borgmcp 3.9.0 → 3.11.0

package/src/clone-security.ts

@@ -0,0 +1,40 @@
+/** Redaction and fail-closed credential detection for untrusted Git remotes. */
+
+const URL_USERINFO_RE = /([a-z][a-z0-9+.-]*:\/\/)([^/\s@]+)@/gi;
+const URL_SUFFIX_RE = /([a-z][a-z0-9+.-]*:\/\/[^\s?#)]+)([?#])[^\s)]*/gi;
+const NAMED_SECRET_RE = /([?&](?:access[_-]?token|api[_-]?key|auth(?:entication)?|credential|password|passwd|private[_-]?key|secret|token)=)[^&#\s)]+/gi;
+const NAMED_SECRET_TEST_RE = new RegExp(NAMED_SECRET_RE.source, 'i');
+const OPTION_SECRET_RE = /((?:^|[\s("'`])--(?:access[_-]?token|api[_-]?key|auth(?:entication)?|credential|password|passwd|private[_-]?key|secret|token)=)[^\s)]*/gi;
+const SCP_REMOTE_RE = /^[^@\s/:]+@[^:\s]+:[^\s]+$/;
+
+export function redactCloneSecrets(value: string): string {
+  return value
+    .replace(URL_USERINFO_RE, '$1<credentials>@')
+    .replace(URL_SUFFIX_RE, '$1$2<redacted>')
+    .replace(NAMED_SECRET_RE, '$1<redacted>')
+    .replace(OPTION_SECRET_RE, '$1<redacted>')
+    .replace(/(^|[\s("'`])[^/\s:@]+:[^@\s/]+@(?=[^\s/])/g, '$1<credentials>@');
+}
+
+/**
+ * True means the value must never reach subprocess argv, output, or Git config.
+ * Opaque `scheme:...@...` forms fail closed; URL() accepts those but exposes no
+ * username/password fields, which is precisely the class that escaped the old flow.
+ */
+export function hasCloneCredentials(value: string): boolean {
+  if (NAMED_SECRET_TEST_RE.test(value)) return true;
+  if (SCP_REMOTE_RE.test(value)) return false;
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(value)?.[1].toLowerCase();
+  if (scheme && !value.toLowerCase().startsWith(`${scheme}://`) && scheme !== 'file') {
+    return value.includes('@');
+  }
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol === 'ssh:' || parsed.protocol === 'git+ssh:') {
+      return parsed.password.length > 0;
+    }
+    return parsed.username.length > 0 || parsed.password.length > 0;
+  } catch {
+    return /[^/\s:@]+:[^@\s/]+@/.test(value);
+  }
+}

package/src/cubes.ts

@@ -91,8 +91,8 @@ export class LaunchSeatIdentityChangedError extends Error {
 
   constructor(droneLabel: string) {
     super(
-      `borg launch: did not launch '${droneLabel}' — its seat registration changed before the launch could start. ` +
-      'Run `borg seats` to see the current state, then try again.',
+      `borg launch: did not launch '${droneLabel}' — its registration changed before the launch could start. ` +
+      'Run `borg drones` to see the current state, then try again.',
     );
     this.name = 'LaunchSeatIdentityChangedError';
   }

package/src/index.ts

@@ -133,6 +133,7 @@ import { resolveReportableSessionAgentKind } from './agent-runtime.js';
 import {
   connectOpenCodeDrone,
   injectOpenCodeEntry,
+  settleOpenCodeEntry,
   configuredOpenCodePort,
   OPEN_CODE_PORT_MISSING_DIAGNOSTIC,
   openCodeLaunchBinding,
@@ -314,7 +315,9 @@ export async function main() {
       installBorgPlugin();
       const active = await getActiveCube();
       if (active && openCodeRuntime) {
-        if (await connectOpenCodeRuntime(active)) setModuleInjectOpenCode(injectOpenCodeEntry);
+        if (await connectOpenCodeRuntime(active)) {
+          setModuleInjectOpenCode(injectOpenCodeEntry, settleOpenCodeEntry);
+        }
       }
     },
   };

package/src/launch-all-cmd.ts

@@ -16,6 +16,9 @@ import { runPastelistBackend } from './backends/launch-all-pastelist.js';
 
 type Backend = 'tmux' | 'terminals' | 'pastelist';
 
+/** Internal strict-seam result: requested sessions were not dispatched. */
+export const LAUNCH_ALL_NO_DISPATCH_EXIT_CODE = 2;
+
 const TMUX_INSTALL_HINT =
   'borg launch-all: tmux not found.\n' +
   '  macOS:  brew install tmux\n' +
@@ -239,6 +242,12 @@ export interface RunLaunchAllOptions {
   sleep?: (ms: number) => Promise<void>;
   nowISO?: () => string;
   borgPath?: string;
+  /** Internal quickstart filter: launch only the requested staffed roster. */
+  droneIds?: readonly string[];
+  /** Fail when any requested registered drone cannot be discovered or launched. */
+  requireAllRequested?: boolean;
+  /** Internal resolved target avoids ambiguous same-name lookup during composition. */
+  targetCube?: { cubeId: string; name: string };
 }
 
 export async function runLaunchAll(
@@ -253,7 +262,7 @@ export async function runLaunchAll(
   const launchDelayMs = resolveLaunchDelayMs(args.flags.launchDelayMs, deps.getEnv('BORG_LAUNCH_DELAY_MS'));
 
