@botbuddy/cli 1.13.0 → 1.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -296,6 +296,15 @@ async function cmdStart(args) {
 // (BOT-1566, Codex P2).
 const STATUS_PROBE_TIMEOUT_MS = 4000;
 
+// The OAuth server issues OPAQUE access tokens, not JWTs: `mcp_at_` + hex
+// (oauth_tokens.access_token default = 'mcp_at_' + two dash-stripped uuids = 64
+// hex chars; handleToken returns that verbatim). We use this only to refuse
+// shipping a legacy typed-password "owner token" (the pre-1.13 Keychain bug) to
+// the server in an Authorization header — which would disclose the secret just
+// to learn it is invalid (BOT-1566, Codex P1). Prefix + hex body, length-lenient
+// so a future opaque-token size change can't reintroduce the false rejection.
+const looksLikeOwnerToken = (t) => typeof t === "string" && /^mcp_at_[0-9a-f]{32,}$/.test(t);
+
 async function logServerStatus(call, auth, log) {
   let res;
   try {
@@ -331,10 +340,20 @@ export async function cmdStatus({
   const cfg = getCfg();
   const owner = await resolveOwner({ getConfig: getCfg });
   if (owner) {
-    log(`${green("✓")} Authenticated via OAuth ${dim("(Keychain)")}`);
+    // BOT-1566 (Codex P1): a pre-1.13 login could have stored a typed password
+    // where the OAuth token belongs. Such a value is NOT healthy — resolveCallAuth
+    // / authHeader still prefer this entry, so every `botbuddy call` keeps sending
+    // the bad secret until `botbuddy login` overwrites it. Never present it as
+    // authenticated, and never put it on the wire.
+    const ownerValid = looksLikeOwnerToken(owner.token);
+    if (ownerValid) {
+      log(`${green("✓")} Authenticated via OAuth ${dim("(Keychain)")}`);
+    } else {
+      log(`${red("✗")} Stored OAuth token is invalid — not a sign-in token (pre-1.13 login bug). Run ${cyan("botbuddy login")} to replace it.`);
+    }
     if (cfg.agent_name) log(`  Agent: ${cyan(cfg.agent_name)}`);
     if (cfg.client_id) log(`  Client: ${dim(cfg.client_id)}`);
-    if (owner.expiresAt) {
+    if (ownerValid && owner.expiresAt) {
       const remaining = owner.expiresAt - now();
       if (remaining <= 0) {
         log(`  Token: ${red("EXPIRED")} — run ${cyan("botbuddy start")}`);
@@ -345,6 +364,19 @@ export async function cmdStatus({
       }
     }
     log(`  Config: ${dim(getConfigPath())}`);
+    if (!ownerValid) {
+      // Never send the non-token secret to the server. An agent key can still be
+      // health-checked, but the broken owner credential is what `botbuddy call`
+      // will use, so report it either way rather than looking healthy.
+      const key = await resolveAgent();
+      if (key) {
+        await logServerStatus(call, { "x-agent-api-key": key }, log);
+        log(`  ${red("!")} the stored OAuth token is invalid — botbuddy commands will keep using it until you run ${cyan("botbuddy login")}`);
+      } else {
+        log(`  server: ${red("not checked")} — stored OAuth token is invalid; run ${cyan("botbuddy login")}`);
+      }
+      return;
+    }
     // BOT-1566 (Codex P2): match resolveCallAuth — an expired owner token defers
     // to a valid profile agent key, so probe the credential real commands would
     // actually use instead of reporting a false `server: rejected` on the dead

package/src/update-check.mjs

@@ -13,7 +13,7 @@
 // off to a detached, unref'd `npm install -g` and exits 0.
 
