@botbuddy/cli 1.2.3 → 1.4.1

package/bin/botbuddy.mjs

@@ -1,3 +1,7 @@
 #!/usr/bin/env node
 import { run } from "../src/commands.mjs";
-run(process.argv.slice(2));
+
+run(process.argv.slice(2)).catch((err) => {
+  console.error(`\x1b[31m✗\x1b[0m ${err?.message || err}`);
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.2.3",
+  "version": "1.4.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-credential-store.mjs

@@ -0,0 +1,208 @@
+import { chmod, link, mkdir, readFile, rename, stat, unlink, utimes, writeFile } from "node:fs/promises";
+import { homedir, userInfo } from "node:os";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { existsSync } from "node:fs";
+
+const STORE_SCHEMA_VERSION = 1;
+const LOCK_RETRY_MS = 10;
+const LOCK_MAX_ATTEMPTS = 100;
+const STALE_LOCK_MS = 30_000;
+const execFileAsync = promisify(execFile);
+
+export function ensureProfileCredentialBackend({ platform = process.platform, exists = existsSync } = {}) {
+  if (platform !== "darwin" || !exists("/usr/bin/security")) {
+    throw new Error("profile setup requires the macOS Keychain credential backend");
+  }
+}
+
+export function profileCredentialEnvironment(profile) {
+  return profile === "botbuddy-dev" ? "BOTBUDDY_BB_AGENT_KEY"
+    : profile === "supplyguard-dev" ? "BOTBUDDY_SG_AGENT_KEY" : null;
+}
+
+function keychainService(profile) {
+  return profileCredentialEnvironment(profile);
+}
+
+function writePasswordPrompt(command, args, password) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["pipe", "ignore", "pipe"] });
+    let stderr = "";
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`${command} exited ${code}${stderr ? `: ${stderr.trim()}` : ""}`));
+    });
+    // `security -w` prompts from standard input when it is the last option.
+    // Keeping the password off argv prevents process-list disclosure.
+    child.stdin.end(`${password}\n`);
+  });
+}
+
+async function writeKeychain(profile, token) {
+  const service = keychainService(profile);
+  if (!service) throw new Error("unknown profile keychain service");
+  await writePasswordPrompt("security", ["add-generic-password", "-U", "-s", service, "-a", userInfo().username, "-w"], token);
+}
+
+async function readKeychain(profile) {
+  const service = keychainService(profile);
+  if (!service) return null;
+  try {
+    const { stdout } = await execFileAsync("security", ["find-generic-password", "-s", service, "-a", userInfo().username, "-w"]);
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+function profileCredentialStorePath(home = homedir()) {
+  return join(home, ".botbuddy", "agent-profiles.json");
+}
+
+async function readStore({ home = homedir() } = {}) {
+  try {
+    const raw = await readFile(profileCredentialStorePath(home), "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed?.schema_version !== STORE_SCHEMA_VERSION || !parsed.profiles || typeof parsed.profiles !== "object") {
+      return { schema_version: STORE_SCHEMA_VERSION, profiles: {} };
+    }
+    return parsed;
+  } catch (error) {
+    if (error?.code === "ENOENT") return { schema_version: STORE_SCHEMA_VERSION, profiles: {} };
+    throw error;
+  }
+}
+
+function validIdentityEntry(entry) {
+  return entry && typeof entry === "object" && typeof entry.name === "string";
+}
+
+async function withStoreLock(path, operation) {
+  const lockPath = `${path}.lock`;
+  for (let attempt = 0; attempt < LOCK_MAX_ATTEMPTS; attempt++) {
+    const ownerPath = `${lockPath}.${process.pid}.${randomUUID()}`;
+    try {
+      await writeFile(ownerPath, JSON.stringify({ pid: process.pid, owner_path: ownerPath }), { flag: "wx", mode: 0o600 });
+      await link(ownerPath, lockPath);
+      const ownerStat = await stat(ownerPath);
+      const ownsLock = async () => {
+        try {
+          const current = await stat(lockPath);
+          return current.dev === ownerStat.dev && current.ino === ownerStat.ino;
+        } catch (error) {
+          if (error?.code === "ENOENT") return false;
+          throw error;
+        }
+      };
+      const refresh = setInterval(() => {
+        const now = new Date();
