borgmcp 5.4.1 → 5.6.0

package/src/seat-store.ts

@@ -49,16 +49,24 @@ interface LockPayload {
 export interface SecureStoreOptions {
   secureRoot?: string;
   rootMode?: 'private' | 'owner-controlled';
+  /** Harden leaf publication for private lease records; default store behavior is unchanged. */
+  verifyLeafIdentity?: boolean;
+  /** Publish without replacing an existing leaf (lease takeover marker). */
+  exclusive?: boolean;
+  /** Read-only lease inspection must not recreate a directory moved by its owner. */
+  createRoot?: boolean;
 }
 
 function expectedUid(): number | null {
   return typeof process.getuid === 'function' ? process.getuid() : null;
 }
 
-async function assertSecureRoot(
+/** Shared directory policy; create=false validates without mutating and returns false if absent. */
+export async function assertSecureRoot(
   root: string,
   rootMode: SecureStoreOptions['rootMode'] = 'private',
-): Promise<void> {
+  create = true,
+): Promise<boolean> {
   if (!isCanonicalPath(root)) {
     throw new Error(`Borg credential store path ${root} is not canonical`);
   }
@@ -67,6 +75,7 @@ async function assertSecureRoot(
     metadata = await lstat(root);
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    if (!create) return false;
     await mkdir(root, { recursive: true, mode: 0o700 });
     metadata = await lstat(root);
   }
@@ -87,6 +96,7 @@ async function assertSecureRoot(
   if (!isCanonicalPath(root)) {
     throw new Error(`Borg credential store root ${root} is not canonical or contains a symlink`);
   }
+  return true;
 }
 
 async function assertSecureFile(filePath: string): Promise<Awaited<ReturnType<typeof lstat>> | null> {
@@ -115,7 +125,9 @@ async function assertSecurePath(filePath: string, options: SecureStoreOptions):
   if (!isAbsolute(filePath) || resolve(filePath) !== filePath || dirname(filePath) !== secureRoot) {
     throw new Error(`Borg credential store file path ${filePath} is not canonical`);
   }
-  await assertSecureRoot(secureRoot, options.rootMode);
+  if (!await assertSecureRoot(secureRoot, options.rootMode, options.createRoot !== false)) {
+    throw Object.assign(new Error('Borg private store directory disappeared'), { code: 'ENOENT' });
+  }
 }
 
 /**
@@ -223,13 +235,28 @@ export async function atomicWrite0600(
   else await ensureParentDir(filePath);
   if (options.secureRoot) await assertSecureFile(filePath);
   const tmp = `${filePath}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
-  const handle = await open(tmp, 'wx', 0o600);
+  const handle = await open(tmp, options.verifyLeafIdentity
+    ? constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW
+    : 'wx', 0o600);
+  let opened: Awaited<ReturnType<typeof handle.stat>> | null = null;
+  const cleanup = async () => {
+    if (options.verifyLeafIdentity) {
+      const current = await lstat(tmp).catch(() => null);
+      if (!opened || !current || current.dev !== opened.dev || current.ino !== opened.ino) return;
+    }
+    await unlink(tmp).catch(() => {});
+  };
   try {
+    opened = options.verifyLeafIdentity ? await handle.stat() : null;
+    if (opened && (!opened.isFile() || (opened.mode & 0o777) !== 0o600 ||
+        (expectedUid() !== null && opened.uid !== expectedUid()))) {
+      throw new Error('Borg private store temporary file is not private');
+    }
     await handle.writeFile(data);
     await handle.sync();
   } catch (err) {
     await handle.close().catch(() => {});
-    await unlink(tmp).catch(() => {});
+    await cleanup();
     throw err;
   }
   await handle.close();
@@ -238,7 +265,17 @@ export async function atomicWrite0600(
       await assertSecurePath(filePath, options);
       await assertSecureFile(filePath);
     }
-    await rename(tmp, filePath);
+    if (opened) {
+      const current = await lstat(tmp);
+      if (!current.isFile() || current.dev !== opened.dev || current.ino !== opened.ino ||
+          current.uid !== opened.uid || (current.mode & 0o777) !== 0o600) {
+        throw new Error('Borg private store temporary file identity changed');
+      }
+    }
+    if (options.exclusive) {
+      await link(tmp, filePath);
+      await unlink(tmp);
+    } else await rename(tmp, filePath);
     const parent = await open(dirname(filePath), 'r');
     try {
       await parent.sync();
@@ -246,7 +283,7 @@ export async function atomicWrite0600(
       await parent.close();
     }
   } catch (err) {
-    await unlink(tmp).catch(() => {});
+    await cleanup();
     throw err;
   }
 }
@@ -283,6 +320,20 @@ async function assertSecureStorePerms(
   }
 }
 