   // 1. resolve target cube
-  const resolved = await resolveTargetCube(args, deps);
+  const resolved = opts.targetCube ?? await resolveTargetCube(args, deps);
   if ('error' in resolved) {
     deps.stderr(`borg launch-all: ${resolved.error}\n`);
     return 1;
@@ -264,7 +273,18 @@ export async function runLaunchAll(
   sweepStaleLocks(deps, cubeId, now());
 
   // 3. discover candidates
-  const discovered = await discoverDroneCandidates({ targetCubeId: cubeId, only: args.flags.only }, deps);
+  let discovered = await discoverDroneCandidates({ targetCubeId: cubeId, only: args.flags.only }, deps);
+  if (opts.droneIds !== undefined) {
+    const requested = new Set(opts.droneIds);
+    discovered = discovered.filter((candidate) => requested.has(candidate.droneId));
+    if (opts.requireAllRequested && discovered.length !== requested.size) {
+      deps.stderr(
+        `borg launch-all: found ${discovered.length} of ${requested.size} requested registered drone worktrees; ` +
+        'nothing was launched. Run `borg drones` to inspect the missing local registration.\n',
+      );
+      return 1;
+    }
+  }
   if (discovered.length === 0) {
     if (args.flags.only !== undefined) {
       deps.stdout(`No worktrees matched --only '${args.flags.only}' for cube '${cubeName}'\n`);
@@ -392,6 +412,14 @@ export async function runLaunchAll(
     }
     launchable.push(c);
   }
+  const terminalSkipCount = evictedCount + revokedCount + rejectedCount + trustMismatchCount + credentialRejectedCount;
+  if (opts.requireAllRequested && terminalSkipCount > 0) {
+    deps.stderr(
+      `borg launch-all: ${terminalSkipCount} requested registered drone(s) are not launchable; ` +
+      'nothing was launched. Resolve the cause reported above, then retry.\n',
+    );
+    return 1;
+  }
   if (launchable.length === 0) {
     // Accurate cause counts — an all-rejected sweep must NOT claim "evicted"
     // (and vice-versa). Only name a cause when at least one seat hit it.
@@ -441,6 +469,13 @@ export async function runLaunchAll(
     deps.stderr(sel.hardFail);
     return 1;
   }
+  if (sel.backend === 'pastelist' && opts.requireAllRequested) {
+    deps.stderr(
+      'borg launch-all: pastelist mode prints commands for manual use but does not launch sessions; ' +
+      'nothing was launched. Run `borg launch-all` separately to print the commands.\n',
+    );
+    return LAUNCH_ALL_NO_DISPATCH_EXIT_CODE;
+  }
   const sessionName = sanitizeSessionName(cubeName);
   const launchStartISO = nowISO();
 

package/src/log-stream.ts

@@ -59,6 +59,7 @@ import { formatCubeActivityWakeMessage } from './cube-activity-wake-copy.js';
 import { readBoundedResponseBody } from './server-response.js';
 import { BorgServerError } from './server-errors.js';
 import { markSeatRejected } from './seats.js';
+import { hasPendingWakeEntry as hasPendingDurableWakeEntry } from './remote-client.js';
 import {
   acquireStreamLease,
   readOwnershipSnapshot,
@@ -124,13 +125,16 @@ function isProcessAlive(pid: number): boolean {
  * Used by defaultDeps when no explicit injectOpenCode is supplied.
  */
 let _moduleInjectOpenCode:
-  | ((text: string, entryId: string, allowSubmit: boolean) => Promise<boolean>)
+  | ((text: string, entryId: string, allowSubmit: boolean, sourceEntryId?: string) => Promise<boolean>)
   | undefined;
+let _moduleSettleOpenCodeEntry: ((sourceEntryId: string) => void) | undefined;
 
 export function setModuleInjectOpenCode(
-  fn: (text: string, entryId: string, allowSubmit: boolean) => Promise<boolean>
+  fn: (text: string, entryId: string, allowSubmit: boolean, sourceEntryId?: string) => Promise<boolean>,
+  settle: (sourceEntryId: string) => void,
 ): void {
   _moduleInjectOpenCode = fn;
+  _moduleSettleOpenCodeEntry = settle;
 }
 
