@botbuddy/cli 1.31.2 → 1.32.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.31.2",
+  "version": "1.32.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/pw/args.mjs

@@ -1,4 +1,5 @@
 import { TARGET_VERBS, parseTargetFlags, hasTargetFlags, buildLocatorTarget, classifyTarget, isSnapshotRef } from "./targets.mjs";
+import { TRANSLATE_VERBS, planTranslateVerb, MAX_EXEC_ARG } from "./translate.mjs";
 export const GLOBAL_VERBS = new Set(["list", "close-all", "kill-all", "reap"]);
 const secret = /^@ENV:(.+)$/;
 export function resolveRef(value, env = process.env) {
@@ -16,6 +17,20 @@ export function planInvocation(argv, env = process.env) {
   if (!validLane(lane) || !verb) throw new Error(`bb-pw: usage: lane must be a positive integer and include a verb`);
   if (verb === "status") return { scope: "lane", lane, session: `lane-${lane}`, verb, mode: "status" };
   const rest = argv.slice(2); let forwarded = rest, target = null, fresh = false;
+  // BOT-1702: bb-pw OWNS upload/route/unroute and translates them to upstream
+  // `run-code` (see translate.mjs). A resolved `@ENV:` secret in any value routes
+  // the generated code through the socket path so it never lands in argv, and is
+  // tracked for redaction — mirroring the sibling verbs' guarantee.
+  if (TRANSLATE_VERBS.has(verb)) {
+    const { code, secretValues } = planTranslateVerb(verb, rest, { env, resolveRef });
+    // Use the daemon socket (JSON, no argv limit) for a resolved secret OR a
+    // payload too large for a single child-process argument (Codex R2 P2: a big
+    // --inline/body would otherwise fail with E2BIG). Measure UTF-8 BYTES, not
+    // UTF-16 code units — the kernel's per-arg limit is on encoded bytes, so a
+    // multibyte body (e.g. emoji/CJK) could otherwise slip past (Codex R3 P2).
+    const sensitive = secretValues.length > 0 || Buffer.byteLength(code, "utf8") > MAX_EXEC_ARG;
+    return { scope: "lane", lane, session: `lane-${lane}`, verb, mode: sensitive ? "socket" : "exec", execArgv: sensitive ? null : [`-s=lane-${lane}`, "run-code", code], socketArgs: sensitive ? ["run-code", code] : null, telemetryUrl: null, secretValues, rollup: false, target: null, targetKind: null, fresh: false, translate: true };
+  }
   if (TARGET_VERBS.has(verb)) {
     const parsed = parseTargetFlags(rest); fresh = parsed.fresh;
     forwarded = hasTargetFlags(parsed.flags) ? [buildLocatorTarget(parsed.flags), ...parsed.rest] : parsed.rest;

package/src/pw/readiness.mjs

@@ -1,4 +1,7 @@
 export const NAV = "navigate";
-const interaction = new Set(["click", "fill", "type", "select", "press", "drag", "hover", "dblclick", "check", "uncheck"]);
+// `upload` mutates the page (it sets the input's files), so it counts as an
+// interaction — otherwise session telemetry would omit every upload (BOT-1702
+// Codex R27 P2).
+const interaction = new Set(["click", "fill", "type", "select", "press", "drag", "hover", "dblclick", "check", "uncheck", "upload"]);
 export function actionTypeFromMethod(method) { const value = String(method); return ["goto", "open", "go-back", "go-forward", "reload"].includes(value) ? NAV : value === "screenshot" ? "screenshot" : value === "snapshot" ? "snapshot" : interaction.has(value) ? "interaction" : "other"; }
 export function deriveSession(events, { meta = {} } = {}) { const ordered = [...events].sort((a,b) => a.ts-b.ts), type = (name) => ordered.filter((event) => actionTypeFromMethod(event.method) === name); const nav = type(NAV); return { ...meta, started_at: ordered[0]?.ts ?? null, ended_at: ordered.at(-1)?.ts ?? null, duration_ms: ordered.length ? ordered.at(-1).ts - ordered[0].ts : 0, active_ms: 0, idle_threshold_ms: 60000, navigations: nav.length, distinct_routes: [...new Set(nav.map((event) => { try { return new URL(event.url).pathname; } catch { return String(event.url).split("?")[0]; } }))], screenshots: type("screenshot").length, snapshots: type("snapshot").length, interactions: type("interaction").length, actions_total: ordered.length }; }

package/src/pw/run.mjs

@@ -13,8 +13,19 @@ import { clearAgentState, isRejectedCachedMcpSession, resolveAgentSessionCredent
 // server-side, so the lane name bb-pw builds/matches/prints is the one the lock
 // kernel actually stored ("jonos-mbp:8", not "Jonos-MBP.localdomain:8").
 const hostFor = (env) => canonicalizeHostString(env.PLAYWRIGHT_MCP_HOST || env.HOSTNAME || os.hostname());
-function help(out) { out.write("Usage: pw [--tenant <slug>] [--session-id <id>] [--agent-session-token <token>] <lane> <verb> [args…]\n\nAliases: bb-pw <lane> <verb> [args…]   ·   botbuddy pw <lane> <verb> [args…]\n         (all three drive the same lock-gated Playwright lane)\n\n--session-id <id>  accept a lane held by this arming-session agent id (from\n                   register_agent); defaults to $BOTBUDDY_SESSION_ID, then the\n                   id saved by `botbuddy register`.\n--agent-session-token <token>  session credential (env $BOTBUDDY_AGENT_SESSION_TOKEN);\n                   --agent-key / --session-token are one-release legacy aliases.\n--tenant <slug>    override the worktree .botbuddy-agent.json tenant when falling\n                   back to the .mcp.json ($BOTBUDDY_MCP_KEY) credential.\n"); }
-function redact(value, secretValues = []) { return secretValues.reduce((text, secret) => secret ? text.split(secret).join("[redacted]") : text, String(value ?? "")); }
+function help(out) { out.write("Usage: pw [--tenant <slug>] [--session-id <id>] [--agent-session-token <token>] <lane> <verb> [args…]\n\nAliases: bb-pw <lane> <verb> [args…]   ·   botbuddy pw <lane> <verb> [args…]\n         (all three drive the same lock-gated Playwright lane)\n\n--session-id <id>  accept a lane held by this arming-session agent id (from\n                   register_agent); defaults to $BOTBUDDY_SESSION_ID, then the\n                   id saved by `botbuddy register`.\n--agent-session-token <token>  session credential (env $BOTBUDDY_AGENT_SESSION_TOKEN);\n                   --agent-key / --session-token are one-release legacy aliases.\n--tenant <slug>    override the worktree .botbuddy-agent.json tenant when falling\n                   back to the .mcp.json ($BOTBUDDY_MCP_KEY) credential.\n\nFile upload (BOT-1702) — works on a hidden <input type=file>:\n  bb-pw <lane> upload <selector> <path...>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,size=<bytes>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,bytes=@base64:<b64>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,text=<str>\n     --inline repeats; builds synthetic files in memory (no workstation FS).\n     <selector> also accepts --testid/--role/--label/--text like click/fill.\n\nNetwork mocking (BOT-1702) — routes persist on the lane across invocations:\n  bb-pw <lane> route <url-glob> stall                 hold the request pending\n                                                      (screenshot the loading state)\n  bb-pw <lane> route <url-glob> abort [--error <code>] fail the request (default: failed)\n  bb-pw <lane> route <url-glob> fulfill --status <n> [--content-type <ct>]\n                                        [--body <str|@base64:..|@file:PATH>]\n  bb-pw <lane> unroute [<url-glob>]                    release one route, or all\n  bb-pw <lane> route-list                              list the routes owned on this lane\n  (offline mode already exists upstream: bb-pw <lane> network-state-set offline)\n"); }
+// Redact LONGEST secrets first: replacing a short value that is a substring of a
+// longer secret (e.g. a filename that also appears inside the payload's base64)
+// would otherwise break the longer match and leave the remainder recoverable
+// (Codex R11 P1).
+export function redact(value, secretValues = []) { return [...new Set(secretValues.filter(Boolean))].sort((a, b) => b.length - a.length).reduce((text, secret) => text.split(secret).join("[redacted]"), String(value ?? "")); }
+// bb-pw OWNS the translate verbs, so their generated run-code is an internal
+// implementation detail. When a secret is embedded in it, @playwright/cli echoes
+// the source back ("### Ran Playwright code") in forms our value-based redaction
+// cannot always match (JSON- vs single-quote-escaped, normalized, base64…). When
+// any secret is in play we therefore DROP the echoed code block entirely — the
+// robust fix for the whole class — while still redacting the rest (Codex R11).
+export const stripCodeEcho = (text) => String(text ?? "").replace(/### Ran Playwright code\n```[\s\S]*?\n```\n?/g, "");
 // BOT-1488: the register_agent identity for this machine, persisted by
 // `botbuddy register` into ~/.botbuddy/config.json. This is the SESSION agent
 // that acquire_resources binds a lane to — distinct from the tenant-bound
@@ -161,7 +172,17 @@ async function runPwInner(argv, deps = {}) {
   const effHost = auth.canonicalHost ?? host;
   if (plan.mode === "status") { const lock = auth.coordinator?.status ? await auth.coordinator.status({ host: effHost, slot: plan.lane }) : null; stdout.write(JSON.stringify({ lane: plan.lane, session: plan.session, host: effHost, lock, spooled_events: telemetry.count(plan.lane) }, null, 2) + "\n"); return 0; }
   if (actionTypeFromMethod(plan.verb) !== "other") telemetry.append(plan.lane, { ts: Date.now(), method: plan.verb, url: actionTypeFromMethod(plan.verb) === NAV ? plan.telemetryUrl : null });
-  const inspect = plan.mode === "socket" || (actionTypeFromMethod(plan.verb) === "interaction" && (plan.targetKind === "ref" || plan.fresh)); let code;
-  if (inspect) { if (plan.fresh) await socketRun({ ...plan, socketArgs: ["snapshot"] }, env).catch(() => {}); const result = await socketRun({ ...plan, socketArgs: plan.socketArgs ?? plan.execArgv.slice(1) }, env); if (result.text) stdout.write(`${redact(result.text, plan.secretValues)}\n`); if (!result.ok) stderr.write(`${redact(plan.targetKind === "ref" && isStaleRefError(result.error) ? staleRefRemediation(plan.target) : result.error, plan.secretValues)}\n`); code = result.ok ? 0 : 1; } else code = await spawnExec(plan, env);
+  // Translate verbs ALWAYS run via the socket (even a small, non-secret one), so
+  // run.mjs — not an inherited-stdio spawnExec — owns their output and can strip
+  // the internal code echo; socketRun falls back to execArgv.slice(1) as its args
+  // (Codex R26 P2).
+  const inspect = plan.mode === "socket" || plan.translate || (actionTypeFromMethod(plan.verb) === "interaction" && (plan.targetKind === "ref" || plan.fresh)); let code;
+  // bb-pw's translate verbs (upload/route/...) generate internal run-code; that
+  // echoed "### Ran Playwright code" block is never useful to the caller and can
+  // be large (a 100KB+ base64 payload) or carry a secret, so strip it for every
+  // translated command — not only secret ones (Codex R25 P2) — while still
+  // redacting any tracked secret from the rest.
+  const suppressEcho = !!plan.translate || !!plan.secretValues?.length;
+  if (inspect) { if (plan.fresh) await socketRun({ ...plan, socketArgs: ["snapshot"] }, env).catch(() => {}); const result = await socketRun({ ...plan, socketArgs: plan.socketArgs ?? plan.execArgv.slice(1) }, env); if (result.text) { const text = suppressEcho ? stripCodeEcho(result.text) : result.text; stdout.write(`${redact(text, plan.secretValues)}\n`); } if (!result.ok) { let errText = plan.targetKind === "ref" && isStaleRefError(result.error) ? staleRefRemediation(plan.target) : result.error; if (suppressEcho) errText = stripCodeEcho(errText); stderr.write(`${redact(errText, plan.secretValues)}\n`); } code = result.ok ? 0 : 1; } else code = await spawnExec(plan, env);
   if (plan.rollup && code === 0) await telemetry.rollup({ lane: plan.lane, coordinator: auth.coordinator, host: effHost }); return code;
 }

