borgmcp 3.10.0 → 3.11.1

package/src/claude.ts

@@ -42,8 +42,12 @@ import { runSpawn } from './spawn.js';
 import { buildClaudeLaunchArgs } from './claude-launch-args.js';
 import { parseCleanupArgs, runCleanup } from './cleanup-cmd.js';
 import { parseAssimilateArgs } from './parse-assimilate-args.js';
+import { parseQuickstartArgs } from './parse-quickstart-args.js';
+import { parseCloneArgs, safeCloneParseError } from './parse-clone-args.js';
 import { runAssimilate } from './assimilate-cmd.js';
 import { buildDefaultAssimilateDeps } from './assimilate-deps.js';
+import { buildDefaultQuickstartDeps, runQuickstart } from './quickstart-cmd.js';
+import { buildDefaultCloneDeps, runClone } from './clone-cmd.js';
 import {
   parseResetLocalSeatArgs,
   runResetLocalSeat,
@@ -104,6 +108,12 @@ import { ensureCliMcpConfigured } from './ensure-mcp-config.js';
 import { configureResolvedCli } from './resolved-cli-config.js';
 import { installBorgPlugin } from './opencode-plugin.js';
 import { allocateOpenCodePort, connectOpenCodeDrone, createOpenCodeLaunchKickoff, injectInitialKickoff, openCodeLaunchBinding } from './opencode-drone.js';
+import {
+  BORG_OPENCODE_LAUNCH_CORRELATION_ENV,
+  OPENCODE_SERVER_PASSWORD_ENV,
+  OPENCODE_SERVER_USERNAME,
+  OPENCODE_SERVER_USERNAME_ENV,
+} from './opencode-launch-trust.js';
 import { buildOpenCodeLaunchArgs, defaultApprovalIo, resolveLaunchBorgApprovals } from './cli-tool-approval.js';
 import { isClientOwnedCubeInitArgv, runEarlyServerFacade } from './server-facade.js';
 import { runEarlyUpdate } from './update-cmd.js';
@@ -155,7 +165,13 @@ export function launchOpenCodeProcess(options: {
   process: ReturnType<typeof spawn>;
 } {
   const plan = createOpenCodeLaunchPlan(options.cwd, options.port, options.prompt, options.passthroughArgs);
-  const launchEnv = { ...options.env, BORG_OPENCODE_PORT: plan.envPort };
+  const launchEnv = {
+    ...options.env,
+    BORG_OPENCODE_PORT: plan.envPort,
+    [OPENCODE_SERVER_USERNAME_ENV]: OPENCODE_SERVER_USERNAME,
+    [OPENCODE_SERVER_PASSWORD_ENV]: options.kickoff.apiPassword,
+    [BORG_OPENCODE_LAUNCH_CORRELATION_ENV]: options.kickoff.correlationIdentity,
+  };
   // OpenCode's bind can still race this allocation; client#298 tracks the
   // residual pre-bind window outside this slice.
   const child = (options.spawnProcess ?? spawn)('opencode', plan.launchArgs, {
@@ -165,6 +181,7 @@ export function launchOpenCodeProcess(options: {
   });
   (options.connect ?? connectOpenCodeDrone)({
     serverUrl: plan.serverUrl,
+    apiPassword: options.kickoff.apiPassword,
     directory: options.cwd,
     droneLabel: options.droneLabel,
     cubeName: options.cubeName,
@@ -251,6 +268,24 @@ async function main() {
     const code = await runAssimilateEntry(process.argv.slice(3));
     process.exit(code);
   }
+  if (process.argv[2] === 'clone') {
+    const parsed = parseCloneArgs(process.argv.slice(3));
+    if (!parsed.ok) {
+      process.stderr.write(chalk.red(`${consolePrefix()}◼ borg clone: ${safeCloneParseError(parsed)}\n`));
+      process.stderr.write(`Run \`borg clone --help\` for usage.\n`);
+      process.exit(1);
+    }
+    process.exit(await runClone(parsed.args, buildDefaultCloneDeps()));
+  }
+  if (process.argv[2] === 'quickstart') {
+    const parsed = parseQuickstartArgs(process.argv.slice(3));
+    if (!parsed.ok) {
+      process.stderr.write(chalk.red(`${consolePrefix()}◼ borg quickstart: ${parsed.error}\n`));
+      process.stderr.write(`Run \`borg quickstart --help\` for usage.\n`);
+      process.exit(1);
+    }
+    process.exit(await runQuickstart(parsed.args, buildDefaultQuickstartDeps()));
+  }
   if (process.argv[2] === 'reset-local-connection') {
     const parsed = parseResetLocalSeatArgs(process.argv.slice(3));
     if (!parsed.ok) {
@@ -604,9 +639,8 @@ async function main() {
     monitorClause,
     codexWakePathClause,
   });
-  // This stays separate from the shared kickoff so Claude and Codex preserve
-  // their existing launch prompts. OpenCode records this nonce-bearing copy
-  // and later uses the nonce to bind its separately spawned MCP child.
+  // This stays separate from the shared kickoff so OpenCode can carry
+  // launch-only API and correlation identities outside argv and prompt text.
   let openCodeKickoff: ReturnType<typeof createOpenCodeLaunchKickoff> | null = null;
   let openCodePort: number | undefined;
   let launchArgs: string[];

