borgmcp 2.7.1 → 2.7.2

package/docs/RELEASING.md

@@ -158,8 +158,13 @@ Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.0
 `a8d3c572dee3b90cf2a898768c45a1f46270fe11`. Workflow run `30440435955`, attempt 1,
 successfully published that exact source as `borgmcp@2.7.0`; the same-run artifact report records integrity
 `sha512-qn7ljuq/UwYzQJ5pWliLqD7Q5mlwk287ObOXbSV5FOcs+JdoXjFlb9NVC6bFoQzjHaWixCX600EAEtRZ0UeNPw==`.
+Never move, replace, reuse, or rerun that tag or workflow. The annotated `v2.7.1` tag object
+`fc308b52393edf0ed8299490980207840a69c157` peels to protected-main commit
+`41091978bfe02831863de26e75fdf3bb48d4b038`. Workflow run `30463299198`, attempt 1,
+successfully published that exact source as `borgmcp@2.7.1`; the same-run artifact report records integrity
+`sha512-hgxKTCAocbTsBV/YHIegn/jlG9a9YwdbOHD3s5mL+CsN61/5m180rvGJ8+RlNRd5Sdk408phc+QW2Li46tmTMg==`.
 Never move, replace, reuse, or rerun that tag or workflow. The next candidate
-uses the unused `v2.7.1` identity from a fresh reviewed protected-main commit
+uses the unused `v2.7.2` identity from a fresh reviewed protected-main commit
 and requires the complete release gate again.
 
 ## Release Prerequisites

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "borgmcp",
-  "version": "2.7.1",
+  "version": "2.7.2",
   "description": "Coordinate AI coding agents in shared cubes. Works with Claude Code, Codex, and OpenCode.",
   "type": "module",
   "main": "./dist/index.js",

