borgmcp 4.3.0 → 4.5.0

package/src/agent-integration-health.ts

@@ -15,6 +15,7 @@ import {
   installBorgPlugin,
   openCodePluginPath,
 } from './opencode-plugin.js';
+import { openCodeStartupDiagnosticLogPath } from './opencode-drone.js';
 
 export const AGENT_HOOK_BINS = [
   'borg-regen',
@@ -292,12 +293,30 @@ export function assertAgentIntegrationHealthy(report: AgentIntegrationHealth): v
 
 export function runDoctor(options: InspectAgentIntegrationHealthOptions & {
   stdout?: (text: string) => void;
+  openCodeStartupLogPath?: string;
 } = {}): number {
   const report = inspectAgentIntegrationHealth(options);
-  (options.stdout ?? ((text) => process.stdout.write(text)))(renderAgentIntegrationHealth(report));
+  const output = renderAgentIntegrationHealth(report) + renderOpenCodeStartupDiagnostics(
+    options.openCodeStartupLogPath ?? openCodeStartupDiagnosticLogPath(),
+  );
+  (options.stdout ?? ((text) => process.stdout.write(text)))(output);
   return report.issues.length === 0 ? 0 : 1;
 }
 
+export function renderOpenCodeStartupDiagnostics(logPath: string): string {
+  try {
+    const metadata = fs.lstatSync(logPath);
+    if (metadata.isSymbolicLink() || !metadata.isFile()) {
+      return `OpenCode startup diagnostics: refused at ${logPath} (path is not a regular file)\n`;
+    }
+    const contents = fs.readFileSync(logPath, 'utf8');
+    return `OpenCode startup diagnostics (${logPath}):\n${contents.trimEnd()}\n`;
+  } catch (error) {
+    if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return '';
+    return `OpenCode startup diagnostics: unreadable at ${logPath} (${error instanceof Error ? error.message : String(error)})\n`;
+  }
+}
+
 export function warnIfAgentIntegrationUnhealthy(
   options: InspectAgentIntegrationHealthOptions & { stderr?: (text: string) => void } = {},
 ): boolean {

package/src/assimilate-cmd.ts

@@ -299,10 +299,13 @@ export interface AssimilateDeps {
    *  production; absent from unit stubs that fully mock `assimilate`. */
   finalizeServerSeat?: (input: {
     active: ActiveCube;
+    commonDir: string;
     expected: ExpectedBinding;
     activate: (binding: SeatBinding) => Promise<unknown>;
     scrubPending: () => Promise<unknown>;
   }) => Promise<FinalizeServerSeatOutcome>;
+  /** Advisory clone-family comparison for public repositories. */
+  hasActiveSeatInDifferentCloneFamily?: (cubeId: string, commonDir: string) => Promise<boolean>;
   findProjectRoot: (cwd: string) => string;
   resolveRepositoryContext: (cwd: string) => Promise<GitRepositoryContext | null>;
   getRepositoryIdentity: (context: GitRepositoryContext) => Promise<CreateCubeRepository>;
@@ -1938,6 +1941,7 @@ export async function runAssimilate(
     try {
       outcome = await deps.finalizeServerSeat({
         active: activeCube,
+        commonDir: repositoryContext.commonDir,
         expected: sessionExpected,
         activate: result.finalize.activate,
         scrubPending: result.finalize.scrubPending,
@@ -2030,6 +2034,19 @@ export async function runAssimilate(
     }
   }
 
+  if (repositoryContext.publicRepository && deps.hasActiveSeatInDifferentCloneFamily) {
+    try {
+      if (await deps.hasActiveSeatInDifferentCloneFamily(result.cube_id, repositoryContext.commonDir)) {
+        deps.stderr(
+          'warning: this cube already has a seat from a different clone family. ' +
+          'All seats for a repository use worktrees from the same clone family, sharing its object database and refs.\n',
+        );
+      }
+    } catch {
+      // This comparison is advisory and must never block assimilation.
+    }
+  }
+
   // gh#793: best-effort GC of orphaned inbox files (evicted/dead drones) in the
   // cube just joined — lazy-on-assimilate, no cron/new command. NEVER blocks or
   // fails the assimilate (whole call swallowed). Local-only signal (CubeDetail