+        void ownsLock().then((owned) => owned && utimes(lockPath, now, now)).catch(() => {});
+      }, Math.floor(STALE_LOCK_MS / 3));
+      try {
+        return await operation();
+      } finally {
+        clearInterval(refresh);
+        if (await ownsLock()) await unlink(lockPath).catch(() => {});
+        await unlink(ownerPath).catch(() => {});
+      }
+    } catch (error) {
+      await unlink(ownerPath).catch(() => {});
+      if (error?.code !== "EEXIST") throw error;
+      try {
+        const lockStat = await stat(lockPath);
+        if (Date.now() - lockStat.mtimeMs > STALE_LOCK_MS) {
+          const lock = JSON.parse(await readFile(lockPath, "utf8"));
+          let ownerAlive = false;
+          try { process.kill(lock.pid, 0); ownerAlive = true; } catch (ownerError) { ownerAlive = ownerError?.code === "EPERM"; }
+          if (!ownerAlive) {
+            await unlink(lockPath);
+            if (typeof lock.owner_path === "string") await unlink(lock.owner_path).catch(() => {});
+          }
+        }
+      } catch (lockError) {
+        if (lockError?.code !== "ENOENT") throw lockError;
+      }
+      await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+    }
+  }
+  throw new Error("profile credential store is busy; retry profile setup");
+}
+
+export async function readProfileIdentity(profile, options = {}) {
+  const store = await readStore(options);
+  const entry = store.profiles[profile];
+  if (!validIdentityEntry(entry) || typeof entry.tenant !== "string" || typeof entry.agent_id !== "string") return null;
+  return { agentId: entry.agent_id, tenant: entry.tenant, name: entry.name };
+}
+
+export async function readProfileRetryIdentity(profile, options = {}) {
+  const store = await readStore(options);
+  const entry = store.profiles[profile];
+  if (!validIdentityEntry(entry)) return null;
+  const agentId = typeof entry.agent_id === "string" ? entry.agent_id : entry.pending_agent_id;
+  return typeof agentId === "string" ? { agentId, name: entry.name } : null;
+}
+
+export async function readProfileCredential(profile, options = {}) {
+  return (options.keychainRead ?? readKeychain)(profile);
+}
+
+async function writeProfileMetadata(profile, entry, {
+  home = homedir(),
+  onlyIfNoAttestedIdentity = false,
+  afterWrite = null,
+} = {}) {
+  const path = profileCredentialStorePath(home);
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  await withStoreLock(path, async () => {
+    const store = await readStore({ home });
+    const current = store.profiles[profile];
+    if (onlyIfNoAttestedIdentity && validIdentityEntry(current) && typeof current.tenant === "string" && typeof current.agent_id === "string") {
+      return false;
+    }
+    const next = {
+      schema_version: STORE_SCHEMA_VERSION,
+      profiles: { ...store.profiles, [profile]: entry },
+    };
+    const temporaryPath = `${path}.${randomUUID()}.tmp`;
+    await writeFile(temporaryPath, JSON.stringify(next), { mode: 0o600 });
+    await chmod(temporaryPath, 0o600);
+    await rename(temporaryPath, path);
+    await chmod(path, 0o600);
+    await afterWrite?.();
+    return true;
+  });
+}
+
+export async function recordProfileRetryIdentity({ profile, agentId, name }, options = {}) {
+  if (![profile, agentId, name].every((value) => typeof value === "string" && value.length > 0)) {
+    throw new Error("profile retry identity requires profile, agentId, and name");
+  }
+  // This entry is explicitly not tenant-attested and contains no credential. It
+  // may only be used to reconnect with the profile's fixed tenant on retry.
+  await writeProfileMetadata(profile, { pending_agent_id: agentId, name }, {
+    ...options,
+    onlyIfNoAttestedIdentity: true,
+  });
+}
+
+export async function installProfileCredential({ profile, tenant, agentId, name, token }, { home = homedir(), keychainWrite = writeKeychain } = {}) {
+  if (![profile, tenant, agentId, name, token].every((value) => typeof value === "string" && value.length > 0)) {
+    throw new Error("profile credential store requires profile, tenant, agentId, name, and token");
+  }
+  // Keep non-secret identity metadata even if Keychain is momentarily locked.
