borgmcp 3.4.0 → 3.5.1

package/src/bare-launch-menu.ts

@@ -1,27 +1,34 @@
 /**
  * gh#853 — bare `borg` (no-args) interactive launch menu.
  *
- * When `borg` is run with NO arguments in a TTY, offer a small launch selector
- * instead of launching immediately:
- *   1. Launch (default)             — the configured agent (Enter selects).
- *   2. Launch with <other> instead  — the OTHER configured agent, ONE-SHOT
- *                                      (does NOT persist the preference).
- *   3. Launch all                   — runLaunchAll for the active cube.
+ * When `borg` is run with NO arguments in a TTY outside an active seat, offer
+ * a small launch selector. In a repository with live sibling drones, those
+ * drones come first; otherwise the existing agent choices remain unchanged.
  *
  * The option-set, the selection→action mapping, and the show/collapse decision
  * are pure functions so they're unit-testable without a real TTY. claude.ts
- * main() is thin glue: it computes the inputs (default cli, other-configured cli,
- * launch-all targets), gates on shouldShowLaunchMenu, runs the orchestrator with
- * the real readline prompt, then dispatches the returned action.
+ * main() is thin glue: it computes the available candidates and agent choices,
+ * gates on shouldShowLaunchMenu, runs the orchestrator with the real readline
+ * prompt, then dispatches the returned action.
  *
- * Load-bearing safety: TTY-only + bare-args-only (shouldShowLaunchMenu) so every
- * scripted/programmatic `borg` and every explicit subcommand/flag is untouched.
+ * Load-bearing safety: TTY-only + bare-args-only + no-active-seat
+ * (shouldShowLaunchMenu), so scripted/programmatic invocations and direct
+ * worktree resumes are untouched.
  */
-import type { BorgCli } from './cubes.js';
+import type { ActiveCube, BorgCli } from './cubes.js';
+import type { DroneCandidate } from './launch-all-discovery.js';
+import type { SeatStatus } from './seat-probe.js';
 
 export type LaunchMenuAction =
   | { kind: 'launch'; cli: BorgCli }
-  | { kind: 'launch-all' };
+  | { kind: 'launch-seat'; target: string }
+  | { kind: 'launch-all'; cubeId?: string };
+
+export interface LaunchMenuDroneCandidate {
+  droneLabel: string;
+  target: string;
+  worktree: string;
+}
 