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
@@ -114,14 +114,54 @@ export async function maybeWarnStale({
 }
 
 // `botbuddy update` — hand off to npm and get out of the way.
-export function cmdUpdate({ version = VERSION, spawnImpl = spawn, log = (line) => console.log(line), platform = process.platform } = {}) {
+export function cmdUpdate({ version = VERSION, spawnImpl = spawn, probeImpl = spawnSync, log = (line) => console.log(line), platform = process.platform, stderr = process.stderr } = {}) {
   log(`current: ${version}`);
-  // BOT-1566 (Codex P2): on Windows npm is the `npm.cmd` shim, and a shell-free
-  // spawn cannot execute .cmd scripts (Node docs) — it would ENOENT after we
-  // already claimed the update started. Select the platform-correct binary.
-  const npmBin = platform === "win32" ? "npm.cmd" : "npm";
-  const child = spawnImpl(npmBin, ["install", "-g", "@botbuddy/cli@latest"], { stdio: "inherit", detached: true });
-  child.unref();
-  log("updating in background — re-run botbuddy --version to confirm");
-  return 0;
+  // BOT-1566 (Codex P1/P2): on Windows npm is the `npm.cmd` shim, and Node
+  // cannot spawn a .cmd file shell-free (docs) — run it through a shell on
+  // win32 (args are all static constants, so no injection surface) and select
+  // the shim name; elsewhere a plain shell-free `npm` is correct.
+  const isWin = platform === "win32";
+  const npmBin = isWin ? "npm.cmd" : "npm";
+  const shellOpt = isWin ? { shell: true } : {};
+  // Resolve npm BEFORE the detached handoff. With `shell: true` the async
+  // `spawn` event only confirms the shell (cmd.exe) launched, not that npm
+  // resolved — a missing `npm.cmd` would otherwise be reported as a successful
+  // background update (Codex P2). A synchronous `npm --version` probe confirms
+  // the executable exists; `botbuddy update` is an explicit command, not a hot
+  // path, so the extra call is acceptable.
+  const probe = probeImpl(npmBin, ["--version"], { stdio: "ignore", ...shellOpt });
+  if (probe?.error || (typeof probe?.status === "number" && probe.status !== 0)) {
+    try { stderr.write(`botbuddy update: npm was not found — install Node.js/npm, then retry (looked for ${npmBin})\n`); } catch { /* ignore */ }
+    return Promise.resolve(1);
+  }
+  const child = spawnImpl(npmBin, ["install", "-g", "@botbuddy/cli@latest"], {
+    stdio: "inherit",
+    detached: true,
+    ...shellOpt,
+  });
+  // Node reports a launch failure asynchronously via the `error` event, so we
+  // must NOT announce success until the child has actually spawned (Codex P2).
+  // Race spawn vs error: print + unref only on `spawn`, exit nonzero on `error`.
+  return new Promise((resolve) => {
+    if (!child || typeof child.once !== "function") {
+      log("updating in background — re-run botbuddy --version to confirm");
+      if (child && typeof child.unref === "function") child.unref();
+      resolve(0);
+      return;
+    }
+    let settled = false;
+    child.once("spawn", () => {
+      if (settled) return;
+      settled = true;
+      if (typeof child.unref === "function") child.unref();
+      log("updating in background — re-run botbuddy --version to confirm");
+      resolve(0);
+    });
+    child.once("error", (err) => {
+      if (settled) return;
+      settled = true;
+      try { stderr.write(`botbuddy update: failed to launch npm (${err?.message ?? err})\n`); } catch { /* ignore */ }
+      resolve(1);
+    });
+  });
 }

package/src/wait.mjs

@@ -399,6 +399,14 @@ function makeConnect(opts) {
     // the agent (and its locks) aren't reaped during a long wait.
     if (opts.heartbeat) url.searchParams.set("heartbeat", "1");
 
+    // BOT-1565: abort the fetch itself on idle. A silently half-open SSE body
+    // already has an `iterator.next()` pending, and `iterator.return()` queues
+    // BEHIND that read — it cannot cancel it until bytes/EOF eventually arrive,
+    // so it would leave the response locked and the socket open while we
+    // reconnect, leaking a connection per stall (Codex P2). Aborting the fetch's
+    // signal tears the stalled socket down immediately, then the read rejects and
+    // the stream ends so runWaitLoop reconnects.
+    const ac = new AbortController();
     const res = await fetch(url, {
       headers: {
         Authorization: `Bearer ${opts.token}`,
@@ -407,12 +415,13 @@ function makeConnect(opts) {
         // BOT-741: never let a proxy gzip-buffer an SSE stream.
         "Accept-Encoding": "identity",
       },
+      signal: ac.signal,
     });
     if (res.status === 401) return errorStream("unauthorized");
     if (res.status === 403) return errorStream("forbidden");
     if (!res.ok || !res.body) throw new Error(`relay responded ${res.status}`);
 