+/** Identity drift is retryable only when inspecting an acquisition lock. */
+export class StoreFileIdentityChangedError extends Error {
+  readonly code = 'STORE_FILE_IDENTITY_CHANGED';
+
+  constructor() {
+    super('Borg credential store file changed while it was being opened');
+  }
+}
+
+function isLockTurnover(error: unknown): boolean {
+  const code = (error as NodeJS.ErrnoException).code;
+  return code === 'ENOENT' || code === 'STORE_FILE_IDENTITY_CHANGED';
+}
+
 /**
  * Read the store file, or null when it does not exist (ONLY the missing-file
  * no-op path initializes empty). When the file exists, the 0600-store + 0700-parent
@@ -310,7 +361,7 @@ export async function readStoreFile(
     try {
       const opened = await handle.stat();
       if (opened.dev !== before.dev || opened.ino !== before.ino) {
-        throw new Error('Borg credential store file changed while it was being opened');
+        throw new StoreFileIdentityChangedError();
       }
       const raw = await handle.readFile('utf8');
       const after = await handle.stat();
@@ -399,7 +450,7 @@ export async function withStoreLock<T>(
           if (stored === null) continue;
           raw = stored;
         } catch (readErr) {
-          if ((readErr as NodeJS.ErrnoException).code === 'ENOENT') continue; // released — retry
+          if (isLockTurnover(readErr)) continue; // released or replaced — retry
           throw readErr;
         }
         const held = parseLockPayload(raw);
@@ -422,7 +473,7 @@ export async function withStoreLock<T>(
               : {},
           );
         } catch (readErr) {
-          if ((readErr as NodeJS.ErrnoException).code === 'ENOENT') continue;
+          if (isLockTurnover(readErr)) continue;
           throw readErr;
         }
         if (currentRaw === null || currentRaw !== raw) continue;

package/src/server-trust.ts

@@ -457,12 +457,7 @@ export async function loadBorgServerTrust(
     let pending = trustCache.get(key);
     if (!pending) {
       pending = (async () => {
-        const [certificate, configText] = await Promise.all([
-          readTrustFile(join(directory, 'ca.crt')),
-          readTrustFile(join(directory, 'server.json')),
-        ]);
-        const config = decodeTrustConfig(configText);
-        const identity = verifyCaIdentity(certificate, config.ca_spki_sha256);
+        const { certificate, identity } = await readLocalAuthorityTrust(directory);
         return { identity, fetchImpl: createPinnedServerFetch(origin, certificate) };
       })();
       trustCache.set(key, pending);
@@ -494,6 +489,30 @@ export async function loadBorgServerTrust(
   });
 }
 
+async function readLocalAuthorityTrust(directory: string): Promise<{ certificate: string; identity: string }> {
+  const [certificate, configText] = await Promise.all([
+    readTrustFile(join(directory, 'ca.crt')),
+    readTrustFile(join(directory, 'server.json')),
+  ]);
+  return { certificate, identity: verifyCaIdentity(certificate, decodeTrustConfig(configText).ca_spki_sha256) };
+}
+
+/**
+ * The current trust identity for `origin`, read from disk on every call with the
+ * same source selection and file checks as loadBorgServerTrust. Its local-authority
+ * branch caches for the process lifetime, which a continuation guard on a
+ * long-lived connection must not rely on; the enrollment branch already rereads
+ * its pointer per call. It returns the identity only and grants no trust. The
+ * local-authority branch builds no fetch; the enrollment delegation may construct
+ * the loader's pinned fetch on a cache miss, but this function sends no request.
+ */
+export async function readBorgServerTrustIdentity(origin: string): Promise<string> {
+  if (!await remoteTrustStateExists(origin) && await trustFilesExist(serverDataDirectory())) {
+    return (await readLocalAuthorityTrust(serverDataDirectory())).identity;
+  }
+  return (await loadBorgServerTrust(origin)).identity;
+}
+
 function pemCertificate(raw: Buffer): string {
   const body = raw.toString('base64').match(/.{1,64}/g)?.join('\n') ?? '';
   return `-----BEGIN CERTIFICATE-----\n${body}\n-----END CERTIFICATE-----\n`;