package/src/pw/targets.mjs

@@ -3,7 +3,12 @@ export const TARGET_VERBS = new Set(["click", "dblclick", "fill", "hover", "chec
 export const isSnapshotRef = (value) => REF.test(String(value ?? ""));
 export const classifyTarget = (value) => /^getBy[A-Z]/.test(String(value ?? "")) ? "locator" : isSnapshotRef(value) ? "ref" : "selector";
 const BASE = ["role", "placeholder", "text", "testid", "label", "title", "alt"];
-const quote = (value) => `'${String(value).replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+// Produce a VALID single-quoted JS string literal. Besides backslash and the
+// quote, escape newline/CR — an unescaped newline in a single-quoted literal is a
+// syntax error, which would break the run-code that embeds a locator built from a
+// multiline flag value (BOT-1702 Codex R24 P2). (U+2028/U+2029 are legal in
+// string literals since ES2019, so they need no escaping.)
+const quote = (value) => "'" + String(value).replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/\n/g, "\\n").replace(/\r/g, "\\r") + "'";
 export function parseTargetFlags(args) {
   const flags = {}, rest = []; let fresh = false;
   for (let index = 0; index < args.length; index += 1) {
@@ -15,6 +20,10 @@ export function parseTargetFlags(args) {
     if (![...BASE, "name"].includes(name)) { rest.push(args[index]); continue; }
     const value = inline ?? args[++index];
     if (value === undefined) throw new Error(`bb-pw: --${name} needs a value`);
+    // Reject a repeated locator flag rather than silently keeping the last value,
+    // so a concatenated command can't target a different element while reporting
+    // success (BOT-1702 Codex R22 P2).
+    if (name in flags) throw new Error(`bb-pw: duplicate flag --${name}`);
     flags[name] = value;
   }
   return { flags, rest, fresh };

