@botbuddy/cli 1.22.0 → 1.24.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.22.0",
+  "version": "1.24.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/api.mjs

@@ -1,7 +1,53 @@
 import { getConfig, SERVER_URL } from "./config.mjs";
 import { resolveOwnerToken, resolveAgentKey } from "./cli-credentials.mjs";
+import { findProfileName, getAgentProfile } from "./wait-profile.mjs";
 import { die, cyan, dim, yellow, prettyJson } from "./utils.mjs";
 
+// Same slug shape the server accepts on `?tenant=`.
+const TENANT_PIN_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+
+// BOT-1571 (Codex P1): a plain `botbuddy login` mints a USER token, which the
+// server refuses unpinned (MCP_TENANT_PIN_REQUIRED). Generic commands
+// (`botbuddy call`, resources) therefore derive a default pin:
+//   1. BOTBUDDY_TENANT (explicit; malformed → usage error, never sent),
+//   2. the repo's .botbuddy-agent.json profile tenant (walks up from cwd),
+//   3. the token's sole reachable tenant,
+//   4. none — the server's error names the fix.
+// A sealed (tenant-mode) or pre-1571 token gets NO derived pin: the server
+// resolves its own tenant, and a differing pin would be a hard conflict
+// (a pin can confirm a sealed tenant, never repoint it). BOTBUDDY_TENANT is
+// always honoured — it is the operator's explicit statement.
+export async function resolveDefaultTenantPin({
+  getConfig: getCfg = getConfig,
+  env = process.env,
+  cwd = process.cwd(),
+  findProfile = findProfileName,
+  profileFor = getAgentProfile,
+} = {}) {
+  const explicit = typeof env.BOTBUDDY_TENANT === "string" ? env.BOTBUDDY_TENANT.trim() : "";
+  if (explicit) {
+    if (!TENANT_PIN_RE.test(explicit)) throw new Error("BOTBUDDY_TENANT must be a lowercase tenant slug");
+    return explicit;
+  }
+  const cfg = getCfg() ?? {};
+  if (cfg.token_tenant_mode !== "user") return null;
+  let profileName = null;
+  try { profileName = await findProfile(cwd); } catch { profileName = null; }
+  const profileTenant = profileName ? profileFor(profileName)?.tenant ?? null : null;
+  if (profileTenant) return profileTenant;
+  const tenants = Array.isArray(cfg.token_tenants) ? cfg.token_tenants.filter((t) => typeof t === "string" && t) : [];
+  return tenants.length === 1 ? tenants[0] : null;
+}
+
+// Endpoint for a generic call: explicit `tenant` beats the derived pin.
+async function genericEndpoint({ tenant = null, resolvePin = resolveDefaultTenantPin } = {}) {
+  let pin = tenant;
+  if (!pin) {
+    try { pin = await resolvePin(); } catch (err) { die(err.message); }
+  }
+  return toolEndpoint(pin);
+}
+
 // BOT-1520: auth headers come from the Keychain, never a plaintext config.json
 // secret. The owner OAuth token (from `botbuddy login`) is preferred; the
 // tenant-bound agent key (from `botbuddy profile setup`) is the fallback.
@@ -23,8 +69,8 @@ async function authHeader() {
   die(`Not authenticated. Run: ${cyan("botbuddy login")}`);
 }
 
-export async function callTool(toolName, args = {}) {
-  const headers = { "Content-Type": "application/json", ...(await authHeader()) };
+export async function callTool(toolName, args = {}, { fetchImpl = fetch, auth = null, tenant = null, resolvePin = resolveDefaultTenantPin, log = (line) => console.log(line) } = {}) {
+  const headers = { "Content-Type": "application/json", ...(auth ?? await authHeader()) };
   const body = {
     jsonrpc: "2.0",
     id: 1,
@@ -32,16 +78,22 @@ export async function callTool(toolName, args = {}) {
     params: { name: toolName, arguments: args },
   };
 
-  const res = await fetch(SERVER_URL, { method: "POST", headers, body: JSON.stringify(body) });
+  const res = await fetchImpl(await genericEndpoint({ tenant, resolvePin }), { method: "POST", headers, body: JSON.stringify(body) });
   const data = await res.json();
 
