borgmcp 3.5.0 → 3.6.1

package/src/assimilate-cmd.ts

@@ -17,7 +17,7 @@ import {
   recordCodexWakeTarget,
   socketPathFromRemoteArgs,
 } from './codex-launch.js';
-import { perWorktreeBranchName, adoptWorktree, computeWorktreePath, localBranchExists, isMerged } from './worktree-lifecycle.js';
+import { perWorktreeBranchName, computeWorktreePath, localBranchExists, isMerged } from './worktree-lifecycle.js';
 import { DroneEvictedError } from './drone-lifecycle.js';
 import { codexBorgSessionConfigArgs } from './launch-gate.js';
 import {
@@ -269,11 +269,7 @@ export interface AssimilateDeps {
     cubeId: string;
     projectRoot: string;
   }) => Promise<{ operation: ServerSessionOperation; roleId: string; credentialRef: string } | null>;
-  probeSeat: (
-    sessionToken: string,
-    apiUrl: string,
-    serverTrustIdentity?: string,
-  ) => Promise<SeatStatus>;
+  probeSeat: (seat: ActiveCube) => Promise<SeatStatus>;
   setActiveCube: (a: ActiveCube) => Promise<void>;
   /** COMPOSITE cube-owned FINALIZE (Race 2): under the cube lock, revalidate the
    *  typed expectation, persist the binding FIRST, then run `activate` (keychain
@@ -910,6 +906,30 @@ export async function runAssimilate(
   }
 
   const projectRoot = repositoryContext.root;
+  const wantSibling =
+    args.flags.worktree !== undefined ||
+    (!args.flags.here && !(existing === null && hasPersistedIdentity));
+  let verifiedHead = '';
+
+  if (mode !== 'cube-init' && args.flags.here && existing === null && !hasPersistedIdentity) {
+    deps.stderr(
+      '`borg assimilate --here` resumes this worktree\'s saved drone, but no saved drone was found.\n' +
+      'Run `borg assimilate` to create a new drone in a managed worktree.\n',
+    );
+    return 1;
+  }
+
+  if (mode !== 'cube-init' && wantSibling) {
+    const headProbe = deps.runSync('git', ['rev-parse', '--verify', 'HEAD'], projectRoot);
+    if (headProbe.status !== 0) {
+      deps.stderr(
+        'sibling worktree spawn requires HEAD pointing at a commit.\n' +
+        'Create an initial commit (for example: `git commit --allow-empty -m "Initial commit"`), then rerun `borg assimilate`.\n',
+      );
+      return 1;
+    }
+    verifiedHead = headProbe.stdout.trim();
+  }
 
   let auth: { token: string; apiUrl: string; serverTrustIdentity: string; serverCapabilities: readonly string[] };
   {
@@ -1145,8 +1165,6 @@ export async function runAssimilate(
   // retain its original role so the attach request reuses the exact durable
   // retry binding instead of selecting another unoccupied role and minting a
   // duplicate seat.
-  const wantSibling =
-    args.flags.worktree !== undefined || (existing !== null && !args.flags.here);
   // `let`: the bound-pending resume path (CR#2) OVERRIDES this from the stored
   // operation so a rerun re-derives the EXACT original sibling seat ref.
   let sessionOperation: ServerSessionOperation = {
@@ -1154,7 +1172,7 @@ export async function runAssimilate(
     // cwd. This is the stable seat/sibling namespace for the pending bearer, so a
     // deliberate sibling never collides with the durable in-place seat's bearer.
     projectRoot,
-    kind: wantSibling ? 'sibling' : 'seat',
+    kind: 'sibling',
     // CR1(a): an implicit sibling's operation key must be COLLISION-SAFE — two
     // unnamed siblings of the same (origin,trust,cube,role) must get DISTINCT seat
     // refs, else prepareSeat reuses the first sibling's ACTIVE record and the
@@ -1162,11 +1180,9 @@ export async function runAssimilate(
     // and rebound). A named sibling already keys on its name; an unnamed one derives
     // a per-invocation-unique key so every distinct implicit sibling target mints a
     // distinct bearer / seat ref.
-    operationKey: wantSibling
-      ? (args.flags.worktree === undefined
-        ? `implicit-sibling:${randomUUID()}`
-        : `named-sibling:${args.flags.worktree}`)
-      : 'current-worktree',
+    operationKey: args.flags.worktree === undefined
+      ? `implicit-sibling:${randomUUID()}`
+      : `named-sibling:${args.flags.worktree}`,
   };
   // A selected sibling can be the surviving live seat for this worktree (#63).
   // `--here` must re-send that seat's durable operation, not reconstruct the
@@ -1316,11 +1332,7 @@ export async function runAssimilate(
       savedLocalRole = existing.roleName
         ? cubeDetail.roles.find((role) => role.name === existing.roleName)
         : undefined;
-      const status = await deps.probeSeat(
-        existing.sessionToken ?? '',
-        auth.apiUrl,
-        auth.serverTrustIdentity,
-      );
+      const status = await deps.probeSeat(existing);
       // Canonical rotated/revoked path: a pin-matched 401 on THIS worktree's
       // saved bearer. PURE DIAGNOSIS — attach never mutates local state on a
       // rejection; it points at the offline `borg reset-local-connection` command.
@@ -1662,21 +1674,7 @@ export async function runAssimilate(
   let spawnedWorktreePath: string | null = null;
 