package/src/assimilate-cmd.ts

@@ -1456,7 +1456,10 @@ export async function runAssimilate(
       }
     }
 
-    const repoBase = basename(projectRoot);
+    // The common Git directory identifies the repository across every linked
+    // worktree. Using projectRoot here fragments one repository's siblings when
+    // assimilation starts inside an existing sibling worktree.
+    const repoBase = basename(dirname(repositoryContext.commonDir));
     const suffix = args.flags.worktree ?? roleSlug(assignedRole.name);
     // gh#556 Part 1: empty-suffix guard (CR-binding). roleSlug can yield '' for a
     // pathological all-special-char role name; an empty leaf would let join() collapse
@@ -1473,6 +1476,15 @@ export async function runAssimilate(
     // (was a sibling <parent>/<repo>-<name>). Existing siblings are untouched
     // (absolute git-registered paths). Collision dedup KEPT (<name>-<n>).
     const homeDir = deps.homedir();
+    let registeredWorktrees = listRegisteredWorktrees(deps, projectRoot);
+    if (registeredWorktrees === null) {
+      deps.stderr(
+        'Borg could not enumerate this repository’s existing worktrees, so it did not risk creating a colliding sibling.\n' +
+        'Run `git worktree list` from this repository and resolve the reported Git error, then rerun `borg assimilate`.\n' +
+        'A seat was reserved and remains pending; rerunning after fixing the worktree issue resumes that seat.\n',
+      );
+      return 1;
+    }
     let candidate = computeWorktreePath(homeDir, repoBase, suffix);
     let wtBranch = perWorktreeBranchName(basename(candidate), repoBase);
     let n = 2;
@@ -1485,7 +1497,8 @@ export async function runAssimilate(
     // fresh suffix so we never reuse/clobber its work.
     while (
       deps.pathExists(candidate) ||
-      worktreeRegistered(deps, projectRoot, candidate) ||
+      registeredWorktrees.names.has(basename(candidate)) ||
+      registeredWorktrees.branches.has(wtBranch) ||
       (localBranchExists(deps.runSync, projectRoot, wtBranch) &&
         !isMerged(deps.runSync, projectRoot, wtBranch, startRef))
     ) {
@@ -1493,26 +1506,56 @@ export async function runAssimilate(
       wtBranch = perWorktreeBranchName(basename(candidate), repoBase);
       n++;
     }
-    // gh#556 Part 1: create the intermediate ~/.borg/worktrees/<repo>/ before
-    // `git worktree add` (git creates the leaf, not the parent chain). Plain
-    // recursive mkdir — NO chmod of the existing ~/.borg (credentials file).
-    deps.mkdirp(dirname(candidate));
-    // gh#33 (Q1/Q4): spawn on a named per-worktree branch (wt-<suffix>),
-    // NOT detached HEAD. The named branch is current with startRef and is
-    // where the drone's feature branches get cut from. Uniform for every
-    // role incl. coordinator — main is never a working branch (Q4).
-    // Branch naming is UNAFFECTED by the relocation: perWorktreeBranchName's
-    // as-is else-branch maps the new basename <suffix> → wt-<suffix> (== old).
-    //
-    // gh#864: if <wtBranch> already exists here it is MERGED (the loop bumped
-    // past any unmerged ref), so ADOPT it — `git worktree add <path> <branch>`
-    // (no -b) attaches the merged branch instead of failing on a create-
-    // collision. A fresh suffix has no ref → create it at startRef with -b.
-    const wt = localBranchExists(deps.runSync, projectRoot, wtBranch)
-      ? deps.runSync('git', ['worktree', 'add', candidate, wtBranch], projectRoot)
-      : deps.runSync('git', ['worktree', 'add', '-b', wtBranch, candidate, startRef], projectRoot);
+    let wt: ReturnType<AssimilateDeps['runSync']>;
+    let residualBranch: string | null = null;
+    while (true) {
+      // gh#556 Part 1: create the intermediate ~/.borg/worktrees/<repo>/ before
+      // `git worktree add` (git creates the leaf, not the parent chain). Plain
+      // recursive mkdir — NO chmod of the existing ~/.borg (credentials file).
+      deps.mkdirp(dirname(candidate));
+      const branchExisted = localBranchExists(deps.runSync, projectRoot, wtBranch);
+      wt = branchExisted
+        ? deps.runSync('git', ['worktree', 'add', candidate, wtBranch], projectRoot)
+        : deps.runSync('git', ['worktree', 'add', '-b', wtBranch, candidate, startRef], projectRoot);
+      if (wt.status === 0) break;
+
+      // Another assimilate may claim the name or branch after our first list.
+      // Refresh and suffix-bump instead of surfacing a collision to the operator.
+      const refreshed = listRegisteredWorktrees(deps, projectRoot);
+      const branchAppeared = !branchExisted && localBranchExists(deps.runSync, projectRoot, wtBranch);
+      const collision =
+        deps.pathExists(candidate) ||
+        refreshed?.names.has(basename(candidate)) === true ||
+        refreshed?.branches.has(wtBranch) === true ||
+        (!branchExisted && worktreeAddReportedCollision(wt.stderr));
+      if (!collision || refreshed === null) {
+        if (branchAppeared && refreshed?.branches.has(wtBranch) !== true) {
+          residualBranch = wtBranch;
+        }
+        break;
+      }
+      registeredWorktrees = refreshed;
+      do {
+        candidate = computeWorktreePath(homeDir, repoBase, suffix, n);
+        wtBranch = perWorktreeBranchName(basename(candidate), repoBase);
+        n++;
+      } while (
+        deps.pathExists(candidate) ||
+        registeredWorktrees.names.has(basename(candidate)) ||
+        registeredWorktrees.branches.has(wtBranch) ||
+        localBranchExists(deps.runSync, projectRoot, wtBranch)
+      );
+    }
     if (wt.status !== 0) {
-      deps.stderr(`git worktree add failed: ${safeStderr(wt.stderr)}\n`);
+      deps.stderr(
+        `Borg could not create sibling worktree ${candidate} on branch ${wtBranch}. ` +
+        `Git reported: ${safeStderr(wt.stderr)}\n` +
+        (residualBranch
+          ? `Git left branch ${residualBranch} without a registered worktree; Borg preserved it.\n`
+          : '') +
+        'Run `git worktree list` and `git status` to inspect repository state, resolve the reported Git error, then rerun `borg assimilate`.\n' +
+        'A seat was reserved and remains pending; rerunning after fixing the worktree issue resumes that seat.\n',
+      );
       return 1;
     }
     deps.stderr(
@@ -1958,10 +2001,24 @@ export function safeStderr(msg: string): string {
   return msg.replace(/[\x00-\x1F\x7F]/g, '');
 }
 