-  if (data.error?.message) die(`Server error: ${data.error.message}`);
+  if (data.error?.message) {
+    const code = data.error?.data?.code;
+    const hint = code === "MCP_TENANT_PIN_REQUIRED"
+      ? ` Pin a tenant: ${cyan("botbuddy call <tool> --pin <slug>")}, ${cyan("BOTBUDDY_TENANT=<slug>")}, or run from a repo with ${dim(".botbuddy-agent.json")}.`
+      : "";
+    die(`Server error: ${data.error.message}${hint}`);
+  }
 
   const text = data.result?.content?.map((c) => c.text).join("\n");
   if (text) {
-    console.log(prettyJson(text));
+    log(prettyJson(text));
   } else {
-    console.log(JSON.stringify(data, null, 2));
+    log(JSON.stringify(data, null, 2));
   }
   return data;
 }
@@ -84,17 +136,26 @@ function toolEndpoint(tenant) {
   return url.toString();
 }
 
-export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null } = {}) {
+export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null, resolvePin = resolveDefaultTenantPin } = {}) {
   let auth = pinnedAuth;
   if (!auth) {
     const resolved = await resolveCallAuth();
     if (resolved.error) return resolved.error;
     auth = resolved.auth;
   }
+  // BOT-1571 (Codex P1, round 2): `botbuddy stack` and every other
+  // callToolJson caller that passes no explicit tenant would send a USER token
+  // unpinned → MCP_TENANT_PIN_REQUIRED. Derive the default pin, but only for
+  // an OWNER bearer — an agent key is already tenant-bound and a differing
+  // derived pin would be a spurious conflict.
+  let pin = tenant;
+  if (!pin && auth && Object.prototype.hasOwnProperty.call(auth, "Authorization")) {
+    try { pin = await resolvePin(); } catch (err) { return { ok: false, status: null, error: `usage: ${err?.message ?? err}` }; }
+  }
   const body = { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: toolName, arguments: args } };
   let res;
   try {
-    res = await fetchImpl(toolEndpoint(tenant), {
+    res = await fetchImpl(toolEndpoint(pin), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...auth },
       body: JSON.stringify(body),
@@ -127,23 +188,23 @@ export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, sig
   return { ok: true, data, isError: payload.result?.isError === true };
 }
 
-export async function listResources() {
-  const headers = { "Content-Type": "application/json", ...(await authHeader()) };
+export async function listResources({ fetchImpl = fetch, auth = null, tenant = null, resolvePin = resolveDefaultTenantPin, log = (line) => console.log(line) } = {}) {
+  const headers = { "Content-Type": "application/json", ...(auth ?? await authHeader()) };
   const body = { jsonrpc: "2.0", id: 1, method: "resources/list", params: {} };
-  const res = await fetch(SERVER_URL, { method: "POST", headers, body: JSON.stringify(body) });
+  const res = await fetchImpl(await genericEndpoint({ tenant, resolvePin }), { method: "POST", headers, body: JSON.stringify(body) });
   const data = await res.json();
-  console.log(JSON.stringify(data.result?.resources ?? data.result ?? data, null, 2));
+  log(JSON.stringify(data.result?.resources ?? data.result ?? data, null, 2));
 }
 
-export async function readResource(uri) {
-  const headers = { "Content-Type": "application/json", ...(await authHeader()) };
+export async function readResource(uri, { fetchImpl = fetch, auth = null, tenant = null, resolvePin = resolveDefaultTenantPin, log = (line) => console.log(line) } = {}) {
+  const headers = { "Content-Type": "application/json", ...(auth ?? await authHeader()) };
   const body = { jsonrpc: "2.0", id: 1, method: "resources/read", params: { uri } };
-  const res = await fetch(SERVER_URL, { method: "POST", headers, body: JSON.stringify(body) });
+  const res = await fetchImpl(await genericEndpoint({ tenant, resolvePin }), { method: "POST", headers, body: JSON.stringify(body) });
   const data = await res.json();
   const text = data.result?.contents?.[0]?.text;
   if (text) {
-    console.log(prettyJson(text));
+    log(prettyJson(text));
   } else {
-    console.log(JSON.stringify(data.result ?? data, null, 2));
+    log(JSON.stringify(data.result ?? data, null, 2));
   }
 }