 export interface LaunchMenuOption {
   /** The keystroke that selects this option (sequential: '1', '2', …). */
@@ -35,8 +42,87 @@ export interface LaunchMenuInputs {
   defaultCli: BorgCli;
   /** All configured agents that are NOT the default, in display order. */
   otherConfiguredClis: BorgCli[];
-  /** True iff there's an active cube with >=1 discoverable drone (option 3). */
+  /** True iff the current menu context has launch-all targets. */
   hasLaunchAllTargets: boolean;
+  /** Live sibling drones offered before the unattached launch choices. */
+  droneCandidates?: LaunchMenuDroneCandidate[];
+  /** Cube selected by the sibling-drone context for its launch-all action. */
+  launchAllCubeId?: string;
+}
+
+interface LaunchMenuCandidateDeps {
+  readAllProjectIdentities: () => Promise<Array<{ projectPath: string; cube: ActiveCube }>>;
+  discoverDroneCandidates: (cubeId: string) => Promise<DroneCandidate[]>;
+  getActiveSeatForWorktree: (
+    worktree: string,
+  ) => Promise<{ cubeId: string; droneId?: string } | null>;
+  pathExists: (worktree: string) => boolean;
+  probeSeat: (candidate: DroneCandidate) => Promise<SeatStatus>;
+}
+
+const TERMINAL_SEAT_STATUSES = new Set<SeatStatus>([
+  'evicted',
+  'revoked',
+  'rejected',
+  'credential-rejected',
+  'trust-mismatch',
+]);
+
+/**
+ * Find linked sibling worktrees that still own their preferred active seat.
+ * Authoritative terminal probe results are omitted; transient/unknown probe
+ * results stay visible, matching launch-all's constructive fail-open behavior.
+ */
+export async function discoverLiveLaunchMenuCandidates(
+  deps: LaunchMenuCandidateDeps,
+): Promise<{ candidates: LaunchMenuDroneCandidate[]; launchAllCubeId?: string }> {
+  const identities = await deps.readAllProjectIdentities();
+  const cubeIds = [...new Set(identities.map(({ cube }) => cube.cubeId))];
+  const discovered = (
+    await Promise.all(cubeIds.map((cubeId) => deps.discoverDroneCandidates(cubeId)))
+  ).flat();
+
+  const candidates: Array<LaunchMenuDroneCandidate & { cubeId: string }> = [];
+  const seen = new Set<string>();
+  for (const candidate of discovered) {
+    if (!deps.pathExists(candidate.worktreeDir)) continue;
+    const preferred = await deps.getActiveSeatForWorktree(candidate.worktreeDir);
+    if (
+      !preferred ||
+      preferred.cubeId !== candidate.cubeId ||
+      preferred.droneId !== candidate.droneId
+    ) continue;
+
+    let status: SeatStatus;
+    try {
+      status = await deps.probeSeat(candidate);
+    } catch {
+      status = 'indeterminate';
+    }
+    if (TERMINAL_SEAT_STATUSES.has(status)) continue;
+
+    const key = `${candidate.cubeId}\0${candidate.droneId}\0${candidate.worktreeDir}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    candidates.push({
+      cubeId: candidate.cubeId,
+      droneLabel: candidate.droneLabel,
+      target: candidate.droneId,
+      worktree: candidate.worktreeDir,
+    });
+  }
+
+  candidates.sort((a, b) =>
+    a.droneLabel.localeCompare(b.droneLabel) || a.worktree.localeCompare(b.worktree)
+  );
+  const candidateCubeIds = new Set(candidates.map((candidate) => candidate.cubeId));
+  const launchAllCubeId = candidateCubeIds.size === 1
+    ? candidates[0].cubeId
+    : undefined;
+  return {
+    candidates: candidates.map(({ cubeId: _cubeId, ...candidate }) => candidate),
+    ...(launchAllCubeId ? { launchAllCubeId } : {}),
+  };
 }
 
 /**
@@ -59,16 +145,20 @@ export function configureSelectedLaunchCli(
 const PRETTY: Record<BorgCli, string> = { claude: 'Claude', codex: 'Codex', opencode: 'OpenCode' };
 
 /**
- * Gate: the menu fires ONLY for bare `borg` (no args) in a TTY. Any explicit
- * subcommand/flag, or a non-TTY (piped/scripted/CI) invocation, falls straight
- * through to the existing default launch — no menu, no behavior change.
+ * Gate: the menu fires ONLY for bare `borg` (no args) in a TTY without an
+ * active seat. Explicit invocations, non-TTY launches, and direct worktree
+ * resumes fall straight through to the existing launch path.
  */
 export function shouldShowLaunchMenu(args: {
   extraArgs: string[];
   stdinIsTTY: boolean;
   stdoutIsTTY: boolean;
+  hasActiveSeat?: boolean;
 }): boolean {
-  return args.extraArgs.length === 0 && args.stdinIsTTY && args.stdoutIsTTY;
+  return args.extraArgs.length === 0
+    && args.stdinIsTTY
+    && args.stdoutIsTTY
+    && !args.hasActiveSeat;
 }
 