   if (wantSibling) {
-    // BUG-4 / gh#150 fix (v0.9.5): `git worktree add --detach <path>`
-    // fails with "fatal: not a valid object name: 'HEAD'" when the
-    // repo has no commits yet (unborn HEAD). Detect explicitly via
-    // `git rev-parse --verify HEAD` so we surface an actionable
-    // prerequisite error rather than git's cryptic internal message.
-    const headProbe = deps.runSync('git', ['rev-parse', '--verify', 'HEAD'], projectRoot);
-    if (headProbe.status !== 0) {
-      deps.stderr(
-        `sibling worktree spawn requires HEAD pointing at a commit.\n` +
-        `  Fix: create at least one commit (\`git commit --allow-empty -m "initial"\`)\n` +
-        `  OR:  pass --here to skip the sibling spawn and use the current directory\n`
-      );
-      return 1;
-    }
-    const localHead = headProbe.stdout.trim();
+    const localHead = verifiedHead;
     const originProbe = deps.runSync('git', ['remote', 'get-url', 'origin'], projectRoot);
     let startRef = 'HEAD';
     if (originProbe.status === 0 && originProbe.stdout.trim().length > 0) {
@@ -1813,8 +1811,10 @@ export async function runAssimilate(
       return 1;
     }
     deps.stderr(
-      `spawned sibling worktree at ${candidate} on branch ${wtBranch} (${startRef}); ` +
-      `the original dir keeps its active drone binding — run \`borg reset-local-connection\` there if that binding is stale.\n`
+      `spawned sibling worktree at ${candidate} on branch ${wtBranch} (${startRef})` +
+      (existing !== null
+        ? `; the original dir keeps its active drone binding — run \`borg reset-local-connection\` there if that binding is stale.\n`
+        : '.\n'),
     );
     deps.chdir(candidate);
     deps.stderr(renderWorktreeSteeringNote(candidate, wtBranch, projectRoot));
@@ -2071,30 +2071,6 @@ export async function runAssimilate(
     deps.stderr(`warning: could not install the project-local SessionStart hook in ${agentCwd}; it will be re-attempted on the next borg launch\n`);
   }
 
