borgmcp 3.3.0 → 3.5.0

package/src/claude.ts

@@ -22,7 +22,18 @@ import { basename } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
 import chalk from 'chalk';
-import { findProjectRoot, getActiveCube, inboxPathForDrone, setCodexWakeTarget, pruneDeadCodexWakeTargets, type BorgCli } from './cubes.js';
+import {
+  BORG_LAUNCH_EXPECTED_SEAT_ENV,
+  codexLaunchSeatExpectationConfigArgs,
+  findProjectRoot,
+  getActiveCube,
+  inboxPathForDrone,
+  LaunchSeatIdentityChangedError,
+  setCodexWakeTarget,
+  pruneDeadCodexWakeTargets,
+  type ActiveCube,
+  type BorgCli,
+} from './cubes.js';
 import { monitorStateRootForWorktree } from './inbox-monitor.js';
 import { formatSeatReattachRefusal, inspectLiveInboxMonitor } from './seat-reattach-guard.js';
 import { handleVersionFlag, getPackageVersion } from './version.js';
@@ -43,9 +54,17 @@ import { unknownSubcommand } from './unknown-subcommand.js';
 import { parseRecoverEnrollmentArgs, runRecoverEnrollment } from './recover-enrollment-cmd.js';
 import { runLaunchAll } from './launch-all-cmd.js';
 import { buildDefaultLaunchAllDeps } from './launch-all-deps.js';
+import {
+  buildDefaultSeatCommandDeps,
+  parseLaunchSeatArgs,
+  parseSeatsArgs,
+  runLaunchSeat,
+  runSeats,
+} from './seat-commands.js';
 import { discoverDroneCandidates } from './launch-all-discovery.js';
 import {
   configureSelectedLaunchCli,
+  discoverLiveLaunchMenuCandidates,
   explicitCliLaunchHint,
   runBareLaunchMenu,
   shouldResolveExplicitCliLaunchHintTargets,
@@ -90,6 +109,19 @@ import { runDoctor, warnIfAgentIntegrationUnhealthy } from './agent-integration-
 
 export type AssimilateDepsBuilder = typeof buildDefaultAssimilateDeps;
 