-    return sseFrameStream(res.body);
+    return sseFrameStream(res.body, { onIdle: () => ac.abort() });
   };
 }
 
@@ -468,14 +477,68 @@ function makeFeedLagProbe(opts) {
   };
 }
 
-async function* sseFrameStream(body) {
+// BOT-1565: a silently half-open SSE socket (a network blip, or a gateway/edge
+// connection-lifetime ceiling ~45–51 min) delivers no bytes AND no end-of-stream,
+// so a bare `for await` here would block forever and never reconnect. Meanwhile
+// the relay's last_seen_at keepalive stops bumping and the wait reaper abandons
+// the still-parked wait after its grace → /waits goes blank (BOT-1565). Guard
+// every read with an IDLE watchdog: the relay sends a keepalive comment every
+// ~30s (EVENT_STREAM_KEEPALIVE_MS), and every chunk (comment or frame) resets
+// the timer, so a healthy-but-quiet connection never trips it. If NOTHING
+// arrives for idleMs the connection is presumed dead: end the stream so
+// runWaitLoop reconnects from the cursor, which re-bumps wait_sessions.last_seen_at
+// (and, with --heartbeat, agents.last_heartbeat) before the reaper's grace.
+// 70s ≈ 2.3 missed keepalives — long enough to never false-trip on jitter, short
+// enough that the reconnect lands inside the 90s last_seen reap window.
+export const DEFAULT_SSE_IDLE_TIMEOUT_MS = 70_000;
+
+function sseIdleTimeoutMs() {
+  const raw = Number(process.env.BOTBUDDY_WAIT_IDLE_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_SSE_IDLE_TIMEOUT_MS;
+}
+
+const SSE_IDLE = Symbol("sse_idle");
+
+export async function* sseFrameStream(body, { idleMs = sseIdleTimeoutMs(), onIdle = null } = {}) {
   const decoder = new TextDecoder();
   let buf = "";
-  for await (const chunk of body) {
-    buf += decoder.decode(chunk, { stream: true });
-    const { frames, rest } = parseSseFrames(buf);
-    buf = rest;
-    for (const f of frames) yield f;
+  const iterator = body[Symbol.asyncIterator]();
+  try {
+    while (true) {
+      const nextP = iterator.next();
+      let timer;
+      const idle = new Promise((resolve) => { timer = setTimeout(() => resolve(SSE_IDLE), idleMs); });
+      let result;
+      try {
+        result = await Promise.race([nextP, idle]);
+      } finally {
+        clearTimeout(timer);
+      }
+      if (result === SSE_IDLE) {
+        // Presumed dead. onIdle() aborts the underlying fetch (makeConnect wires
+        // it to the request's AbortController) — the ONLY thing that actually
+        // tears a stalled socket down, since iterator.return() would queue behind
+        // the pending read and never fire until bytes/EOF arrive (Codex P2). The
+        // abort settles the pending read (rejects with AbortError); swallow it so
+        // it isn't an unhandled rejection, then end the stream to force a reconnect.
+        nextP.then(() => {}, () => {});
+        if (onIdle) onIdle();
+        return;
+      }
+      const { value: chunk, done } = result;
+      if (done) return;
+      buf += decoder.decode(chunk, { stream: true });
+      const { frames, rest } = parseSseFrames(buf);
+      buf = rest;
+      for (const f of frames) yield f;
+    }
+  } finally {
+    // Belt-and-braces release for the non-idle early-stop path (the consumer
+    // stopped iterating, e.g. runWaitLoop matched). On the idle path the fetch
+    // has already been aborted above, so the body is torn down regardless; this
+    // return() then resolves promptly instead of queuing behind a live read.
+    // Fire-and-forget + swallow: never let teardown block the generator's exit.
+    Promise.resolve(iterator.return?.()).then(() => {}, () => {});
   }
 }