package/src/stream-owner.ts

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { borgConfigRoot } from './private-root.js';
+import { assertSecureRoot, atomicWrite0600, readStoreFile } from './seat-store.js';
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const STREAM_LOCKS_DIR = path.join(borgConfigRoot(), 'stream-locks');
@@ -58,6 +59,13 @@ export interface StreamOwnerDeps {
   pid?: number;
   cwd?: string;
   locksDir?: string;
+  /** Production opt-in for private lease storage beneath this canonical root.
+   * Ancestors from boundary to root use the store owner-controlled policy;
+   * root and descendants require 0700. Uses private reads and exclusive,
+   * identity-checked leaf publication. Absent: ordinary stream I/O unchanged.
+   * Static hostile objects are in scope; same-UID syscall races are not.
+   */
+  privateRoot?: { root: string; boundary: string };
   processNonce?: string;
   processStartedAt?: string;
   worktree?: string;
@@ -88,7 +96,8 @@ export async function acquireStreamLease(
   deps: StreamOwnerDeps = {}
 ): Promise<StreamLease | null> {
   const lockPath = streamLockPath(cubeId, droneId, deps.locksDir);
-  await fs.mkdir(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+  if (deps.privateRoot) await privateLeaseDirectory(path.dirname(lockPath), deps, true);
+  else await fs.mkdir(path.dirname(lockPath), { recursive: true, mode: 0o700 });
 
   if (!(await recoverTakeoverClaim(lockPath, staleMs, deps))) return null;
 
@@ -130,8 +139,37 @@ export async function readOwnershipSnapshot(
   deps: StreamOwnerDeps = {}
 ): Promise<StreamOwnershipSnapshot> {
   const lockPath = streamLockPath(cubeId, droneId, deps.locksDir);
-  const inspected = await readBoundOwner(lockPath);
-  if (!inspected) return { state: 'unowned', lockPath };
+  // A refresh renames the lock to `<lock>.takeover` while it rewrites the record
+  // and then restores it. Read-only: report an intact, fresh, live in-flight
+  // owner there; a stale, future-dated, dead or malformed leftover stays
+  // `unowned`. A missing directory or owner leaf is re-resolved from the lock
+  // path, so one refresh overlapping any step cannot hide the owner; genuine
+  // initialization still reports `initializing` after the bounded attempts.
+  let initializing: StreamOwnershipSnapshot | undefined;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const inspected = await readBoundOwner(lockPath, deps);
+    if (inspected) {
+      const snapshot = snapshotFromOwner(lockPath, inspected, deps);
+      if (inspected.raw !== null) return snapshot;
+      initializing = snapshot;
+      continue;
+    }
+    const claimed = await readBoundOwner(takeoverPath(lockPath), deps);
+    if (!claimed || claimed.raw === null) continue;
+    const snapshot = snapshotFromOwner(lockPath, claimed, deps);
+    const ageMs = snapshot.ageMs ?? Infinity;
+    const live = snapshot.pid !== undefined && ageMs >= 0 && ageMs <= STREAM_OWNER_STALE_MS &&
+      isPidAlive(snapshot.pid, deps);
+    return live ? snapshot : { state: 'unowned', lockPath };
+  }
+  return initializing ?? { state: 'unowned', lockPath };
+}
+
+function snapshotFromOwner(
+  lockPath: string,
+  inspected: { raw: string | null; stat: { dev: number; ino: number; mtimeMs: number } },
+  deps: StreamOwnerDeps,
+): StreamOwnershipSnapshot {
   const { raw, stat: lockStat } = inspected;
   if (raw === null) {
     const now = (deps.now ?? (() => new Date()))();
@@ -200,6 +238,10 @@ async function tryCreateLease(
   lockPath: string,
   deps: StreamOwnerDeps
 ): Promise<StreamLease | null> {
+  if (deps.privateRoot) {
+    await privateLeaseDirectory(lockPath, deps, false);
+    await privateLeaseDirectory(takeoverPath(lockPath), deps, false);
+  }
   if (await pathExists(takeoverPath(lockPath))) return null;
   try {
     await fs.mkdir(lockPath, { mode: 0o700 });
@@ -210,22 +252,22 @@ async function tryCreateLease(
 