+export class OpenCodeTargetedLaunchConfigError extends Error {
+  readonly code = 'OPENCODE_TARGETED_LAUNCH_CONFIG';
+
+  constructor(droneLabel: string, worktree: string) {
+    super(
+      `borg launch: did not launch '${droneLabel}' — borg could not update or verify the OpenCode configuration ` +
+      'that a targeted launch needs to open the correct drone. Check that the OpenCode configuration file is ' +
+      `writable, then try again. As a fallback, run \`borg\` in ${worktree} to resume that worktree's drone directly.`,
+    );
+    this.name = 'OpenCodeTargetedLaunchConfigError';
+  }
+}
+
 export function createOpenCodeLaunchPlan(
   cwd: string,
   port: number,
@@ -267,6 +299,27 @@ async function main() {
     const code = await runCleanup({}, parsed.options);
     process.exit(code);
   }
+  if (process.argv[2] === 'seats') {
+    const parsed = parseSeatsArgs(process.argv.slice(3));
+    if (!parsed.ok) {
+      process.stderr.write(chalk.red(`${consolePrefix()}◼ borg seats: ${parsed.error}\n`));
+      process.stderr.write(`Run \`borg seats --help\` for usage.\n`);
+      process.exit(1);
+    }
+    process.exit(await runSeats(buildDefaultSeatCommandDeps()));
+  }
+  if (process.argv[2] === 'launch') {
+    const parsed = parseLaunchSeatArgs(process.argv.slice(3));
+    if (!parsed.ok) {
+      process.stderr.write(chalk.red(`${consolePrefix()}◼ borg launch: ${parsed.error}\n`));
+      process.stderr.write(`Run \`borg launch --help\` for usage.\n`);
+      process.exit(1);
+    }
+    process.exit(await runLaunchSeat(
+      { target: parsed.target, ...(parsed.cube ? { cube: parsed.cube } : {}) },
+      buildDefaultSeatCommandDeps(),
+    ));
+  }
   if (process.argv[2] === 'launch-all') {
     const parsed = parseLaunchAllArgs(process.argv.slice(3));
     if (!parsed.ok) {
@@ -359,19 +412,59 @@ async function main() {
       extraArgs: process.argv.slice(2),
       stdinIsTTY,
       stdoutIsTTY,
+      hasActiveSeat: active !== null,
     })
   ) {
+    const launchAllDeps = buildDefaultLaunchAllDeps();
+    const seatCommandDeps = buildDefaultSeatCommandDeps();
+    const siblingContext = await discoverLiveLaunchMenuCandidates({
+      readAllProjectIdentities: launchAllDeps.readAllProjectIdentities,
+      discoverDroneCandidates: (cubeId) => discoverDroneCandidates(
+        { targetCubeId: cubeId },
+        { ...launchAllDeps, stderr: () => {} },
+      ),
+      getActiveSeatForWorktree: seatCommandDeps.getActiveSeatForWorktree,
+      pathExists: launchAllDeps.pathExists,
+      probeSeat: (candidate) => launchAllDeps.probeSeat(
+        candidate.sessionToken,
+        candidate.apiUrl,
+        candidate.serverTrustIdentity,
+      ),
+    });
     const otherConfiguredClis = configuredCliNames(
       detectCliAvailability(),
       detectCliConfiguration(),
     ).filter((c) => c !== cli);
     const action = await runBareLaunchMenu(
-      { defaultCli: cli, otherConfiguredClis, hasLaunchAllTargets: await hasLaunchAllTargets() },
+      {
+        defaultCli: cli,
+        otherConfiguredClis,
+        hasLaunchAllTargets: siblingContext.launchAllCubeId !== undefined,
+        droneCandidates: siblingContext.candidates,
+        ...(siblingContext.launchAllCubeId
+          ? { launchAllCubeId: siblingContext.launchAllCubeId }
+          : {}),
+      },
       prompt
     );
+    if (action.kind === 'launch-seat') {
+      process.exit(await runLaunchSeat(
+        { target: action.target },
+        buildDefaultSeatCommandDeps(),
+      ));
+    }
     if (action.kind === 'launch-all') {
-      const parsed = parseLaunchAllArgs([]); // empty args → active cube, auto backend
-      const code = parsed.ok ? await runLaunchAll(parsed.args, buildDefaultLaunchAllDeps()) : 1;
+      const deps = buildDefaultLaunchAllDeps();
+      const selectedIdentity = action.cubeId
+        ? (await deps.readAllProjectIdentities()).find(({ cube }) => cube.cubeId === action.cubeId)
+        : undefined;
+      const parsed = parseLaunchAllArgs([]);
+      const code = parsed.ok
+        ? await runLaunchAll(
+          parsed.args,
+          selectedIdentity ? { ...deps, getActiveCube: async () => selectedIdentity.cube } : deps,
+        )
+        : 1;
       process.exit(code);
     }
     // option 1 → configured default; option 2 → the other agent, ONE-SHOT
@@ -382,7 +475,11 @@ async function main() {
 
   // Configure only the CLI that will actually launch. This must follow the
   // one-shot menu: the resolved default can differ from the menu selection.
-  cli = configureSelectedLaunchCli(cli, launchAction, ensureResolvedCliConfigured);
+  cli = configureSelectedLaunchCli(
+    cli,
+    launchAction,
+    (selectedCli) => ensureResolvedCliConfigured(selectedCli, active),
+  );
 
   if (active && !parsedCli.force) {
     const inboxPath = inboxPathForDrone(active.cubeId, active.droneId);
@@ -531,6 +628,7 @@ async function main() {
       ...codexAgentKindConfigArgs(),
       ...codexRemoteWakeConfigArgs(codexSocketPath !== null),
       ...codexStateRootConfigArgs(),
+      ...codexLaunchSeatExpectationConfigArgs(),
       ...remoteArgs,
       ...withCodexCwdArg([...passthroughArgs, kickoff], process.cwd()),
     ];
@@ -614,11 +712,25 @@ async function main() {
   });
 }
 