package/src/auth.mjs

@@ -170,8 +170,14 @@ export async function doLogin(options = {}, deps = {}) {
     // BOT-1566: a Keychain read-back mismatch (`keychain_readback_mismatch`)
     // propagates from here, so login exits non-zero and the success line below
     // is never printed for a credential that did not verifiably land.
+    // BOT-1571: record the token's scope. A server that predates tenant modes
+    // omits `tenant_mode`; such a token is sealed (or legacy), never assumed
+    // to be a user token.
+    const tenantMode = tokenData.tenant_mode === "user" ? "user" : "tenant";
+    const tenantId = typeof tokenData.tenant_id === "string" && tokenData.tenant_id ? tokenData.tenant_id : null;
+    const tenants = Array.isArray(tokenData.tenants) ? tokenData.tenants.filter((t) => typeof t === "string" && t) : [];
     const { storedInKeychain } = await persist(
-      { token: tokenData.access_token, expiresAt, clientId },
+      { token: tokenData.access_token, expiresAt, clientId, tenantMode, tenantId, tenants },
       { getConfig, saveConfig, warn: errorLog },
     );
 
@@ -180,6 +186,11 @@ export async function doLogin(options = {}, deps = {}) {
         storedInKeychain ? "the macOS Keychain" : dim("~/.botbuddy/config.json")
       }.`,
     );
+    if (tenantMode === "user") {
+      log(`  Token scope: ${cyan("user")} — works for every tenant you belong to${tenants.length ? ` (${tenants.join(", ")})` : ""}; each ${cyan("botbuddy profile setup")} pins its own.`);
+    } else if (tenantId) {
+      log(`  Token scope: ${cyan("tenant")} — sealed to ${cyan(tenantId)}. Run ${cyan("botbuddy login")} without ${dim("--tenant")} for a token that reaches all your tenants.`);
+    }
     return { clientId, redirectUri };
   } finally {
     // AC-11/AC-13: always release the socket so re-running login starts clean.

package/src/cli-credentials.mjs

@@ -25,9 +25,19 @@ import {
 } from "./agent-credential-store.mjs";
 import { resolveAgentProfile } from "./wait-profile.mjs";
 
-// Dedicated Keychain service for the owner OAuth token. Distinct from the
-// per-profile agent-key services (BOTBUDDY_BB_AGENT_KEY / BOTBUDDY_SG_AGENT_KEY)
-// so the human owner session and the machine agent identity never collide.
+// BOT-1574: the per-machine CLIENT KEY. `botbuddy login` mints a user-mode OAuth
+// token (BOT-1571) — tenant-agnostic, pins one tenant per request against the
+// owner's memberships — and that token IS the machine's client credential. It is
+// stored under ONE Keychain item per machine, distinct from the per-profile
+// agent-key services (BOTBUDDY_BB_AGENT_KEY / BOTBUDDY_SG_AGENT_KEY) and from the
+// per-session token (bb_sess_), so a setup credential is never mistaken for an
+// agent. (The wire format stays `mcp_at_`; "client key" is the kind, not a new
+// prefix — the OAuth token format is out of scope for BOT-1574.)
+export const CLIENT_KEY_SERVICE = "BOTBUDDY_CLIENT_KEY";
+
+// The legacy service the same token was stored under before BOT-1574. Still read
+// (so an already-logged-in user keeps working across the upgrade without
+// re-login) and cleared on logout; `login` always writes CLIENT_KEY_SERVICE now.
 export const OWNER_TOKEN_SERVICE = "BOTBUDDY_OWNER_TOKEN";
 