-function worktreeRegistered(deps: AssimilateDeps, projectRoot: string, candidate: string): boolean {
+function worktreeAddReportedCollision(stderr: string): boolean {
+  const message = safeStderr(stderr);
+  return /(?:branch named .* already exists|already checked out|already registered|already exists at)/i.test(message);
+}
+
+function listRegisteredWorktrees(
+  deps: AssimilateDeps,
+  projectRoot: string,
+): { names: Set<string>; branches: Set<string> } | null {
   const res = deps.runSync('git', ['worktree', 'list', '--porcelain'], projectRoot);
-  if (res.status !== 0) return false;
-  return res.stdout.split('\n').some((line) => line === `worktree ${candidate}`);
+  if (res.status !== 0) return null;
+  const names = new Set<string>();
+  const branches = new Set<string>();
+  for (const line of res.stdout.split('\n')) {
+    if (line.startsWith('worktree ')) names.add(basename(line.slice('worktree '.length)));
+    if (line.startsWith('branch refs/heads/')) branches.add(line.slice('branch refs/heads/'.length));
+  }
+  return { names, branches };
 }
 
 /**

package/src/cubes.ts

@@ -72,6 +72,8 @@ export interface ActiveCube {
   roleName?: string;
   roleClass?: 'queen' | 'worker';
   isHumanSeat?: boolean;
+  /** Canonical worktree bound to this exact durable seat. */
+  worktree?: string;
 }
 