-  // gh#33 (Q2/Q4/Q6): in-place wt- adoption. A freshly-spawned worktree is
-  // already at origin/main on a fresh wt- branch, so only the in-place /
-  // --here path (running in an existing checkout) needs handling. ADOPT
-  // the per-worktree branch — switch the checkout onto wt-<suffix> at
-  // origin/main when clean + merged. This both moves the drone off main
-  // (Q4: main is never a working branch) AND brings the branch current,
-  // which a bare ff-sync would not do (it would leave a main checkout on
-  // main — the gap two-of-four-CR 27af1001 + QA c7a0c615 caught). Dirty ->
-  // skip + surface; unmerged HEAD -> block + surface; NEVER discards.
-  // Using adoptWorktree (HEAD-merged check + explicit `switch -C wtBranch
-  // ref`) also closes one-of-four-CR's compute-name-vs-current-branch NIT.
-  // Best-effort: a skip/block surfaces but never blocks the launch.
-  if (!spawnedWorktreePath) {
-    deps.runSync('git', ['fetch', 'origin', '--prune'], agentCwd);
-    const wtBranch = perWorktreeBranchName(basename(agentCwd), basename(projectRoot));
-    const adopt = adoptWorktree(deps.runSync, agentCwd, wtBranch, 'origin/main');
-    if (adopt.action === 'adopted') {
-      deps.stderr(`worktree: adopted branch ${wtBranch} at origin/main\n`);
-      deps.stderr(renderInPlaceWorktreeNote(agentCwd, wtBranch));
-    } else if (adopt.message) {
-      deps.stderr(`worktree sync: ${adopt.message}\n`);
-    }
-  }
-
   // BUG-5 / v0.9.3: probe MCP readiness before launching claude so
   // the launched session sees tools at startup. Non-blocking: probe
   // failure surfaces a stderr warning but the launch proceeds (the
@@ -2280,14 +2256,6 @@ function renderWorktreeSteeringNote(worktreePath: string, wtBranch: string, prim
   );
 }
 
-function renderInPlaceWorktreeNote(worktreePath: string, wtBranch: string): string {
-  return (
-    `\nWORKTREE STEERING: This checkout is now on branch ${wtBranch}. ` +
-    `Do ALL work HERE in ${worktreePath} — cut your feature branch (fix/.../feat/...) off ${wtBranch}, ` +
-    `use relative paths / your cwd.\n`
-  );
-}
-
 /**
  * Sprint 4 / gh#147 (drone-8 SR-PE-FINDING-1): strip ASCII control
  * characters before interpolating subprocess stderr into operator-

package/src/assimilate-deps.ts

@@ -203,8 +203,7 @@ export function buildDefaultAssimilateDeps(
       if (!record) return null;
       return { operation: record.operation, roleId: record.roleId, credentialRef: seatRef(record) };
     },
-    probeSeat: (sessionToken, apiUrl, serverTrustIdentity) =>
-      defaultProbeSeat(sessionToken, apiUrl, serverTrustIdentity),
+    probeSeat: (seat) => defaultProbeSeat(seat as import('./cubes.js').ActiveCube),
     setActiveCube: (a) => cubesSetActive(a),
     // Single-store FINALIZE: the merged activate+bind (reached via the injected
     // `activate` thunk from sendBorgServerAttach) stamps the exact

package/src/backends/launch-all-pastelist.ts

@@ -1,5 +1,5 @@
 // gh#556 Part 2 — pastelist backend (never-fail floor, spec §4.3).
-// Prints copy-pasteable `cd <dir> && borg assimilate --here` lines.
+// Prints copy-pasteable `cd <dir> && borg launch <droneId>` lines.
 
 import type { DroneCandidate } from '../launch-all-discovery.js';
 import type { LaunchAllDeps } from '../launch-all-deps.js';
@@ -13,6 +13,6 @@ export function runPastelistBackend(
   deps.stdout('# borg launch-all: open each worktree in a terminal window and run:\n\n');
   for (const c of candidates) {
     // No keep-open-on-fail: the operator owns their own shell in pastelist mode.
-    deps.stdout(buildLaunchCommand(c.worktreeDir, borgPath) + '\n');
+    deps.stdout(buildLaunchCommand(c, borgPath) + '\n');
   }
 }