   const record = makeRecord(deps);
   try {
-    await (deps.writeRecord ?? writeRecord)(lockPath, record);
+    await writeLeaseRecord(lockPath, record, deps);
     if (await pathExists(takeoverPath(lockPath))) {
-      await cleanupFailedInitialization(lockPath, record).catch(() => {});
+      await cleanupFailedInitialization(lockPath, record, deps).catch(() => {});
       return null;
     }
   } catch (err) {
-    await cleanupFailedInitialization(lockPath, record).catch(() => {});
+    await cleanupFailedInitialization(lockPath, record, deps).catch(() => {});
     throw err;
   }
-  const created = await readBoundOwner(lockPath);
+  const created = await readBoundOwner(lockPath, deps);
   const createdRecord = created?.raw ? parseOwnershipRecord(created.raw) : null;
   if (
     !created || !createdRecord ||
     !sameOwner(record, createdRecord)
   ) {
-    await cleanupFailedInitialization(lockPath, record).catch(() => {});
+    await cleanupFailedInitialization(lockPath, record, deps).catch(() => {});
     throw new Error('Borg stream lease initialization lost ownership');
   }
   return makeLease(
@@ -243,7 +285,8 @@ async function tryCreateLease(
  */
 async function cleanupFailedInitialization(
   lockPath: string,
-  attempted: StreamOwnerRecord
+  attempted: StreamOwnerRecord,
+  deps: StreamOwnerDeps,
 ): Promise<void> {
   const cleanupPath = `${lockPath}.failed-${attempted.processNonce}-${Date.now()}`;
   try {
@@ -252,7 +295,7 @@ async function cleanupFailedInitialization(
     if (err?.code === 'ENOENT') return;
     throw err;
   }
-  const current = await readOwnershipRecord(cleanupPath);
+  const current = await readOwnershipRecord(cleanupPath, deps);
   if (current && (current.pid !== attempted.pid || current.processNonce !== attempted.processNonce)) {
     try {
       await fs.rename(cleanupPath, lockPath);
@@ -274,6 +317,10 @@ async function moveStaleLockAside(
   deps: StreamOwnerDeps
 ): Promise<boolean> {
   const claimPath = takeoverPath(lockPath);
+  if (deps.privateRoot) {
+    await privateLeaseDirectory(lockPath, deps, false);
+    await privateLeaseDirectory(claimPath, deps, false);
+  }
   try {
     await fs.rename(lockPath, claimPath);
   } catch (err: any) {
@@ -301,13 +348,14 @@ async function moveStaleLockAside(
     processNonce: deps.processNonce ?? processNonce,
     claimedAt: (deps.now ?? (() => new Date()))().toISOString(),
   };
-  await fs.writeFile(
+  if (deps.privateRoot) await writePrivateLeaseFile(claimPath, TAKEOVER_FILE, claimant, deps, true);
+  else await fs.writeFile(
     path.join(claimPath, TAKEOVER_FILE),
     JSON.stringify(claimant, null, 2) + '\n',
     { flag: 'wx', mode: 0o600 },
   );
   await deps.beforeTakeoverVerify?.(claimPath);
-  const verified = await readOwnershipRecord(claimPath);
+  const verified = await readOwnershipRecord(claimPath, deps);
   const verifiedStat = await fs.stat(claimPath).catch(() => null);
   if (!isStillReclaimable(snapshot, verified, verifiedStat, staleMs, deps)) {
     await fs.unlink(path.join(claimPath, TAKEOVER_FILE)).catch(() => {});
@@ -344,6 +392,10 @@ async function recoverTakeoverClaim(
   deps: StreamOwnerDeps,
 ): Promise<boolean> {
   const claimPath = takeoverPath(lockPath);
+  if (deps.privateRoot) {
+    await privateLeaseDirectory(lockPath, deps, false);
+    await privateLeaseDirectory(claimPath, deps, false);
+  }
   let claimStat;
   try {
     claimStat = await fs.stat(claimPath);
@@ -353,9 +405,14 @@ async function recoverTakeoverClaim(
   }
 