 export function explicitCliLaunchHint(args: {
@@ -98,6 +188,39 @@ export function shouldResolveExplicitCliLaunchHintTargets(args: {
  * middle option never produces a "1) … 3) …" gap menu.
  */
 export function buildLaunchMenuOptions(inputs: LaunchMenuInputs): LaunchMenuOption[] {
+  if (inputs.droneCandidates && inputs.droneCandidates.length > 0) {
+    const options: LaunchMenuOption[] = [...inputs.droneCandidates]
+      .sort((a, b) => a.droneLabel.localeCompare(b.droneLabel) || a.worktree.localeCompare(b.worktree))
+      .map((candidate, index) => ({
+        key: String(index + 1),
+        label: `Resume ${candidate.droneLabel} (${candidate.worktree})`,
+        action: { kind: 'launch-seat' as const, target: candidate.target },
+      }));
+    if (inputs.hasLaunchAllTargets) {
+      options.push({
+        key: String(options.length + 1),
+        label: "Launch all (this cube's drone worktrees)",
+        action: {
+          kind: 'launch-all',
+          ...(inputs.launchAllCubeId ? { cubeId: inputs.launchAllCubeId } : {}),
+        },
+      });
+    }
+    options.push({
+      key: String(options.length + 1),
+      label: `Launch ${PRETTY[inputs.defaultCli]} here without a drone`,
+      action: { kind: 'launch', cli: inputs.defaultCli },
+    });
+    for (const cli of inputs.otherConfiguredClis) {
+      options.push({
+        key: String(options.length + 1),
+        label: `Launch with ${PRETTY[cli]} here without a drone (one-shot)`,
+        action: { kind: 'launch', cli },
+      });
+    }
+    return options;
+  }
+
   const options: LaunchMenuOption[] = [
     {
       key: '1',

package/src/claude.ts

@@ -22,7 +22,18 @@ import { basename } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
 import chalk from 'chalk';
-import { findProjectRoot, getActiveCube, inboxPathForDrone, setCodexWakeTarget, pruneDeadCodexWakeTargets, type BorgCli } from './cubes.js';
+import {
+  BORG_LAUNCH_EXPECTED_SEAT_ENV,
+  codexLaunchSeatExpectationConfigArgs,
+  findProjectRoot,
+  getActiveCube,
+  inboxPathForDrone,
+  LaunchSeatIdentityChangedError,
+  setCodexWakeTarget,
+  pruneDeadCodexWakeTargets,
+  type ActiveCube,
+  type BorgCli,
+} from './cubes.js';
 import { monitorStateRootForWorktree } from './inbox-monitor.js';
 import { formatSeatReattachRefusal, inspectLiveInboxMonitor } from './seat-reattach-guard.js';
 import { handleVersionFlag, getPackageVersion } from './version.js';
@@ -43,9 +54,17 @@ import { unknownSubcommand } from './unknown-subcommand.js';
 import { parseRecoverEnrollmentArgs, runRecoverEnrollment } from './recover-enrollment-cmd.js';
 import { runLaunchAll } from './launch-all-cmd.js';
 import { buildDefaultLaunchAllDeps } from './launch-all-deps.js';
+import {
+  buildDefaultSeatCommandDeps,
+  parseLaunchSeatArgs,
+  parseSeatsArgs,
+  runLaunchSeat,
+  runSeats,
+} from './seat-commands.js';
 import { discoverDroneCandidates } from './launch-all-discovery.js';
 import {
   configureSelectedLaunchCli,
+  discoverLiveLaunchMenuCandidates,
   explicitCliLaunchHint,
   runBareLaunchMenu,
   shouldResolveExplicitCliLaunchHintTargets,
@@ -90,6 +109,19 @@ import { runDoctor, warnIfAgentIntegrationUnhealthy } from './agent-integration-
 
 export type AssimilateDepsBuilder = typeof buildDefaultAssimilateDeps;
 
