@botbuddy/cli 1.28.0 → 1.29.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.28.0",
+  "version": "1.29.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -612,6 +612,9 @@ export function mcpHelp(log = console.log) {
                     ${cyan("botbuddy login")} owner/client credential), store it in the
                     Keychain under ${dim("BOTBUDDY_MCP_KEY")} (or --env <NAME>), and print
                     the .mcp.json / .codex/config.toml snippets that reference it.
+                    A bb_mcp_ key is tenant-sealed: on a machine serving more than
+                    one tenant, mint each tenant under a distinct --env <NAME> var
+                    and commit that repo's matching .botbuddy-agent.json mcp_env.
                     Refuses an occupied Keychain slot unless --force (revoke the
                     old key first — --force leaves it live server-side).
   revoke <agent_id> [--tenant <slug>] [--env <NAME>]

package/src/setup-block.mjs

@@ -65,6 +65,7 @@ export const SETUP_BLOCK = `SETUP — the connectivity ladder (install → conne
   3. bb mcp setup                           tier 2 · MCP key (bb_mcp_, tenant-bound) → Keychain + .mcp.json ($BOTBUDDY_MCP_KEY)
                                             (Keychainless host: the key is printed ONCE — store + export + edit .mcp.json yourself)
                                             the repo's pre-committed .botbuddy-agent.json binds tenant + mcp_env
+                                            multi-tenant machine: mint each tenant under a distinct --env <NAME> var (they collide otherwise)
   4. register_agent (over MCP)              tier 3 · session token (bb_agent_, per-session, 8 h)
   5. export BOTBUDDY_AGENT_KEY=<session_token>   and   BOTBUDDY_SESSION_ID=<session_id>
   6. bb wait                                needs the tier-3 token; bb run/test also accept $BOTBUDDY_SESSION_ID,

package/src/stack.mjs

@@ -30,6 +30,7 @@ import { randomUUID } from "crypto";
 import { callToolJson } from "./api.mjs";
 import { SERVER_URL, getConfig } from "./config.mjs";
 import { resolveOwnerToken, resolveAgentKey } from "./cli-credentials.mjs";
+import { AGENT_KEY_RE, readAgentKeyEnv } from "./agent-key.mjs";
 import { runDockerCommand, runDockerWorkflow } from "./docker-hygiene.mjs";
 import { machineUuid } from "./machine-id.mjs";
 import { bold, dim, yellow } from "./utils.mjs";
@@ -352,10 +353,17 @@ export function parseSupabaseStatus(text) {
 
 // ── runtime (network / process) ──────────────────────────────────────────────
 
-// BOT-1520: source both auth headers from the Keychain — the owner OAuth token
-// (`botbuddy login`) is preferred, the tenant-bound MCP key
-// (`botbuddy mcp setup`, BOT-1608) is the fallback. No plaintext config.json secret.
+// BOT-1599: a stack lease is a host-bound operation. When a session token is
+// present it must win over the durable OAuth client credential, otherwise the
+// lease RPC resolves the hostless/stale OAuth agent rather than the agent that
+// registered this worktree and machine attestation. The MCP server accepts the
+// session token through the same agent-key header used by bb-pw.
+//
+// Without a session token, retain the BOT-1520 Keychain-backed OAuth/MCP-key
+// fallback for operator commands and legacy callers.
 export async function stackAuthHeader() {
+  const sessionToken = readAgentKeyEnv();
+  if (sessionToken) return AGENT_KEY_RE.test(sessionToken) ? { "x-agent-api-key": sessionToken } : null;
   const agentKey = await resolveAgentKey();
   const owner = await resolveOwnerToken({ getConfig });
   if (owner) {
@@ -697,6 +705,7 @@ export async function cmdUp(opts, {
   }
   const auth = await authProvider();
   if (!auth) return emitResult(buildReceipt({ command: "up", outcome: "error", error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
+  const call = (name, args, callOptions = {}) => callTool(name, args, { ...callOptions, auth });
 