package/src/pw/translate.mjs

@@ -0,0 +1,411 @@
+import { resolve } from "node:path";
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { parseTargetFlags, hasTargetFlags, buildLocatorTarget } from "./targets.mjs";
+
+// BOT-1702: bb-pw OWNS the `upload`/`route`/`unroute` verbs and translates them
+// to upstream `@playwright/cli run-code`, whose function body runs against the
+// lane daemon's persistent page. This keeps the surface in our control (no MS
+// fork) and lets route handlers persist across invocations, so
+// `route <glob> stall` → `goto` → `screenshot` → `unroute` works. Driver:
+// a Supply Guard acceptance flow (its policy-document upload UI).
+export const TRANSLATE_VERBS = new Set(["upload", "route", "unroute", "route-list"]);
+const ROUTE_ACTIONS = new Set(["stall", "abort", "fulfill"]);
+// Force the socket transport (JSON over the daemon socket, no argv limit) once
+// the generated run-code exceeds this, instead of passing it as one child-process
+// argument. Linux caps a single argv entry at ~128 KiB (MAX_ARG_STRLEN), but
+// Windows caps the WHOLE command line at 32,767 chars — so pick the limit by
+// platform, well under each cap, or a large `--inline`/fulfill body would fail in
+// spawn() (Codex R2/R23 P2).
+export const MAX_EXEC_ARG = process.platform === "win32" ? 8_000 : 100_000;
+// A JS string/number literal safe to embed in generated code. JSON.stringify
+// emits a valid double-quoted JS string (or a bare number), so it doubles as our
+// escaper for selectors, globs, bodies and base64 blobs.
+const j = (value) => JSON.stringify(value);
+
+// Node's base64 decoder is permissive: it silently drops invalid chars AND
+// normalizes non-canonical padding bits (e.g. "AB==" → "AA=="), so a malformed
+// payload would decode to different bytes than the caller supplied (Codex R4/R6
+// P2). Accept only input that round-trips to itself, i.e. canonical standard
+// base64.
+function decodeBase64(text, ctx) {
+  const s = String(text);
+  const buf = Buffer.from(s, "base64");
+  if (buf.toString("base64") !== s)
+    throw new Error(`bb-pw: ${ctx}: invalid base64 (expected canonical standard padded base64)`);
+  return buf;
+}
+
+// A fulfill body is embedded as a JS string literal, so it must be exact UTF-8.
+// Reject bytes that don't round-trip (e.g. a base64/file payload with byte 0xff),
+// rather than silently corrupting them via `toString("utf8")` → U+FFFD (Codex R19
+// P2). Binary response bodies are out of scope.
+function utf8Body(buf, ctx) {
+  const str = buf.toString("utf8");
+  if (!Buffer.from(str, "utf8").equals(buf))
+    throw new Error(`bb-pw: ${ctx}: body is not valid UTF-8 (binary fulfill bodies are not supported — provide text/JSON)`);
+  return str;
+}
+
+// The finite set Playwright's Route.abort accepts; anything else asserts in
+// Chromium at request time, so validate at plan time (Codex R6 P2).
+const ABORT_ERRORS = new Set(["aborted", "accessdenied", "addressunreachable", "blockedbyclient", "blockedbyresponse", "connectionaborted", "connectionclosed", "connectionfailed", "connectionrefused", "connectionreset", "internetdisconnected", "namenotresolved", "timedout", "failed"]);
+
+// Parse one `--inline name=<n>,mime=<m>,(size=<bytes>|bytes=@base64:<b64>|text=<str>)`
+// spec into an in-memory file descriptor. Never touches the workstation FS, so an
+// agent can craft a 0-byte or spoofed-bytes file without staging one on disk.
+export function parseInline(spec) {
+  const s = String(spec);
+  // The content source (size=/bytes=/text=) is the LAST field and its value runs
+  // to end-of-string, so a text/CSV/query-string payload may contain commas —
+  // even a literal `,name=`/`,size=` — without being mis-split (Codex R8 P2).
+  const src = /(?:^|,)(size|bytes|text)=/.exec(s);
+  if (!src) throw new Error("bb-pw: --inline needs one of size=<bytes>, bytes=@base64:<b64>, or text=<str> as its last field");
+  const srcKey = src[1];
+  const srcStart = src.index + (src[0].length - (srcKey.length + 1));
+  const srcValue = s.slice(srcStart + srcKey.length + 1);
+  // The head (everything before the source) holds name=/mime=; those values never
+  // contain commas, so a plain comma split is safe here.
+  const kv = {};
+  const head = s.slice(0, srcStart).replace(/,$/, "");
+  if (head) for (const part of head.split(",")) {
+    const eq = part.indexOf("=");
+    if (eq < 0) throw new Error(`bb-pw: --inline expects key=value pairs, got "${part}"`);
+    const key = part.slice(0, eq).trim();
+    // Only name/mime are valid before the content source; reject an unknown or
+    // misspelled field (e.g. `filename=`) or a duplicate rather than ignoring it
+    // and uploading with different metadata than the caller intended (Codex R20).
+    if (key !== "name" && key !== "mime") throw new Error(`bb-pw: --inline: unknown field "${key}" (allowed: name, mime, and one of size/bytes/text)`);
+    if (key in kv) throw new Error(`bb-pw: --inline: duplicate field "${key}"`);
+    kv[key] = part.slice(eq + 1);
+  }
+  if (!kv.name) throw new Error("bb-pw: --inline needs name=<filename> before the content source");
+  if (!kv.mime) throw new Error("bb-pw: --inline needs mime=<type> before the content source");
+  let buffer;
+  if (srcKey === "size") {
+    const n = Number(srcValue);
+    if (!/^\d+$/.test(srcValue) || !Number.isInteger(n) || n < 0) throw new Error(`bb-pw: --inline size must be a non-negative integer, got "${srcValue}"`);
+    buffer = Buffer.alloc(n);
+  } else if (srcKey === "bytes") {
+    const match = /^@base64:(.*)$/s.exec(srcValue);
+    if (!match) throw new Error("bb-pw: --inline bytes= must be @base64:<data>");
+    buffer = decodeBase64(match[1], "--inline bytes");
+  } else {
+    buffer = Buffer.from(srcValue, "utf8");
+  }
+  // Bytes are carried as base64 and decoded in the BROWSER via `atob` (see
+  // buildUploadCode): base64 is ~1.33× vs ~3-4× for a JS number array, keeping the
+  // generated arg small (Codex R2 P2), and the browser has `atob` where the
+  // run-code VM lacks Node `Buffer` and Playwright's Buffer-only FilePayload.
+  return { name: kv.name, mimeType: kv.mime, base64: buffer.toString("base64") };
+}
+
+// `selectorExpr` is a full page accessor expression, e.g. `page.locator("#x")` or
+// `page.getByTestId('x')`. `files` is either [{path}] (real disk paths) or
+// [{name,mimeType,bytes}] (synthetic in-memory). Both paths work on a hidden
+// <input type=file>:
+//   - real paths → Playwright `setInputFiles([...paths])` (native chooser path).
+//   - synthetic → built as File objects in the BROWSER via DataTransfer and
+//     assigned to `input.files`, dispatching input+change. This is fully hermetic
+//     (no workstation FS) and avoids Playwright's Buffer-only FilePayload, which
+//     is unreachable from the sandboxed run-code context (no Node Buffer there).
+export function buildUploadCode(selectorExpr, files) {
+  const synthetic = files.length > 0 && files[0].path === undefined;
+  if (!synthetic) {
+    const items = files.map((file) => j(file.path));
+    return `async page => { await ${selectorExpr}.setInputFiles([${items.join(", ")}]); }`;
+  }
+  const payload = files.map((file) => ({ name: file.name, mime: file.mimeType, b64: file.base64 }));
+  // Enforce the same constraints Playwright's setInputFiles applies, which this
+  // synthetic path would otherwise bypass — allowing browser states a real user
+  // cannot reach (Codex R13 P2): the target must be an <input type=file>, and
+  // multiple files require a `multiple` input.
+  return `async page => { await ${selectorExpr}.evaluate((el, files) => { if (el instanceof HTMLLabelElement && el.control) el = el.control; if (!(el instanceof HTMLInputElement) || el.type !== "file") throw new Error("bb-pw upload: target is not an <input type=file>"); if (el.webkitdirectory) throw new Error("bb-pw upload: cannot assign synthetic files to a directory (webkitdirectory) input"); if (files.length > 1 && !el.multiple) throw new Error("bb-pw upload: multiple files require an <input multiple>"); const dt = new DataTransfer(); for (const f of files) { const bin = atob(f.b64); const u8 = new Uint8Array(bin.length); for (let i = 0; i < bin.length; i++) u8[i] = bin.charCodeAt(i); dt.items.add(new File([u8], f.name, { type: f.mime })); } el.files = dt.files; el.dispatchEvent(new Event("input", { bubbles: true, composed: true })); el.dispatchEvent(new Event("change", { bubbles: true, composed: true })); }, ${JSON.stringify(payload)}); }`;
+}
+
+// bb-pw's routes are registered via `page.route` inside the run-code VM, which
+// bypasses upstream's route registry — so upstream `route-list` would report "No
+// active routes" and a leftover stall/fulfill mock would be invisible (Codex R2
+// P2). We therefore track owned routes on `page.__bbPwRoutes` (the daemon reuses
+// one page object across invocations) and OWN `route-list`/`unroute` so they read
+// and prune that registry.
+// Bookkeeping key = a non-reversible digest of the RESOLVED glob. It mirrors
+// Playwright's page.unroute (which matches on the resolved pattern), so two routes
+// installed under the same `@ENV:` ref but DIFFERENT resolved values get distinct
+// keys and are pruned independently (Codex R4 P2). It is a hash, so it never
+// leaks a secret glob into the registry that route-list prints (Codex R3 P1).
+const matchKey = (resolvedGlob) => createHash("sha256").update(String(resolvedGlob)).digest("hex").slice(0, 16);
+// `displayGlob` is what route-list shows — the raw arg (e.g. `@ENV:SIGNED_URL`),
+// never the resolved value.
+const trackRoute = (displayGlob, action, key) => `(page.__bbPwRoutes = page.__bbPwRoutes || []).push({ glob: ${j(displayGlob)}, action: ${j(action)}, key: ${j(key)} });`;
+
+export function buildRouteCode(glob, action, opts = {}, displayGlob = glob) {
+  const g = j(glob), key = matchKey(glob);
+  const track = trackRoute(displayGlob, action, key);
+  if (action === "stall")
+    // Capture each intercepted route (never resolving it) so the matched request
+    // hangs pending — a screenshot captures the loading state — and unroute can
+    // later release it (Codex R3 P2), instead of leaving it hung forever.
+    return `async page => { await page.route(${g}, route => { (page.__bbPwPending = page.__bbPwPending || []).push({ key: ${j(key)}, route }); }); ${track} }`;
+  if (action === "abort")
+    return `async page => { await page.route(${g}, route => route.abort(${j(opts.error || "failed")})); ${track} }`;
+  if (action === "fulfill") {
+    const fields = [];
+    if (opts.status !== undefined) fields.push(`status: ${Number(opts.status)}`);
+    if (opts.contentType !== undefined) fields.push(`contentType: ${j(opts.contentType)}`);
+    // Body is ALWAYS a plain string literal. @base64:/@file: are decoded at plan
+    // time (Node, where Buffer exists) — the generated handler runs in the
+    // @playwright/cli run-code VM, which exposes no Node Buffer, so a
+    // `Buffer.from(...)` here would throw ReferenceError on the first request.
+    if (opts.body !== undefined) fields.push(`body: ${j(opts.body)}`);
+    return `async page => { await page.route(${g}, route => route.fulfill({ ${fields.join(", ")} })); ${track} }`;
+  }
+  throw new Error(`bb-pw: route action must be stall|abort|fulfill, got "${action}"`);
+}
+
+// On unroute, also RELEASE any requests already caught by a stall handler —
+// page.unroute only stops future interceptions and would leave the pending
+// request hanging (Codex R3 P2) — and prune only the records whose resolved key
+// matches, so a colliding display ref keeps its other route (R4 P2). For a
+// SPECIFIC unroute, release via route.fallback() so any broader still-registered
+// mock in the chain still runs (route.continue() would go straight to the network
+// and bypass it); for clear-all there is no remaining chain, so continue()
+// directly (Codex R23 P2).
+export function buildUnrouteCode(glob, displayGlob = glob) {
+  // Only null/undefined means "clear all"; an (already-rejected) empty string
+  // must never reach the unrouteAll branch (Codex R5 P2).
+  if (glob != null) {
+    const g = j(glob), key = j(matchKey(glob));
+    return `async page => { await page.unroute(${g}); for (const p of (page.__bbPwPending || []).filter(p => p.key === ${key})) { try { await p.route.fallback(); } catch {} } if (page.__bbPwPending) page.__bbPwPending = page.__bbPwPending.filter(p => p.key !== ${key}); if (page.__bbPwRoutes) page.__bbPwRoutes = page.__bbPwRoutes.filter(r => r.key !== ${key}); }`;
+  }
+  return `async page => { await page.unrouteAll(); for (const p of (page.__bbPwPending || [])) { try { await p.route.continue(); } catch {} } page.__bbPwPending = []; page.__bbPwRoutes = []; }`;
+}
+
+export function buildRouteListCode() {