+export class OpenCodeTargetedLaunchConfigError extends Error {
+  readonly code = 'OPENCODE_TARGETED_LAUNCH_CONFIG';
+
+  constructor(droneLabel: string, worktree: string) {
+    super(
+      `borg launch: did not launch '${droneLabel}' — borg could not update or verify the OpenCode configuration ` +
+      'that a targeted launch needs to open the correct drone. Check that the OpenCode configuration file is ' +
+      `writable, then try again. As a fallback, run \`borg\` in ${worktree} to resume that worktree's drone directly.`,
+    );
+    this.name = 'OpenCodeTargetedLaunchConfigError';
+  }
+}
+
 export function createOpenCodeLaunchPlan(
   cwd: string,
   port: number,
@@ -267,6 +299,27 @@ async function main() {
     const code = await runCleanup({}, parsed.options);
     process.exit(code);
   }
+  if (process.argv[2] === 'seats') {
+    const parsed = parseSeatsArgs(process.argv.slice(3));
+    if (!parsed.ok) {
+      process.stderr.write(chalk.red(`${consolePrefix()}◼ borg seats: ${parsed.error}\n`));
+      process.stderr.write(`Run \`borg seats --help\` for usage.\n`);
+      process.exit(1);
+    }
+    process.exit(await runSeats(buildDefaultSeatCommandDeps()));
+  }
+  if (process.argv[2] === 'launch') {
+    const parsed = parseLaunchSeatArgs(process.argv.slice(3));
+    if (!parsed.ok) {
+      process.stderr.write(chalk.red(`${consolePrefix()}◼ borg launch: ${parsed.error}\n`));
+      process.stderr.write(`Run \`borg launch --help\` for usage.\n`);
+      process.exit(1);
+    }
+    process.exit(await runLaunchSeat(
+      { target: parsed.target, ...(parsed.cube ? { cube: parsed.cube } : {}) },
+      buildDefaultSeatCommandDeps(),
+    ));
+  }
   if (process.argv[2] === 'launch-all') {
     const parsed = parseLaunchAllArgs(process.argv.slice(3));
     if (!parsed.ok) {
@@ -359,19 +412,59 @@ async function main() {
       extraArgs: process.argv.slice(2),
       stdinIsTTY,
       stdoutIsTTY,
+      hasActiveSeat: active !== null,
     })
   ) {
+    const launchAllDeps = buildDefaultLaunchAllDeps();
+    const seatCommandDeps = buildDefaultSeatCommandDeps();
+    const siblingContext = await discoverLiveLaunchMenuCandidates({
+      readAllProjectIdentities: launchAllDeps.readAllProjectIdentities,
+      discoverDroneCandidates: (cubeId) => discoverDroneCandidates(
+        { targetCubeId: cubeId },
+        { ...launchAllDeps, stderr: () => {} },
+      ),
+      getActiveSeatForWorktree: seatCommandDeps.getActiveSeatForWorktree,
+      pathExists: launchAllDeps.pathExists,
+      probeSeat: (candidate) => launchAllDeps.probeSeat(
+        candidate.sessionToken,
+        candidate.apiUrl,
+        candidate.serverTrustIdentity,
+      ),
+    });
     const otherConfiguredClis = configuredCliNames(
       detectCliAvailability(),
       detectCliConfiguration(),
     ).filter((c) => c !== cli);
     const action = await runBareLaunchMenu(
-      { defaultCli: cli, otherConfiguredClis, hasLaunchAllTargets: await hasLaunchAllTargets() },
+      {
+        defaultCli: cli,
+        otherConfiguredClis,
+        hasLaunchAllTargets: siblingContext.launchAllCubeId !== undefined,
+        droneCandidates: siblingContext.candidates,
+        ...(siblingContext.launchAllCubeId
+          ? { launchAllCubeId: siblingContext.launchAllCubeId }
+          : {}),
+      },
       prompt
     );
+    if (action.kind === 'launch-seat') {
+      process.exit(await runLaunchSeat(
+        { target: action.target },
+        buildDefaultSeatCommandDeps(),
+      ));
+    }
     if (action.kind === 'launch-all') {
-      const parsed = parseLaunchAllArgs([]); // empty args → active cube, auto backend
-      const code = parsed.ok ? await runLaunchAll(parsed.args, buildDefaultLaunchAllDeps()) : 1;
+      const deps = buildDefaultLaunchAllDeps();
+      const selectedIdentity = action.cubeId
+        ? (await deps.readAllProjectIdentities()).find(({ cube }) => cube.cubeId === action.cubeId)
+        : undefined;
+      const parsed = parseLaunchAllArgs([]);
+      const code = parsed.ok
+        ? await runLaunchAll(
+          parsed.args,
+          selectedIdentity ? { ...deps, getActiveCube: async () => selectedIdentity.cube } : deps,
+        )
+        : 1;
       process.exit(code);
     }
     // option 1 → configured default; option 2 → the other agent, ONE-SHOT
@@ -382,7 +475,11 @@ async function main() {
 