+  // The next setup call reconnects this same server agent instead of minting a
+  // random orphan; credentials are never written to this file.
+  await writeProfileMetadata(profile, { tenant, agent_id: agentId, name }, {
+    home,
+    // Keep this Keychain operation in the same lock as the metadata write. A
+    // later setup cannot leave metadata from one agent beside another agent's
+    // credential, while a failed write still leaves resumable metadata.
+    afterWrite: () => keychainWrite(profile, token),
+  });
+}

package/src/api.mjs

@@ -39,6 +39,45 @@ export async function callTool(toolName, args = {}) {
   return data;
 }
 
+// BOT-1220: programmatic tool call for `botbuddy stack` — returns the tool's parsed
+// JSON result WITHOUT printing anything (the stack command owns stdout for its single
+// JSON-line receipt). Never calls die(): auth/transport problems come back as a
+// structured { ok:false, ... } so the caller can emit a typed receipt + exit code.
+//   * { ok:true, data }        — tool result JSON (data.success may still be false)
+//   * { ok:false, auth:true }  — not authenticated / token expired
+//   * { ok:false, status }     — HTTP/JSON-RPC/transport error (status may be null)
+export async function callToolJson(toolName, args = {}, { fetchImpl = fetch } = {}) {
+  const cfg = getConfig();
+  let auth;
+  if (cfg.access_token) {
+    if (cfg.token_expires_at && Date.now() >= cfg.token_expires_at) return { ok: false, auth: true, error: "token_expired" };
+    auth = { Authorization: `Bearer ${cfg.access_token}` };
+  } else if (cfg.api_key) {
+    auth = { "x-agent-api-key": cfg.api_key };
+  } else {
+    return { ok: false, auth: true, error: "not_authenticated" };
+  }
+  const body = { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: toolName, arguments: args } };
+  let res;
+  try {
+    res = await fetchImpl(SERVER_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...auth },
+      body: JSON.stringify(body),
+    });
+  } catch (err) {
+    return { ok: false, status: null, error: `transport: ${err?.message ?? err}` };
+  }
+  if (res.status === 401 || res.status === 403) return { ok: false, auth: true, status: res.status, error: "unauthorized" };
+  let payload;
+  try { payload = await res.json(); } catch { return { ok: false, status: res.status, error: "invalid_json" }; }
+  if (payload.error?.message) return { ok: false, status: res.status, error: payload.error.message };
+  const text = payload.result?.content?.map((c) => c.text).filter(Boolean).join("\n") ?? "";
+  let data;
+  try { data = text ? JSON.parse(text) : {}; } catch { data = { raw: text }; }
+  return { ok: true, data, isError: payload.result?.isError === true };
+}
+
 export async function listResources() {
   const headers = { "Content-Type": "application/json", ...authHeader() };
   const body = { jsonrpc: "2.0", id: 1, method: "resources/list", params: {} };

package/src/auth.mjs

@@ -1,72 +1,171 @@
-import { createHash, randomBytes } from "crypto";
-import { SERVER_URL, saveConfig, getConfig } from "./config.mjs";
-import { green, dim, die } from "./utils.mjs";
-
-export async function doLogin() {
-  console.log("\x1b[1mBotBuddy OAuth Login\x1b[0m\n");
-
-  // Step 1: Dynamic client registration
-  console.log(dim("→ Registering client..."));
-  const regRes = await fetch(`${SERVER_URL}/register`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      client_name: "botbuddy-cli-node",
-      redirect_uris: ["http://localhost:19836/callback"],
-      grant_types: ["authorization_code"],
-      token_endpoint_auth_method: "none",
-    }),
-  });
-  const regData = await regRes.json();
-  const clientId = regData.client_id;
-  if (!clientId) die(`Client registration failed: ${JSON.stringify(regData)}`);
-  console.log(`  ${green("✓")} Client registered: ${dim(clientId)}`);
-
-  // Step 2: Generate PKCE
-  const codeVerifier = randomBytes(32).toString("base64url").slice(0, 43);