package/src/cli-help.ts

@@ -51,6 +51,35 @@ export function launchAllHelpText(version: string): string {
   );
 }
 
+export function quickstartHelpText(version: string): string {
+  return (
+    `borg quickstart (borgmcp ${version}) — create, staff, and launch this repository's cube\n\n` +
+    `Usage:\n` +
+    `  borg quickstart [options]\n\n` +
+    `Options:\n` +
+    `  --template ${NEW_CUBE_TEMPLATE_OPTIONS}  Choose the new-cube template without prompting\n` +
+    `  --role <slug>[:<count>]            Fully specify the roster (repeatable)\n` +
+    `  --yes, -y                          Accept the displayed plan\n` +
+    `  --help, -h                         Show this help\n\n` +
+    `Quickstart requires a running Borg server and never starts one. Rerun the same\n` +
+    `command after a partial failure; existing drones are kept and skipped.\n`
+  );
+}
+
+export function cloneHelpText(version: string): string {
+  return (
+    `borg clone (borgmcp ${version}) — clone a repository and run quickstart\n\n` +
+    `Usage:\n` +
+    `  borg clone <repository-url> [directory] [--no-launch]\n\n` +
+    `Options:\n` +
+    `  --no-launch  Stop after the checkout is ready; do not create or launch a cube\n` +
+    `  --help, -h   Show this help\n\n` +
+    `A repeated command reuses a checkout only when its origin matches. Default\n` +
+    `destination names avoid non-repository collisions. Credential-bearing URLs are\n` +
+    `refused; use a Git credential helper or SSH configuration instead.\n`
+  );
+}
+
 export function seatsHelpText(version: string): string {
   return (
     `borg drones (borgmcp ${version}) — list this machine's registered drones\n\n` +
@@ -91,7 +120,9 @@ export function clientSubcommandHelpText(
   if (!args.some(isHelpFlag)) return null;
   switch (command) {
     case 'setup': return setupHelpText(version);
+    case 'clone': return cloneHelpText(version);
     case 'assimilate': return assimilateHelpText(version);
+    case 'quickstart': return quickstartHelpText(version);
     case 'reset-local-connection': return resetLocalSeatHelpText(version);
     case 'recover-enrollment': return recoverEnrollmentHelpText(version);
     case 'cleanup': return cleanupHelpText(version);
@@ -107,7 +138,7 @@ export function setupNextStepsText(): string {
   return (
     `◼ Next steps:\n` +
     `1. Run \`borg server start\` and leave that terminal open.\n` +
-    `2. In a second terminal, cd into your project's Git repository and run \`borg assimilate\`.\n`
+    `2. In a second terminal, cd into your project's Git repository and run \`borg quickstart\`.\n`
   );
 }
 