package/src/backends/launch-all-terminals.ts

@@ -53,7 +53,7 @@ async function launchMacOS(candidates: DroneCandidate[], opts: TerminalsOpts, de
   for (let i = 0; i < candidates.length; i++) {
     const c = candidates[i];
     if (i > 0 && opts.launchDelayMs > 0) await opts.sleep(opts.launchDelayMs); // rate-limit stagger
-    const cmd = buildLaunchCommand(c.worktreeDir, opts.borgPath);
+    const cmd = buildLaunchCommand(c, opts.borgPath);
     const title = composeTerminalTitle({ label: c.droneLabel, cubeName: opts.cubeName }, '');
     const script = hasITerm
       ? `tell application "iTerm"\n  if (count of windows) = 0 then\n    set launchedWindow to (create window with default profile command "${appleScriptEscape(cmd)}")\n    tell current session of launchedWindow to set name to "${appleScriptEscape(title)}"\n  else\n    tell current window\n      set launchedTab to (create tab with default profile command "${appleScriptEscape(cmd)}")\n      tell current session of launchedTab to set name to "${appleScriptEscape(title)}"\n    end tell\n  end if\nend tell`
@@ -88,7 +88,7 @@ async function launchLinux(candidates: DroneCandidate[], opts: TerminalsOpts, de
     const title = composeTerminalTitle({ label: c.droneLabel, cubeName: opts.cubeName }, '');
     const cmd =
       `printf '\\033]0;%s\\007' ${shellEscape(title)}; ` +
-      buildLaunchCommand(c.worktreeDir, opts.borgPath, { keepOpenOnFail: true });
+      buildLaunchCommand(c, opts.borgPath, { keepOpenOnFail: true });
     // `<term> -e sh -c '<cmd>'` opens a new window running the command.
     deps.runSync(term, ['-e', 'sh', '-c', cmd]);
     writeLockMarker(deps, c.cubeId, c.droneLabel, c.worktreeDir, opts.launchedAtISO);

package/src/backends/launch-all-tmux.ts

@@ -1,6 +1,6 @@
 // gh#556 Part 2 — tmux backend (primary, spec §4.1).
 // One detached `borg-<cube>` session, one window per drone, each running
-// `borg assimilate --here`. Idempotent: reuses an existing session (adds windows).
+// `borg launch <droneId>`. Idempotent: reuses an existing session (adds windows).
 
 import type { DroneCandidate } from '../launch-all-discovery.js';
 import type { LaunchAllDeps } from '../launch-all-deps.js';
@@ -33,7 +33,7 @@ export async function runTmuxBackend(
     const c = candidates[i];
 
     // Rate-limit stagger: wait BEFORE each launch after the first, so a fleet's
-    // agents don't all bootstrap (assimilate + regen + roster) simultaneously and
+    // agents don't all bootstrap (launch + regen + roster) simultaneously and
     // trip the per-user/IP limiter. Window creation is ~instant otherwise, so
     // without this N agents start within ~100ms. 0 → no delay (first never waits).
     if (i > 0 && launchDelayMs > 0) {
@@ -59,7 +59,7 @@ export async function runTmuxBackend(
     // tmux-level window name (status bar). The agent's own OSC-0 may update it later.
     deps.runSync('tmux', ['rename-window', '-t', windowId, c.droneLabel]);
 
-    const cmd = buildLaunchCommand(c.worktreeDir, borgPath, { keepOpenOnFail: true });
+    const cmd = buildLaunchCommand(c, borgPath, { keepOpenOnFail: true });
     deps.runSync('tmux', ['send-keys', '-t', windowId, cmd, 'Enter']);
 
     // Lock marker written immediately after dispatch (best-effort liveness signal).

package/src/bare-launch-menu.ts

@@ -1,9 +1,9 @@
 /**
  * gh#853 — bare `borg` (no-args) interactive launch menu.
  *
- * When `borg` is run with NO arguments in a TTY outside an active seat, offer
- * a small launch selector. In a repository with live sibling drones, those
- * drones come first; otherwise the existing agent choices remain unchanged.
+ * When `borg` is run with NO arguments in a TTY from a repository's main
+ * worktree, offer a small launch selector. A linked worktree still resumes its
+ * own drone directly, so selecting a sibling from the menu cannot recurse.
  *
  * The option-set, the selection→action mapping, and the show/collapse decision
  * are pure functions so they're unit-testable without a real TTY. claude.ts
@@ -11,10 +11,11 @@
  * gates on shouldShowLaunchMenu, runs the orchestrator with the real readline
  * prompt, then dispatches the returned action.
  *
- * Load-bearing safety: TTY-only + bare-args-only + no-active-seat
+ * Load-bearing safety: TTY-only + bare-args-only + main-worktree-only
  * (shouldShowLaunchMenu), so scripted/programmatic invocations and direct
- * worktree resumes are untouched.
+ * linked-worktree resumes are untouched.
  */
+import { isAbsolute } from 'node:path';
 import type { ActiveCube, BorgCli } from './cubes.js';
 import type { DroneCandidate } from './launch-all-discovery.js';
 import type { SeatStatus } from './seat-probe.js';
@@ -44,6 +45,8 @@ export interface LaunchMenuInputs {
   otherConfiguredClis: BorgCli[];
   /** True iff the current menu context has launch-all targets. */
   hasLaunchAllTargets: boolean;
+  /** Legacy drone saved in the repository's main worktree, resumed in this process. */
+  currentDrone?: { droneLabel: string; worktree: string; status: SeatStatus };
   /** Live sibling drones offered before the unattached launch choices. */
   droneCandidates?: LaunchMenuDroneCandidate[];
   /** Cube selected by the sibling-drone context for its launch-all action. */
@@ -60,7 +63,12 @@ interface LaunchMenuCandidateDeps {
   probeSeat: (candidate: DroneCandidate) => Promise<SeatStatus>;
 }
 