 export type ActiveCubeInput = Omit<ActiveCube, 'sessionToken'> & {
@@ -97,7 +99,53 @@ interface CodexWakeTargetsFile {
  * directory. If not found by filesystem root, return the original cwd.
  * The returned absolute path is the "project key" used to scope cube state.
  */
-export function findProjectRoot(cwd: string = process.cwd()): string {
+let pinnedMcpProjectRoot: string | null = null;
+let pinnedMcpSeatIdentity: {
+  worktree: string;
+  cubeId: string;
+  droneId: string;
+  credentialRef?: string;
+} | null = null;
+
+export class McpSeatIdentityChangedError extends Error {
+  readonly code = 'SEAT_IDENTITY_CHANGED';
+  constructor() {
+    super('The saved Borg seat changed after this MCP session pinned its identity. Exit this session and relaunch from the intended worktree.');
+    this.name = 'McpSeatIdentityChangedError';
+  }
+}
+
+export function pinMcpProjectRoot(worktree: string): void {
+  const normalized = resolve(worktree);
+  if (pinnedMcpProjectRoot !== null && pinnedMcpProjectRoot !== normalized) {
+    throw new Error(`Borg MCP session project root is already pinned to ${pinnedMcpProjectRoot}`);
+  }
+  pinnedMcpProjectRoot = normalized;
+}
+
+export function pinMcpSeatIdentity(active: ActiveCube): void {
+  if (!active.worktree) throw new McpSeatIdentityChangedError();
+  pinMcpProjectRoot(active.worktree);
+  const next = {
+    worktree: resolve(active.worktree),
+    cubeId: active.cubeId,
+    droneId: active.droneId,
+    ...(active.localSessionCredentialRef
+      ? { credentialRef: active.localSessionCredentialRef }
+      : {}),
+  };
+  if (pinnedMcpSeatIdentity && (
+    pinnedMcpSeatIdentity.worktree !== next.worktree ||
+    pinnedMcpSeatIdentity.cubeId !== next.cubeId ||
+    pinnedMcpSeatIdentity.droneId !== next.droneId ||
+    pinnedMcpSeatIdentity.credentialRef !== next.credentialRef
+  )) {
+    throw new McpSeatIdentityChangedError();
+  }
+  pinnedMcpSeatIdentity = next;
+}
+
+export function findProjectRoot(cwd: string = pinnedMcpProjectRoot ?? process.cwd()): string {
   let dir = resolve(cwd);
   while (true) {
     if (existsSync(join(dir, '.git'))) return dir;
@@ -244,9 +292,22 @@ async function writeCodexWakeTargetsFile(data: CodexWakeTargetsFile): Promise<vo
  * refresh.
  */
 export async function getActiveCube(): Promise<ActiveCube | null> {
-  const record = await getActiveSeatForWorktree(findProjectRoot());
+  return getActiveCubeForWorktree(findProjectRoot());
+}
+
+export async function getActiveCubeForWorktree(worktree: string): Promise<ActiveCube | null> {
+  const record = await getActiveSeatForWorktree(findProjectRoot(worktree));
   if (!record || !record.cubeId || !record.droneId) return null;
-  return hydrateActiveCube(record);
+  const active = await hydrateActiveCube(record);
+  if (active && pinnedMcpSeatIdentity && (
+    resolve(active.worktree ?? '') !== pinnedMcpSeatIdentity.worktree ||
+    active.cubeId !== pinnedMcpSeatIdentity.cubeId ||
+    active.droneId !== pinnedMcpSeatIdentity.droneId ||
+    active.localSessionCredentialRef !== pinnedMcpSeatIdentity.credentialRef
+  )) {
+    throw new McpSeatIdentityChangedError();
+  }
+  return active;
 }
 
 /**
@@ -282,12 +343,18 @@ async function hydrateActiveCube(record: SeatRecord): Promise<ActiveCube | null>
     serverTrustIdentity: record.trustIdentity,
     localSessionCredentialRef: ref,
     operation: record.operation,
+    worktree: record.worktree,
     ...(record.roleName !== undefined ? { roleName: record.roleName } : {}),
     ...(record.roleClass !== undefined ? { roleClass: record.roleClass } : {}),
     ...(record.isHumanSeat !== undefined ? { isHumanSeat: record.isHumanSeat } : {}),
   };
 }
 
+export function __resetPinnedMcpProjectRootForTests(): void {
+  pinnedMcpProjectRoot = null;
+  pinnedMcpSeatIdentity = null;
+}
+
 /**
  * Token-free lookup used after an offline reset. A surviving seat is only
  * described as saved local state; the caller must still revalidate it with the