   // Configure only the CLI that will actually launch. This must follow the
   // one-shot menu: the resolved default can differ from the menu selection.
-  cli = configureSelectedLaunchCli(cli, launchAction, ensureResolvedCliConfigured);
+  cli = configureSelectedLaunchCli(
+    cli,
+    launchAction,
+    (selectedCli) => ensureResolvedCliConfigured(selectedCli, active),
+  );
 
   if (active && !parsedCli.force) {
     const inboxPath = inboxPathForDrone(active.cubeId, active.droneId);
@@ -531,6 +628,7 @@ async function main() {
       ...codexAgentKindConfigArgs(),
       ...codexRemoteWakeConfigArgs(codexSocketPath !== null),
       ...codexStateRootConfigArgs(),
+      ...codexLaunchSeatExpectationConfigArgs(),
       ...remoteArgs,
       ...withCodexCwdArg([...passthroughArgs, kickoff], process.cwd()),
     ];
@@ -614,11 +712,25 @@ async function main() {
   });
 }
 
-function ensureResolvedCliConfigured(cli: BorgCli): void {
+export function ensureResolvedCliConfigured(cli: BorgCli, active: ActiveCube | null = null): void {
   const label = cli === 'claude' ? 'Claude Code' : cli === 'codex' ? 'Codex' : 'OpenCode';
+  const targetedOpenCodeLaunch = cli === 'opencode' &&
+    Boolean(process.env[BORG_LAUNCH_EXPECTED_SEAT_ENV]);
   try {
     configureResolvedCli(cli, {
-      ensureMcp: ensureCliMcpConfigured,
+      ensureMcp: (selectedCli) => {
+        try {
+          ensureCliMcpConfigured(selectedCli);
+        } catch (error) {
+          if (targetedOpenCodeLaunch && selectedCli === 'opencode') {
+            throw new OpenCodeTargetedLaunchConfigError(
+              active?.droneLabel ?? '<unknown>',
+              active?.worktree ?? process.cwd(),
+            );
+          }
+          throw error;
+        }
+      },
       addClaudeProjectSessionStartHook: () => {
         // gh#673 P2 (WI-1): the orientation hook lives PROJECT-LOCAL in
         // <root>/.claude/settings.local.json — ensured on every bare
@@ -633,6 +745,7 @@ function ensureResolvedCliConfigured(cli: BorgCli): void {
       installOpenCodePlugin: installBorgPlugin,
     });
   } catch (err: any) {
+    if (err instanceof OpenCodeTargetedLaunchConfigError) throw err;
     console.error(`${consolePrefix()}${chalk.yellow(`warning: ${label} integration check failed: ${err?.message ?? err}`)}`);
   }
   try {
@@ -656,6 +769,13 @@ function isEntryInvocation(): boolean {
 
 if (isEntryInvocation()) {
   main().catch((error) => {
+    if (
+      error instanceof LaunchSeatIdentityChangedError ||
+      error instanceof OpenCodeTargetedLaunchConfigError
+    ) {
+      process.stderr.write(`${error.message}\n`);
+      process.exit(1);
+    }
     console.error(`${consolePrefix()}${chalk.red(`\n◼ Error: ${error.message}\n`)}`);
     process.exit(1);
   });