@@ -129,6 +160,8 @@ export function topLevelHelpText(version: string): string {
     `  borg setup               Set up borg MCP server + agent CLI integration\n` +
     `  borg update              Update the client and installed local server together\n` +
     `  borg doctor              Check agent hook commands, versions, configs, and the OpenCode plugin\n` +
+    `  borg clone <url> [dir]   Clone a repository, then create and launch its cube\n` +
+    `  borg quickstart          Create a cube and a drone for every role, then launch them\n` +
     `  borg assimilate [role]   Join or create a cube\n` +
     `  borg assimilate --host <host>   Join or create on an explicit server\n` +
     `  borg assimilate --worktree <name>   Spawn a worktree drone (in ~/.borg/worktrees/<repo>/<name>)\n` +

package/src/clone-cmd.ts

@@ -0,0 +1,243 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { hasCloneCredentials, redactCloneSecrets } from './clone-security.js';
+import type { CloneArgs } from './parse-clone-args.js';
+import { buildDefaultQuickstartDeps, runQuickstart } from './quickstart-cmd.js';
+import { shellEscape } from './shell-escape.js';
+
+export interface GitRunResult {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+}
+
+export interface CloneDeps {
+  cwd: () => string;
+  chdir: (path: string) => void;
+  runSync: (cmd: string, args: string[], cwd?: string) => GitRunResult;
+  pathExists: (path: string) => boolean;
+  isDirectory: (path: string) => boolean;
+  readDirectory: (path: string) => string[];
+  createDirectory: (path: string) => boolean;
+  removeTree: (path: string) => void;
+  quickstart: (cwd: string) => Promise<number>;
+  stdout: (text: string) => void;
+  stderr: (text: string) => void;
+}
+
+const CONTROL_RE = /[\u0000-\u001f\u007f]/;
+const ALLOWED_SCHEMES = new Set(['file:', 'git:', 'git+ssh:', 'http:', 'https:', 'ssh:']);
+const SCP_REMOTE_RE = /^[^@\s/:]+@[^:\s]+:[^\s]+$/;
+
+function defaultRunSync(cmd: string, args: string[], cwd?: string): GitRunResult {
+  const result = spawnSync(cmd, args, { cwd, encoding: 'utf8' });
+  return {
+    status: result.status,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? (result.error instanceof Error ? result.error.message : ''),
+  };
+}
+
+export function buildDefaultCloneDeps(): CloneDeps {
+  return {
+    cwd: () => process.cwd(),
+    chdir: (path) => process.chdir(path),
+    runSync: defaultRunSync,
+    pathExists: existsSync,
+    isDirectory: (path) => {
+      try { return statSync(path).isDirectory(); } catch { return false; }
+    },
+    readDirectory: (path) => readdirSync(path),
+    createDirectory: (path) => {
+      mkdirSync(dirname(path), { recursive: true });
+      try {
+        mkdirSync(path);
+        return true;
+      } catch (error) {
+        if (error instanceof Error && 'code' in error && error.code === 'EEXIST') return false;
+        throw error;
+      }
+    },
+    removeTree: (path) => rmSync(path, { recursive: true, force: true }),
+    quickstart: async (cwd) => {
+      process.chdir(cwd);
+      return runQuickstart({ roles: [], yes: false }, buildDefaultQuickstartDeps());
+    },
+    stdout: (text) => process.stdout.write(text),
+    stderr: (text) => process.stderr.write(text),
+  };
+}
+
+export function validateCloneRepositoryUrl(value: string): { ok: true } | { ok: false; error: string } {
+  if (!value || value.trim() !== value || /\s/.test(value) || CONTROL_RE.test(value)) {
+    return { ok: false, error: 'repository URL contains whitespace or control characters' };
+  }
+  if (value.startsWith('-')) return { ok: false, error: 'repository URL must not start with a hyphen' };
+  if (hasCloneCredentials(value)) {
+    return { ok: false, error: 'credential-bearing repository URLs are not accepted; use a credential helper or SSH configuration instead' };