package/src/index.ts

@@ -64,9 +64,11 @@ import {
 import {
   activeCubeWithFreshRegenIdentity,
   getActiveCube,
+  getActiveCubeForWorktree,
   refreshActiveCubeMetadata,
   findProjectRoot,
   inboxPathForDrone,
+  pinMcpSeatIdentity,
 } from './cubes.js';
 import { isEntryInvocation, monitorStateRootForWorktree } from './inbox-monitor.js';
 import { addSessionStartHook, addUserPromptSubmitHook } from './config-utils.js';
@@ -140,6 +142,11 @@ import {
   normalizeDirectLogRecipients,
 } from './direct-log.js';
 import { formatLocalManageToolResult } from './local-manage-tool-result.js';
+import {
+  OpenCodeSeatIdentityError,
+  formatOpenCodeSeatIdentityError,
+  resolveOpenCodeSeatIdentity,
+} from './opencode-seat-identity.js';
 import {
   runEvictDroneTool,
   runReassignDroneTool,
@@ -216,8 +223,8 @@ export async function main() {
   // installed client version.
   handleVersionFlag();
   const readinessProbe = isMcpReadinessProbe();
-
-  await runMcpStartupServices(readinessProbe, {
+  const openCodeRuntime = resolveSessionAgentKind() === 'opencode';
+  const startupServices = {
     // Auto-register the SessionStart hook so existing users get borg-regen
     // auto-orientation on session start without re-running borg setup. Idempotent.
     sessionStartHook: () => {
@@ -255,19 +262,22 @@ export async function main() {
     openCode: async () => {
       installBorgPlugin();
       const active = await getActiveCube();
-      if (active && process.env.BORG_OPENCODE === '1') {
+      if (active && openCodeRuntime) {
         const port = computeOpenCodePort(active.droneId);
         const serverUrl = `http://127.0.0.1:${port}`;
         await connectOpenCodeDrone({
           serverUrl,
-          directory: process.cwd(),
+          directory: active.worktree ?? findProjectRoot(),
           droneLabel: active.droneLabel,
           cubeName: active.name,
         });
         setModuleInjectOpenCode(injectOpenCodeEntry);
       }
     },
-  });
+  };
+  // Claude and Codex retain their existing pre-handshake startup behavior.
+  // OpenCode must first obtain the session-scoped MCP root from its client.
+  if (!openCodeRuntime) await runMcpStartupServices(readinessProbe, startupServices);
 
   // Create MCP server. `version` is the installed borgmcp version
   // (T1.4 of 0.6.0): read at runtime from package.json so Claude
@@ -286,6 +296,16 @@ export async function main() {
     }
   );
 
+  let openCodeIdentityFailure: OpenCodeSeatIdentityError | null = null;
+  let finishOpenCodeIdentity: (() => void) | null = null;
+  const openCodeIdentityReady = openCodeRuntime && !readinessProbe
+    ? new Promise<void>((resolveIdentity) => { finishOpenCodeIdentity = resolveIdentity; })
+    : null;
+  const waitForOpenCodeIdentity = async (): Promise<OpenCodeSeatIdentityError | null> => {
+    if (openCodeIdentityReady) await openCodeIdentityReady;
+    return openCodeIdentityFailure;
+  };
+
   // gh#899: tool definitions built once at setup, then role-scoped per caller
   // in the ListTools handler below (the dispatcher reaches deferred tools).
   const allToolDefs: ToolManifestEntry[] = TOOL_MANIFEST;
@@ -294,6 +314,7 @@ export async function main() {
   // (old cubes.json / pre-assimilate) → full set; deferred tools stay reachable
   // via borg_tool. Never an auth boundary — live per-client cube grants govern.
   server.setRequestHandler(ListToolsRequestSchema, async () => {
+    await waitForOpenCodeIdentity();
     let scope: { roleName?: string; roleClass?: 'queen' | 'worker'; isHumanSeat?: boolean } | null = null;
     try {
       const active = await getActiveCube();
@@ -310,6 +331,17 @@ export async function main() {
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     let { name, arguments: args } = request.params;
 
+    const identityFailure = await waitForOpenCodeIdentity();
+    if (identityFailure) {
+      return {
+        content: [{
+          type: 'text',
+          text: formatOpenCodeSeatIdentityError(identityFailure, process.cwd()),
+        }],
+        isError: true,
+      };
+    }
+
     // gh#899: borg_describe-tool — schema-only, NEVER executes. Returns the
     // named tool's def from allToolDefs so a role-scoped session can learn a
     // deferred tool's arguments before invoking it via borg_tool.
@@ -386,7 +418,7 @@ export async function main() {
               since,
               reportedModel,
               agentKind: resolveReportableSessionAgentKind(),
-              workingRepo: resolveWorkingRepo(),
+              workingRepo: resolveWorkingRepo(active.worktree),
               serverTrustIdentity: active.serverTrustIdentity,
             });
           } catch (error) {
@@ -467,7 +499,7 @@ export async function main() {
             seedDisplayIdentity(active!);
             const result = await regen(active!.sessionToken, active!.apiUrl, {
               agentKind: resolveReportableSessionAgentKind(),
-              workingRepo: resolveWorkingRepo(),
+              workingRepo: resolveWorkingRepo(active!.worktree),
               serverTrustIdentity: active!.serverTrustIdentity,
             });
             const displayIdentity = confirmDisplayIdentity(active!, identityFromRegen(result));
@@ -1259,9 +1291,36 @@ export async function main() {
   // Create stdio transport
   const transport = new StdioServerTransport();
 