-  const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
-
-  // Step 3: Authorization
-  const state = randomBytes(16).toString("hex");
-  const authUrl = `${SERVER_URL}/authorize?client_id=${clientId}&redirect_uri=${encodeURIComponent("http://localhost:19836/callback")}&response_type=code&scope=read+write+lock&state=${state}&code_challenge=${codeChallenge}&code_challenge_method=S256`;
-
-  console.log(dim("→ Requesting authorization..."));
-  const authRes = await fetch(authUrl, { redirect: "manual" });
-  const location = authRes.headers.get("location");
-  if (!location) die("Authorization failed — no redirect received");
-
-  const codeMatch = location.match(/code=([^&]+)/);
-  if (!codeMatch) die("No authorization code in redirect");
-  const authCode = codeMatch[1];
-  console.log(`  ${green("✓")} Authorization code received`);
-
-  // Step 4: Exchange code for token
-  console.log(dim("→ Exchanging code for token..."));
-  const tokenRes = await fetch(`${SERVER_URL}/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      code: authCode,
+import { SERVER_URL, saveConfig as realSaveConfig, getConfig as realGetConfig } from "./config.mjs";
+import { green, dim, cyan, yellow, bold, red } from "./utils.mjs";
+import {
+  createLoopbackReceiver,
+  generatePkce,
+  generateState,
+  buildAuthorizeUrl,
+  openBrowser as realOpenBrowser,
+  DEFAULT_LOGIN_TIMEOUT_MS,
+  OAuthCallbackError,
+} from "./oauth-loopback.mjs";
+
+// A login that could not complete. commands.mjs turns this into one terminal
+// error line; the core never calls process.exit so it stays unit-testable.
+export class LoginError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LoginError";
+  }
+}
+
+// Bounded, secret-free rendering of a failed /register or /token response body.
+function describeResponse(data) {
+  let text;
+  try {
+    text = JSON.stringify(data);
+  } catch {
+    text = String(data);
+  }
+  return text.length > 300 ? `${text.slice(0, 300)}…` : text;
+}
+
+// Map a callback failure to one actionable terminal message (AC-11).
+function callbackErrorMessage(err) {
+  if (!(err instanceof OAuthCallbackError)) {
+    return err?.message || "Authorization failed";
+  }
+  switch (err.code) {
+    case "timeout":
+      return "Timed out waiting for authorization. Re-run `botbuddy login` and finish signing in in the browser before it times out.";
+    case "missing_code":
+      return "The authorization callback did not include a code. Re-run `botbuddy login` and try again.";
+    case "access_denied":
+      return "Authorization was denied. Re-run `botbuddy login` and approve access for an allowed user.";
+    default:
+      return `Authorization failed: ${err.message}`;
+  }
+}
+
+// AC-1..AC-13: orchestrate the loopback authorization-code flow.
+//
+// options: { noBrowser }
+// deps (all injectable for tests): serverUrl, fetch, openBrowser, saveConfig,
+//   getConfig, log, errorLog, timeoutMs, now.
+export async function doLogin(options = {}, deps = {}) {
+  const {
+    serverUrl = SERVER_URL,
+    fetch: fetchImpl = fetch,
+    openBrowser = realOpenBrowser,
+    saveConfig = realSaveConfig,
+    getConfig = realGetConfig,
+    log = (s) => console.log(s),
+    errorLog = (s) => console.error(s),
+    timeoutMs = DEFAULT_LOGIN_TIMEOUT_MS,
+    now = () => Date.now(),
+  } = deps;
+  const noBrowser = Boolean(options.noBrowser);
+
+  log(`${bold("BotBuddy OAuth Login")}\n`);
+
+  // AC-4/AC-13: fresh PKCE + state for THIS attempt — never reused across logins.
+  const { codeVerifier, codeChallenge } = generatePkce();
+  const state = generateState();
+
+  // AC-1/AC-2: start the loopback listener BEFORE registration or browser launch,
+  // on 127.0.0.1 with an OS-assigned ephemeral port.
+  const receiver = createLoopbackReceiver({ expectedState: state });
+  const { redirectUri } = await receiver.listen();
+
+  // AC-11: Ctrl-C must close the listener and exit non-zero without saving.