+  }
+  if (SCP_REMOTE_RE.test(value)) return { ok: true };
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(value)?.[1];
+  if (!scheme) return { ok: true }; // Local path.
+  if (!value.toLowerCase().startsWith(`${scheme.toLowerCase()}://`) && scheme.toLowerCase() !== 'file') {
+    return { ok: false, error: 'repository URL is not a supported hierarchical URL' };
+  }
+  try {
+    const parsed = new URL(value);
+    if (!ALLOWED_SCHEMES.has(parsed.protocol)) return { ok: false, error: `unsupported repository URL scheme ${parsed.protocol}` };
+    if (parsed.search || parsed.hash) return { ok: false, error: 'repository URLs with query strings or fragments are not accepted' };
+    if (parsed.protocol !== 'file:' && !parsed.hostname) return { ok: false, error: 'repository URL must include a host' };
+    if (!parsed.pathname || parsed.pathname === '/') return { ok: false, error: 'repository URL must include a repository path' };
+    return { ok: true };
+  } catch {
+    return { ok: false, error: 'repository URL is not valid' };
+  }
+}
+
+function sourceName(value: string): string {
+  let leaf = value;
+  try {
+    const parsed = new URL(value);
+    leaf = parsed.protocol === 'file:' ? fileURLToPath(parsed) : parsed.pathname;
+  } catch {
+    if (SCP_REMOTE_RE.test(value)) leaf = value.slice(value.indexOf(':') + 1);
+  }
+  const name = basename(leaf.replace(/\/+$/, '')).replace(/\.git$/i, '')
+    .replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+  return name || 'repository';
+}
+
+function remoteKey(value: string, base: string): string {
+  if (SCP_REMOTE_RE.test(value)) {
+    const colon = value.indexOf(':');
+    const login = value.slice(0, colon);
+    const at = login.lastIndexOf('@');
+    const user = login.slice(0, at);
+    const host = login.slice(at + 1).toLowerCase();
+    return `ssh://${user}@${host}/${value.slice(colon + 1).replace(/\/+$/, '').replace(/\.git$/i, '')}`;
+  }
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol === 'file:') return `file:${resolve(fileURLToPath(parsed))}`;
+    const user = parsed.username ? `${parsed.username}@` : '';
+    const port = parsed.port ? `:${parsed.port}` : '';
+    return `${parsed.protocol}//${user}${parsed.hostname.toLowerCase()}${port}${parsed.pathname.replace(/\/+$/, '').replace(/\.git$/i, '')}`;
+  } catch {
+    return `file:${resolve(base, value)}`;
+  }
+}
+
+function readOrigin(deps: CloneDeps, directory: string): string | null {
+  const result = deps.runSync('git', ['remote', 'get-url', 'origin'], directory);
+  return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : null;
+}
+
+function repositoryAt(deps: CloneDeps, directory: string): boolean {
+  return deps.runSync('git', ['rev-parse', '--is-inside-work-tree'], directory).status === 0;
+}
+
+function validateDestination(value: string): string | null {
+  if (!value || value.trim() !== value || CONTROL_RE.test(value) || value.startsWith('-') || hasCloneCredentials(value)) {
+    return 'destination contains an unsafe path value';
+  }
+  return null;
+}
+
+function chooseDestination(deps: CloneDeps, args: CloneArgs): { path: string } | { error: string } {
+  const base = deps.cwd();
+  if (args.destination !== undefined) {
+    const error = validateDestination(args.destination);
+    return error ? { error } : { path: resolve(base, args.destination) };
+  }
+  const name = sourceName(args.repositoryUrl);
+  for (let n = 1; n < 10_000; n += 1) {
+    const candidate = resolve(base, n === 1 ? name : `${name}-${n}`);
+    if (!deps.pathExists(candidate)) return { path: candidate };
+    if (deps.isDirectory(candidate) && repositoryAt(deps, candidate)) {
+      const origin = readOrigin(deps, candidate);