-function ensureResolvedCliConfigured(cli: BorgCli): void {
+export function ensureResolvedCliConfigured(cli: BorgCli, active: ActiveCube | null = null): void {
   const label = cli === 'claude' ? 'Claude Code' : cli === 'codex' ? 'Codex' : 'OpenCode';
+  const targetedOpenCodeLaunch = cli === 'opencode' &&
+    Boolean(process.env[BORG_LAUNCH_EXPECTED_SEAT_ENV]);
   try {
     configureResolvedCli(cli, {
-      ensureMcp: ensureCliMcpConfigured,
+      ensureMcp: (selectedCli) => {
+        try {
+          ensureCliMcpConfigured(selectedCli);
+        } catch (error) {
+          if (targetedOpenCodeLaunch && selectedCli === 'opencode') {
+            throw new OpenCodeTargetedLaunchConfigError(
+              active?.droneLabel ?? '<unknown>',
+              active?.worktree ?? process.cwd(),
+            );
+          }
+          throw error;
+        }
+      },
       addClaudeProjectSessionStartHook: () => {
         // gh#673 P2 (WI-1): the orientation hook lives PROJECT-LOCAL in
         // <root>/.claude/settings.local.json — ensured on every bare
@@ -630,8 +742,10 @@ function ensureResolvedCliConfigured(cli: BorgCli): void {
       addClaudeUserPromptSubmitHook: addUserPromptSubmitHook,
       addCodexSessionStartHook,
       addCodexUserPromptSubmitHook,
+      installOpenCodePlugin: installBorgPlugin,
     });
   } catch (err: any) {
+    if (err instanceof OpenCodeTargetedLaunchConfigError) throw err;
     console.error(`${consolePrefix()}${chalk.yellow(`warning: ${label} integration check failed: ${err?.message ?? err}`)}`);
   }
   try {
@@ -655,6 +769,13 @@ function isEntryInvocation(): boolean {
 
 if (isEntryInvocation()) {
   main().catch((error) => {
+    if (
+      error instanceof LaunchSeatIdentityChangedError ||
+      error instanceof OpenCodeTargetedLaunchConfigError
+    ) {
+      process.stderr.write(`${error.message}\n`);
+      process.exit(1);
+    }
     console.error(`${consolePrefix()}${chalk.red(`\n◼ Error: ${error.message}\n`)}`);
     process.exit(1);
   });

package/src/cli-help.ts

@@ -32,7 +32,7 @@ export function launchAllHelpText(version: string): string {
     `Usage:\n` +
     `  borg launch-all [cube] [options]\n\n` +
     `Options:\n` +
-    `  --mode <tmux|windows|pastelist>       Select the launch backend\n` +
+    `  --mode <tmux|terminals|pastelist>     Select the launch backend\n` +
     `  --only <name>                         Launch one role or drone label\n` +
     `  --dry-run                             Show what would launch\n` +
     `  --cli <claude|codex|opencode>         Select the agent CLI\n` +
@@ -40,7 +40,38 @@ export function launchAllHelpText(version: string): string {
     `  --yes, -y                             Skip the large-fleet confirmation\n` +
     `  --force                               Override live-session skips\n` +
     `  --launch-delay <ms>                   Wait between launches\n` +
-    `  --help, -h                            Show this help\n`
+    `  --help, -h                            Show this help\n\n` +
+    `Modes:\n` +
+    `  terminals  Open each drone in its own terminal tab, with the drone's name as\n` +
+    `             the tab title. Default on macOS when iTerm2 or Terminal.app is\n` +
+    `             installed. Terminal.app opens one named window for each drone\n` +
+    `             instead; tabs would need macOS automation permissions, which borg\n` +
+    `             does not request.\n` +
+    `  tmux       Open all drones in one shared tmux session. Default on Linux.\n` +
+    `  pastelist  Print the launch commands so you can run them yourself.\n`
+  );
+}
+
+export function seatsHelpText(version: string): string {
+  return (
+    `borg seats (borgmcp ${version}) — list this machine's registered drones\n\n` +
+    `Usage:\n` +
+    `  borg seats          Show drone, cube, worktree, agent CLI, and local state\n` +
+    `  borg seats --help   Show this help\n\n` +
+    `The local registry belongs to this machine only.\n`
+  );
+}
+
+export function launchSeatHelpText(version: string): string {
+  return (
+    `borg launch (borgmcp ${version}) — reopen one registered drone from its worktree\n\n` +
+    `Usage:\n` +
+    `  borg launch <drone-label-or-id-prefix>\n` +
+    `  borg launch <drone-label-or-id-prefix> --cube <name>\n` +
+    `  borg launch --help\n\n` +
+    `Options:\n` +
+    `  --cube <name>                Disambiguate the same drone label across cubes\n` +
+    `  --help, -h                   Show this help\n`
   );
 }
 
