@botbuddy/cli 1.25.0 → 1.26.0

package/src/profile-bootstrap.mjs

@@ -1,252 +0,0 @@
-import { hostname } from "node:os";
-import { randomUUID } from "node:crypto";
-
-import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment, ProfileCredentialStoreError } from "./agent-credential-store.mjs";
-import { callToolJson, resolveCallAuth } from "./api.mjs";
-import { latestPublicCliCommand } from "./public-invocation.mjs";
-
-const PROFILES = Object.freeze({
-  "botbuddy-dev": Object.freeze({ tenant: "botbuddy" }),
-  "supplyguard-dev": Object.freeze({ tenant: "supply-guard" }),
-});
-
-function getAgentProfile(name) {
-  return PROFILES[name] ?? null;
-}
-
-export class ProfileBootstrapError extends Error {
-  constructor(code) {
-    super(code);
-    this.code = code;
-  }
-}
-
-export function defaultProfileAgentName(profile) {
-  const host = hostname().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
-  const suffix = randomUUID().replace(/-/g, "").slice(0, 12);
-  return `${profile}-${host || "host"}-${suffix}`;
-}
-
-// A structured MCP error code can arrive on a tool result body (`data.code`) or,
-// for a 401/403, on the top-level auth receipt (`code`) that callToolJson lifts
-// out of the JSON-RPC error body (BOT-1561). Read whichever is present.
-function structuredCode(response) {
-  if (typeof response?.data?.code === "string") return response.data.code;
-  if (typeof response?.code === "string") return response.code;
-  return null;
-}
-
-function registrationCredential(data) {
-  return typeof data?.agent_api_key === "string"
-    ? data.agent_api_key
-    : typeof data?.api_key === "string"
-      ? data.api_key
-      : null;
-}
-
-export async function bootstrapProfile(profileName, {
-  name = null,
-  call = callToolJson,
-  resolveAuth = resolveCallAuth,
-  readIdentity = readProfileIdentity,
-  readRetryIdentity = readProfileRetryIdentity,
-  recordRetryIdentity = recordProfileRetryIdentity,
-  store = installProfileCredential,
-  ensureBackend = ensureProfileCredentialBackend,
-} = {}) {
-  const profile = getAgentProfile(profileName);
-  if (!profile) throw new ProfileBootstrapError("profile_required");
-  try { ensureBackend(); } catch { throw new ProfileBootstrapError("profile_agent_required"); }
-
-  const existing = await readIdentity(profileName);
-  const retryIdentity = existing ? null : await readRetryIdentity(profileName);
-  // A mismatched local entry is never reused. A fresh server-attested
-  // registration replaces it atomically, so the documented recovery command
-  // cannot loop forever on stale metadata.
-  const reusableIdentity = existing?.tenant === profile.tenant ? existing.agentId : retryIdentity?.agentId ?? null;
-  const agentName = name ?? (existing?.tenant === profile.tenant ? existing.name : retryIdentity?.name ?? defaultProfileAgentName(profileName));
-  // BOT-1487: tenancy is auth-bound after BOT-1416 — register_agent selects the
-  // tenant from the OAuth session / agent key and rejects a runtime tenant_id
-  // with MCP_TENANT_CONTEXT_IS_AUTH_ONLY. So we no longer send tenant_id; the
-  // returned tenant_id is attested against the profile's tenant below instead.
-  //
-  // register_agent is a MUTATING call (it persists the agent, its credential
-  // hash, and tenant membership). If the session is logged into another tenant,
-  // registering first and rejecting the response afterwards would leave a stray,
-  // unreachable agent in the wrong tenant on every attempt (names are randomized
-  // and the wrong-tenant path records no retry identity). So resolve the bound
-  // tenant with the read-only `whoami` FIRST and gate registration on it.
-  //
-  // Fail CLOSED (AGENTS.md — no fallbacks; non-determinism is worse than
-  // failure): the mutating register_agent runs ONLY on a positively attested
-  // tenant that matches the profile. A missing/erroring/malformed whoami never
-  // silently proceeds, because the later attestation cannot undo an agent that
-  // registration already persisted in the wrong tenant.
-  //
-  // Snapshot the credential ONCE and pin it to both whoami and register_agent.
-  // Otherwise each call re-reads the owner token, so a concurrent `botbuddy
-  // login` could swap the bound tenant between the attesting whoami and the
-  // mutating register (a TOCTOU that would register in the second tenant).