 /**
@@ -403,8 +407,13 @@ export interface StreamDeps {
   injectOpenCode?: (
     text: string,
     entryId: string,
-    allowSubmit: boolean
+    allowSubmit: boolean,
+    sourceEntryId?: string,
   ) => Promise<boolean>;
+  /** Inspect whether one retry source remains beyond the durable unread cursor. */
+  hasPendingWakeEntry?: (active: ActiveCube, entryId: string) => Promise<boolean>;
+  /** Clear in-process retry diagnostics after the durable entry is consumed. */
+  settleOpenCodeEntry?: (sourceEntryId: string) => void;
 }
 
 const defaultDeps: Required<StreamDeps> = {
@@ -420,10 +429,15 @@ const defaultDeps: Required<StreamDeps> = {
   abortSignal: new AbortController().signal,
   ownerDeps: {},
   ownerStaleMs: 70_000,
-  injectOpenCode: (text, entryId, allowSubmit) =>
+  injectOpenCode: (text, entryId, allowSubmit, sourceEntryId) =>
     _moduleInjectOpenCode
-      ? _moduleInjectOpenCode(text, entryId, allowSubmit)
+      ? _moduleInjectOpenCode(text, entryId, allowSubmit, sourceEntryId)
       : Promise.resolve(false),
+  hasPendingWakeEntry: (active, entryId) => hasPendingDurableWakeEntry(
+    active as Parameters<typeof hasPendingDurableWakeEntry>[0],
+    entryId,
+  ),
+  settleOpenCodeEntry: (sourceEntryId) => _moduleSettleOpenCodeEntry?.(sourceEntryId),
 };
 
 // ------------------------------------------------------------------
@@ -678,6 +692,8 @@ export async function streamOnce(
     hwmDivergenceGraceMs,
     abortSignal,
     injectOpenCode,
+    hasPendingWakeEntry,
+    settleOpenCodeEntry,
   } = { ...defaultDeps, ...deps };
 
   assertUuidShape(active.cubeId, 'cube_id');
@@ -819,6 +835,17 @@ export async function streamOnce(
     pendingHwmDivergence = { hwm, timer };
   };
 
+  const shouldDeliverWakeRetry = async (entryId: string): Promise<boolean> => {
+    try {
+      if (await hasPendingWakeEntry(active, entryId)) return true;
+      settleOpenCodeEntry(entryId);
+    } catch {
+      // A retry is never authoritative enough to cross the model boundary on
+      // its own. The durable inbox and a later retry remain available.
+    }
+    return false;
+  };
+
   // Bounded recent-id set for replay-on-reconnect dedup per spec §(3).
   // Set + FIFO array for O(1) membership + bounded memory.
   const recentIds = new Set<string>();
@@ -844,6 +871,10 @@ export async function streamOnce(
     const line = formatInboxLine(withSseEventId(ev.data, ev.id));
     const deliveryId = ev.wake_nonce ?? ev.id;
     const isReping = ev.wake_nonce !== undefined;
+    if (isReping && !(await shouldDeliverWakeRetry(ev.id))) {
+      markEventPersisted(ev.id, ev.data?.created_at ?? '');
+      return 'persisted-skip';
+    }
     const eventHwm = ev.data?.created_at
       ? { id: ev.id, created_at: ev.data.created_at }
       : null;
@@ -867,12 +898,11 @@ export async function streamOnce(
       await hasInboxEntryId(active.cubeId, active.droneId, ev.id, line)
     );
     if (alreadyPersisted) {
-      // An ordinary entry at/before the persisted cursor is already delivered
-      // and must not re-enter the OpenCode queue. Re-pings are the explicit
-      // exception: each wake nonce is a new delivery identity even when the
-      // underlying inbox line is already durable.
+      // An ordinary entry at/before the persisted cursor must not re-enter the
+      // OpenCode queue. A still-unread re-ping may reconcile the prior attempt;
+      // its source entry ID prevents a new nonce from resubmitting that prompt.
       if (isReping) {
-        await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true);
+        await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true, ev.id);
       }
       markEventPersisted(ev.id, ev.data?.created_at ?? '');
       return 'persisted-skip';
@@ -880,7 +910,10 @@ export async function streamOnce(
     // The inbox append is the durable record. OpenCode injection is only the
     // wake attempt and may return before the agent finishes processing.
     await appendLine(active.cubeId, active.droneId, line);
-    if (!(await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true))) {
+    const openCodeDelivered = isReping
+      ? await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true, ev.id)
+      : await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true);
+    if (!openCodeDelivered) {
       if (ev.wake_nonce === undefined) wakeCodex(formatCodexWakePrompt(line));
       else wakeCodex(formatCodexWakePrompt(line), ev.wake_nonce);
     }
@@ -1198,7 +1231,11 @@ export async function streamOnce(
         if (isRecentWakeReplay) {
           const line = formatInboxLine(withSseEventId(event.data, event.id));
           const wakeNonce = event.wake_nonce;
-          if (wakeNonce !== undefined && !(await injectOpenCode(formatOpenCodeWakePrompt(line), wakeNonce, true))) {
+          if (
+            wakeNonce !== undefined &&
+            await shouldDeliverWakeRetry(event.id) &&
+            !(await injectOpenCode(formatOpenCodeWakePrompt(line), wakeNonce, true, event.id))
+          ) {
             wakeCodex(formatCodexWakePrompt(line), wakeNonce);
           }
           continue;