@botbuddy/cli 1.17.0 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -3,6 +3,7 @@ import { doLogin } from "./auth.mjs";
 import { runBridge } from "./codex-bridge.mjs";
 import { loadConfig, getConfig, clearConfig, getConfigPath, SERVER_URL } from "./config.mjs";
 import { resolveOwnerToken, resolveAgentKey, clearOwnerToken } from "./cli-credentials.mjs";
+import { agentProfileKeyLabel } from "./credential-kinds.mjs";
 import { buildAcquireResourcesPayload, LocksUsageError } from "./locks.mjs";
 import { CallUsageError, discoveryUrlFor, formatDiscovery, parseCallArgs } from "./discovery.mjs";
 import { cmdStack } from "./stack.mjs";
@@ -468,7 +469,11 @@ export async function cmdStatus({
   }
   const agentKey = await resolveAgent();
   if (agentKey) {
-    log(`${green("✓")} Authenticated via agent key ${dim("(Keychain profile store)")}`);
+    // BOT-1573: name the credential by its prefix rather than always "agent key"
+    // — a profile slot can hold an agent, a carrier (legacy), or a CI key. A
+    // legacy bare-hex register_agent key (no prefix yet) still reads as an agent.
+    const label = agentProfileKeyLabel(agentKey);
+    log(`${green("✓")} Authenticated via ${label} ${dim("(Keychain profile store)")}`);
     if (cfg.agent_name) log(`  Agent: ${cyan(cfg.agent_name)}`);
     await logServerStatus(call, { "x-agent-api-key": agentKey }, log);
     return;

package/src/credential-kinds.mjs

@@ -0,0 +1,66 @@
+// BOT-1573 — classify a stored secret by its prefix and name its kind, so
+// `botbuddy status` can say WHAT credential it holds ("agent", "client key",
+// "OAuth owner token") instead of a generic "agent key".
+//
+// This mirrors the UI single source `src/components/credentials/types.ts`
+// (CREDENTIAL_TYPES). The front-end registry is TypeScript in the web bundle and
+// can't be imported into this CLI package, so the prefix→kind table is restated
+// here — kept honest by tests on both sides. Classification is recognition ONLY;
+// it is NEVER used for authorization (auth is the server's hashed lookup).
+
+/**
+ * Ordered longest-prefix-first so `bb_ci_` can't shadow a longer `bb_*` prefix,
+ * and the bare legacy `bb_` is matched last.
+ * @type {ReadonlyArray<{ prefix: string, kind: string, label: string }>}
+ */
+export const CREDENTIAL_PREFIXES = [
+  { prefix: "mcp_at_", kind: "oauth", label: "OAuth owner token" },
+  { prefix: "bb_pat_", kind: "pat", label: "personal access token" },
+  { prefix: "bb_cli_", kind: "cli", label: "client key" },
+  // BOT-1573/1582 transition: TODAY every live bb_agent_ secret is an older
+  // shared service carrier (this PR keeps them authenticating), and the actual
+  // per-session agent token is bb_sess_ (BOT-1572). So bb_agent_ classifies as
+  // the carrier — matching the UI adapter — NOT as an agent. Once BOT-1582 makes
+  // register_agent MINT bb_agent_, this flips to the agent kind.
+  { prefix: "bb_agent_", kind: "svc", label: "carrier (legacy)" },
+  { prefix: "bb_sess_", kind: "agent", label: "agent (session)" },
+  { prefix: "bb_ci_", kind: "ci", label: "CI key" },
+  { prefix: "bb_svc_", kind: "svc", label: "carrier (legacy)" },
+  { prefix: "bb_ios_", kind: "ios", label: "device pairing token" },
+  { prefix: "bb_", kind: "legacy", label: "legacy personal key" },
+];
+
+/**
+ * Classify a raw secret by its prefix.
+ * @param {unknown} secret
+ * @returns {{ prefix: string, kind: string, label: string } | null} null when it
+ *   matches no known BotBuddy prefix.
+ */
+export function classifyCredential(secret) {
+  if (typeof secret !== "string" || secret.length === 0) return null;
+  for (const entry of CREDENTIAL_PREFIXES) {
+    if (secret.startsWith(entry.prefix)) return entry;
+  }
+  return null;
+}
+
+/** The operator-facing kind label for a secret, or a safe fallback. */
+export function credentialKindLabel(secret) {
+  return classifyCredential(secret)?.label ?? "credential";
+}
+
+/** True for the legacy bare-hex agent api_key that `register_agent` still returns
+ *  (64 lowercase hex, NO typed prefix). BOT-1574/1582 migrate profiles off it. */
+export function isLegacyBareAgentKey(secret) {
+  return typeof secret === "string" && /^[0-9a-f]{64}$/.test(secret);
+}
+
+/** Kind label for a key resolved from the profile AGENT-key store. A typed
+ *  prefix classifies normally; a legacy bare-hex api_key (register_agent, no
+ *  prefix yet) is still an agent credential — not the generic fallback. */
+export function agentProfileKeyLabel(secret) {
+  const classified = classifyCredential(secret);
+  if (classified) return classified.label;
+  if (isLegacyBareAgentKey(secret)) return "agent key (legacy profile)";
+  return "credential";
+}