+  // Return the ARRAY directly (glob + action only; the internal match key stays
+  // out of the output). @playwright/cli's run-code wrapper JSON.stringifies the
+  // result once — stringifying here too would emit a JSON string, leaving
+  // automation a string after one parse (Codex R25 P2).
+  return `async page => { return (page.__bbPwRoutes || []).map(r => ({ glob: r.glob, action: r.action })); }`;
+}
+
+// Allowed flags per route action; anything else is a typo or an incompatible
+// option and must be rejected rather than silently ignored (Codex R3 P2).
+const ROUTE_FLAGS = { stall: [], abort: ["error"], fulfill: ["status", "content-type", "body"] };
+
+function parseSimpleFlags(args) {
+  const flags = {};
+  for (let index = 0; index < args.length; index += 1) {
+    const match = /^--([a-z][a-z-]*)(?:=(.*))?$/s.exec(String(args[index]));
+    if (!match) throw new Error(`bb-pw: unexpected argument "${args[index]}"`);
+    const value = match[2] !== undefined ? match[2] : args[index += 1];
+    if (value === undefined) throw new Error(`bb-pw: --${match[1]} needs a value`);
+    // Reject a repeated flag rather than silently keeping the last value, so a
+    // concatenated command can't run against a different mock than intended
+    // (Codex R21 P2).
+    if (match[1] in flags) throw new Error(`bb-pw: duplicate flag --${match[1]}`);
+    flags[match[1]] = value;
+  }
+  return flags;
+}
+
+function planUpload(rest, rr, markSecret, resolveMeta) {
+  const { flags, rest: remainder } = parseTargetFlags(rest);
+  let selectorExpr, fileArgs;
+  if (hasTargetFlags(flags)) {
+    // Resolve `@ENV:` in each locator flag value (not the boolean `exact`), so a
+    // secret/ref in a target flag behaves like any other value (Codex R1 P2).
+    const resolved = Object.fromEntries(Object.entries(flags).map(([key, value]) => [key, key === "exact" ? value : rr(value)]));
+    selectorExpr = `page.${buildLocatorTarget(resolved)}`;
+    fileArgs = remainder;
+  } else {
+    const selector = remainder[0];
+    if (selector === undefined || String(selector).startsWith("--"))
+      throw new Error("bb-pw: upload needs a <selector> (or --testid/--role/--label/--text)");
+    selectorExpr = `page.locator(${j(rr(selector))})`;
+    fileArgs = remainder.slice(1);
+  }
+  // Parse one --inline spec. If the spec itself came from a secret ref
+  // (`--inline @ENV:SPEC`), parseInline SPLITS and TRANSFORMS it, so the whole
+  // recorded secret no longer matches the substrings that reach errors, nor the
+  // base64 payload embedded in the echoed code. Mark the derived name/mime/base64
+  // sensitive, and on an invalid secret spec throw a value-free error so no
+  // fragment leaks (Codex R10 P1).
+  const parseInlineArg = (spec) => {
+    const { value: resolved, secret: specWasSecret } = resolveMeta(spec);
+    let file;
+    try { file = parseInline(resolved); }
+    catch (error) { throw specWasSecret ? new Error("bb-pw: --inline spec from a secret ref is invalid (value redacted)") : error; }
+    if (specWasSecret) { markSecret(file.name); markSecret(file.mimeType); markSecret(file.base64); }
+    return file;
+  };
+  const paths = [], inlines = [];
+  for (let index = 0; index < fileArgs.length; index += 1) {
+    const token = String(fileArgs[index]);
+    if (token === "--inline") {
+      const spec = fileArgs[index += 1];
+      if (spec === undefined) throw new Error("bb-pw: --inline needs a value");
+      inlines.push(parseInlineArg(spec));
+    } else if (token.startsWith("--inline=")) {
+      inlines.push(parseInlineArg(token.slice("--inline=".length)));
+    } else if (token.startsWith("--")) {
+      throw new Error(`bb-pw: upload: unexpected flag "${token}"`);
+    } else {
+      paths.push(fileArgs[index]);
+    }
+  }
+  if (inlines.length && paths.length)
+    throw new Error("bb-pw: upload takes either real <path...> OR --inline synthetic files, not both");
+  if (!inlines.length && !paths.length)
+    throw new Error("bb-pw: upload needs at least one <path> or --inline file");
+  const files = inlines.length ? inlines : paths.map((path) => {
+    const { value, secret } = resolveMeta(path);
+    const abs = resolve(value);
+    // If the path came from a secret ref, normalization may change its spelling;
+    // mark the resolved absolute form sensitive too (Codex R11/R14 P2).
+    if (secret) markSecret(abs);
+    return { path: abs };
+  });
+  return buildUploadCode(selectorExpr, files);
+}
+
+function planRoute(rest, rr, markSecret, resolveMeta) {
+  const rawGlob = rest[0];
+  if (rawGlob === undefined || rawGlob === "" || String(rawGlob).startsWith("--"))
+    throw new Error("bb-pw: route needs a <url-glob> pattern");
+  const action = rest[1];
+  if (action === undefined || String(action).startsWith("--"))
+    throw new Error("bb-pw: route needs an action: stall|abort|fulfill");
+  if (!ROUTE_ACTIONS.has(action))
+    throw new Error(`bb-pw: route action must be stall|abort|fulfill, got "${action}"`);
+  const flags = parseSimpleFlags(rest.slice(2));
+  const allowed = ROUTE_FLAGS[action];
+  const unknown = Object.keys(flags).filter((flag) => !allowed.includes(flag));
+  if (unknown.length)
+    throw new Error(`bb-pw: route ${action}: unsupported flag(s) ${unknown.map((f) => `--${f}`).join(", ")}. Allowed: ${allowed.length ? allowed.map((f) => `--${f}`).join(", ") : "none"}`);
+  // displayGlob is the raw arg (safe: a secret ref stays "@ENV:X"); g is resolved.
+  const g = rr(rawGlob), displayGlob = rawGlob;
+  if (action === "stall") return buildRouteCode(g, "stall", {}, displayGlob);
+  if (action === "abort") {
+    let error;
+    if (flags.error !== undefined) {
+      error = rr(flags.error);
+      if (!ABORT_ERRORS.has(error)) throw new Error(`bb-pw: route abort --error "${error}" is not a valid code. One of: ${[...ABORT_ERRORS].join(", ")}`);
+    }
+    return buildRouteCode(g, "abort", { error }, displayGlob);
+  }
+  const opts = {};
+  // --status is required for fulfill (contract: `fulfill --status <n>`); omitting
+  // it would silently default to 200 and turn a negative-path mock into a success
+  // (Codex R6 P2).
+  if (flags.status === undefined) throw new Error("bb-pw: route fulfill requires --status <n>");
+  {
+    // Resolve @ENV: like the other values, then validate — an unresolved ref
+    // would become status: NaN in the handler (Codex R2 P2). Require a valid HTTP
+    // status (100-599): Playwright evaluates `status || 200`, so 0 (and other
+    // out-of-range values) would silently return 200 (Codex R7 P2).
+    const status = rr(flags.status);
+    if (!/^\d+$/.test(String(status)) || Number(status) < 100 || Number(status) > 599)
+      throw new Error(`bb-pw: route fulfill --status must be a valid HTTP status (100-599), got "${status}"`);
+    opts.status = status;
+  }
+  if (flags["content-type"] !== undefined) opts.contentType = rr(flags["content-type"]);
+  if (flags.body !== undefined) {
+    // Resolve @ENV: FIRST, then interpret @base64:/@file: on the RESOLVED value —
+    // so `--body @ENV:BODY` where BODY is `@base64:…`/`@file:…` is decoded/loaded,
+    // not fulfilled with the literal marker (Codex R16 P2).
+    const { value: resolvedBody, secret: bodyWasSecret } = resolveMeta(flags.body);
+    const base64 = /^@base64:(.*)$/s.exec(resolvedBody);
+    const file = /^@file:(.*)$/s.exec(resolvedBody);
+    // Decode to a UTF-8 string at plan time so the generated handler embeds a
+    // plain string (no Buffer in the run-code VM). Fulfill bodies are text/JSON
+    // mock responses; binary bodies are out of scope.
+    if (base64) opts.body = utf8Body(decodeBase64(base64[1], "route fulfill --body @base64"), "route fulfill --body @base64");
+    else if (file) {
+      // When the @file: path itself came from a secret ref, mark the EXTRACTED
+      // path sensitive before reading, so a filesystem error (ENOENT etc.) that
+      // contains the bare path is redacted by the planner-error path (Codex R17
+      // P2). @file: contents are always sensitive — mark them so the body takes
+      // the socket path and is redacted, never emitted into argv/logs (R8 P2).
+      if (bodyWasSecret) markSecret(file[1]);
+      opts.body = markSecret(utf8Body(readFileSync(file[1]), "route fulfill --body @file"));
+    }
+    else opts.body = resolvedBody;
+    // If the ref itself was secret, the decoded/loaded body inherits provenance.
+    if (bodyWasSecret) markSecret(opts.body);
+  }
+  return buildRouteCode(g, "fulfill", opts, displayGlob);
+}
+
+function planUnroute(rest, rr) {
+  // Reject flag-shaped args: a typo like `unroute --glob=x` must NOT silently
+  // fall through to clearing every route (Codex R4 P2).
+  const flags = rest.filter((arg) => String(arg).startsWith("--"));
+  if (flags.length) throw new Error(`bb-pw: unroute takes no flags, got ${flags.join(", ")}`);
+  const positionals = rest.filter((arg) => !String(arg).startsWith("--"));
+  if (positionals.length > 1) throw new Error("bb-pw: unroute takes at most one <url-glob> (omit to clear all)");
+  const rawGlob = positionals[0];
+  if (rawGlob === undefined) return buildUnrouteCode(null, null);
+  // Fail closed on an explicitly empty glob (e.g. an unset "$GLOB"): it must not
+  // silently clear every route (Codex R5 P2).
+  if (rawGlob === "") throw new Error("bb-pw: unroute given an empty <url-glob>; omit the argument to clear all routes");
+  return buildUnrouteCode(rr(rawGlob), rawGlob);
+}
+
+function planRouteList(rest) {
+  // route-list takes no operands; reject a stray glob/flag rather than silently
+  // ignoring it and returning the full registry (Codex R18 P2).
+  if (rest.length) throw new Error(`bb-pw: route-list takes no arguments, got ${rest.join(" ")}`);
+  return buildRouteListCode();
+}
+
+// Build the generated run-code for a translate verb. `resolveRef` is passed in
+// from args.mjs (avoids an import cycle) so `@ENV:` refs resolve the same way as
+// for every other verb; any resolved secret is collected so the caller can route
+// through the socket path and redact it from output.
+export function planTranslateVerb(verb, rest, { env, resolveRef }) {
+  const secretValues = [];
+  // Track a secret in BOTH the raw form (as it may appear in a browser result)
+  // AND the JSON-escaped inner form (as it appears embedded via JSON.stringify in
+  // the generated code that @playwright/cli echoes back), so redaction catches a
+  // secret containing quotes/backslashes/newlines too (Codex R8 P2).
+  const pushSecret = (value) => {
+    const raw = String(value);
+    if (raw && !secretValues.includes(raw)) secretValues.push(raw);
+    const escaped = JSON.stringify(raw).slice(1, -1);
+    if (escaped !== raw && !secretValues.includes(escaped)) secretValues.push(escaped);
+  };
+  // Resolve @ENV: and report provenance. Provenance comes from resolveRef().secret
+  // directly — NOT from growth of the (deduplicated) secretValues, which would
+  // wrongly read false when the same secret was already tracked (Codex R14 P2).
+  const resolveMeta = (value) => {
+    const resolved = resolveRef(value, env);
+    if (resolved.secret) pushSecret(resolved.value);
+    return { value: String(resolved.value), secret: !!resolved.secret };
+  };
+  const rr = (value) => resolveMeta(value).value;
+  // Mark a value sensitive so it forces the socket transport and is redacted from
+  // output — used for content loaded from disk (@file:), which was never on the
+  // command line and must not be newly exposed in argv/logs (Codex R8 P2).
+  const markSecret = (value) => { pushSecret(value); return value; };
+  let code;
+  try {
+    code = verb === "upload" ? planUpload(rest, rr, markSecret, resolveMeta)
+      : verb === "route" ? planRoute(rest, rr, markSecret, resolveMeta)
+      : verb === "unroute" ? planUnroute(rest, rr)
+      : verb === "route-list" ? planRouteList(rest)
+      : (() => { throw new Error(`bb-pw: unknown translate verb ${verb}`); })();
+  } catch (error) {
+    // A planning error may interpolate a resolved @ENV: value (e.g. an invalid
+    // --status/--error). runPwInner writes the thrown message straight to stderr,
+    // before secretValues is applied — so redact it here, using the secrets rr()
+    // has already collected (Codex R9 P2).
+    throw new Error(redactSecrets(error?.message ?? String(error), secretValues));
+  }
+  return { code, secretValues };
+}
+
+// Dedupe + longest-first, matching run.mjs redact(): a short secret that is a
+// substring of a longer one must not be replaced first, or the longer match
+// breaks and leaks its remainder (Codex R12 P1).
+const redactSecrets = (text, secrets) => [...new Set(secrets.filter(Boolean))].sort((a, b) => b.length - a.length).reduce((acc, secret) => acc.split(secret).join("[redacted]"), String(text ?? ""));