-  const pinned = await resolveAuth();
-  if (pinned?.error) throw new ProfileBootstrapError("profile_agent_required");
-  const auth = pinned?.auth ?? null;
-  // BOT-1561: a multi-tenant owner's OAuth credential is tenant-ambiguous, so an
-  // unpinned whoami returns no tenant_id and BOT-1487's gate throws
-  // profile_tenant_unverified. Each profile already knows its tenant, so pin it
-  // on BOTH calls: whoami resolves/confirms exactly that tenant (the server
-  // refuses a non-member owner → profile_credential_wrong_tenant below), and
-  // register_agent mints in the pinned tenant. Preserves BOT-1487's fail-closed
-  // + single-credential pinning guarantees.
-  const tenant = profile.tenant;
-  const identity = await call("whoami", {}, { auth, tenant });
-  const identityCode = structuredCode(identity);
-  // BOT-1561: the server refuses the pin with MCP_TENANT_MEMBERSHIP_REQUIRED
-  // (HTTP 403) when the credential cannot register in the profile's tenant —
-  // either the owner is not a member, or a tenant-bound login is sealed to a
-  // DIFFERENT tenant (resolveHintedTenant never repoints a bound credential).
-  // callToolJson now preserves that code from the 403 body; map it to the
-  // wrong-tenant outcome so setup reports the accurate, actionable failure
-  // instead of the misleading profile_tenant_unverified the swallowed 403
-  // previously produced. register_agent never runs.
-  if (identityCode === "MCP_TENANT_MEMBERSHIP_REQUIRED") {
-    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
-  }
-  if (identityCode === "MCP_TENANT_SELECTION_REQUIRED" || identityCode === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY") {
-    throw new ProfileBootstrapError("profile_tenant_selection_required");
-  }
-  const boundTenant = typeof identity?.data?.tenant_id === "string" ? identity.data.tenant_id : null;
-  if (!boundTenant) {
-    // whoami did not positively attest a tenant (transport/server error or a
-    // response without a string tenant_id) — refuse rather than register blind.
-    throw new ProfileBootstrapError("profile_tenant_unverified");
-  }
-  if (boundTenant !== profile.tenant) {
-    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
-  }
-  const args = {
-    name: agentName,
-    type: "codex",
-    ...(reusableIdentity ? { agent_id: reusableIdentity } : {}),
-  };
-  const response = await call("register_agent", args, { auth, tenant });
-  const data = response?.data;
-  const responseCode = structuredCode(response);
-  // Defense-in-depth: whoami above already gated on the tenant, so register_agent
-  // should not return a tenant-context error here — but if the contract drifts,
-  // surface its own actionable recovery, not the misleading
-  // `profile_agent_required` → `botbuddy login` loop that keeps failing because
-  // login itself is fine.
-  if (responseCode === "MCP_TENANT_MEMBERSHIP_REQUIRED") {
-    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
-  }
-  if (responseCode === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY" || responseCode === "MCP_TENANT_SELECTION_REQUIRED") {
-    throw new ProfileBootstrapError("profile_tenant_selection_required");
-  }
-  if (!response?.ok || (response.isError && data?.code !== "FRESH_CONNECTION_REQUIRED")) {
-    throw new ProfileBootstrapError("profile_agent_required");
-  }
-  if (!data?.agent_id || typeof data.agent_id !== "string") {
-    throw new ProfileBootstrapError("profile_agent_required");
-  }
-  if (typeof data.tenant_id !== "string") {
-    await recordRetryIdentity({ profile: profileName, agentId: data.agent_id, name: agentName });
-    throw new ProfileBootstrapError("profile_tenant_attestation_missing");
-  }
-  if (data.tenant_id !== profile.tenant) {
-    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
-  }
-  const token = registrationCredential(data);
-  if (!token) throw new ProfileBootstrapError("profile_agent_required");
-
-  try {
-    await store({
-      profile: profileName,
-      tenant: profile.tenant,
-      agentId: data.agent_id,
-      name: agentName,
-      token,
-    });
-  } catch (error) {
-    // OAuth + registration + tenant attestation all succeeded; only persisting
-    // the credential failed. Give the two persistence failures accurate,
-    // distinct recoveries — never the `botbuddy login` OAuth recovery:
-    //   • a Keychain write failure (ProfileCredentialStoreError) is resolved by
-    //     unlocking the login keychain;
-    //   • a filesystem/lock failure writing ~/.botbuddy/agent-profiles.json
-    //     (EACCES/ENOSPC/busy store lock) is NOT — unlocking the keychain would
-    //     not help, so it gets its own code.