   const now = (deps.now ?? (() => new Date()))();
+  const privateClaim = deps.privateRoot
+    ? await readStoreFile(path.join(claimPath, TAKEOVER_FILE), { secureRoot: claimPath, createRoot: false })
+    : undefined;
   let claimant: { pid: number; processNonce: string; claimedAt: string } | null = null;
   try {
-    const parsed = JSON.parse(await fs.readFile(path.join(claimPath, TAKEOVER_FILE), 'utf8'));
+    const parsed = JSON.parse((deps.privateRoot
+      ? privateClaim
+      : await fs.readFile(path.join(claimPath, TAKEOVER_FILE), 'utf8')) ?? 'null');
     if (
       parsed?.schemaVersion === 1 &&
       Number.isSafeInteger(parsed.pid) && parsed.pid > 0 &&
@@ -377,7 +434,7 @@ async function recoverTakeoverClaim(
   ) return false;
   if (!claimant && claimAge <= STREAM_OWNER_TAKEOVER_STALE_MS) return false;
 
-  const owner = await readOwnershipRecord(claimPath);
+  const owner = await readOwnershipRecord(claimPath, deps);
   const ownerHeartbeat = owner ? Date.parse(owner.heartbeatAt) : Number.NaN;
   const ownerAge = Number.isFinite(ownerHeartbeat)
     ? now.getTime() - ownerHeartbeat
@@ -481,7 +538,7 @@ function makeLease(
         ownedRecord,
         deps,
         async (claimPath) => {
-          await (deps.writeRecord ?? writeRecord)(claimPath, next);
+          await writeLeaseRecord(claimPath, next, deps);
           return 'restore';
         },
       );
@@ -511,6 +568,10 @@ async function mutateClaimedLease(
   mutation: (claimPath: string) => Promise<'restore' | 'remove'>,
 ): Promise<boolean> {
   const claimPath = takeoverPath(lockPath);
+  if (deps.privateRoot) {
+    await privateLeaseDirectory(lockPath, deps, false);
+    await privateLeaseDirectory(claimPath, deps, false);
+  }
   try {
     await fs.rename(lockPath, claimPath);
   } catch (error: any) {
@@ -532,13 +593,14 @@ async function mutateClaimedLease(
     processNonce: deps.processNonce ?? processNonce,
     claimedAt: (deps.now ?? (() => new Date()))().toISOString(),
   };
-  await fs.writeFile(
+  if (deps.privateRoot) await writePrivateLeaseFile(claimPath, TAKEOVER_FILE, claimant, deps, true);
+  else await fs.writeFile(
     path.join(claimPath, TAKEOVER_FILE),
     JSON.stringify(claimant, null, 2) + '\n',
     { flag: 'wx', mode: 0o600 },
   );
 
-  const inspected = await readBoundOwner(claimPath);
+  const inspected = await readBoundOwner(claimPath, deps);
   const current = inspected?.raw ? parseOwnershipRecord(inspected.raw) : null;
   if (
     !inspected || !sameIdentity(identity, inspected.stat) || !current ||
@@ -590,7 +652,11 @@ function sameOwner(left: StreamOwnerRecord, right: StreamOwnerRecord): boolean {
     left.cubeName === right.cubeName;
 }
 
-async function readOwnershipRecord(lockPath: string): Promise<StreamOwnerRecord | null> {
+async function readOwnershipRecord(lockPath: string, deps: StreamOwnerDeps = {}): Promise<StreamOwnerRecord | null> {
+  if (deps.privateRoot) {
+    const inspected = await readBoundOwner(lockPath, deps);
+    return inspected?.raw ? parseOwnershipRecord(inspected.raw) : null;
+  }
   try {
     const raw = await fs.readFile(path.join(lockPath, OWNER_FILE), 'utf8');
     return parseOwnershipRecord(raw);
@@ -608,10 +674,11 @@ function parseOwnershipRecord(raw: string): StreamOwnerRecord | null {
   }
 }
 