package/src/assimilate-deps.ts

@@ -43,6 +43,7 @@ import {
 import { advanceLocalServerCursor } from './local-server-cursor.js';
 import {
   findIncompleteSiblingAttempt,
+  hasActiveSeatInDifferentCloneFamily,
   observeSeat,
   prepareSeat,
   seatRef,
@@ -214,9 +215,10 @@ export function buildDefaultAssimilateDeps(
     // missing/replaced/throw → the pending record is the rerunnable locator; the
     // caller PRESERVES the worktree). expectation-mismatch is produced upstream at
     // PREPARE (result.prepareAborted), never here.
-    finalizeServerSeat: async ({ active, activate }) => {
+    finalizeServerSeat: async ({ active, commonDir, activate }) => {
       const binding = {
         worktree: cubesFindProjectRoot(process.cwd()),
+        commonDir,
         name: active.name,
         droneLabel: active.droneLabel,
         ...(active.roleName !== undefined ? { roleName: active.roleName } : {}),
@@ -233,6 +235,7 @@ export function buildDefaultAssimilateDeps(
         ? { committed: true }
         : { committed: false, reason: 'activation-failed' };
     },
+    hasActiveSeatInDifferentCloneFamily,
     findProjectRoot: (cwd) => cubesFindProjectRoot(cwd),
     resolveRepositoryContext: resolveGitRepositoryContext,
     getRepositoryIdentity: getOrCreateRepositoryIdentity,

package/src/backends/launch-all-terminals.ts

@@ -96,14 +96,17 @@ async function launchLinux(candidates: DroneCandidate[], opts: TerminalsOpts, de
 }
 
 /**
- * Control char (incl. newline) in a worktree path. SR f94bb3fe + Coordinator
+ * Control char (incl. newline) in a worktree path. A path cannot be escaped
+ * without changing the launch target, so it remains a fail-loud rejection.
+ * Server-derived title fields are escaped separately by composeTerminalTitle.
+ * SR f94bb3fe + Coordinator
  * c6370c41 fold-in: a newline in the path breaks the macOS osascript AppleScript
  * string literal (parse error). Reject such paths up front (the user's own path;
  * pathological) — fail-loud + skip, never silently mangle. Applies to both
  * platforms defensively (the tmux primary handles control chars fine via
  * shellEscape + array-args, so this guard is terminals-backend-specific).
  */
-const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/;
+const WORKTREE_CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/;
 
 export async function runTerminalsBackend(
   candidates: DroneCandidate[],
@@ -111,7 +114,7 @@ export async function runTerminalsBackend(
   deps: LaunchAllDeps
 ): Promise<void> {
   const safe = candidates.filter((c) => {
-    if (CONTROL_CHAR_RE.test(c.worktreeDir)) {
+    if (WORKTREE_CONTROL_CHAR_RE.test(c.worktreeDir)) {
       deps.stderr(
         `skipping ${c.droneLabel} (${JSON.stringify(c.worktreeDir)}): worktree path contains a control ` +
           `character — unsafe for --mode terminals; use --mode tmux instead.\n`

package/src/cli-help.ts

@@ -117,7 +117,7 @@ export function doctorHelpText(version: string): string {
   return (
     `borg doctor (borgmcp ${version}) — inspect Borg agent integrations without changing them\n\n` +
     `Usage:\n` +
-    `  borg doctor          Run read-only checks for hook commands, hook configuration, and the OpenCode plugin\n` +
+    `  borg doctor          Run read-only checks for hook commands, OpenCode integration, and startup diagnostics\n` +
     `  borg doctor --help   Show this help\n`
   );
 }
@@ -172,7 +172,7 @@ export function topLevelHelpText(version: string): string {
     `  borg                     Show the launch menu in a repository root; resume directly in a linked worktree\n` +
     `  borg setup               Set up borg MCP server + agent CLI integration\n` +
     `  borg update              Update the client and installed local server together\n` +
-    `  borg doctor              Check agent hook commands, versions, configs, and the OpenCode plugin\n` +
+    `  borg doctor              Check agent hook commands, OpenCode integration, and startup diagnostics\n` +
     `  borg clone <url> [dir]   Clone a repository, then create and launch its cube\n` +
     `  borg quickstart          Create a cube and a drone for every role, then launch them\n` +
     `  borg assimilate [role]   Join or create a cube with one drone under one role\n` +
@@ -210,12 +210,15 @@ export function updateHelpText(version: string): string {
     `Usage:\n` +
     `  borg update             Confirm interactively, then update\n` +
     `  borg update --yes       Update without prompting (required outside a TTY)\n` +
+    `  borg update --registry <url>\n` +
+    `                          Acknowledge this exact configured npm registry for one update\n` +
     `  borg update --help      Show this help\n\n` +
     `Before changing anything, Borg reads the exact published client and server manifests,\n` +
     `requires matching exact borgmcp-shared pins, and verifies canonical npm ownership. The client is\n` +
     `installed first and the update continues under that new client before the server controller\n` +
-    `and runtime are updated. Alternate registries and unsupported or ambiguous package-manager\n` +
-    `provenance fail closed with manual-update guidance.\n\n` +
+    `and runtime are updated. An alternate configured registry requires an exact per-invocation\n` +
+    `--registry acknowledgement; registry changes refuse before any subsequent package mutation,\n` +
+    `and unsupported or ambiguous package-manager provenance fails closed.\n\n` +
     `If no local server is installed, the server phase is skipped. A failure after the client\n` +
     `succeeds is reported as partial completion with status-specific recovery. Borg never starts\n` +
     `a stopped server. After package verification, Borg replaces stale borgmcp package launch paths\n` +