+  if (openCodeIdentityReady) {
+    server.oninitialized = () => {
+      void resolveOpenCodeSeatIdentity({
+        listRoots: () => server.listRoots(),
+        findProjectRoot,
+        getActiveCubeForWorktree,
+        pinSeatIdentity: pinMcpSeatIdentity,
+        childCwd: process.cwd(),
+      }).catch((error) => {
+        openCodeIdentityFailure = error instanceof OpenCodeSeatIdentityError
+          ? error
+          : new OpenCodeSeatIdentityError('ROOTS_UNAVAILABLE', String(error));
+      }).finally(() => {
+        finishOpenCodeIdentity?.();
+      });
+    };
+  }
+
   // Connect server to transport
   await server.connect(transport);
 
+  if (openCodeIdentityReady) {
+    await openCodeIdentityReady;
+    if (openCodeIdentityFailure) {
+      console.error(formatOpenCodeSeatIdentityError(openCodeIdentityFailure, process.cwd()));
+    } else {
+      await runMcpStartupServices(false, startupServices, { openCodeFirst: true });
+    }
+  }
+
   // Resolve drone self-identification prefix before any console output
   // (gh#25). Falls back to `[unassimilated · <repo>]` if no cube cached.
   await initConsolePrefix();

package/src/log-stream.ts

@@ -496,7 +496,12 @@ async function runLoop(testDeps: RunLoopTestDeps = {}): Promise<void> {
         active.cubeId,
         active.droneId,
         STREAM_OWNER_STALE_MS,
-        { isPidAlive: isProcessAlive },
+        {
+          isPidAlive: isProcessAlive,
+          ...(active.worktree ? { worktree: active.worktree } : {}),
+          ...(active.droneLabel ? { droneLabel: active.droneLabel } : {}),
+          ...(active.name ? { cubeName: active.name } : {}),
+        },
       );
       leaseKey = lease ? nextLeaseKey : null;
     }
@@ -642,6 +647,9 @@ export interface ActiveCube {
   serverTrustIdentity?: string;
   localSessionCredentialRef?: string;
   localSessionExpiresAt?: string | null;
+  worktree?: string;
+  droneLabel?: string;
+  name?: string;
 }
 
