@botbuddy/cli 1.2.3 → 1.4.1

package/src/wait-profile.mjs

@@ -0,0 +1,84 @@
+import { readFile } from "node:fs/promises";
+import { dirname, join, parse } from "node:path";
+import { readProfileCredential } from "./agent-credential-store.mjs";
+
+// Public CLI profiles remain tenant-bound machine-principal contracts.
+export const PROFILE_FILE = ".botbuddy-agent.json";
+
+const PROFILES = Object.freeze({
+  "botbuddy-dev": Object.freeze({
+    tenant: "botbuddy",
+    tokenEnv: "BOTBUDDY_BB_AGENT_KEY",
+  }),
+  "supplyguard-dev": Object.freeze({
+    tenant: "supply-guard",
+    tokenEnv: "BOTBUDDY_SG_AGENT_KEY",
+  }),
+});
+
+export function getAgentProfile(name) {
+  return PROFILES[name] ?? null;
+}
+
+export async function findProfileName(cwd) {
+  let dir = cwd;
+  const root = parse(dir).root;
+  while (true) {
+    try {
+      const raw = await readFile(join(dir, PROFILE_FILE), "utf8");
+      const config = JSON.parse(raw);
+      if (config?.schema_version !== 1 || typeof config?.profile !== "string") {
+        throw new Error(`${PROFILE_FILE} must contain schema_version 1 and a profile`);
+      }
+      return config.profile;
+    } catch (err) {
+      if (err?.code !== "ENOENT") throw err;
+    }
+    if (dir === root) return null;
+    dir = dirname(dir);
+  }
+}
+
+export async function resolveAgentProfile({
+  cwd = process.cwd(),
+  env = process.env,
+  explicitProfile = null,
+  explicitToken = null,
+  readCredential = readProfileCredential,
+} = {}) {
+  const name = explicitProfile || await findProfileName(cwd);
+  if (!name) {
+    const err = new Error(
+      `no BotBuddy agent profile found (add ${PROFILE_FILE} or pass --profile)`,
+    );
+    err.code = "profile_required";
+    throw err;
+  }
+  const profile = getAgentProfile(name);
+  if (!profile) {
+    const err = new Error(`unknown BotBuddy agent profile '${name}'`);
+    err.code = "unknown_profile";
+    throw err;
+  }
+  return {
+    name,
+    tenant: profile.tenant,
+    tokenEnv: profile.tokenEnv,
+    // A freshly bootstrapped credential must take effect even if a calling shell
+    // still has a stale profile variable. `--token` remains the explicit escape
+    // hatch for a one-off credential.
+    token: explicitToken || await readCredential(name) || env[profile.tokenEnv] || null,
+  };
+}
+
+export function withPrincipalReceipt(receipt, profile, registration = {}) {
+  if (!profile) return receipt;
+  return {
+    ...receipt,
+    principal: {
+      profile: profile.name,
+      tenant_id: registration.sessionTenant ?? profile.tenant,
+      agent_id: registration.agentId ?? null,
+    },
+  };
+}

package/src/wait-profile.test.mjs

@@ -0,0 +1,30 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { resolveAgentProfile } from "./wait-profile.mjs";
+
+test("BOT-1344: a profiled public wait reads its tenant-bound Keychain credential without a shell export", async () => {
+  const profile = await resolveAgentProfile({
+    explicitProfile: "botbuddy-dev",
+    env: {},
+    readCredential: async (name) => {
+      assert.equal(name, "botbuddy-dev");
+      return "fixture-keychain-agent-credential";
+    },
+  });
+
+  assert.equal(profile.token, "fixture-keychain-agent-credential");
+  assert.equal(profile.tenant, "botbuddy");
+  assert(!JSON.stringify(profile).includes("BOTBUDDY_AGENT_KEY"));
+});
+
+test("BOT-1344: a one-off wait token overrides the Keychain profile credential", async () => {
+  const profile = await resolveAgentProfile({
+    explicitProfile: "botbuddy-dev",
+    explicitToken: "fixture-diagnostic-token",
+    env: { BOTBUDDY_BB_AGENT_KEY: "fixture-ci-token" },
+    readCredential: async () => "fixture-keychain-agent-credential",
+  });
+
+  assert.equal(profile.token, "fixture-diagnostic-token");
+});