package/src/cli-help.ts

@@ -32,7 +32,7 @@ export function launchAllHelpText(version: string): string {
     `Usage:\n` +
     `  borg launch-all [cube] [options]\n\n` +
     `Options:\n` +
-    `  --mode <tmux|windows|pastelist>       Select the launch backend\n` +
+    `  --mode <tmux|terminals|pastelist>     Select the launch backend\n` +
     `  --only <name>                         Launch one role or drone label\n` +
     `  --dry-run                             Show what would launch\n` +
     `  --cli <claude|codex|opencode>         Select the agent CLI\n` +
@@ -40,7 +40,38 @@ export function launchAllHelpText(version: string): string {
     `  --yes, -y                             Skip the large-fleet confirmation\n` +
     `  --force                               Override live-session skips\n` +
     `  --launch-delay <ms>                   Wait between launches\n` +
-    `  --help, -h                            Show this help\n`
+    `  --help, -h                            Show this help\n\n` +
+    `Modes:\n` +
+    `  terminals  Open each drone in its own terminal tab, with the drone's name as\n` +
+    `             the tab title. Default on macOS when iTerm2 or Terminal.app is\n` +
+    `             installed. Terminal.app opens one named window for each drone\n` +
+    `             instead; tabs would need macOS automation permissions, which borg\n` +
+    `             does not request.\n` +
+    `  tmux       Open all drones in one shared tmux session. Default on Linux.\n` +
+    `  pastelist  Print the launch commands so you can run them yourself.\n`
+  );
+}
+
+export function seatsHelpText(version: string): string {
+  return (
+    `borg seats (borgmcp ${version}) — list this machine's registered drones\n\n` +
+    `Usage:\n` +
+    `  borg seats          Show drone, cube, worktree, agent CLI, and local state\n` +
+    `  borg seats --help   Show this help\n\n` +
+    `The local registry belongs to this machine only.\n`
+  );
+}
+
+export function launchSeatHelpText(version: string): string {
+  return (
+    `borg launch (borgmcp ${version}) — reopen one registered drone from its worktree\n\n` +
+    `Usage:\n` +
+    `  borg launch <drone-label-or-id-prefix>\n` +
+    `  borg launch <drone-label-or-id-prefix> --cube <name>\n` +
+    `  borg launch --help\n\n` +
+    `Options:\n` +
+    `  --cube <name>                Disambiguate the same drone label across cubes\n` +
+    `  --help, -h                   Show this help\n`
   );
 }
 
@@ -65,6 +96,8 @@ export function clientSubcommandHelpText(
     case 'reset-local-connection': return resetLocalSeatHelpText(version);
     case 'recover-enrollment': return recoverEnrollmentHelpText(version);
     case 'cleanup': return cleanupHelpText(version);
+    case 'seats': return seatsHelpText(version);
+    case 'launch': return launchSeatHelpText(version);
     case 'launch-all': return launchAllHelpText(version);
     case 'doctor': return doctorHelpText(version);
     default: return null;
@@ -104,6 +137,8 @@ export function topLevelHelpText(version: string): string {
     `  borg reset-local-connection  Clear ONLY this worktree's saved connection to its cube (offline; after a rejection)\n` +
     `  borg recover-enrollment  Restore or clear ONLY one failed server enrollment transaction\n` +
     `  borg cleanup [--prune]   Report (or --prune) worktrees orphaned by evicted drones\n` +
+    `  borg seats               List this machine's registered drones and worktrees\n` +
+    `  borg launch <drone-label-or-id-prefix>  Reopen one registered drone from its worktree\n` +
     `  borg launch-all [cube]   Launch all drone worktrees of a cube (default: active cube)\n` +
     `  borg launch-all [cube] --cli claude|codex|opencode\n` +
     `                           Launch all drone worktrees with that agent CLI\n` +

package/src/config-utils.ts

@@ -23,6 +23,7 @@ import {
 import { shellEscape } from './shell-escape.js';
 import { BORG_STATE_ROOT_ENV, borgAgentConfigEnv, borgHomeRoot } from './private-root.js';
 import type { LaunchAccessPaths } from './launch-access.js';
+import { BORG_LAUNCH_EXPECTED_SEAT_ENV } from './cubes.js';
 