@@ -65,6 +96,8 @@ export function clientSubcommandHelpText(
     case 'reset-local-connection': return resetLocalSeatHelpText(version);
     case 'recover-enrollment': return recoverEnrollmentHelpText(version);
     case 'cleanup': return cleanupHelpText(version);
+    case 'seats': return seatsHelpText(version);
+    case 'launch': return launchSeatHelpText(version);
     case 'launch-all': return launchAllHelpText(version);
     case 'doctor': return doctorHelpText(version);
     default: return null;
@@ -104,6 +137,8 @@ export function topLevelHelpText(version: string): string {
     `  borg reset-local-connection  Clear ONLY this worktree's saved connection to its cube (offline; after a rejection)\n` +
     `  borg recover-enrollment  Restore or clear ONLY one failed server enrollment transaction\n` +
     `  borg cleanup [--prune]   Report (or --prune) worktrees orphaned by evicted drones\n` +
+    `  borg seats               List this machine's registered drones and worktrees\n` +
+    `  borg launch <drone-label-or-id-prefix>  Reopen one registered drone from its worktree\n` +
     `  borg launch-all [cube]   Launch all drone worktrees of a cube (default: active cube)\n` +
     `  borg launch-all [cube] --cli claude|codex|opencode\n` +
     `                           Launch all drone worktrees with that agent CLI\n` +

package/src/config-utils.ts

@@ -23,6 +23,7 @@ import {
 import { shellEscape } from './shell-escape.js';
 import { BORG_STATE_ROOT_ENV, borgAgentConfigEnv, borgHomeRoot } from './private-root.js';
 import type { LaunchAccessPaths } from './launch-access.js';
+import { BORG_LAUNCH_EXPECTED_SEAT_ENV } from './cubes.js';
 
 // Get __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
@@ -36,6 +37,7 @@ const CLEAR_REWAKE_HOOK_COMMAND = 'borg-clear-rewake';
 const AUDIT_HOOK_COMMAND = 'borg-log-audit';
 const FOREIGN_PATH_REMINDER_HOOK_COMMAND = 'borg-foreign-path-reminder';
 const MCP_COMMAND = 'borg-mcp';
+const OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE = `{env:${BORG_LAUNCH_EXPECTED_SEAT_ENV}}`;
 
 /**
  * Claude Code CLI config path. The CLI reads `mcpServers.<name>` from
@@ -1167,7 +1169,7 @@ export function isCodexUserPromptSubmitHookRegistered(hooksPath: string = CODEX_
  * `type: "local"`. Safe-default: any read error returns `false`.
  */
 export function isOpenCodeMcpServerConfigured(
-  configPath: string = OPENCODE_CONFIG_PATH
+  configPath: string = path.join(borgHomeRoot(), '.config', 'opencode', 'opencode.json')
 ): boolean {
   try {
     if (!fs.existsSync(configPath)) return false;
@@ -1183,6 +1185,28 @@ export function isOpenCodeMcpServerConfigured(
   }
 }
 
+/**
+ * Launch-time OpenCode registration check. Ordinary launches retain the
+ * existing configured/not-configured behavior. A targeted `borg launch`,
+ * identified by its non-empty expected-seat marker, additionally requires the
+ * config substitution that carries that marker into OpenCode's MCP child.
+ */
+export function isOpenCodeMcpServerConfiguredForLaunch(
+  configPath: string = path.join(borgHomeRoot(), '.config', 'opencode', 'opencode.json'),
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  if (!isOpenCodeMcpServerConfigured(configPath)) return false;
+  if (!env[BORG_LAUNCH_EXPECTED_SEAT_ENV]) return true;
+  try {
+    const borgServer = readJsonFile(configPath)?.mcp?.borg;
+    const environment = borgServer?.environment ?? borgServer?.env;
+    return environment?.[BORG_LAUNCH_EXPECTED_SEAT_ENV] ===
+      OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Pre-authorize the exact worktree + scratch paths in the launch-root
  * OpenCode config. This intentionally writes only the project-local
@@ -1254,12 +1278,11 @@ export function addOpenCodeLaunchAccess(
 