+  const onSigint = () => {
+    errorLog(`\n${red("✗")} Login canceled.`);
+    receiver.close().finally(() => process.exit(1));
+  };
+  process.once("SIGINT", onSigint);
+
+  try {
+    // AC-3: dynamically register the EXACT loopback callback URI.
+    log(dim("→ Registering client..."));
+    const regRes = await fetchImpl(`${serverUrl}/register`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        client_name: "botbuddy-cli-node",
+        redirect_uris: [redirectUri],
+        grant_types: ["authorization_code"],
+        token_endpoint_auth_method: "none",
+      }),
+    });
+    const regData = await regRes.json().catch(() => ({}));
+    const clientId = regData.client_id;
+    if (!clientId) throw new LoginError(`Client registration failed: ${describeResponse(regData)}`);
+    log(`  ${green("✓")} Client registered: ${dim(clientId)}`);
+
+    // AC-6/AC-7: build the authorization URL and always print it (headless users
+    // open it themselves). The CLI never fetches /authorize.
+    const authUrl = buildAuthorizeUrl({ serverUrl, clientId, redirectUri, state, codeChallenge });
+    log("");
+    log(dim("→ Authorize BotBuddy in your browser:"));
+    log(`  ${cyan(authUrl)}`);
+    log("");
+
+    // AC-5/AC-12: launch the browser unless suppressed; a launch failure prints
+    // guidance and keeps listening rather than aborting.
+    if (noBrowser) {
+      log(dim("  --no-browser set — open the URL above before the login times out."));
+    } else {
+      try {
+        await openBrowser(authUrl);
+        log(dim("  Opened your default browser. Complete sign-in there."));
+      } catch {
+        log(`  ${yellow("!")} Couldn't open a browser automatically — open the URL above before the login times out.`);
+      }
+    }
+    log(dim(`→ Waiting for authorization (up to ${Math.round(timeoutMs / 60000)} min)...`));
+
+    // AC-8: await exactly one validated loopback callback.
+    let code;
+    try {
+      ({ code } = await receiver.waitForCallback({ timeoutMs }));
+    } catch (err) {
+      throw new LoginError(callbackErrorMessage(err));
+    }
+    log(`  ${green("✓")} Authorization received`);
+
+    // AC-10: exchange the code once, with the EXACT callback URI.
+    log(dim("→ Exchanging code for token..."));
+    const tokenRes = await fetchImpl(`${serverUrl}/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        client_id: clientId,
+        code_verifier: codeVerifier,
+        redirect_uri: redirectUri,
+      }),
+    });
+    const tokenData = await tokenRes.json().catch(() => ({}));
+    if (!tokenData.access_token) throw new LoginError(`Token exchange failed: ${describeResponse(tokenData)}`);
+    log(`  ${green("✓")} Access token received`);
+
+    const expiresAt = tokenData.expires_in
+      ? now() + tokenData.expires_in * 1000
+      : now() + 24 * 60 * 60 * 1000; // default 24h if server omits expires_in
+
+    saveConfig({
+      ...getConfig(),
+      access_token: tokenData.access_token,
       client_id: clientId,
-      code_verifier: codeVerifier,
-      redirect_uri: "http://localhost:19836/callback",
-    }),
-  });
-  const tokenData = await tokenRes.json();
-  if (!tokenData.access_token) die(`Token exchange failed: ${JSON.stringify(tokenData)}`);
-  console.log(`  ${green("✓")} Access token received`);
-
-  const expiresAt = tokenData.expires_in
-    ? Date.now() + tokenData.expires_in * 1000
-    : Date.now() + 24 * 60 * 60 * 1000; // default 24h if server omits expires_in
-
-  saveConfig({
-    ...getConfig(),
-    access_token: tokenData.access_token,
-    client_id: clientId,
-    token_expires_at: expiresAt,
-  });
-
-  console.log(`\n${green("✓")} Logged in successfully! Token saved to ${dim("~/.botbuddy/config.json")}`);
+      token_expires_at: expiresAt,
+    });
+
+    log(`\n${green("✓")} Logged in successfully! Token saved to ${dim("~/.botbuddy/config.json")}`);
+    return { clientId, redirectUri };
+  } finally {
+    // AC-11/AC-13: always release the socket so re-running login starts clean.
+    process.removeListener("SIGINT", onSigint);
+    await receiver.close();
+  }
 }