+      if (origin && !hasCloneCredentials(origin) && remoteKey(origin, candidate) === remoteKey(args.repositoryUrl, base)) {
+        return { path: candidate };
+      }
+      if (n === 1) return { error: `existing checkout at ${candidate} points at another remote; choose an explicit destination` };
+    }
+  }
+  return { error: `could not find a collision-safe destination for ${name}` };
+}
+
+export async function runClone(args: CloneArgs, rawDeps: CloneDeps): Promise<number> {
+  const deps: CloneDeps = {
+    ...rawDeps,
+    stdout: (text) => rawDeps.stdout(redactCloneSecrets(text)),
+    stderr: (text) => rawDeps.stderr(redactCloneSecrets(text)),
+  };
+  const valid = validateCloneRepositoryUrl(args.repositoryUrl);
+  if (!valid.ok) {
+    deps.stderr(`borg clone: ${valid.error}.\n`);
+    return 1;
+  }
+  const selected = chooseDestination(deps, args);
+  if ('error' in selected) {
+    deps.stderr(`borg clone: ${selected.error}.\n`);
+    return 1;
+  }
+  const destination = selected.path;
+  let cloned = false;
+  const destinationExisted = deps.pathExists(destination);
+  const emptyDestination = destinationExisted && deps.isDirectory(destination) && deps.readDirectory(destination).length === 0;
+  if (destinationExisted && !emptyDestination) {
+    if (!deps.isDirectory(destination) || !repositoryAt(deps, destination)) {
+      deps.stderr(`borg clone: destination ${destination} exists and is not a Git checkout; it was left untouched.\n`);
+      return 1;
+    }
+    const origin = readOrigin(deps, destination);
+    if (!origin || hasCloneCredentials(origin)) {
+      deps.stderr(`borg clone: the existing checkout has no safe, readable origin remote; it was left untouched.\n`);
+      return 1;
+    }
+    if (remoteKey(origin, destination) !== remoteKey(args.repositoryUrl, deps.cwd())) {
+      deps.stderr(`borg clone: remote mismatch at ${destination}; existing ${origin}, requested ${args.repositoryUrl}. The checkout was left untouched.\n`);
+      return 1;
+    }
+    deps.stdout(`Reusing existing checkout at ${destination}; its origin remote matches.\n`);
+  } else {
+    const createdDestination = destinationExisted ? false : deps.createDirectory(destination);
+    if (!destinationExisted && !createdDestination) {
+      deps.stderr(`borg clone: destination ${destination} appeared while preparing the clone; it was left untouched. Retry with another directory.\n`);
+      return 1;
+    }
+    const result = deps.runSync('git', ['clone', '--', args.repositoryUrl, destination], deps.cwd());
+    if (result.status !== 0) {
+      if (createdDestination && deps.pathExists(destination)) {
+        deps.removeTree(destination);
+      }
+      deps.stderr(
+        `borg clone: clone failed${result.stderr.trim() ? `: ${result.stderr.trim()}` : ''}.\n` +
+        `Rollback: ${destinationExisted
+          ? `the pre-existing empty destination ${destination} was preserved; inspect it for partial Git files`
+          : deps.pathExists(destination) ? `partial checkout remains at ${destination}` : `the directory borg created at ${destination} was removed`}.\n`,
+      );
+      return 1;
+    }
+    cloned = true;
+    deps.stdout(`Cloned ${sourceName(args.repositoryUrl)} into ${destination}.\n`);
+  }
+
+  if (args.noLaunch) {
+    deps.stdout(
+      `Checkout ready at ${destination}. No cube or drone was created.\n` +
+      `Next: cd ${shellEscape(destination)} && borg quickstart\n`,
+    );
+    return 0;
+  }
+  deps.chdir(destination);
+  const code = await deps.quickstart(destination);
+  if (code !== 0) {
+    deps.stderr(
+      `The checkout${cloned ? '' : ' you already had'} is ready at ${destination}, but quickstart did not finish. ` +
+      `It was left untouched; cd there and run \`borg quickstart\` again.\n`,
+    );
+  }
+  return code;
+}