-async function readBoundOwner(lockPath: string): Promise<{
+async function readBoundOwner(lockPath: string, deps: StreamOwnerDeps = {}): Promise<{
   raw: string | null;
   stat: { dev: number; ino: number; mtimeMs: number };
 } | null> {
+  if (deps.privateRoot && !await privateLeaseDirectory(lockPath, deps, false)) return null;
   for (let attempt = 0; attempt < 3; attempt += 1) {
     let handle;
     try {
@@ -624,8 +691,13 @@ async function readBoundOwner(lockPath: string): Promise<{
       const openedStat = await handle.stat();
       let raw: string | null;
       try {
-        raw = await fs.readFile(path.join(lockPath, OWNER_FILE), 'utf8');
+        raw = deps.privateRoot
+          ? await readStoreFile(path.join(lockPath, OWNER_FILE), { secureRoot: lockPath, createRoot: false })
+          : await fs.readFile(path.join(lockPath, OWNER_FILE), 'utf8');
       } catch (error: any) {
+        // A concurrent refresh atomically replaces the owner file; like other
+        // lock inspection, that identity drift is turnover and is re-read.
+        if (error?.code === 'STORE_FILE_IDENTITY_CHANGED') continue;
         if (error?.code !== 'ENOENT') throw error;
         raw = null;
       }
@@ -652,6 +724,43 @@ function sameIdentity(
   return left.dev === right.dev && left.ino === right.ino;
 }
 
+/** Apply the existing private-store directory policy without creating on reads. */
+async function privateLeaseDirectory(directory: string, deps: StreamOwnerDeps, create: boolean): Promise<boolean> {
+  const { root, boundary } = deps.privateRoot!;
+  const ancestors = path.relative(boundary, root);
+  if (ancestors.startsWith('..') || path.isAbsolute(ancestors)) {
+    throw new Error('Borg private lease root escapes its trusted boundary');
+  }
+  const relative = path.relative(root, directory);
+  if (path.resolve(directory) !== directory || relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error('Borg private lease path escapes its private root');
+  }
+  let ancestor = boundary;
+  for (const component of ancestors.split(path.sep).filter(Boolean)) {
+    if (!await assertSecureRoot(ancestor, 'owner-controlled', create)) return false;
+    ancestor = path.join(ancestor, component);
+  }
+  if (!await assertSecureRoot(root, 'private', create)) return false;
+  let current = root;
+  for (const component of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, component);
+    if (!await assertSecureRoot(current, 'private', create)) return false;
+  }
+  return true;
+}
+
+async function writePrivateLeaseFile(directory: string, name: string, value: unknown, deps: StreamOwnerDeps, exclusive = false): Promise<void> {
+  if (!await privateLeaseDirectory(directory, deps, false)) throw new Error('Borg private lease directory disappeared');
+  await atomicWrite0600(path.join(directory, name), JSON.stringify(value, null, 2) + '\n', {
+    secureRoot: directory, verifyLeafIdentity: true, exclusive, createRoot: false,
+  });
+}
+
+async function writeLeaseRecord(directory: string, record: StreamOwnerRecord, deps: StreamOwnerDeps): Promise<void> {
+  if (deps.privateRoot) await writePrivateLeaseFile(directory, OWNER_FILE, record, deps);
+  else await (deps.writeRecord ?? writeRecord)(directory, record);
+}
+
 async function writeRecord(lockPath: string, record: StreamOwnerRecord): Promise<void> {
   const ownerPath = path.join(lockPath, OWNER_FILE);
   const tmpPath = path.join(lockPath, `${OWNER_FILE}.${record.processNonce}.tmp`);

package/src/unknown-subcommand.ts

@@ -27,6 +27,7 @@ export const KNOWN_SUBCOMMANDS = [
   'drones',
   'launch',
   'launch-all',
+  'representative',
   'server',
 ] as const;