 /**
  * Add borg MCP server to OpenCode using `opencode mcp add` CLI.
- * Pins BORG_SESSION=1, BORG_AGENT_KIND=opencode, the legacy BORG_OPENCODE=1,
- * and BORG_API_URL in the server environment so the MCP child inherits the
- * activation gate + explicit agent-kind signal (same approach as Codex's
- * pinned env — OpenCode MCP children only see pinned env, not parent process
- * env). Existing configs with BORG_OPENCODE remain supported by the runtime
- * fallback.
+ * Pins activation and agent-kind signals plus an OpenCode config substitution
+ * for the launch-scoped expected seat. OpenCode resolves `{env:NAME}` from its
+ * own launch environment before starting the MCP child, so `borg launch`
+ * reaches the identity check without persisting one launch's value. Existing
+ * configs with BORG_OPENCODE remain supported by the runtime fallback.
  */
 export function addOpenCodeMcpServer(): void {
   try {
@@ -1270,8 +1293,10 @@ export function addOpenCodeMcpServer(): void {
     const stateRootEnvArg = stateRoot
       ? ` --env ${BORG_STATE_ROOT_ENV}=${shellQuote(stateRoot)}`
       : '';
+    const launchExpectedSeatEnvArg =
+      ` --env ${BORG_LAUNCH_EXPECTED_SEAT_ENV}=${shellQuote(OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE)}`;
     execSync(
-      `opencode mcp add borg --env BORG_SESSION=1 --env BORG_AGENT_KIND=opencode --env BORG_OPENCODE=1${apiUrlEnvArg}${stateRootEnvArg} -- ${shellQuote(MCP_COMMAND)}`,
+      `opencode mcp add borg --env BORG_SESSION=1 --env BORG_AGENT_KIND=opencode --env BORG_OPENCODE=1${apiUrlEnvArg}${stateRootEnvArg}${launchExpectedSeatEnvArg} -- ${shellQuote(MCP_COMMAND)}`,
       { stdio: 'inherit', env: borgAgentConfigEnv(process.env) }
     );
   } catch (error: any) {

package/src/cubes.ts

@@ -76,6 +76,113 @@ export interface ActiveCube {
   worktree?: string;
 }
 
+export const BORG_LAUNCH_EXPECTED_SEAT_ENV = 'BORG_LAUNCH_EXPECTED_SEAT';
+
+export interface LaunchSeatExpectation {
+  credentialRef: string;
+  cubeId: string;
+  droneId: string;
+  worktree: string;
+  droneLabel: string;
+}
+
+export class LaunchSeatIdentityChangedError extends Error {
+  readonly code = 'LAUNCH_SEAT_IDENTITY_CHANGED';
+
+  constructor(droneLabel: string) {
+    super(
+      `borg launch: did not launch '${droneLabel}' — its seat registration changed before the launch could start. ` +
+      'Run `borg seats` to see the current state, then try again.',
+    );
+    this.name = 'LaunchSeatIdentityChangedError';
+  }
+}
+
+export function withLaunchSeatExpectationEnv(
+  env: NodeJS.ProcessEnv,
+  expectation: LaunchSeatExpectation,
+): NodeJS.ProcessEnv {
+  // The deterministic ref and public identity are sufficient; never copy the
+  // stored bearer into a process environment.
+  return {
+    ...env,
+    [BORG_LAUNCH_EXPECTED_SEAT_ENV]: JSON.stringify(expectation),
+  };
+}
+
+/** Codex MCP children do not inherit the wrapper environment, so carry the
+ * launch-scoped expected seat through the same per-invocation config channel as
+ * the Borg-session and state-root markers. */
+export function codexLaunchSeatExpectationConfigArgs(
+  env: NodeJS.ProcessEnv = process.env,
+): string[] {
+  const expectation = env[BORG_LAUNCH_EXPECTED_SEAT_ENV];
+  if (expectation === undefined) return [];
+  return [
+    '-c',
+    `mcp_servers.borg.env.${BORG_LAUNCH_EXPECTED_SEAT_ENV}=${JSON.stringify(expectation)}`,
+  ];
+}
+
+function readLaunchSeatExpectation(
+  env: NodeJS.ProcessEnv = process.env,
+): LaunchSeatExpectation | null {
+  const raw = env[BORG_LAUNCH_EXPECTED_SEAT_ENV];
+  // OpenCode substitutes an unset `{env:NAME}` reference with an empty string.
+  // That is an ordinary bare launch, not a malformed launch-seat expectation.
+  if (raw === undefined || raw === '') return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new LaunchSeatIdentityChangedError('<unknown>');
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new LaunchSeatIdentityChangedError('<unknown>');
+  }
+  const value = parsed as Record<string, unknown>;
+  const droneLabel = typeof value.droneLabel === 'string' ? value.droneLabel : '<unknown>';
+  if (
+    typeof value.credentialRef !== 'string' ||
+    typeof value.cubeId !== 'string' ||
+    typeof value.droneId !== 'string' ||
+    typeof value.worktree !== 'string' ||
+    typeof value.droneLabel !== 'string'
+  ) {
+    throw new LaunchSeatIdentityChangedError(droneLabel);
+  }
+  return {
+    credentialRef: value.credentialRef,
+    cubeId: value.cubeId,
+    droneId: value.droneId,
+    worktree: value.worktree,
+    droneLabel: value.droneLabel,
+  };
+}
+
+function assertLaunchSeatExpectation(
+  expectation: LaunchSeatExpectation,
+  active: ActiveCube | null | undefined,
+  worktree: string,
+  currentRecord: SeatRecord | null,
+): void {
+  if (
+    currentRecord === null ||
+    seatRef(currentRecord) !== expectation.credentialRef ||
+    currentRecord.cubeId !== expectation.cubeId ||
+    currentRecord.droneId !== expectation.droneId ||
+    resolve(worktree) !== resolve(expectation.worktree) ||
+    (active !== undefined && (
+      active === null ||
+      active.localSessionCredentialRef !== expectation.credentialRef ||
+      active.cubeId !== expectation.cubeId ||
+      active.droneId !== expectation.droneId
+    ))
+  ) {
+    throw new LaunchSeatIdentityChangedError(expectation.droneLabel);
+  }
+}
+
 export type ActiveCubeInput = Omit<ActiveCube, 'sessionToken'> & {
   sessionToken?: string;
 };
@@ -303,9 +410,19 @@ export async function getActiveCube(): Promise<ActiveCube | null> {
 }
 