   // BOT-1585: co-location dispatches the lease to the Helper enrolled for THIS
   // physical machine (hardware id), since a hostname is not machine-unique. The
@@ -705,7 +714,7 @@ export async function cmdUp(opts, {
   if (!hardwareUuid) {
     return emitResult(buildReceipt({ command: "up", outcome: "error", code: "MACHINE_UUID_REQUIRED", error: "could not determine this machine's hardware id (needed to dispatch the stack lease to the right machine)" }), opts, EXIT.BACKEND);
   }
-  const req = await callTool("request_stack_lease", {
+  const req = await call("request_stack_lease", {
     slot, host_key: opts.host || undefined, repo: opts.repo || undefined,
     ticket_id: opts.ticket || undefined, ticket_url: opts.ticketUrl || undefined,
     pr_id: opts.prId || undefined, pr_url: opts.prUrl || undefined,
@@ -748,7 +757,7 @@ export async function cmdUp(opts, {
       localPreflight = compactPreflight(checked.receipt);
       localDockerTarget = dockerTargetFromPreflight(checked.receipt);
       if (checked.exitCode !== 0 || !localDockerTarget) {
-        const cancelled = await callTool("cancel_unclaimed_stack_lease", { lease_id: leaseId });
+        const cancelled = await call("cancel_unclaimed_stack_lease", { lease_id: leaseId });
         const leaseCancellation = cancelled.ok && cancelled.data?.success
           ? { success: true, state: cancelled.data.state, provision_job_cancelled: cancelled.data.provision_job_cancelled === true }
           : { success: false, error: cancelled.error || cancelled.data?.code || "atomic cancellation failed" };
@@ -768,7 +777,7 @@ export async function cmdUp(opts, {
       // Persist the validated Docker target with the reservation so that if the
       // provisioner partially starts a stack and then fails, the fenced lease can
       // still be torn down by `stack done --local-exec` (BOT-1421 review).
-      const reserved = await callTool("reserve_stack_lease", {
+      const reserved = await call("reserve_stack_lease", {
         lease_id: leaseId,
         connection: connectionWithDockerTarget({}, localDockerTarget),
       });
@@ -801,7 +810,7 @@ export async function cmdUp(opts, {
           // Fall through to the authoritative `get_stack_lease` read below — do
           // NOT run the local provisioner; the Helper owns this stack.
         } else {
-          const cancelled = await callTool("cancel_unclaimed_stack_lease", { lease_id: leaseId });
+          const cancelled = await call("cancel_unclaimed_stack_lease", { lease_id: leaseId });
           const leaseCancellation = cancelled.ok && cancelled.data?.success
             ? { success: true, state: cancelled.data.state, provision_job_cancelled: cancelled.data.provision_job_cancelled === true }
             : { success: false, error: cancelled.error || cancelled.data?.code || "atomic cancellation failed" };
@@ -825,7 +834,7 @@ export async function cmdUp(opts, {
           // review); do NOT cancel.
           return emitResult(buildReceipt({ command: "up", outcome: "error", lease_id: leaseId, error: e.message }), opts, EXIT.LEASE_FAILED);
         }
-        const act = await callTool("activate_stack_lease", { lease_id: leaseId, connection: conn });
+        const act = await call("activate_stack_lease", { lease_id: leaseId, connection: conn });
         if (!act.ok || !act.data?.success) {
           return emitResult(buildReceipt({ command: "up", outcome: "error", lease_id: leaseId, error: act.error || act.data?.code || "activate failed" }), opts, EXIT.BACKEND);
         }
@@ -840,7 +849,7 @@ export async function cmdUp(opts, {
   }
 
   // Authoritative final read (connection block, current state).
-  const got = await callTool("get_stack_lease", { lease_id: leaseId });
+  const got = await call("get_stack_lease", { lease_id: leaseId });
   const g = got.ok && got.data?.success ? got.data : null;
   if (!g || g.state !== "active") {
     return emitResult(buildReceipt({ command: "up", outcome: "error", lease_id: leaseId, state: g?.state, error: g ? `lease is ${g.state}, not active` : (got.error || "could not read lease") }), opts, g?.state && isReaped(g.state) ? EXIT.LEASE_FAILED : EXIT.BACKEND);
@@ -854,7 +863,9 @@ export async function cmdUp(opts, {
 }
 
 async function cmdStatus(leaseId, opts) {
-  const got = await callToolJson("get_stack_lease", { lease_id: leaseId });
+  const auth = await stackAuthHeader();
+  if (!auth) return emit(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
+  const got = await callToolJson("get_stack_lease", { lease_id: leaseId }, { auth });
   if (!got.ok) return got.auth
     ? emit(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: got.error }), opts, EXIT.AUTH)
     : emit(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: got.error }), opts, EXIT.BACKEND);
@@ -868,7 +879,9 @@ async function cmdStatus(leaseId, opts) {
 }
 
 async function cmdTouch(leaseId, opts) {
-  const r = await callToolJson("touch_stack_lease", { lease_id: leaseId });
+  const auth = await stackAuthHeader();
+  if (!auth) return emit(buildReceipt({ command: "touch", outcome: "error", lease_id: leaseId, error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
+  const r = await callToolJson("touch_stack_lease", { lease_id: leaseId }, { auth });
   if (!r.ok) return emit(buildReceipt({ command: "touch", outcome: "error", lease_id: leaseId, error: r.error }), opts, r.auth ? EXIT.AUTH : EXIT.BACKEND);
   if (!r.data.success) return emit(buildReceipt({ command: "touch", outcome: "error", lease_id: leaseId, code: r.data.code, error: r.data.code }), opts, EXIT.BACKEND);
   return emit(buildReceipt({ command: "touch", outcome: "touched", lease_id: leaseId, last_used_at: r.data.last_used_at }), opts, EXIT.OK);
@@ -876,15 +889,19 @@ async function cmdTouch(leaseId, opts) {
 