package/src/stack-file-lock.mjs

@@ -11,9 +11,25 @@ import { join } from "node:path";
 
 let tmpCounter = 0;
 
+// Decode the escape sequences a TOML BASIC string ("...") allows, so an escaped value
+// compares equal to its literal form (BOT-1711 Codex R15): `"shared\u002Dcanonical"` and
+// `"shared-canonical"` are the same project to Supabase. LITERAL strings ('...') are raw.
+function decodeTomlBasicString(s) {
+  return String(s).replace(/\\(u[0-9A-Fa-f]{4}|U[0-9A-Fa-f]{8}|[btnfr"\\])/g, (_m, esc) => {
+    if (esc[0] === "u" || esc[0] === "U") return String.fromCodePoint(parseInt(esc.slice(1), 16));
+    return { b: "\b", t: "\t", n: "\n", f: "\f", r: "\r", '"': '"', "\\": "\\" }[esc];
+  });
+}
+
 export function projectIdFromConfig(configText) {
-  const match = String(configText).match(/^\s*project_id\s*=\s*"([^"]+)"/m);
-  return match ? match[1] : null;
+  // TOML accepts BASIC ("...", with escapes) and LITERAL ('...', raw) strings; match either
+  // so neither a single-quoted nor an escaped project_id can bypass identity checks
+  // (BOT-1711 Codex R6/R15). The basic-string body allows escaped quotes (`\"`).
+  const text = String(configText);
+  const basic = text.match(/^\s*project_id\s*=\s*"((?:[^"\\]|\\.)*)"/m);
+  if (basic) return decodeTomlBasicString(basic[1]);
+  const literal = text.match(/^\s*project_id\s*=\s*'([^']*)'/m);
+  return literal ? literal[1] : null;
 }
 
 export function dbPortFromConfig(configText) {

package/src/stack.mjs

@@ -32,6 +32,7 @@ import { SERVER_URL, getConfig } from "./config.mjs";
 import { resolveOwnerToken, resolveAgentKey } from "./cli-credentials.mjs";
 import { AGENT_KEY_RE, readAgentKeyEnv } from "./agent-key.mjs";
 import { runDockerCommand, runDockerWorkflow, ADMITTED_DOCKER_VALIDATIONS } from "./docker-hygiene.mjs";
+import { projectIdFromConfig } from "./stack-file-lock.mjs";
 import { machineUuid } from "./machine-id.mjs";
 import { bold, dim, yellow } from "./utils.mjs";
 
@@ -70,11 +71,15 @@ ${bold("up OPTIONS")}
   --repo <repo>          Repository the batch is for (e.g. botbuddy-web).
   --ticket <BOT-123>     Ticket the batch is for (also used to derive the slot).
   --stack-path <relative> Stack directory inside the registered worktree (default: .).
+                         REQUIRED with --local-exec: point it at a slot-derived stack whose
+                         supabase/config.toml declares a DISTINCT project_id + remapped ports
+                         (never the worktree root's shared canonical project).
   --purpose <text>       Free-text purpose recorded on the lease.
   --idle-ttl <seconds>   Idle seconds before the reaper STOPS an unused stack (default 1800).
   --timeout <seconds>    Max seconds to park for capacity before giving up (default ${DEFAULT_TIMEOUT_SEC}).
   --no-wait              If the host is full, print the queue position and exit (don't park).
-  --local-exec           FALLBACK (no Helper): run 'supabase start' locally and self-activate.
+  --local-exec           FALLBACK (no Helper): run 'supabase start' in an ISOLATED --stack-path
+                         stack and self-activate. Refused at the worktree root (shared stack).
   --docker-context <name> Explicit Docker context for the mandatory local preflight
                          (an allowlisted engine: OrbStack or Docker Desktop, e.g. desktop-linux).
   --docker-endpoint <uri> Explicit Docker endpoint instead of --docker-context.
@@ -253,6 +258,15 @@ export function parseStackArgs(argv) {
   if (["up", "done"].includes(command) && opts.localExec && Boolean(opts.dockerContext) === Boolean(opts.dockerEndpoint)) {
     errors.push(`--local-exec ${command} requires exactly one of --docker-context <name> or --docker-endpoint <uri>`);
   }
+  // BOT-1711: a local-exec `up` must isolate the leased stack in a --stack-path subdirectory
+  // (its own supabase/config.toml → distinct project_id + remapped ports). The worktree root
+  // is the developer's shared canonical dev stack; `supabase start`/`stop` there is the exact
+  // clobber this closes. `done` needs no --stack-path (the teardown dir comes from the lease).
+  if (command === "up" && opts.localExec && (typeof opts.stackPath !== "string" || opts.stackPath === ".")) {
+    errors.push("--local-exec up requires --stack-path <isolated-stack-dir>: an isolated leased stack must not be the " +
+      "worktree root's default (shared canonical) project. Point --stack-path at a slot-derived stack directory with its " +
+      "own supabase/config.toml (distinct project_id + remapped ports).");
+  }
   if ((opts.dockerContext || opts.dockerEndpoint) && !(["up", "done"].includes(command) && opts.localExec)) {
     errors.push("--docker-context and --docker-endpoint are valid only with `stack up --local-exec` or `stack done --local-exec`");
   }
@@ -292,29 +306,6 @@ export function truncateReceipt(receipt, maxBytes = DEFAULT_RECEIPT_MAX_BYTES) {
   };
 }
 