package/src/clone-security.ts

@@ -0,0 +1,40 @@
+/** Redaction and fail-closed credential detection for untrusted Git remotes. */
+
+const URL_USERINFO_RE = /([a-z][a-z0-9+.-]*:\/\/)([^/\s@]+)@/gi;
+const URL_SUFFIX_RE = /([a-z][a-z0-9+.-]*:\/\/[^\s?#)]+)([?#])[^\s)]*/gi;
+const NAMED_SECRET_RE = /([?&](?:access[_-]?token|api[_-]?key|auth(?:entication)?|credential|password|passwd|private[_-]?key|secret|token)=)[^&#\s)]+/gi;
+const NAMED_SECRET_TEST_RE = new RegExp(NAMED_SECRET_RE.source, 'i');
+const OPTION_SECRET_RE = /((?:^|[\s("'`])--(?:access[_-]?token|api[_-]?key|auth(?:entication)?|credential|password|passwd|private[_-]?key|secret|token)=)[^\s)]*/gi;
+const SCP_REMOTE_RE = /^[^@\s/:]+@[^:\s]+:[^\s]+$/;
+
+export function redactCloneSecrets(value: string): string {
+  return value
+    .replace(URL_USERINFO_RE, '$1<credentials>@')
+    .replace(URL_SUFFIX_RE, '$1$2<redacted>')
+    .replace(NAMED_SECRET_RE, '$1<redacted>')
+    .replace(OPTION_SECRET_RE, '$1<redacted>')
+    .replace(/(^|[\s("'`])[^/\s:@]+:[^@\s/]+@(?=[^\s/])/g, '$1<credentials>@');
+}
+
+/**
+ * True means the value must never reach subprocess argv, output, or Git config.
+ * Opaque `scheme:...@...` forms fail closed; URL() accepts those but exposes no
+ * username/password fields, which is precisely the class that escaped the old flow.
+ */
+export function hasCloneCredentials(value: string): boolean {
+  if (NAMED_SECRET_TEST_RE.test(value)) return true;
+  if (SCP_REMOTE_RE.test(value)) return false;
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(value)?.[1].toLowerCase();
+  if (scheme && !value.toLowerCase().startsWith(`${scheme}://`) && scheme !== 'file') {
+    return value.includes('@');
+  }
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol === 'ssh:' || parsed.protocol === 'git+ssh:') {
+      return parsed.password.length > 0;
+    }
+    return parsed.username.length > 0 || parsed.password.length > 0;
+  } catch {
+    return /[^/\s:@]+:[^@\s/]+@/.test(value);
+  }
+}

package/src/config-utils.ts

@@ -24,6 +24,10 @@ import { shellEscape } from './shell-escape.js';
 import { BORG_STATE_ROOT_ENV, borgAgentConfigEnv, borgHomeRoot } from './private-root.js';
 import type { LaunchAccessPaths } from './launch-access.js';
 import { BORG_LAUNCH_EXPECTED_SEAT_ENV } from './cubes.js';
+import {
+  OPENCODE_SERVER_PASSWORD_ENV,
+  OPENCODE_SERVER_PASSWORD_REFERENCE,
+} from './opencode-launch-trust.js';
 
 // Get __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
@@ -53,6 +57,7 @@ const CLAUDE_CONFIG_PATH = path.join(CONFIG_HOME, '.claude.json');
 const CODEX_CONFIG_PATH = path.join(CONFIG_HOME, '.codex', 'config.toml');
 const CODEX_HOOKS_PATH = path.join(CONFIG_HOME, '.codex', 'hooks.json');
 const OPENCODE_CONFIG_PATH = path.join(CONFIG_HOME, '.config', 'opencode', 'opencode.json');
+const OPENCODE_GLOBAL_CONFIG_FILENAMES = ['config.json', 'opencode.json', 'opencode.jsonc'] as const;
 const MCP_SERVER_NAME = 'borg';
 
 function settingsPath(): string {
@@ -80,6 +85,125 @@ function readJsonFile(p: string): any {
   return JSON.parse(text);
 }
 