-    if (error instanceof ProfileBootstrapError) throw error;
-    const code = error instanceof ProfileCredentialStoreError
-      ? "profile_credential_store_failed"
-      : "profile_credential_persist_failed";
-    const failure = new ProfileBootstrapError(code);
-    failure.cause = error;
-    throw failure;
-  }
-  return {
-    schema_version: 1,
-    outcome: "installed",
-    profile: profileName,
-    tenant_id: profile.tenant,
-    agent_id: data.agent_id,
-    credential_source: "keychain_profile_slot",
-    shell_refresh: `source <(${latestPublicCliCommand(`profile env ${profileName}`)})`,
-    gui_refresh: "$HOME/.local/bin/botbuddy-mcp-env.sh",
-  };
-}
-
-// Maps a bootstrap error code to the recovery hint shown in the CLI receipt.
-// A credential-store/Keychain failure gets its own actionable recovery; every
-// other failure keeps the historical login-first recovery verbatim.
-export function profileBootstrapRecovery(code, profileName) {
-  if (code === "profile_credential_store_failed") {
-    return `unlock your login keychain (security unlock-keychain), then re-run: botbuddy profile setup ${profileName}`;
-  }
-  if (code === "profile_credential_persist_failed") {
-    return `ensure ~/.botbuddy is writable and no other setup is running, then re-run: botbuddy profile setup ${profileName}`;
-  }
-  if (code === "profile_credential_wrong_tenant") {
-    // BOT-1561: reached when the login is authorized for a different tenant (a
-    // tenant-bound token can't be repointed) or the owner isn't a member of the
-    // profile's tenant. The fix is to authenticate INTO the profile's tenant —
-    // not the bare login loop, which relogs into the same wrong tenant.
-    // BOT-1571: a plain `botbuddy login` (no --tenant) now mints a USER token
-    // that reaches every tenant the owner belongs to, so the fix is that — not
-    // "log in again and pick this tenant", which is exactly the per-tenant
-    // re-login friction BOT-1571 removes.
-    // BOT-1571 (Codex follow-up): MCP_TENANT_MEMBERSHIP_REQUIRED conflates two
-    // causes and the CLI cannot tell them apart from the code alone — the owner
-    // is not a member of the tenant, OR a `--tenant`-sealed login is pinned to a
-    // different one. Lead with the membership case and say re-login will NOT fix
-    // it (a user token still can't reach a tenant you don't belong to), so a
-    // non-member is not sent through a no-op `botbuddy login` loop; offer the
-    // re-login only for the genuinely-sealed case.
-    const tenant = getAgentProfile(profileName)?.tenant;
-    const forTenant = tenant ? ` tenant "${tenant}"` : " this profile's tenant";
-    const memberHint = tenant
-      ? `if you are not a member of "${tenant}", ask an admin to add you — a re-login will not help`
-      : "if you are not a member of it, ask an admin to add you — a re-login will not help";
-    return `your login is not authorized for${forTenant}: ${memberHint}. If instead your login is sealed to a different tenant (you signed in with --tenant), run botbuddy login (without --tenant) to get a user token that reaches all your tenants, then re-run: botbuddy profile setup ${profileName}`;
-  }
-  if (code === "profile_tenant_unverified") {
-    // whoami could not confirm the bound tenant, so registration was refused
-    // before any mutation. Usually transient — retry; login only if it persists.
-    return `could not confirm your tenant with the server — retry: botbuddy profile setup ${profileName} (if it persists, run botbuddy login, then re-run setup)`;
-  }
-  if (code === "profile_tenant_selection_required") {
-    // Tenancy is chosen at MCP authentication (BOT-1416), not passed to
-    // register_agent. Point the user at selecting the profile's tenant when
-    // they sign in — never the bare login loop that implies login is broken.
-    const tenant = getAgentProfile(profileName)?.tenant;
-    return tenant
-      ? `sign in and select the "${tenant}" tenant during authentication, then re-run: botbuddy profile setup ${profileName}`
-      : `sign in and select the matching tenant during authentication, then re-run: botbuddy profile setup ${profileName}`;
-  }
-  return `botbuddy login && botbuddy profile setup ${profileName}`;
-}
-
-export function profileShellRefresh(profileName) {
-  const tokenEnv = profileCredentialEnvironment(profileName);
-  if (!tokenEnv) throw new ProfileBootstrapError("profile_required");
-  return `if botbuddy_profile_token="$(security find-generic-password -a \"$USER\" -s \"${tokenEnv}\" -w)"; then export ${tokenEnv}="$botbuddy_profile_token"; unset botbuddy_profile_token; else unset botbuddy_profile_token; false; fi`;
-}