 // Config keys that must never carry secret material at rest.
@@ -67,11 +77,11 @@ export async function migrateConfigSecrets(config, {
   exists,
   // `createOnly`: the migration write must not overwrite a token another process
   // wrote after our empty-slot read (BOT-1569 Codex P2 TOCTOU).
-  keychainWrite = (value) => writeKeychainSecret(OWNER_TOKEN_SERVICE, value, { createOnly: true }),
+  keychainWrite = (value) => writeKeychainSecret(CLIENT_KEY_SERVICE, value, { createOnly: true }),
   // `strict`: a transient READ failure throws (fail closed) instead of reading as
   // an empty slot, so the migration never overwrites a live stored token because
   // the lookup momentarily failed (BOT-1569 Codex P2).
-  keychainRead = () => readKeychainSecret(OWNER_TOKEN_SERVICE, { strict: true }),
+  keychainRead = () => readKeychainSecret(CLIENT_KEY_SERVICE, { strict: true }),
   warn = (message) => console.error(message),
 } = {}) {
   const out = { ...(config ?? {}) };
@@ -167,13 +177,13 @@ export async function migrateConfigSecrets(config, {
 // the token itself goes to the Keychain on darwin, or (with a warning) stays in
 // the 0600 config.json where no Keychain exists.
 export async function persistOwnerToken(
-  { token, expiresAt, clientId },
+  { token, expiresAt, clientId, tenantMode, tenantId, tenants },
   {
     platform = process.platform,
     exists,
     getConfig,
     saveConfig,
-    keychainWrite = (value) => writeKeychainSecret(OWNER_TOKEN_SERVICE, value),
+    keychainWrite = (value) => writeKeychainSecret(CLIENT_KEY_SERVICE, value),
     warn = (message) => console.error(message),
   } = {},
 ) {
@@ -187,6 +197,16 @@ export async function persistOwnerToken(
   const next = { ...base };
   if (clientId !== undefined) next.client_id = clientId;
   if (expiresAt !== undefined) next.token_expires_at = expiresAt;
+  // BOT-1571: the token's SCOPE (non-secret). `user` = not bound to a tenant,
+  // pins one per request; `tenant` = sealed to token_tenant_id. Recorded from
+  // the /token response so `status` can describe the credential and probe it
+  // with a pin it is known to reach. Always replaced together, never merged
+  // with a previous login's scope.
+  if (tenantMode !== undefined) {
+    next.token_tenant_mode = tenantMode;
+    next.token_tenant_id = tenantId ?? null;
+    next.token_tenants = Array.isArray(tenants) ? tenants.filter((t) => typeof t === "string" && t) : [];
+  }
 
   if (keychain) {
     await keychainWrite(token);
@@ -209,25 +229,38 @@ export async function resolveOwnerToken({
   platform = process.platform,
   exists,
   getConfig,
-  keychainRead = () => readKeychainSecret(OWNER_TOKEN_SERVICE),
+  keychainRead = () => readKeychainSecret(CLIENT_KEY_SERVICE),
+  // BOT-1574 migration: a machine logged in before 1574 has the token under the
+  // legacy OWNER_TOKEN service. Read it as a fallback so an upgrade needs no
+  // re-login; `login` rewrites it to CLIENT_KEY, and `logout` clears both.
+  keychainReadLegacy = () => readKeychainSecret(OWNER_TOKEN_SERVICE),
 } = {}) {
   const cfg = getConfig() ?? {};
   const expiresAt = typeof cfg.token_expires_at === "number" ? cfg.token_expires_at : null;
   let token = null;
   if (keychainAvailable(platform, exists)) {
     token = await keychainRead();
+    if (!token) token = await keychainReadLegacy();
   } else if (typeof cfg.access_token === "string" && cfg.access_token) {
     token = cfg.access_token;
   }
   if (!token) return null;
-  return { token, expiresAt };
+  const tenantMode = cfg.token_tenant_mode === "user" || cfg.token_tenant_mode === "tenant" ? cfg.token_tenant_mode : null;
+  const tenantId = typeof cfg.token_tenant_id === "string" && cfg.token_tenant_id ? cfg.token_tenant_id : null;
+  const tenants = Array.isArray(cfg.token_tenants) ? cfg.token_tenants.filter((t) => typeof t === "string" && t) : [];
+  return { token, expiresAt, tenantMode, tenantId, tenants };
 }
 
-// Remove the owner OAuth token from every store (`botbuddy logout`).
+// Remove the client key from every store (`botbuddy logout`). Clears BOTH the
+// current CLIENT_KEY item and the legacy OWNER_TOKEN item so a pre-1574 token
+// left behind by the read-both migration is never orphaned in the Keychain.
 export async function clearOwnerToken({
   platform = process.platform,
   exists,
-  keychainDelete = () => deleteKeychainSecret(OWNER_TOKEN_SERVICE),
+  keychainDelete = async () => {
+    await deleteKeychainSecret(CLIENT_KEY_SERVICE);
+    await deleteKeychainSecret(OWNER_TOKEN_SERVICE);
+  },
 } = {}) {
   if (keychainAvailable(platform, exists)) {
     await keychainDelete();