 export async function streamOnce(

package/src/opencode-seat-identity.ts

@@ -0,0 +1,111 @@
+import { fileURLToPath } from 'node:url';
+import { resolve } from 'node:path';
+import type { ActiveCube } from './cubes.js';
+
+export type OpenCodeSeatIdentityErrorCode =
+  | 'ROOTS_UNAVAILABLE'
+  | 'ROOTS_INVALID'
+  | 'SEAT_NOT_FOUND'
+  | 'SEAT_WORKTREE_MISMATCH';
+
+export class OpenCodeSeatIdentityError extends Error {
+  constructor(
+    public readonly code: OpenCodeSeatIdentityErrorCode,
+    message: string,
+    public readonly sessionDirectory?: string,
+    public readonly seat?: Pick<ActiveCube, 'droneLabel' | 'worktree'>,
+  ) {
+    super(message);
+    this.name = 'OpenCodeSeatIdentityError';
+  }
+}
+
+export interface OpenCodeSeatIdentityDeps {
+  listRoots: () => Promise<{ roots?: Array<{ uri?: string }> }>;
+  findProjectRoot: (directory: string) => string;
+  getActiveCubeForWorktree: (worktree: string) => Promise<ActiveCube | null>;
+  pinSeatIdentity: (active: ActiveCube) => void;
+  childCwd: string;
+}
+
+export async function resolveOpenCodeSeatIdentity(
+  deps: OpenCodeSeatIdentityDeps,
+): Promise<ActiveCube> {
+  let roots: { roots?: Array<{ uri?: string }> };
+  try {
+    roots = await deps.listRoots();
+  } catch {
+    throw new OpenCodeSeatIdentityError(
+      'ROOTS_UNAVAILABLE',
+      'OpenCode did not provide its session directory.',
+    );
+  }
+  if (!Array.isArray(roots.roots) || roots.roots.length !== 1) {
+    throw new OpenCodeSeatIdentityError(
+      'ROOTS_INVALID',
+      'OpenCode must provide exactly one local session directory.',
+    );
+  }
+  const uri = roots.roots[0]?.uri;
+  let sessionDirectory: string;
+  try {
+    const parsed = new URL(typeof uri === 'string' ? uri : '');
+    if (parsed.protocol !== 'file:' || parsed.hostname || parsed.search || parsed.hash) throw new Error();
+    sessionDirectory = resolve(fileURLToPath(parsed));
+  } catch {
+    throw new OpenCodeSeatIdentityError(
+      'ROOTS_INVALID',
+      'OpenCode provided an invalid or non-local session directory.',
+    );
+  }
+
+  const sessionWorktree = deps.findProjectRoot(sessionDirectory);
+  const cwdWorktree = deps.findProjectRoot(deps.childCwd);
+  // Direct `borg` launch keeps cwd as its seat source. When a shared OpenCode
+  // server spawns the MCP child elsewhere, the session-scoped root is the
+  // launcher-conferred pin and replaces that ambient cwd inference.
+  const identityWorktree = cwdWorktree === sessionWorktree
+    ? cwdWorktree
+    : sessionWorktree;
+  const active = await deps.getActiveCubeForWorktree(identityWorktree);
+  if (!active) {
+    throw new OpenCodeSeatIdentityError(
+      'SEAT_NOT_FOUND',
+      'No active Borg seat is bound to the OpenCode session directory.',
+      sessionWorktree,
+    );
+  }
+  if (typeof active.worktree !== 'string' || resolve(active.worktree) !== resolve(sessionWorktree)) {
+    throw new OpenCodeSeatIdentityError(
+      'SEAT_WORKTREE_MISMATCH',
+      'The resolved Borg seat belongs to a different worktree than the OpenCode session.',
+      sessionWorktree,
+      active,
+    );
+  }
+
+  deps.pinSeatIdentity(active);
+  return active;
+}
+
+export function formatOpenCodeSeatIdentityError(
+  error: OpenCodeSeatIdentityError,
+  childCwd: string,
+): string {
+  const lines = [
+    `Borg OpenCode seat identity error [${error.code}]`,
+    '',
+    error.message,
+    `- OpenCode session directory: ${error.sessionDirectory ?? 'unavailable'}`,
+    `- Borg MCP child cwd: ${childCwd}`,
+  ];
+  if (error.seat) {
+    lines.push(`- Resolved seat: ${error.seat.droneLabel} (${error.seat.worktree})`);
+  }
+  lines.push(
+    '',
+    'The Borg stream and OpenCode wake injection were not started.',
+    'Exit this session and run `borg --cli opencode` from the intended worktree. If that worktree’s saved seat is stale, run `borg reset-local-seat` from that exact worktree before assimilating again.',
+  );
+  return lines.join('\n');
+}