-const TERMINAL_SEAT_STATUSES = new Set<SeatStatus>([
+export type TerminalLaunchMenuSeatStatus = Extract<
+  SeatStatus,
+  'evicted' | 'revoked' | 'rejected' | 'credential-rejected' | 'trust-mismatch'
+>;
+
+const TERMINAL_SEAT_STATUSES = new Set<TerminalLaunchMenuSeatStatus>([
   'evicted',
   'revoked',
   'rejected',
@@ -68,6 +76,29 @@ const TERMINAL_SEAT_STATUSES = new Set<SeatStatus>([
   'trust-mismatch',
 ]);
 
+export function isTerminalLaunchMenuSeatStatus(
+  status: SeatStatus,
+): status is TerminalLaunchMenuSeatStatus {
+  return TERMINAL_SEAT_STATUSES.has(status as TerminalLaunchMenuSeatStatus);
+}
+
+export function terminalLaunchMenuSeatRefusal(status: TerminalLaunchMenuSeatStatus): string {
+  const reason: Record<TerminalLaunchMenuSeatStatus, string> = {
+    evicted: 'the server reports that it was evicted',
+    revoked: 'its local session was revoked',
+    rejected: 'its local session was superseded by a newer enrollment',
+    'credential-rejected': 'its saved credential was rejected',
+    'trust-mismatch': 'the saved server identity no longer matches',
+  };
+  const recovery = status === 'trust-mismatch'
+    ? 'Verify that this is the expected server; if it was re-initialized, restore the expected identity before relaunching.\n'
+    : 'Run `borg reset-local-connection`, then `borg assimilate` to start a replacement managed-worktree drone.\n';
+  return (
+    `This worktree's saved drone cannot be resumed because ${reason[status]}. ` +
+    `No agent was launched and nothing was changed. ${recovery}`
+  );
+}
+
 /**
  * Find linked sibling worktrees that still own their preferred active seat.
  * Authoritative terminal probe results are omitted; transient/unknown probe
@@ -99,7 +130,7 @@ export async function discoverLiveLaunchMenuCandidates(
     } catch {
       status = 'indeterminate';
     }
-    if (TERMINAL_SEAT_STATUSES.has(status)) continue;
+    if (isTerminalLaunchMenuSeatStatus(status)) continue;
 
     const key = `${candidate.cubeId}\0${candidate.droneId}\0${candidate.worktreeDir}`;
     if (seen.has(key)) continue;
@@ -145,41 +176,37 @@ export function configureSelectedLaunchCli(
 const PRETTY: Record<BorgCli, string> = { claude: 'Claude', codex: 'Codex', opencode: 'OpenCode' };
 