 export async function getActiveCubeForWorktree(worktree: string): Promise<ActiveCube | null> {
-  const record = await getActiveSeatForWorktree(findProjectRoot(worktree));
+  const projectRoot = findProjectRoot(worktree);
+  const expectation = readLaunchSeatExpectation();
+  const record = await getActiveSeatForWorktree(projectRoot);
+  // A launch-by-label child must hydrate the exact record selected by its
+  // parent. Check on both sides of bearer hydration so a concurrent preferred-
+  // seat replacement fails closed instead of launching a different drone.
+  if (expectation) assertLaunchSeatExpectation(expectation, undefined, projectRoot, record);
   if (!record || !record.cubeId || !record.droneId) return null;
   const active = await hydrateActiveCube(record);
+  if (expectation) {
+    const currentRecord = await getActiveSeatForWorktree(projectRoot);
+    assertLaunchSeatExpectation(expectation, active, projectRoot, currentRecord);
+  }
   if (active && pinnedMcpSeatIdentity && (
     resolve(active.worktree ?? '') !== pinnedMcpSeatIdentity.worktree ||
     active.cubeId !== pinnedMcpSeatIdentity.cubeId ||

package/src/ensure-mcp-config.ts

@@ -5,7 +5,7 @@ import {
   addOpenCodeMcpServer,
   isCodexMcpServerConfigured,
   isMcpServerConfigured,
-  isOpenCodeMcpServerConfigured,
+  isOpenCodeMcpServerConfiguredForLaunch,
 } from './config-utils.js';
 
 export interface EnsureMcpConfigDeps {
@@ -22,7 +22,7 @@ const defaultDeps: EnsureMcpConfigDeps = {
   addClaude: addMcpServer,
   isCodexConfigured: isCodexMcpServerConfigured,
   addCodex: addCodexMcpServer,
-  isOpenCodeConfigured: isOpenCodeMcpServerConfigured,
+  isOpenCodeConfigured: isOpenCodeMcpServerConfiguredForLaunch,
   addOpenCode: addOpenCodeMcpServer,
 };
 