-/**
- * Resolve a LOCAL Supabase API origin to pin into the `supabase start` environment
- * (BOT-903 / Codex P1): without `VITE_SUPABASE_URL` pinned, config.toml's
- * `env(VITE_SUPABASE_URL)` falls back to the repo's `.env` PRODUCTION origin, so the
- * "disposable" local edge runtime would address `https://api.bot-buddy.ai`. Precedence:
- *   1. an already-exported local (`127.0.0.1`/`localhost`) `VITE_SUPABASE_URL`;
- *   2. `http://127.0.0.1:<[api] port>` read from `./supabase/config.toml`.
- * Returns null when neither is available — the caller then REFUSES to run `supabase
- * start` rather than risk crossing into production.
- */
-export function resolveLocalSupabaseUrl(env = process.env, cwd = process.cwd()) {
-  const cur = env.VITE_SUPABASE_URL;
-  if (cur && /(127\.0\.0\.1|localhost)/.test(cur)) return cur;
-  try {
-    const toml = readFileSync(`${cwd}/supabase/config.toml`, "utf8");
-    // The [api] section's `port = NNNNN` (stop at the next section header).
-    const section = /\[api\]([\s\S]*?)(\n\[|$)/.exec(toml);
-    const m = section && /\bport\s*=\s*(\d+)/.exec(section[1]);
-    if (m) return `http://127.0.0.1:${m[1]}`;
-  } catch { /* no config.toml here */ }
-  return null;
-}
-
 /** Resolve the requested stack directory once, before it leaves the coding
  * machine. This closes both `..` and symlink escapes; the server separately
  * verifies the resulting root is a registered worktree on the selected host. */
@@ -597,24 +588,30 @@ function dockerEnvForTarget(target, env = process.env) {
  * OrbStack endpoint, reports the same non-secret API + DB endpoints stored on
  * the lease. Only then may that observed daemon be used for teardown.
  */
-export function proveLegacyLocalExecTarget(lease, observedTarget, opts, run = spawnSync, cwd = process.cwd()) {
+export function proveLegacyLocalExecTarget(lease, observedTarget, _opts, run = spawnSync, cwd = process.cwd()) {
   if (!observedTarget?.resolved_endpoint || !observedTarget?.server_id) {
     return { ok: false, error: "fresh OrbStack target identity is incomplete" };
   }
-  let execution;
+  if (!lease?.worktree_root) {
+    return { ok: false, error: "legacy lease has no recorded worktree_root" };
+  }
+  // BOT-1711 (Codex R10): prove the caller is in the lease's REGISTERED worktree root, and
+  // take the stack subdirectory from the LEASE's recorded stack_path — NOT from opts.stackPath.
+  // `stack done <id> --local-exec` carries no --stack-path, so re-resolving opts.stackPath
+  // ("." by default) would reject every non-root legacy lease as an invoking-worktree mismatch.
+  let callerRoot;
   try {
-    execution = resolveStackPath(cwd, opts?.stackPath || ".");
+    callerRoot = realpathSync(cwd);
   } catch (error) {
-    return { ok: false, error: `could not resolve the invoking stack path: ${error.message}` };
+    return { ok: false, error: `could not resolve the invoking worktree: ${error.message}` };
   }
-  if (!lease?.worktree_root || lease.worktree_root !== execution.worktreeRoot ||
-      (lease.stack_path || ".") !== execution.stackPath) {
-    return { ok: false, error: "legacy lease worktree/stack metadata does not exactly match the invoking worktree" };
+  if (lease.worktree_root !== callerRoot) {
+    return { ok: false, error: "legacy lease worktree does not match the invoking worktree" };
   }
-
-  const stackDir = execution.stackPath === "."
-    ? execution.worktreeRoot
-    : join(execution.worktreeRoot, execution.stackPath);
+  const leaseStackPath = lease.stack_path || ".";
+  const stackDir = leaseStackPath === "."
+    ? lease.worktree_root
+    : join(lease.worktree_root, leaseStackPath);
   const status = run("supabase", ["status", "-o", "json", "--workdir", stackDir], {
     encoding: "utf8",
     env: dockerEnvForTarget(observedTarget),
@@ -634,8 +631,8 @@ export function proveLegacyLocalExecTarget(lease, observedTarget, opts, run = sp
     ok: true,
     evidence: {
       method: "legacy_worktree_connection_match",
-      worktree_root: execution.worktreeRoot,
-      stack_path: execution.stackPath,
+      worktree_root: lease.worktree_root,
+      stack_path: leaseStackPath,
       api_url: live.api_url,
       db_port: dbPort,
       resolved_endpoint: observedTarget.resolved_endpoint,
@@ -655,33 +652,282 @@ function compactPreflight(receipt) {
   };
 }
 