 /**
- * Gate: the menu fires ONLY for bare `borg` (no args) in a TTY without an
- * active seat. Explicit invocations, non-TTY launches, and direct worktree
- * resumes fall straight through to the existing launch path.
+ * Git reports the main worktree with identical absolute git-dir/common-dir
+ * paths. Linked worktrees instead use <common>/worktrees/<name> as git-dir.
+ * Fail closed when either probe is absent or malformed.
+ */
+export function isMainGitWorktree(
+  readGitPath: (args: string[]) => string,
+): boolean {
+  try {
+    const gitDir = readGitPath(['rev-parse', '--path-format=absolute', '--git-dir']).trim();
+    const commonDir = readGitPath(['rev-parse', '--path-format=absolute', '--git-common-dir']).trim();
+    return isAbsolute(gitDir) && isAbsolute(commonDir) && gitDir === commonDir;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Gate: the menu fires ONLY for bare `borg` (no args) in a TTY from the main
+ * repository worktree. Explicit invocations, non-TTY launches, and linked
+ * worktree resumes fall straight through to the existing launch path.
  */
 export function shouldShowLaunchMenu(args: {
   extraArgs: string[];
   stdinIsTTY: boolean;
   stdoutIsTTY: boolean;
-  hasActiveSeat?: boolean;
+  isMainWorktree: boolean;
 }): boolean {
   return args.extraArgs.length === 0
     && args.stdinIsTTY
     && args.stdoutIsTTY
-    && !args.hasActiveSeat;
-}
-
-export function explicitCliLaunchHint(args: {
-  explicitCli: BorgCli | undefined;
-  stdinIsTTY: boolean;
-  stdoutIsTTY: boolean;
-  hasActiveCube: boolean;
-  hasLaunchAllTargets: boolean;
-}): string | null {
-  if (!args.explicitCli || !args.stdinIsTTY || !args.stdoutIsTTY) return null;
-  if (!args.hasActiveCube || !args.hasLaunchAllTargets) return null;
-  return `borg --cli ${args.explicitCli} launches ${PRETTY[args.explicitCli]} directly; use bare borg for the launch menu or borg launch-all --cli ${args.explicitCli} for all drone worktrees.\n`;
-}
-
-export function shouldResolveExplicitCliLaunchHintTargets(args: {
-  explicitCli: BorgCli | undefined;
-  stdinIsTTY: boolean;
-  stdoutIsTTY: boolean;
-  hasActiveCube: boolean;
-}): boolean {
-  return Boolean(args.explicitCli && args.stdinIsTTY && args.stdoutIsTTY && args.hasActiveCube);
+    && args.isMainWorktree;
 }
 
 /**
@@ -188,14 +215,25 @@ export function shouldResolveExplicitCliLaunchHintTargets(args: {
  * middle option never produces a "1) … 3) …" gap menu.
  */
 export function buildLaunchMenuOptions(inputs: LaunchMenuInputs): LaunchMenuOption[] {
-  if (inputs.droneCandidates && inputs.droneCandidates.length > 0) {
-    const options: LaunchMenuOption[] = [...inputs.droneCandidates]
+  const currentDrone = inputs.currentDrone && !isTerminalLaunchMenuSeatStatus(inputs.currentDrone.status)
+    ? inputs.currentDrone
+    : undefined;
+  if (currentDrone || (inputs.droneCandidates && inputs.droneCandidates.length > 0)) {
+    const options: LaunchMenuOption[] = [];
+    if (currentDrone) {
+      options.push({
+        key: '1',
+        label: `Resume ${currentDrone.droneLabel} (${currentDrone.worktree})`,
+        action: { kind: 'launch', cli: inputs.defaultCli },
+      });
+    }
+    options.push(...[...(inputs.droneCandidates ?? [])]
       .sort((a, b) => a.droneLabel.localeCompare(b.droneLabel) || a.worktree.localeCompare(b.worktree))
       .map((candidate, index) => ({
-        key: String(index + 1),
+        key: String(options.length + index + 1),
         label: `Resume ${candidate.droneLabel} (${candidate.worktree})`,
         action: { kind: 'launch-seat' as const, target: candidate.target },
-      }));
+      })));
     if (inputs.hasLaunchAllTargets) {
       options.push({
         key: String(options.length + 1),
@@ -206,15 +244,19 @@ export function buildLaunchMenuOptions(inputs: LaunchMenuInputs): LaunchMenuOpti
         },
       });
     }
-    options.push({
-      key: String(options.length + 1),
-      label: `Launch ${PRETTY[inputs.defaultCli]} here without a drone`,
-      action: { kind: 'launch', cli: inputs.defaultCli },
-    });
+    if (!currentDrone) {
+      options.push({
+        key: String(options.length + 1),
+        label: `Launch ${PRETTY[inputs.defaultCli]} here without a drone`,
+        action: { kind: 'launch', cli: inputs.defaultCli },
+      });
+    }
     for (const cli of inputs.otherConfiguredClis) {
       options.push({
         key: String(options.length + 1),
-        label: `Launch with ${PRETTY[cli]} here without a drone (one-shot)`,
+        label: currentDrone
+          ? `Resume ${currentDrone.droneLabel} with ${PRETTY[cli]} (one-shot)`
+          : `Launch with ${PRETTY[cli]} here without a drone (one-shot)`,
         action: { kind: 'launch', cli },
       });
     }
@@ -263,10 +305,10 @@ export function renderLaunchMenu(options: LaunchMenuOption[]): string {
 }
 
