ export interface ServerFacadeProcessDeps {
     args: readonly string[],
     options: Pick<SpawnOptions, 'shell' | 'stdio'>,
   ): ServerFacadeChild;
+  isInteractiveTerminal(): boolean;
   addSignalListener(signal: NodeJS.Signals, listener: () => void): void;
   removeSignalListener(signal: NodeJS.Signals, listener: () => void): void;
 }
@@ -70,6 +71,7 @@ export type ServerFacadeProcessResult =
 
 const defaultProcessDeps: ServerFacadeProcessDeps = {
   spawn: (command, args, options) => spawnChild(command, [...args], options),
+  isInteractiveTerminal: () => process.stdin.isTTY === true && process.stdout.isTTY === true,
   addSignalListener: (signal, listener) => process.on(signal, listener),
   removeSignalListener: (signal, listener) => process.off(signal, listener),
 };
@@ -125,7 +127,7 @@ function inertCommand(command: string): string {
 export function unknownServerCommandText(command: string): string {
   return (
     `Unknown server command: ${inertCommand(command)}.\n` +
-    `Available commands: setup, start, stop, status, update, invite, cube init.\n` +
+    `Available commands: setup, start, stop, status, update, invite, dashboard, cube init.\n` +
     `Next: run borg server --help.\n`
   );
 }
@@ -159,7 +161,6 @@ export function runServerFacadeProcess(
     [input.command, ...input.args],
     { shell: false, stdio: 'inherit' },
   );
-  const signals = ['SIGINT', 'SIGTERM'] as const;
 
   return new Promise((resolve) => {
     let settled = false;
@@ -177,13 +178,18 @@ export function runServerFacadeProcess(
       resolve(result);
     };
 
-    for (const signal of signals) {
-      const listener = () => {
-        child.kill(signal);
-      };
-      forwarders.set(signal, listener);
-      deps.addSignalListener(signal, listener);
-    }
+    const forwardSigint = () => {
+      // An interactive terminal has already sent SIGINT to this foreground
+      // group, including the server. Forwarding again kills its cleanup path.
+      // Node exposes no signal origin, so parent-only SIGINT while attached to
+      // a TTY is intentionally treated as terminal delivery and is not forwarded.
+      if (!deps.isInteractiveTerminal()) child.kill('SIGINT');
+    };
+    const forwardSigterm = () => child.kill('SIGTERM');
+    forwarders.set('SIGINT', forwardSigint);
+    forwarders.set('SIGTERM', forwardSigterm);
+    deps.addSignalListener('SIGINT', forwardSigint);
+    deps.addSignalListener('SIGTERM', forwardSigterm);
 
     child.once('error', (error) => settle({ kind: 'spawn-error', error }));
     child.once('exit', (code, signal) => {