@botbuddy/cli 1.13.3 → 1.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.13.3",
+  "version": "1.14.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/wait.mjs

@@ -22,9 +22,13 @@ import { latestPublicCliCommand } from "./public-invocation.mjs";
 // A protocol is deliberately distinct from package semver: compatible pinned
 // clients keep working until the server raises this minimum, while a stale
 // implementation gets a typed, safe upgrade instruction.
-export const WAIT_PROTOCOL_VERSION = 1;
+// BOT-1554: protocol 2 makes --session-id mandatory for every non-timer wait (the
+// server keeps MINIMUM_WAIT_PROTOCOL=1 so pre-2 installs are not 426'd).
+export const WAIT_PROTOCOL_VERSION = 2;
 const CLI_UPGRADE_COMMAND = latestPublicCliCommand("wait");
 const MIN_RECEIPT_MAX_BYTES = 512;
+// BOT-1554: identical to the server's session-id shape check.
+const SESSION_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 const HELP = `botbuddy wait — one wait command instead of a polling loop (BOT-989)
 
@@ -104,7 +108,8 @@ OPTIONS
   --heartbeat           keep this agent session alive while waiting (so it is not reaped)
   --url <base>          relay base URL (default $BOTBUDDY_RELAY_URL or https://api.bot-buddy.ai/functions/v1)
   --profile <name>      tenant-bound machine profile (normally read from .botbuddy-agent.json)
-  --session-id <uuid>   attribute this wait to the arming session (the work-graph session id from register_agent); default $BOTBUDDY_SESSION_ID
+  --session-id <uuid>   attribute this wait to the arming session (the work-graph session id from register_agent); default $BOTBUDDY_SESSION_ID.
+                        REQUIRED for any non-timer wait (a wait must name the work agent that armed it).
   --token <key>         explicit agent key override; otherwise the profile-specific env is used
   --help                show this help
 
@@ -248,6 +253,10 @@ async function registerWait(opts, conditions, deadlineIso) {
       // only ever park to timeout, so it's a hard stop, not the live-only fallback.
       "invalid_session_agent",
       "session_agent_requires_profile",
+      // BOT-1554: the server refuses a protocol-2 register with no session id (the
+      // CLI fails fast before this, but a mismatched/forced body could reach it) —
+      // a hard stop, never the untracked live-only fallback.
+      "session_id_required",
     ]);
     if (INVALID_CONDITION_CODES.has(body.error)) {
       const err = new Error(body.detail || body.error);
@@ -264,6 +273,16 @@ async function registerWait(opts, conditions, deadlineIso) {
       err.errorCode = body.error;
       throw err;
     }
+    // BOT-1554: the credential (or its session's agent) is a shared type='service'
+    // carrier — it can hold locks/MCP sessions but cannot be a wait's actor. Carry
+    // the carrier id so runWait can name it in the fix. Auth-shaped → exit 3.
+    if (body.error === "wait_actor_required") {
+      const err = new Error(body.detail || body.error);
+      err.auth = true;
+      err.errorCode = "wait_actor_required";
+      err.carrierAgentId = body.carrier_agent_id ?? null;
+      throw err;
+    }
     const err = new Error(body.detail || body.message || body.error || "forbidden");
     err.auth = true;
     err.errorCode = body.error || "forbidden";
@@ -637,6 +656,27 @@ export async function runWait(argv) {
 
   const needsRelay = conditions.some((c) => c.type !== "timer");
   if (needsRelay) {
+    // BOT-1554: a relay wait MUST name its arming work-graph session. Fail fast —
+    // before any profile resolution or network call — so a wait can never be filed
+    // under whatever credential the machine holds (the "/waits all Megan" bug). A
+    // timer-only wait needs no relay and no session id (handled by !needsRelay).
+    if (!opts.sessionId) {
+      process.stderr.write(
+        "botbuddy wait: --session-id is required (or set $BOTBUDDY_SESSION_ID) — the work-graph session id returned by register_agent\n",
+      );
+      emitReceipt({
+        schema_version: 1,
+        outcome: "error",
+        error: "session_id_required",
+        recovery: "register_agent → export BOTBUDDY_SESSION_ID=<session_id>",
+      });
+      process.exit(EXIT.INVALID);
+    }
+    if (!SESSION_UUID.test(opts.sessionId)) {
+      process.stderr.write(`botbuddy wait: --session-id must be a uuid (got '${opts.sessionId}')\n`);
+      emitReceipt({ schema_version: 1, outcome: "error", error: "invalid_session_agent", detail: "session_id must be a uuid" });
+      process.exit(EXIT.INVALID);
+    }
     try {
       opts.agentProfile = await resolveAgentProfile({
         explicitProfile: opts.profile,
@@ -759,6 +799,33 @@ export async function runWait(argv) {
         process.exit(EXIT.INVALID);
       }
       if (err && err.auth) {
+        // BOT-1554: these are all SESSION-IDENTITY failures — the supplied session id
+        // (or the credential behind it) is a shared service carrier, an
+        // ended/foreign session, or a wrong-tenant session. Re-running profile setup
+        // and retrying with the SAME $BOTBUDDY_SESSION_ID just repeats the 403 (that
+        // command can't replace the parent shell's session variable), so lead with the
+        // reliable fix: register a WORK agent and export its NEW session id.
+        const SESSION_IDENTITY_ERRORS = new Set([
+          "wait_actor_required", "session_agent_forbidden", "session_agent_tenant_mismatch",
+        ]);
+        if (SESSION_IDENTITY_ERRORS.has(err.errorCode)) {
+          const cause = err.errorCode === "wait_actor_required"
+            ? `the wait was armed by a shared service carrier (${err.carrierAgentId})`
+            : err.errorCode === "session_agent_tenant_mismatch"
+              ? "the session id ($BOTBUDDY_SESSION_ID) resolves to a different tenant than this wait"
+              : "the session id ($BOTBUDDY_SESSION_ID) is not a live agent session you own";
+          process.stderr.write(
+            `botbuddy wait: ${cause}; register a work agent (register_agent) and export the returned id as $BOTBUDDY_SESSION_ID — re-running '${profileRecovery(opts.agentProfile)}' will not replace the shell's session variable\n`,
+          );
+          emitReceipt(withPrincipalReceipt({
+            schema_version: 1,
+            outcome: "error",
+            error: err.errorCode,
+            ...(err.carrierAgentId ? { carrier_agent_id: err.carrierAgentId } : {}),
+            recovery: "register_agent → export BOTBUDDY_SESSION_ID=<new session_id>",
+          }, opts.agentProfile, { sessionTenant: opts.agentProfile.tenant, agentId: null }));
+          process.exit(EXIT.AUTH);
+        }
         const error = typedProfileError(err.errorCode);
         process.stderr.write(`botbuddy wait: profile authentication failed (${error}); run '${profileRecovery(opts.agentProfile)}'\n`);
         emitReceipt(profileErrorReceipt(opts.agentProfile, error));