@@ -49,6 +49,9 @@ export function ensureCliMcpConfigured(
     case 'opencode':
       if (deps.isOpenCodeConfigured()) return false;
       deps.addOpenCode();
+      if (!deps.isOpenCodeConfigured()) {
+        throw new Error('OpenCode MCP registration could not be verified after setup');
+      }
       return true;
   }
 }

package/src/launch-all-cmd.ts

@@ -11,10 +11,10 @@ import type { SeatStatus } from './seat-probe.js';
 import { resolveBorgPath } from './launch-all-command.js';
 import { sweepStaleLocks, isLockLive } from './launch-all-locks.js';
 import { runTmuxBackend } from './backends/launch-all-tmux.js';
-import { runWindowsBackend } from './backends/launch-all-windows.js';
+import { hasMacOSTerminalApp, runTerminalsBackend } from './backends/launch-all-terminals.js';
 import { runPastelistBackend } from './backends/launch-all-pastelist.js';
 
-type Backend = 'tmux' | 'windows' | 'pastelist';
+type Backend = 'tmux' | 'terminals' | 'pastelist';
 
 const TMUX_INSTALL_HINT =
   'borg launch-all: tmux not found.\n' +
@@ -82,10 +82,11 @@ async function resolveTargetCube(
   return { cubeId: active.cubeId, name: active.name };
 }
 
-/** Backend selection (spec §4.1): native-Windows / explicit / tmux-preflight / auto. */
+/** Backend selection: native-Windows / explicit / platform-specific auto. */
 function selectBackend(args: LaunchAllArgs, deps: LaunchAllDeps): { backend: Backend } | { hardFail: string } {
   const explicit = args.flags.mode;
-  const nativeWindows = deps.platform() === 'win32' && !isWSL(deps);
+  const platform = deps.platform();
+  const nativeWindows = platform === 'win32' && !isWSL(deps);
   if (nativeWindows) {
     deps.stderr(
       'native Windows is not supported for interactive launch; using pastelist mode instead ' +
@@ -93,13 +94,23 @@ function selectBackend(args: LaunchAllArgs, deps: LaunchAllDeps): { backend: Bac
     );
     return { backend: 'pastelist' };
   }
-  if (explicit === 'windows') return { backend: 'windows' };
+  if (explicit === 'terminals') return { backend: 'terminals' };
   if (explicit === 'pastelist') return { backend: 'pastelist' };
-
-  const tmuxAvail = checkTmuxAvailable(deps);
   if (explicit === 'tmux') {
-    return tmuxAvail ? { backend: 'tmux' } : { hardFail: TMUX_INSTALL_HINT };
+    return checkTmuxAvailable(deps) ? { backend: 'tmux' } : { hardFail: TMUX_INSTALL_HINT };
+  }
+
+  // macOS defaults to native terminal tabs/windows when either supported app
+  // is installed. Explicit modes above always win.
+  if (
+    platform === 'darwin' &&
+    deps.isTTY() &&
+    hasMacOSTerminalApp(deps)
+  ) {
+    return { backend: 'terminals' };
   }
+
+  const tmuxAvail = checkTmuxAvailable(deps);
   // auto (no explicit mode)
   if (tmuxAvail) return { backend: 'tmux' };
   deps.stderr(TMUX_INSTALL_HINT + 'Falling back to pastelist mode (paste the commands below).\n');
@@ -416,8 +427,8 @@ export async function runLaunchAll(
         }
         printCheatSheet(sessionName, deps);
       }
-    } else if (sel.backend === 'windows') {
-      await runWindowsBackend(launchable, { borgPath, platform: deps.platform(), launchedAtISO: launchStartISO, launchDelayMs, sleep }, deps);
+    } else if (sel.backend === 'terminals') {
+      await runTerminalsBackend(launchable, { borgPath, platform: deps.platform(), cubeName, launchedAtISO: launchStartISO, launchDelayMs, sleep }, deps);
     } else {
       runPastelistBackend(launchable, borgPath, deps);
       return 0; // pastelist: nothing to reconcile (operator pastes manually)
@@ -453,6 +464,8 @@ export async function runLaunchAll(
     const status = statuses ? (statuses.get(c.droneId) === 'verified' ? 'VERIFIED' : 'unconfirmed (may still be joining)') : 'launched';
     deps.stdout(`  ${c.droneLabel}  ${c.worktreeDir}  ${status}\n`);
   }
-  deps.stdout(`\nAttach: tmux attach -t ${sessionName}\n`);
+  if (sel.backend === 'tmux') {
+    deps.stdout(`\nAttach: tmux attach -t ${sessionName}\n`);
+  }
   return 0;
 }