-/** LOUD local-exec fallback: bring a stack up in the cwd via the Supabase CLI. */
-function localProvision(opts, dockerTarget) {
-  // Pin a LOCAL origin so `supabase start` never bakes the repo's prod origin into the
-  // edge runtime (BOT-903 / Codex P1). Refuse rather than risk crossing into production.
-  const url = resolveLocalSupabaseUrl();
-  if (!url) {
+/**
+ * BOT-903 / BOT-1711 (Codex P1) — pin the edge origin to the ISOLATED stack's OWN
+ * `[api] port`.
+ *
+ * `supabase start` bakes `VITE_SUPABASE_URL` into the edge runtime. Trusting an ambient
+ * local `VITE_SUPABASE_URL` is unsafe for a leased stack: if the caller has exported the
+ * shared canonical stack's origin, `supabase start` brings the isolated project up but
+ * bakes the SHARED stack's URL into its edge runtime, so tests that follow those URLs
+ * escape the leased stack into shared data (and without any local origin it would fall
+ * back to the repo's PRODUCTION origin). The isolated stack's own `[api] port` is
+ * therefore authoritative: require it, and reject an ambient LOCAL origin whose port
+ * does not match it. Throws a caller-facing Error otherwise.
+ */
+export function resolveIsolatedStackApiUrl(stackDir, env = process.env, read = readFileSync) {
+  let port = null;
+  try {
+    const toml = read(`${stackDir}/supabase/config.toml`, "utf8");
+    // Derive the API port from the SAME comment-aware, section-qualified, integer-normalizing
+    // parser used for isolation (BOT-1711 R16): a separate ad-hoc regex here diverged — it
+    // treated a commented `# [api]\n# port =` as config and mis-pinned the edge origin.
+    port = portMapInConfig(toml).get("api.port") ?? null;
+  } catch { /* handled below */ }
+  if (!port) {
+    throw new Error(
+      `refusing --local-exec: the isolated stack at ${stackDir} declares no supabase/config.toml [api] port — ` +
+        "cannot pin the leased stack's own edge origin (the edge runtime must emit the leased stack's URLs, not the shared stack's).",
+    );
+  }
+  const origin = `http://127.0.0.1:${port}`;
+  const ambient = env.VITE_SUPABASE_URL;
+  if (ambient) {
+    let host = null; let ambientPort = null;
+    try { const u = new URL(ambient); host = u.hostname; ambientPort = u.port; } catch { /* non-URL ambient is ignored */ }
+    if ((host === "127.0.0.1" || host === "localhost") && ambientPort !== String(port)) {
+      throw new Error(
+        `refusing --local-exec: ambient VITE_SUPABASE_URL (${ambient}) is a LOCAL origin whose port does not match the ` +
+          `isolated stack's API port (${origin}); the edge runtime would emit another stack's URLs. Unset VITE_SUPABASE_URL ` +
+          "or point it at the leased stack.",
+      );
+    }
+  }
+  return origin;
+}
+
+/** Resolve the absolute stack directory (where `supabase/config.toml` lives) for a
+ * resolved {worktreeRoot, stackPath}. `"."` is the worktree root itself. */
+export function stackDirFor(execution) {
+  return execution.stackPath === "."
+    ? execution.worktreeRoot
+    : join(execution.worktreeRoot, execution.stackPath);
+}
+
+/** Absolute stack directory a lease was provisioned in, from its recorded
+ * worktree_root/stack_path (BOT-1711 teardown). Falls back to `cwd` for a lease
+ * that predates worktree_root recording. */
+export function leaseStackDir(lease, cwd = process.cwd()) {
+  const worktreeRoot = lease?.worktree_root;
+  if (!worktreeRoot) return cwd;
+  const stackPath = lease?.stack_path || ".";
+  return stackPath === "." ? worktreeRoot : join(worktreeRoot, stackPath);
+}
+
+/** Read a `supabase/config.toml` project_id under `dir`, or null if unreadable. */
+function projectIdUnder(dir, read = readFileSync) {
+  try { return projectIdFromConfig(read(`${dir}/supabase/config.toml`, "utf8")); }
+  catch { return null; }
+}
+
+/** Every port a `config.toml` allocates, as a SECTION-QUALIFIED map `"<section>.<key>" ->
+ * "<port>"` (e.g. `api.port`, `db.shadow_port`, `inbucket.pop3_port`). Section-qualified so
+ * the SAME `port` key under [api]/[db]/[studio]/[inbucket] stays distinct, which lets a
+ * target be checked for BOTH completeness (declares every port the root does) and
+ * disjointness (shares no port value). */
+// Normalize any valid TOML integer literal to its decimal string: decimal (with `_`
+// separators), or `0x`/`0o`/`0b` radix forms. Returns null for a non-integer. Without this
+// a hex/octal port (`0xdc01` == 56321) or a separated one (`56_321`) would parse as a
+// truncated value and bypass the port-collision checks while Supabase binds the full port
+// (BOT-1711 Codex R11/R14).
+function tomlIntToDecimal(token) {
+  const cleaned = String(token).replace(/_/g, "");
+  const n = Number(cleaned);
+  return Number.isInteger(n) && n >= 0 ? String(n) : null;
+}
+
+// TOML decimal integers may carry a leading sign (`+56321`); radix forms may not. A
+// negative value is rejected downstream by tomlIntToDecimal (BOT-1711 Codex R15).
+const TOML_INT_PORT = "(0[xX][0-9A-Fa-f_]+|0[oO][0-7_]+|0[bB][01_]+|[+-]?[0-9][0-9_]*)";
+
+function portMapInConfig(toml) {
+  const map = new Map();
+  let section = "";
+  const bare = new RegExp(`^((?:[A-Za-z0-9]+_)?port)\\s*=\\s*${TOML_INT_PORT}`);
+  // Dotted TOML key form (BOT-1711 R16): `api.port = N` / `db.shadow_port = N`, section-
+  // qualified inline instead of under a `[section]` header. Normalizes to the same key.
+  const dotted = new RegExp(`^([A-Za-z0-9_]+)\\.((?:[A-Za-z0-9]+_)?port)\\s*=\\s*${TOML_INT_PORT}`);
+  for (const raw of String(toml).split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.startsWith("#")) continue; // comments are not configuration
+    const sec = /^\[([^\]]+)\]/.exec(line);
+    if (sec) { section = sec[1].trim(); continue; }
+    const dot = dotted.exec(line);
+    if (dot) {
+      const dec = tomlIntToDecimal(dot[3]);
+      if (dec != null) map.set(`${dot[1]}.${dot[2]}`, dec);
+      continue;
+    }
+    const m = bare.exec(line);
+    if (m) {
+      const dec = tomlIntToDecimal(m[2]);
+      if (dec != null) map.set(`${section}.${m[1]}`, dec);
+    }
+  }
+  return map;
+}
+
+/** Read a stack directory's identity — project_id + its COMPLETE, section-qualified port
+ * allocation — from its `supabase/config.toml`, in one read. Empty/null when unreadable. */
+function readStackIdentity(dir, read = readFileSync) {
+  try {
+    const toml = read(`${dir}/supabase/config.toml`, "utf8");
+    return { project: projectIdFromConfig(toml), ports: portMapInConfig(toml) };
+  } catch { return { project: null, ports: new Map() }; }
+}
+
+/**
+ * BOT-1711 (Codex P1) — is a MODERN lease's recorded teardown target NON-isolated,
+ * i.e. the worktree root or a stack whose project_id is the worktree default? A
+ * pre-1.32 client could have minted a modern lease (one that carries a
+ * botbuddy_docker_target) at the worktree root (`stack_path "."`); tearing it down
+ * with `supabase stop` there would stop the shared canonical stack. Refuse those.
+ * Root (`stack_path "."`) is always non-isolated; for a subdir the project_id check
+ * is best-effort (unreadable config ⇒ treated as isolated, since the parse+provision
+ * guards already blocked a same-project subdir at `up`). Never mutates.
+ */
+export function localExecTeardownIsNonIsolated(lease, read = readFileSync) {
+  const stackPath = lease?.stack_path || ".";
+  if (stackPath === ".") return true;
+  const worktreeRoot = lease?.worktree_root;
+  if (!worktreeRoot) return false;
+  const rootProject = projectIdUnder(worktreeRoot, read);
+  const stackProject = projectIdUnder(join(worktreeRoot, stackPath), read);
+  return Boolean(rootProject && stackProject && rootProject === stackProject);
+}
+
+/**
+ * BOT-1711 — the ISOLATION invariant for `--local-exec`.
+ *
+ * `supabase start`/`stop` operate whatever `project_id` the target `supabase/config.toml`
+ * declares. A leased batch must bring up a *disposable, isolated* stack — never the
+ * developer's shared canonical dev stack (the worktree root's committed default project).
+ * Running local-exec at the worktree root would `supabase start` (and later `supabase stop`)
+ * the shared canonical stack — the exact accident BOT-1711 documents (a `stack done` that
+ * stopped 12 shared containers).
+ *
+ * So refuse unless the target stack declares BOTH a project_id AND a COMPLETE port
+ * allocation DISTINCT from the worktree root's default stack. A project_id alone is not
+ * enough (Codex R2 P2): a config copied from the root with only project_id changed still
+ * binds the shared allocation's ports, so `supabase start` would squat the canonical
+ * endpoints if the shared stack is down, or fail after reserving the lease if it is up.
+ * And comparing only the API/DB ports is not enough (Codex R3 P2): the root also allocates
+ * `shadow_port`, Studio, Inbucket, analytics, and inspector ports, any of which a partial
+ * copy could still share. So require the leased stack's ENTIRE set of allocated ports to be
+ * disjoint from the root's. An isolated leased stack lives in a `--stack-path` subdirectory
+ * whose `supabase/config.toml` carries its own project_id AND a fully remapped port set (the
+ * SG<n> pattern / the canonical slot allocation). Throws otherwise; never mutates anything.
+ */
+export function assertIsolatedLocalExecTarget(execution, read = readFileSync) {
+  const stackDir = stackDirFor(execution);
+  const stack = readStackIdentity(stackDir, read);
+  if (!stack.project) {
+    throw new Error(
+      `refusing --local-exec: no supabase/config.toml project_id under ${execution.stackPath} — ` +
+        "an isolated leased stack needs its own supabase/config.toml (distinct project_id + remapped ports).",
+    );
+  }
+  const root = execution.stackPath === "." ? stack : readStackIdentity(execution.worktreeRoot, read);
+  // FAIL CLOSED (Codex R6 P1): if the worktree-root identity is unreadable — absent, or a
+  // project_id the parser doesn't recognize — isolation cannot be proven and the port checks
+  // would be vacuous, yet the shared canonical containers may still be running (e.g. its
+  // config was renamed/regenerated). Refuse rather than accept an unprovable target.
+  if (execution.stackPath !== "." && !root.project) {
+    throw new Error(
+      "refusing --local-exec: cannot read the worktree root's supabase/config.toml project_id, so isolation from the " +
+        "shared canonical stack cannot be proven (its containers may still be running). Ensure the worktree root has a " +
+        "readable supabase/config.toml before running an isolated leased stack.",
+    );
+  }
+  if (root.project && stack.project === root.project) {
+    throw new Error(
+      `refusing --local-exec: the target stack project_id "${stack.project}" is the worktree's default ` +
+        "(shared canonical) project — `supabase start`/`stop` here would operate the shared dev stack, not an " +
+        "isolated leased stack. Point --stack-path at a slot-derived stack directory whose supabase/config.toml " +
+        "declares a DISTINCT project_id and remapped ports (mirror the repo's SG<n> isolation).",
+    );
+  }
+  // COMPLETENESS (Codex R4 P2): every port the shared stack allocates must be explicitly
+  // declared by the target too. A port the target OMITS falls back to Supabase's default,
+  // which the config never reveals and which collides with any other default-using stack —
+  // and provisioning then fails only AFTER the lease is reserved (a fenced lease). Require
+  // the full allocation up front instead.
+  const missing = [...root.ports.keys()].filter((k) => !stack.ports.has(k));
+  if (missing.length) {
+    throw new Error(
+      `refusing --local-exec: the target stack omits port(s) the shared stack allocates (${missing.join(", ")}) — ` +
+        "an omitted port falls back to Supabase's default and collides with other stacks. Declare and remap the COMPLETE " +
+        "port allocation in the leased stack's supabase/config.toml (e.g. via the canonical slot allocation).",
+    );
+  }
+  // INTERNAL UNIQUENESS (Codex R8 P2): two of the target's OWN services on the same port
+  // (e.g. api.port == db.port) would make `supabase start` collide internally — after the
+  // lease is reserved, leaving it fenced. Each declared port must be distinct.
+  const stackValues = [...stack.ports.values()];
+  const intraDupes = [...new Set(stackValues.filter((v, i) => stackValues.indexOf(v) !== i))];
+  if (intraDupes.length) {
+    throw new Error(
+      `refusing --local-exec: the target stack assigns the same port to multiple services (${intraDupes.join(", ")}) — ` +
+        "`supabase start` would collide internally. Give every service a distinct port in the leased stack's supabase/config.toml.",
+    );
+  }
+  // DISJOINTNESS: no port VALUE may be shared with the canonical allocation, or
+  // `supabase start` binds the shared endpoints (squatting them if the shared stack is
+  // down, or failing after the lease is reserved if it is up).
+  const rootValues = new Set(root.ports.values());
+  const shared = [...new Set(stack.ports.values())].filter((v) => rootValues.has(v));
+  if (shared.length) {
     throw new Error(
-      "refusing --local-exec: cannot determine a LOCAL Supabase API origin (no supabase/config.toml [api] port " +
-        "in this directory, and VITE_SUPABASE_URL is not a 127.0.0.1/localhost origin). `supabase start` would bake " +
-        "the repository's PRODUCTION origin into the edge runtime — run from a repo with supabase/config.toml, or " +
-        "export VITE_SUPABASE_URL=http://127.0.0.1:<port> first.",
+      `refusing --local-exec: the target stack reuses the worktree default stack's port(s) ${shared.join(", ")} — ` +
+        "`supabase start` would bind the shared allocation's endpoints. Remap ALL of the leased stack's ports in its " +
+        "supabase/config.toml (api/db/shadow/studio/inbucket/analytics/inspector), e.g. via the canonical slot allocation.",
     );
   }
-  const spawnEnv = { ...dockerEnvForTarget(dockerTarget), VITE_SUPABASE_URL: url };
-  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — no BotBuddy Helper; running ${bold("supabase start")} in this worktree (VITE_SUPABASE_URL=${url}).\n`);
-  const start = spawnSync("supabase", ["start", "--workdir", process.cwd()], { encoding: "utf8", env: spawnEnv });
+}
+
+/**
+ * BOT-1711 (Codex R7 P2) — the COMPLETE non-mutating pre-flight for a local-exec target,
+ * run in `cmdUp` BEFORE any lease is minted or reserved. It proves both:
+ *   1. config isolation from the shared canonical stack (`assertIsolatedLocalExecTarget`), and
+ *   2. that the edge origin resolves to the leased stack's own [api] port and no ambient
+ *      `VITE_SUPABASE_URL` points at another stack (`resolveIsolatedStackApiUrl`).
+ * Both were previously proven only inside `localProvision` (post-reserve), so a target known
+ * invalid before any container started still left a fenced lease. Throws on any failure.
+ */
+export function validateLocalExecTarget(execution, env = process.env, read = readFileSync) {
+  assertIsolatedLocalExecTarget(execution, read);
+  resolveIsolatedStackApiUrl(stackDirFor(execution), env, read);
+}
+
+/** LOUD local-exec fallback: bring an ISOLATED stack up in the resolved stack dir. */
+export function localProvision(opts, dockerTarget, execution, spawn = spawnSync, env = process.env) {
+  const stackDir = stackDirFor(execution);
+  // BOT-1711: never operate the repo's default (shared canonical) project.
+  assertIsolatedLocalExecTarget(execution);
+  // Pin the edge origin to the ISOLATED stack's OWN [api] port (BOT-903 / BOT-1711 Codex
+  // P1): never the repo's prod origin, and never an ambient shared-stack origin — either
+  // would make the isolated stack's edge runtime emit another stack's URLs.
+  const url = resolveIsolatedStackApiUrl(stackDir, env);
+  const spawnEnv = { ...dockerEnvForTarget(dockerTarget, env), VITE_SUPABASE_URL: url };
+  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — no BotBuddy Helper; running ${bold("supabase start")} in ${stackDir} (VITE_SUPABASE_URL=${url}).\n`);
+  const start = spawn("supabase", ["start", "--workdir", stackDir], { encoding: "utf8", env: spawnEnv });
   if (start.status !== 0) {
     throw new Error(`supabase start failed (${start.status}): ${(start.stderr || start.stdout || "").slice(0, 400)}`);
   }
-  const status = spawnSync("supabase", ["status", "-o", "json"], { encoding: "utf8", env: spawnEnv });
-  return parseSupabaseStatus(status.stdout || "");
+  const status = spawn("supabase", ["status", "-o", "json", "--workdir", stackDir], { encoding: "utf8", env: spawnEnv });
+  const conn = parseSupabaseStatus(status.stdout || "");
+  // BOT-1711 (Codex R5 P2): persist the PROVISIONED project_id on the lease connection so
+  // teardown can detect a config that was edited/regenerated between `up` and `done` and
+  // refuse rather than `supabase stop` a replacement stack.
+  const provisionedProject = projectIdUnder(stackDir);
+  if (provisionedProject) conn.project_id = provisionedProject;
+  return conn;
 }
 