+function parseJsonc(text: string): unknown {
+  let stripped = '';
+  let inString = false;
+  let escaped = false;
+  let lineComment = false;
+  let blockComment = false;
+
+  for (let index = 0; index < text.length; index++) {
+    const char = text[index];
+    const next = text[index + 1];
+    if (lineComment) {
+      if (char === '\n' || char === '\r') {
+        lineComment = false;
+        stripped += char;
+      } else {
+        stripped += ' ';
+      }
+      continue;
+    }
+    if (blockComment) {
+      if (char === '*' && next === '/') {
+        stripped += '  ';
+        index++;
+        blockComment = false;
+      } else {
+        stripped += char === '\n' || char === '\r' ? char : ' ';
+      }
+      continue;
+    }
+    if (inString) {
+      stripped += char;
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      stripped += char;
+      continue;
+    }
+    if (char === '/' && next === '/') {
+      stripped += '  ';
+      index++;
+      lineComment = true;
+      continue;
+    }
+    if (char === '/' && next === '*') {
+      stripped += '  ';
+      index++;
+      blockComment = true;
+      continue;
+    }
+    stripped += char;
+  }
+
+  if (inString || blockComment) throw new SyntaxError('unterminated JSONC token');
+
+  let withoutTrailingCommas = '';
+  inString = false;
+  escaped = false;
+  for (let index = 0; index < stripped.length; index++) {
+    const char = stripped[index];
+    if (inString) {
+      withoutTrailingCommas += char;
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      withoutTrailingCommas += char;
+      continue;
+    }
+    if (char === ',') {
+      let lookahead = index + 1;
+      while (/\s/.test(stripped[lookahead] ?? '')) lookahead++;
+      if (stripped[lookahead] === '}' || stripped[lookahead] === ']') continue;
+    }
+    withoutTrailingCommas += char;
+  }
+
+  return JSON.parse(withoutTrailingCommas.replace(/^\uFEFF/, ''));
+}
+
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function mergeOpenCodeConfigValue(target: unknown, source: unknown): unknown {
+  if (!isPlainRecord(target) || !isPlainRecord(source)) return source;
+  const merged = Object.assign(Object.create(null) as Record<string, unknown>, target);
+  for (const [key, value] of Object.entries(source)) {
+    merged[key] = key in merged ? mergeOpenCodeConfigValue(merged[key], value) : value;
+  }
+  return merged;
+}
+
+function readOpenCodeGlobalConfig(configPath: string): Record<string, unknown> {
+  const basename = path.basename(configPath);
+  const paths = OPENCODE_GLOBAL_CONFIG_FILENAMES.includes(
+    basename as typeof OPENCODE_GLOBAL_CONFIG_FILENAMES[number],
+  )
+    ? OPENCODE_GLOBAL_CONFIG_FILENAMES.map((filename) => path.join(path.dirname(configPath), filename))
+    : [configPath];
+  let merged: unknown = {};
+  for (const candidate of paths) {
+    if (!fs.existsSync(candidate)) continue;
+    const text = fs.readFileSync(candidate, 'utf-8');
+    if (text.length === 0) continue;
+    const parsed = parseJsonc(text);
+    if (!isPlainRecord(parsed)) throw new TypeError(`OpenCode config is not an object: ${candidate}`);
+    merged = mergeOpenCodeConfigValue(merged, parsed);
+  }
+  if (!isPlainRecord(merged)) throw new TypeError('OpenCode global config is not an object');
+  return merged;
+}
+
 function writeJsonFile(p: string, data: any): void {
   fs.mkdirSync(path.dirname(p), { recursive: true });
   fs.writeFileSync(p, JSON.stringify(data, null, 2) + '\n', 'utf-8');
@@ -1162,22 +1286,18 @@ export function isCodexUserPromptSubmitHookRegistered(hooksPath: string = CODEX_
 // ─── OpenCode MCP integration ────────────────────────────────────────────
 
 /**
- * Detect whether the borg MCP server is already registered in the opencode
- * config (`~/.config/opencode/opencode.json` `mcp.borg`).
+ * Detect whether the borg MCP server is registered in OpenCode's effective
+ * global config. OpenCode 1.18.15 loads `config.json`, `opencode.json`, then
+ * `opencode.jsonc`, merging later files over earlier ones.
  *
- * Reads the config as JSON and checks for a `mcp.borg` entry with
+ * Reads JSON or JSONC and checks the effective `mcp.borg` entry for
  * `type: "local"`. Safe-default: any read error returns `false`.
  */
 export function isOpenCodeMcpServerConfigured(
   configPath: string = path.join(borgHomeRoot(), '.config', 'opencode', 'opencode.json')
 ): boolean {
   try {
-    if (!fs.existsSync(configPath)) return false;
-    const text = fs.readFileSync(configPath, 'utf-8');
-    if (!text.trim()) return false;
-    const parsed = JSON.parse(text);
-    if (!parsed || typeof parsed !== 'object') return false;
-    const borgServer = (parsed as any).mcp?.borg;
+    const borgServer = (readOpenCodeGlobalConfig(configPath) as any).mcp?.borg;
     if (!borgServer || typeof borgServer !== 'object') return false;
     return borgServer.type === 'local';
   } catch {
@@ -1186,22 +1306,24 @@ export function isOpenCodeMcpServerConfigured(
 }
 