 export async function cmdDone(leaseId, opts, {
   callTool = callToolJson,
+  authProvider = stackAuthHeader,
   runPreflight = runLocalExecTargetCheck,
   proveLegacyTarget = proveLegacyLocalExecTarget,
   localTeardownFn = localTeardown,
   emitResult = emit,
 } = {}) {
+  const auth = await authProvider();
+  if (!auth) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
+  const call = (name, args, callOptions = {}) => callTool(name, args, { ...callOptions, auth });
   let dockerTarget = null;
   let legacyTargetProof = null;
   if (opts.localExec) {
-    const current = await callTool("get_stack_lease", { lease_id: leaseId });
+    const current = await call("get_stack_lease", { lease_id: leaseId });
     if (!current.ok || !current.data?.success) {
       return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId,
         error: current.error || current.data?.code || "could not verify the lease Docker target" }), opts,
@@ -915,7 +932,7 @@ export async function cmdDone(leaseId, opts, {
     }
   }
 
-  const r = await callTool("release_stack_lease", { lease_id: leaseId, disposition: opts.disposition });
+  const r = await call("release_stack_lease", { lease_id: leaseId, disposition: opts.disposition });
   if (!r.ok) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, error: r.error }), opts, r.auth ? EXIT.AUTH : EXIT.BACKEND);
   if (!r.data.success) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, code: r.data.code, error: r.data.code }), opts, EXIT.BACKEND);
   let state = r.data.state;
@@ -931,7 +948,7 @@ export async function cmdDone(leaseId, opts, {
         error: "local `supabase stop` failed — NOT finalizing; the slot stays fenced. Tear the stack down and re-run `stack done --local-exec`, or let the reaper reconcile.",
       }), opts, EXIT.LEASE_FAILED);
     }
-    const fin = await callTool("finalize_stack_lease", { lease_id: leaseId });
+    const fin = await call("finalize_stack_lease", { lease_id: leaseId });
     if (fin.ok && fin.data?.success) state = fin.data.state;
     else process.stderr.write(`${yellow("⚠")} stack: finalize failed (${fin.error || fin.data?.code}); the reaper will reconcile.\n`);
   }
@@ -1049,13 +1066,13 @@ export async function materializeLeasedTestConfig(worktreeRoot, leaseId, connect
  * without Docker or a live BotBuddy service.
  */
 export async function runStackLifecycle(opts, childArgv, adapters = {}) {
+  const auth = adapters.auth ?? await stackAuthHeader();
   const api = adapters.api ?? {
-    request: (args) => callToolJson("request_stack_lease", args),
-    get: (leaseId) => callToolJson("get_stack_lease", { lease_id: leaseId }),
-    touch: (leaseId) => callToolJson("touch_stack_lease", { lease_id: leaseId }),
-    release: (leaseId, signal) => callToolJson("release_stack_lease", { lease_id: leaseId, disposition: "destroy" }, { signal }),
+    request: (args) => callToolJson("request_stack_lease", args, { auth }),
+    get: (leaseId) => callToolJson("get_stack_lease", { lease_id: leaseId }, { auth }),
+    touch: (leaseId) => callToolJson("touch_stack_lease", { lease_id: leaseId }, { auth }),
+    release: (leaseId, signal) => callToolJson("release_stack_lease", { lease_id: leaseId, disposition: "destroy" }, { auth, signal }),
   };
-  const auth = adapters.auth ?? await stackAuthHeader();
   const machineUuidFn = adapters.machineUuidFn ?? machineUuid;
   const wait = adapters.wait ?? ((leaseId, done, failed, options) => waitForLease(leaseId, done, failed, options));
   // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process -- validated executable + argv only; shell is never used.
@@ -1263,6 +1280,13 @@ export async function cmdStack(argv) {
     process.exitCode = code;
     return code;
   }
+  const sessionToken = readAgentKeyEnv();
+  if (sessionToken && !AGENT_KEY_RE.test(sessionToken)) {
+    process.stderr.write(`${yellow("⚠")} stack: $BOTBUDDY_AGENT_KEY must match bb_agent_<64 hex>; re-register and export a fresh session token.\n`);
+    const code = emit(buildReceipt({ command, outcome: "error", error: "invalid_session_token" }), opts, EXIT.INVALID);
+    process.exitCode = code;
+    return code;
+  }
   let code;
   try {
     switch (command) {