@botbuddy/cli 1.29.1 → 1.29.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.29.1",
+  "version": "1.29.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack.mjs

@@ -377,6 +377,16 @@ export async function stackAuthHeader() {
   return null;
 }
 
+// The MCP lease endpoint accepts a session token in x-agent-api-key, whereas
+// the event-stream relay requires that same token in its bearer form too. Keep
+// the lease RPC shape unchanged and derive the relay-compatible form only at
+// the wait boundary; never substitute an ambient OAuth credential.
+function relayAuthHeaders(auth) {
+  const sessionToken = auth?.["x-agent-api-key"];
+  if (auth?.Authorization || !sessionToken || !AGENT_KEY_RE.test(sessionToken)) return auth;
+  return { ...auth, Authorization: `Bearer ${sessionToken}` };
+}
+
 function parseSseFrames(buffer) {
   const frames = [];
   let idx, remaining = buffer;
@@ -402,7 +412,7 @@ async function registerLeaseWait(leaseId, timeoutSec, auth, signal, fetchImpl =
   const deadline = new Date(Date.now() + timeoutSec * 1000).toISOString();
   const res = await fetchImpl(`${eventStreamBase()}`, {
     method: "POST",
-    headers: { ...auth, "Content-Type": "application/json" },
+    headers: { ...relayAuthHeaders(auth), "Content-Type": "application/json" },
     body: JSON.stringify({ action: "register", conditions: [{ type: "lease", params: { id: leaseId } }], deadline, mode: "any" }),
     signal,
   });
@@ -435,7 +445,7 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
         const finalizerTimer = setTimeout(() => finalizer.abort(), 5_000);
         try {
           const response = await fetchImpl(eventStreamBase(), {
-            method: "POST", headers: { ...auth, "Content-Type": "application/json" },
+            method: "POST", headers: { ...relayAuthHeaders(auth), "Content-Type": "application/json" },
             body: JSON.stringify({ action: "finalize", wait_session_id: waitSessionId, status, receipt: { outcome: status, lease_id: leaseId } }),
             signal: finalizer.signal,
           });
@@ -463,7 +473,7 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
   url.searchParams.set("heartbeat", "1");
   let res;
   try {
-    res = await fetchImpl(url, { headers: { ...auth, Accept: "text/event-stream", "Accept-Encoding": "identity" }, signal: ac.signal });
+    res = await fetchImpl(url, { headers: { ...relayAuthHeaders(auth), Accept: "text/event-stream", "Accept-Encoding": "identity" }, signal: ac.signal });
   } catch (err) {
     if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
     return finish({ error: `sse connect: ${err?.message ?? err}` }, "error");