 /**
- * Launch-time OpenCode registration check. Ordinary launches retain the
- * existing configured/not-configured behavior. A targeted `borg launch`,
- * identified by its non-empty expected-seat marker, additionally requires the
- * config substitution that carries that marker into OpenCode's MCP child.
+ * Launch-time OpenCode registration check. Every launch requires the exact
+ * password substitution that carries its ephemeral credential into OpenCode's
+ * MCP child. A targeted `borg launch`, identified by its non-empty expected-seat
+ * marker, additionally requires the substitution that carries that marker.
  */
 export function isOpenCodeMcpServerConfiguredForLaunch(
   configPath: string = path.join(borgHomeRoot(), '.config', 'opencode', 'opencode.json'),
   env: NodeJS.ProcessEnv = process.env,
 ): boolean {
   if (!isOpenCodeMcpServerConfigured(configPath)) return false;
-  if (!env[BORG_LAUNCH_EXPECTED_SEAT_ENV]) return true;
   try {
-    const borgServer = readJsonFile(configPath)?.mcp?.borg;
+    const borgServer = (readOpenCodeGlobalConfig(configPath) as any).mcp?.borg;
     const environment = borgServer?.environment ?? borgServer?.env;
-    return environment?.[BORG_LAUNCH_EXPECTED_SEAT_ENV] ===
-      OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE;
+    if (environment?.[OPENCODE_SERVER_PASSWORD_ENV] !== OPENCODE_SERVER_PASSWORD_REFERENCE) {
+      return false;
+    }
+    if (!env[BORG_LAUNCH_EXPECTED_SEAT_ENV]) return true;
+    return environment?.[BORG_LAUNCH_EXPECTED_SEAT_ENV] === OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE;
   } catch {
     return false;
   }
@@ -1278,11 +1400,11 @@ export function addOpenCodeLaunchAccess(
 
 /**
  * Add borg MCP server to OpenCode using `opencode mcp add` CLI.
- * Pins activation and agent-kind signals plus an OpenCode config substitution
- * for the launch-scoped expected seat. OpenCode resolves `{env:NAME}` from its
- * own launch environment before starting the MCP child, so `borg launch`
- * reaches the identity check without persisting one launch's value. Existing
- * configs with BORG_OPENCODE remain supported by the runtime fallback.
+ * Pins activation and agent-kind signals plus OpenCode config substitutions
+ * for the launch-scoped password and expected seat. OpenCode resolves
+ * `{env:NAME}` from its own launch environment before starting the MCP child,
+ * so no launch credential is persisted. Existing configs with BORG_OPENCODE
+ * remain supported by the runtime fallback after launch-time self-healing.
  */
 export function addOpenCodeMcpServer(): void {
   try {
@@ -1295,8 +1417,10 @@ export function addOpenCodeMcpServer(): void {
       : '';
     const launchExpectedSeatEnvArg =
       ` --env ${BORG_LAUNCH_EXPECTED_SEAT_ENV}=${shellQuote(OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE)}`;
+    const apiPasswordEnvArg =
+      ` --env ${OPENCODE_SERVER_PASSWORD_ENV}=${shellQuote(OPENCODE_SERVER_PASSWORD_REFERENCE)}`;
     execSync(
-      `opencode mcp add borg --env BORG_SESSION=1 --env BORG_AGENT_KIND=opencode --env BORG_OPENCODE=1${apiUrlEnvArg}${stateRootEnvArg}${launchExpectedSeatEnvArg} -- ${shellQuote(MCP_COMMAND)}`,
+      `opencode mcp add borg --env BORG_SESSION=1 --env BORG_AGENT_KIND=opencode --env BORG_OPENCODE=1${apiUrlEnvArg}${stateRootEnvArg}${launchExpectedSeatEnvArg}${apiPasswordEnvArg} -- ${shellQuote(MCP_COMMAND)}`,
       { stdio: 'inherit', env: borgAgentConfigEnv(process.env) }
     );
   } catch (error: any) {