borgmcp 2.2.0 → 2.4.0

package/src/seats.ts

@@ -98,6 +98,8 @@ function emptyStore(): SeatsFile {
 
 const ROLE_CLASSES = new Set(['queen', 'worker']);
 const OPERATION_KINDS = new Set(['seat', 'sibling']);
+const SEAT_BEARER_RE = /^[A-Za-z0-9_-]{43,1024}$/;
+const rejectedSeatRefs = new Set<string>();
 
 function isNonEmptyString(value: unknown): value is string {
   return typeof value === 'string' && value.length > 0;
@@ -117,10 +119,10 @@ function isValidOperation(value: unknown): value is SeatOperation {
 /**
  * CR#2: FULL per-entry validation. Every key/value/invariant of a seat record is
  * checked — the ref is well-formed and self-consistent (the map key equals the
- * record's derived ref), state ∈ {pending,active}, the credential is a non-empty
- * string, the operation is well-shaped, an ACTIVE record carries ALL its required
- * server + binding fields, and a PENDING record carries NO active-only session
- * id. A single invalid entry ⇒ the whole store is rejected
+ * record's derived ref), state ∈ {pending,active}, the credential is an exact
+ * 32-byte base64url bearer, the operation is well-shaped, an ACTIVE record carries
+ * ALL its required server + binding fields, and a PENDING record carries NO
+ * active-only session id. A single invalid entry ⇒ the whole store is rejected
  * (fail closed at the caller, bytes preserved) — never a silent cast.
  */
 function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
@@ -134,7 +136,8 @@ function isValidSeatRecord(ref: string, value: unknown): value is SeatRecord {
     !isNonEmptyString(r.cubeId) ||
     !isNonEmptyString(r.roleId) ||
     !isValidOperation(r.operation) ||
-    !isNonEmptyString(r.credential)
+    typeof r.credential !== 'string' ||
+    !SEAT_BEARER_RE.test(r.credential)
   ) {
     return false;
   }
@@ -204,7 +207,7 @@ function parseStore(raw: string): SeatsFile | null {
             !Array.isArray(replacement) &&
             Object.keys(replacement).length === 1 &&
             typeof (replacement as { credential?: unknown }).credential === 'string' &&
-            /^[A-Za-z0-9_-]{43}$/.test((replacement as { credential: string }).credential);
+            SEAT_BEARER_RE.test((replacement as { credential: string }).credential);
           let canonicalOrigin = false;
           try {
             const origin = new URL(String(withoutReplacement.origin));
@@ -338,6 +341,7 @@ export async function mintPendingSeat(input: {
     };
     txn.data.seats[ref] = record;
     await txn.commit();
+    rejectedSeatRefs.delete(ref);
     return record;
   });
 }
@@ -430,6 +434,7 @@ export async function prepareSeat(input: {
     };
     txn.data.seats[ref] = record;
     await txn.commit();
+    rejectedSeatRefs.delete(ref);
     return { ok: true as const, record };
   });
 }
@@ -498,6 +503,7 @@ export async function activateAndBindSeat(input: {
       ...(input.isHumanSeat !== undefined ? { isHumanSeat: input.isHumanSeat } : {}),
     };
     await txn.commit();
+    rejectedSeatRefs.delete(ref);
     return 'activated';
   });
 }
@@ -567,16 +573,28 @@ export async function bindPendingSeatToWorktree(input: {
 
 // ─── Hydration / enumeration (scan by worktree) ──────────────────────────────
 
-/** The exact ACTIVE seat bound to `worktree`, or null. A pending record (no
- *  worktree, or non-active) is NEVER surfaced as a live binding. */
+/** The preferred ACTIVE seat bound to `worktree`, or null. A pending record (no
+ *  worktree, or non-active) is NEVER surfaced as a live binding. Candidates use
+ *  one total order across every process: unrejected before rejected, a sibling
+ *  finalized into this worktree before an older in-place binding, then seat ref. */
 export async function getActiveSeatForWorktree(worktree: string): Promise<SeatRecord | null> {
   const store = await readStore();
-  for (const [ref, record] of Object.entries(store.seats)) {
-    if (record.state === 'active' && record.worktree === worktree && seatRef(record) === ref) {
-      return record;
-    }
-  }
-  return null;
+  const candidates = Object.entries(store.seats)
+    .filter(([ref, record]) =>
+      record.state === 'active' && record.worktree === worktree && seatRef(record) === ref)
+    .sort(([leftRef, left], [rightRef, right]) => {
+      const rejectionOrder = Number(rejectedSeatRefs.has(leftRef)) - Number(rejectedSeatRefs.has(rightRef));
+      if (rejectionOrder !== 0) return rejectionOrder;
+      const operationOrder = Number(left.operation.kind === 'seat') - Number(right.operation.kind === 'seat');
+      if (operationOrder !== 0) return operationOrder;
+      return leftRef < rightRef ? -1 : leftRef > rightRef ? 1 : 0;
+    });
+  return candidates[0]?.[1] ?? null;
+}
+
+/** Deprioritize an exact seat after a definitive server auth or eviction verdict. */
+export function markSeatRejected(ref: string): void {
+  if (REF_RE.test(ref)) rejectedSeatRefs.add(ref);
 }
 
 /**
@@ -624,6 +642,8 @@ export async function findIncompleteSiblingAttempt(binding: {
       record.state === 'pending' &&
       record.worktree === undefined &&
       record.operation.kind === 'sibling' &&
+      record.operation.operationKey.startsWith('implicit-sibling:') &&
+      record.operation.operationKey.length > 'implicit-sibling:'.length &&
       record.origin === binding.origin &&
       record.trustIdentity === binding.trustIdentity &&
       record.cubeId === binding.cubeId &&
@@ -696,6 +716,7 @@ export async function resetSeatForWorktree(expected: {
     }
     delete txn.data.seats[expected.ref];
     await txn.commit();
+    rejectedSeatRefs.delete(expected.ref);
     return { outcome: 'reset' as const, ref: expected.ref };
   });
 }
@@ -726,6 +747,7 @@ export async function clearSeat(ref: string): Promise<void> {
     if (txn.data.seats[ref] !== undefined) {
       delete txn.data.seats[ref];
       await txn.commit();
+      rejectedSeatRefs.delete(ref);
     }
   });
 }

package/src/unknown-subcommand.ts

@@ -14,6 +14,7 @@
 /** The subcommands the claude.ts router dispatches on (lines 107-176). */
 export const KNOWN_SUBCOMMANDS = [
   'setup',
+  'update',
   'assimilate',
   'reset-local-seat',
   'spawn',