 /**
- * Orchestrate the menu with an injected readline-style prompt. Collapses to a
- * direct default launch (no render, no prompt) when only option 1 applies.
- * Re-prompts on invalid input up to `maxAttempts`, then falls back to the safe
- * default (option 1) so a fat-fingered session still launches.
+ * Orchestrate the menu with an injected readline-style prompt. The caller has
+ * already established that this is a bare interactive main-worktree launch,
+ * so even a one-item selector is rendered. Re-prompts on invalid input up to
+ * `maxAttempts`, then falls back to the safe default (option 1).
  */
 export async function runBareLaunchMenu(
   inputs: LaunchMenuInputs,
@@ -274,7 +316,6 @@ export async function runBareLaunchMenu(
   opts: { maxAttempts?: number; warn?: (message: string) => void } = {}
 ): Promise<LaunchMenuAction> {
   const options = buildLaunchMenuOptions(inputs);
-  if (options.length === 1) return options[0].action; // collapse — never a 1-item menu
 
   const maxAttempts = opts.maxAttempts ?? 3;
   const menu = renderLaunchMenu(options);

package/src/claude.ts

@@ -65,12 +65,14 @@ import { discoverDroneCandidates } from './launch-all-discovery.js';
 import {
   configureSelectedLaunchCli,
   discoverLiveLaunchMenuCandidates,
-  explicitCliLaunchHint,
+  isMainGitWorktree,
+  isTerminalLaunchMenuSeatStatus,
   runBareLaunchMenu,
-  shouldResolveExplicitCliLaunchHintTargets,
   shouldShowLaunchMenu,
+  terminalLaunchMenuSeatRefusal,
   type LaunchMenuAction,
 } from './bare-launch-menu.js';
+import type { SeatStatus } from './seat-probe.js';
 import { setTerminalTitle } from './terminal-title.js';
 import { initConsolePrefix, consolePrefix } from './console-prefix.js';
 import { initDebugFromArgv } from './debug.js';
@@ -372,34 +374,13 @@ async function main() {
   // Active cube for this directory — needed for the launch menu's option-3
   // availability, the terminal title, and the inbox-Monitor clause below.
   const active = await getActiveCube();
-  let launchAllTargetsAvailable: boolean | undefined;
-  const hasLaunchAllTargets = async (): Promise<boolean> => {
-    if (!active) return false;
-    if (launchAllTargetsAvailable === undefined) {
-      const candidates = await discoverDroneCandidates(
-        { targetCubeId: active.cubeId },
-        buildDefaultLaunchAllDeps()
-      );
-      launchAllTargetsAvailable = candidates.length > 0;
-    }
-    return launchAllTargetsAvailable;
-  };
+  const launchAllDeps = buildDefaultLaunchAllDeps();
+  const isMainWorktree = isMainGitWorktree((args) =>
+    launchAllDeps.runSync('git', args, { cwd: process.cwd() })
+  );
 
   const stdinIsTTY = process.stdin.isTTY === true;
   const stdoutIsTTY = process.stdout.isTTY === true;
-  const explicitCliHint = explicitCliLaunchHint({
-    explicitCli: parsedCli.cli,
-    stdinIsTTY,
-    stdoutIsTTY,
-    hasActiveCube: active !== null,
-    hasLaunchAllTargets: shouldResolveExplicitCliLaunchHintTargets({
-      explicitCli: parsedCli.cli,
-      stdinIsTTY,
-      stdoutIsTTY,
-      hasActiveCube: active !== null,
-    }) ? await hasLaunchAllTargets() : false,
-  });
-  if (explicitCliHint) process.stderr.write(explicitCliHint);
 