 // Get __dirname equivalent in ESM
 const __filename = fileURLToPath(import.meta.url);
@@ -36,6 +37,7 @@ const CLEAR_REWAKE_HOOK_COMMAND = 'borg-clear-rewake';
 const AUDIT_HOOK_COMMAND = 'borg-log-audit';
 const FOREIGN_PATH_REMINDER_HOOK_COMMAND = 'borg-foreign-path-reminder';
 const MCP_COMMAND = 'borg-mcp';
+const OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE = `{env:${BORG_LAUNCH_EXPECTED_SEAT_ENV}}`;
 
 /**
  * Claude Code CLI config path. The CLI reads `mcpServers.<name>` from
@@ -1183,6 +1185,28 @@ export function isOpenCodeMcpServerConfigured(
   }
 }
 
+/**
+ * Launch-time OpenCode registration check. Ordinary launches retain the
+ * existing configured/not-configured behavior. A targeted `borg launch`,
+ * identified by its non-empty expected-seat marker, additionally requires the
+ * config substitution that carries that marker into OpenCode's MCP child.
+ */
+export function isOpenCodeMcpServerConfiguredForLaunch(
+  configPath: string = path.join(borgHomeRoot(), '.config', 'opencode', 'opencode.json'),
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  if (!isOpenCodeMcpServerConfigured(configPath)) return false;
+  if (!env[BORG_LAUNCH_EXPECTED_SEAT_ENV]) return true;
+  try {
+    const borgServer = readJsonFile(configPath)?.mcp?.borg;
+    const environment = borgServer?.environment ?? borgServer?.env;
+    return environment?.[BORG_LAUNCH_EXPECTED_SEAT_ENV] ===
+      OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Pre-authorize the exact worktree + scratch paths in the launch-root
  * OpenCode config. This intentionally writes only the project-local
@@ -1254,12 +1278,11 @@ export function addOpenCodeLaunchAccess(
 
 /**
  * Add borg MCP server to OpenCode using `opencode mcp add` CLI.
- * Pins BORG_SESSION=1, BORG_AGENT_KIND=opencode, the legacy BORG_OPENCODE=1,
- * and BORG_API_URL in the server environment so the MCP child inherits the
- * activation gate + explicit agent-kind signal (same approach as Codex's
- * pinned env — OpenCode MCP children only see pinned env, not parent process
- * env). Existing configs with BORG_OPENCODE remain supported by the runtime
- * fallback.
+ * Pins activation and agent-kind signals plus an OpenCode config substitution
+ * for the launch-scoped expected seat. OpenCode resolves `{env:NAME}` from its
+ * own launch environment before starting the MCP child, so `borg launch`
+ * reaches the identity check without persisting one launch's value. Existing
+ * configs with BORG_OPENCODE remain supported by the runtime fallback.
  */
 export function addOpenCodeMcpServer(): void {
   try {
@@ -1270,8 +1293,10 @@ export function addOpenCodeMcpServer(): void {
     const stateRootEnvArg = stateRoot
       ? ` --env ${BORG_STATE_ROOT_ENV}=${shellQuote(stateRoot)}`
       : '';
+    const launchExpectedSeatEnvArg =
+      ` --env ${BORG_LAUNCH_EXPECTED_SEAT_ENV}=${shellQuote(OPENCODE_LAUNCH_EXPECTED_SEAT_REFERENCE)}`;
     execSync(
-      `opencode mcp add borg --env BORG_SESSION=1 --env BORG_AGENT_KIND=opencode --env BORG_OPENCODE=1${apiUrlEnvArg}${stateRootEnvArg} -- ${shellQuote(MCP_COMMAND)}`,
+      `opencode mcp add borg --env BORG_SESSION=1 --env BORG_AGENT_KIND=opencode --env BORG_OPENCODE=1${apiUrlEnvArg}${stateRootEnvArg}${launchExpectedSeatEnvArg} -- ${shellQuote(MCP_COMMAND)}`,
       { stdio: 'inherit', env: borgAgentConfigEnv(process.env) }
     );
   } catch (error: any) {