package/src/startup-services.ts

@@ -16,10 +16,16 @@ export interface McpStartupServices {
  */
 export async function runMcpStartupServices(
   readinessProbe: boolean,
-  services: McpStartupServices
+  services: McpStartupServices,
+  options: { openCodeFirst?: boolean } = {},
 ): Promise<void> {
   if (readinessProbe) return;
-  const tasks = [
+  const tasks = options.openCodeFirst ? [
+    services.sessionStartHook,
+    services.auditHook,
+    services.openCode,
+    services.sseStream,
+  ] : [
     services.sessionStartHook,
     services.auditHook,
     services.sseStream,

package/src/stream-owner.ts

@@ -24,6 +24,9 @@ export interface StreamOwnerRecord {
   cwd: string;
   startedAt: string;
   heartbeatAt: string;
+  worktree?: string;
+  droneLabel?: string;
+  cubeName?: string;
 }
 
 export interface StreamOwnershipSnapshot {
@@ -33,6 +36,9 @@ export interface StreamOwnershipSnapshot {
   cwd?: string;
   startedAt?: string;
   heartbeatAt?: string;
+  worktree?: string;
+  droneLabel?: string;
+  cubeName?: string;
   ageMs?: number;
   lockPath?: string;
   /** Opened-directory identity used to bind inspection to later takeover. */
@@ -54,6 +60,9 @@ export interface StreamOwnerDeps {
   locksDir?: string;
   processNonce?: string;
   processStartedAt?: string;
+  worktree?: string;
+  droneLabel?: string;
+  cubeName?: string;
   isPidAlive?: (pid: number) => boolean;
   beforeTakeoverVerify?: (takeoverPath: string) => Promise<void>;
   beforeLeaseRefreshMutation?: (lockPath: string) => Promise<void>;
@@ -177,6 +186,9 @@ export async function readOwnershipSnapshot(
     cwd: parsed.cwd,
     startedAt: parsed.startedAt,
     heartbeatAt: parsed.heartbeatAt,
+    worktree: parsed.worktree,
+    droneLabel: parsed.droneLabel,
+    cubeName: parsed.cubeName,
     ageMs,
     lockPath,
     lockDev: lockStat.dev,
@@ -572,7 +584,10 @@ function sameOwner(left: StreamOwnerRecord, right: StreamOwnerRecord): boolean {
     left.processNonce === right.processNonce &&
     left.cwd === right.cwd &&
     left.startedAt === right.startedAt &&
-    left.heartbeatAt === right.heartbeatAt;
+    left.heartbeatAt === right.heartbeatAt &&
+    left.worktree === right.worktree &&
+    left.droneLabel === right.droneLabel &&
+    left.cubeName === right.cubeName;
 }
 
 async function readOwnershipRecord(lockPath: string): Promise<StreamOwnerRecord | null> {
@@ -655,6 +670,9 @@ function makeRecord(deps: StreamOwnerDeps): StreamOwnerRecord {
     cwd: deps.cwd ?? process.cwd(),
     startedAt: deps.processStartedAt ?? processStartedAt,
     heartbeatAt: now().toISOString(),
+    ...(deps.worktree ? { worktree: deps.worktree } : {}),
+    ...(deps.droneLabel ? { droneLabel: deps.droneLabel } : {}),
+    ...(deps.cubeName ? { cubeName: deps.cubeName } : {}),
   };
 }
 
@@ -668,7 +686,10 @@ function isRecord(value: any): value is StreamOwnerRecord {
     isSafeLeaseText(value.processNonce, 128) &&
     isSafeLeaseText(value.cwd, 4096) &&
     isIsoTimestamp(value.startedAt) &&
-    isIsoTimestamp(value.heartbeatAt)
+    isIsoTimestamp(value.heartbeatAt) &&
+    (value.worktree === undefined || isSafeLeaseText(value.worktree, 4096)) &&
+    (value.droneLabel === undefined || isSafeLeaseText(value.droneLabel, 256)) &&
+    (value.cubeName === undefined || isSafeLeaseText(value.cubeName, 256))
   );
 }