   // gh#853: bare `borg` (no args) interactive launch menu. TTY-only + bare-args-
   // only (shouldShowLaunchMenu) so every scripted/programmatic `borg` and every
@@ -412,11 +393,22 @@ async function main() {
       extraArgs: process.argv.slice(2),
       stdinIsTTY,
       stdoutIsTTY,
-      hasActiveSeat: active !== null,
+      isMainWorktree,
     })
   ) {
-    const launchAllDeps = buildDefaultLaunchAllDeps();
     const seatCommandDeps = buildDefaultSeatCommandDeps();
+    let currentDroneStatus: SeatStatus | null = null;
+    if (active) {
+      try {
+        currentDroneStatus = await launchAllDeps.probeSeat(active);
+      } catch {
+        currentDroneStatus = 'indeterminate';
+      }
+      if (isTerminalLaunchMenuSeatStatus(currentDroneStatus)) {
+        process.stderr.write(terminalLaunchMenuSeatRefusal(currentDroneStatus));
+        process.exit(1);
+      }
+    }
     const siblingContext = await discoverLiveLaunchMenuCandidates({
       readAllProjectIdentities: launchAllDeps.readAllProjectIdentities,
       discoverDroneCandidates: (cubeId) => discoverDroneCandidates(
@@ -425,11 +417,7 @@ async function main() {
       ),
       getActiveSeatForWorktree: seatCommandDeps.getActiveSeatForWorktree,
       pathExists: launchAllDeps.pathExists,
-      probeSeat: (candidate) => launchAllDeps.probeSeat(
-        candidate.sessionToken,
-        candidate.apiUrl,
-        candidate.serverTrustIdentity,
-      ),
+      probeSeat: (candidate) => launchAllDeps.probeSeat(candidate.seat),
     });
     const otherConfiguredClis = configuredCliNames(
       detectCliAvailability(),
@@ -440,6 +428,15 @@ async function main() {
         defaultCli: cli,
         otherConfiguredClis,
         hasLaunchAllTargets: siblingContext.launchAllCubeId !== undefined,
+        ...(active && currentDroneStatus
+          ? {
+              currentDrone: {
+                droneLabel: active.droneLabel,
+                worktree: active.worktree ?? findProjectRoot(process.cwd()),
+                status: currentDroneStatus,
+              },
+            }
+          : {}),
         droneCandidates: siblingContext.candidates,
         ...(siblingContext.launchAllCubeId
           ? { launchAllCubeId: siblingContext.launchAllCubeId }

package/src/cleanup-cmd.ts

@@ -97,11 +97,7 @@ export interface CleanupDeps {
   /** Enumerate borg-managed seats from the central cubes.json. */
   listSeats?: () => Promise<Array<{ projectPath: string; cube: ActiveCube }>>;
   /** Probe ONE seat's eviction status using ITS OWN token (gh#877). */
-  probeSeat?: (
-    sessionToken: string,
-    apiUrl: string,
-    serverTrustIdentity?: string,
-  ) => Promise<SeatStatus>;
+  probeSeat?: (seat: ActiveCube) => Promise<SeatStatus>;
   /** realpath resolver — injected so tests can model symlink escape. */
   realpath?: (p: string) => string;
   stdout?: (line: string) => void;
@@ -337,11 +333,15 @@ async function classifyWorktree(
   }
 
   // (5) ONLY now probe eviction with the worktree's OWN seat token (S1).
-  const status = await deps.probeSeat(
-    seat.sessionToken,
-    seat.apiUrl,
-    seat.serverTrustIdentity,
-  );
+  let status: SeatStatus;
+  try {
+    status = await deps.probeSeat(seat);
+  } catch {
+    return {
+      reason: 'UNKNOWN-indeterminate',
+      detail: 'probe failed — not deleting',
+    };
+  }
   switch (status) {
     case 'evicted':
       return { reason: 'PRUNABLE', detail: '410 DRONE_EVICTED (clean + merged)' };