package/src/index.ts

@@ -150,6 +150,7 @@ import {
   configuredOpenCodePort,
   OPEN_CODE_PORT_MISSING_DIAGNOSTIC,
   openCodeLaunchBinding,
+  writeOpenCodeStartupDiagnostic,
 } from './opencode-drone.js';
 import { installBorgPlugin } from './opencode-plugin.js';
 import { openCodeApiPasswordFromEnv } from './opencode-launch-trust.js';
@@ -172,6 +173,9 @@ import {
   runEvictDroneTool,
   runReassignDroneTool,
 } from './drone-management.js';
+
+const OPEN_CODE_IDENTITY_HANDSHAKE_TIMEOUT_MS = 5_000;
+
 /**
  * Apply a template's roles + message_taxonomy to a cube.
  *
@@ -392,8 +396,25 @@ export async function main() {
 
   let openCodeIdentityFailure: OpenCodeSeatIdentityError | null = null;
   let finishOpenCodeIdentity: (() => void) | null = null;
+  let openCodeIdentityTimeout: ReturnType<typeof setTimeout> | null = null;
+  const settleOpenCodeIdentity = () => {
+    if (openCodeIdentityTimeout) clearTimeout(openCodeIdentityTimeout);
+    openCodeIdentityTimeout = null;
+    const finish = finishOpenCodeIdentity;
+    finishOpenCodeIdentity = null;
+    finish?.();
+  };
   const openCodeIdentityReady = openCodeRuntime && !readinessProbe
-    ? new Promise<void>((resolveIdentity) => { finishOpenCodeIdentity = resolveIdentity; })
+    ? new Promise<void>((resolveIdentity) => {
+        finishOpenCodeIdentity = resolveIdentity;
+        openCodeIdentityTimeout = setTimeout(() => {
+          openCodeIdentityFailure = new OpenCodeSeatIdentityError(
+            'IDENTITY_HANDSHAKE_TIMEOUT',
+            'OpenCode identity handshake did not complete within 5 seconds.',
+          );
+          settleOpenCodeIdentity();
+        }, OPEN_CODE_IDENTITY_HANDSHAKE_TIMEOUT_MS);
+      })
     : null;
   const waitForOpenCodeIdentity = async (): Promise<OpenCodeSeatIdentityError | null> => {
     if (openCodeIdentityReady) await openCodeIdentityReady;
@@ -1663,7 +1684,7 @@ export async function main() {
           ? error
           : new OpenCodeSeatIdentityError('ROOTS_UNAVAILABLE', String(error));
       }).finally(() => {
-        finishOpenCodeIdentity?.();
+        settleOpenCodeIdentity();
       });
     };
   }
@@ -1674,7 +1695,13 @@ export async function main() {
   if (openCodeIdentityReady) {
     await openCodeIdentityReady;
     if (openCodeIdentityFailure) {
-      console.error(formatOpenCodeSeatIdentityError(openCodeIdentityFailure, process.cwd()));
+      const diagnostic = formatOpenCodeSeatIdentityError(openCodeIdentityFailure, process.cwd());
+      try {
+        writeOpenCodeStartupDiagnostic(diagnostic);
+      } catch {
+        // Diagnostic persistence is best-effort; the original identity failure must terminate startup.
+      }
+      throw new Error(diagnostic);
     } else {
       await runMcpStartupServices(false, startupServices, { openCodeFirst: true });
     }