-/** LOUD local-exec fallback: tear the stack down in the cwd. Returns true iff it succeeded. */
-export function localTeardown(_opts, dockerTarget, spawn = spawnSync, env = process.env) {
-  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — running ${bold("supabase stop")} in this worktree.\n`);
-  const res = spawn("supabase", ["stop", "--workdir", process.cwd()], {
+/** LOUD local-exec fallback: tear the stack down in `stackDir`. Returns true iff it succeeded. */
+export function localTeardown(stackDir, dockerTarget, spawn = spawnSync, env = process.env) {
+  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — running ${bold("supabase stop")} in ${stackDir}.\n`);
+  const res = spawn("supabase", ["stop", "--workdir", stackDir], {
     encoding: "utf8",
     env: dockerEnvForTarget(dockerTarget, env),
   });
@@ -707,6 +953,7 @@ export async function cmdUp(opts, {
   waitFn = waitForLease,
   emitResult = emit,
   machineUuidFn = machineUuid,
+  assertIsolated = validateLocalExecTarget,
 } = {}) {
   let slot;
   try { slot = deriveSlot(opts); } catch (e) {
@@ -719,6 +966,16 @@ export async function cmdUp(opts, {
   let localPreflight = null;
   let localDockerTarget = null;
   if (opts.localExec) {
+    // BOT-1711 (Codex R2/R7 P2): prove BOTH config isolation from the resolved --stack-path
+    // AND the edge origin (no ambient VITE_SUPABASE_URL pointing at another stack) BEFORE any
+    // backend mutation. `resolveStackPath` canonicalizes `..`/symlinks, so a target the parser
+    // missed (e.g. `--stack-path ./` → the worktree root) is only caught here. Running this
+    // non-mutating validation now means an invalid target is refused before a lease is ever
+    // minted or reserved, so it can never leave a fenced lease.
+    try { assertIsolated(execution); }
+    catch (e) {
+      return emitResult(buildReceipt({ command: "up", outcome: "refused", slot, error: e.message }), opts, EXIT.LEASE_FAILED);
+    }
     const checked = await runPreflight(opts);
     localPreflight = compactPreflight(checked.receipt);
     localDockerTarget = dockerTargetFromPreflight(checked.receipt);
@@ -768,6 +1025,10 @@ export async function cmdUp(opts, {
   }
   let leaseId = d.lease_id;
   let state = d.state;
+  // BOT-1711 (Codex R13): request_stack_lease returned an EXISTING active lease (reused),
+  // rather than a freshly minted queued/provisioning one. A reused lease was not provisioned
+  // in this invocation, so its recorded metadata cannot be trusted for a local-exec target.
+  const reusedExisting = state === "active";
 
   if (state === "queued") {
     if (opts.noWait) {
@@ -802,18 +1063,38 @@ export async function cmdUp(opts, {
           lease_cancellation: leaseCancellation,
         }), opts, EXIT.LEASE_FAILED);
       }
+      // BOT-1711 (Codex R8 P2): the target config could have been edited while this lease
+      // was QUEUED for capacity. Re-run the non-mutating target validation NOW, before
+      // reserving the provision job; on failure atomically release the minted lease so a
+      // config invalidated during the queue wait never leaves a fenced lease.
+      try { assertIsolated(execution); }
+      catch (e) {
+        const cancelled = await call("cancel_unclaimed_stack_lease", { lease_id: leaseId });
+        const leaseCancellation = cancelled.ok && cancelled.data?.success
+          ? { success: true, state: cancelled.data.state, provision_job_cancelled: cancelled.data.provision_job_cancelled === true }
+          : { success: false, error: cancelled.error || cancelled.data?.code || "atomic cancellation failed" };
+        return emitResult(buildReceipt({
+          command: "up", outcome: "refused", lease_id: leaseId, state, slot, error: e.message,
+          lease_cancellation: leaseCancellation,
+        }), opts, EXIT.LEASE_FAILED);
+      }
       // Reserve the queued provision job for THIS agent BEFORE `supabase start`.
       // Otherwise a Helper can claim it while the local provisioner runs, winning
       // the later activation race and leaving an untracked local stack (two
       // provisioners contending for one slot). If the reservation is LOST, nothing
       // local has started yet, so it is safe to atomically release the minted lease
       // and free the slot (BOT-1421 review).
-      // Persist the validated Docker target with the reservation so that if the
-      // provisioner partially starts a stack and then fails, the fenced lease can
-      // still be torn down by `stack done --local-exec` (BOT-1421 review).
+      // Persist the validated Docker target AND the target stack's project_id with the
+      // reservation (BOT-1711 Codex R14): if the provisioner partially starts a stack and
+      // then exits nonzero, the fenced lease still carries a provisioned identity so
+      // `stack done --local-exec` recognises it as a current-client lease (not an untrusted
+      // pre-1.32 one) and can tear the partial stack down instead of refusing.
+      const reservedProjectId = projectIdUnder(stackDirFor(execution));
+      const reservedConnection = connectionWithDockerTarget(
+        reservedProjectId ? { project_id: reservedProjectId } : {}, localDockerTarget);
       const reserved = await call("reserve_stack_lease", {
         lease_id: leaseId,
-        connection: connectionWithDockerTarget({}, localDockerTarget),
+        connection: reservedConnection,
       });
       if (!reserved.ok || !reserved.data?.success) {
         // A Helper can win the reservation race by taking the queued provision
@@ -857,7 +1138,7 @@ export async function cmdUp(opts, {
       } else {
         let conn;
         try {
-          conn = connectionWithDockerTarget(localProvisionFn(opts, localDockerTarget), localDockerTarget);
+          conn = connectionWithDockerTarget(localProvisionFn(opts, localDockerTarget, execution), localDockerTarget);
         } catch (e) {
           // Once the local provisioner has run, `supabase start` may have created
           // (or fully started) containers even on a nonzero exit or a status-parse
@@ -888,6 +1169,37 @@ export async function cmdUp(opts, {
   if (!g || g.state !== "active") {
     return emitResult(buildReceipt({ command: "up", outcome: "error", lease_id: leaseId, state: g?.state, error: g ? `lease is ${g.state}, not active` : (got.error || "could not read lease") }), opts, g?.state && isReaped(g.state) ? EXIT.LEASE_FAILED : EXIT.BACKEND);
   }
+  // BOT-1711 (Codex R12 P1): `request_stack_lease` REUSES an existing active lease for this
+  // slot (e.g. a pre-1.32 lease recorded with stack_path "."). The isolation validation above
+  // only covers the newly requested --stack-path, so a reused lease could hand back a
+  // different (possibly shared-root) connection as "active". Refuse a lease whose recorded
+  // worktree/stack does not match the validated target instead of returning it.
+  if (opts.localExec) {
+    const leaseStackPath = g.stack_path || ".";
+    const stackMismatch = leaseStackPath !== execution.stackPath;
+    const worktreeMismatch = g.worktree_root != null && g.worktree_root !== execution.worktreeRoot;
+    if (stackMismatch || worktreeMismatch) {
+      return emitResult(buildReceipt({
+        command: "up", outcome: "refused", lease_id: leaseId, state: "active", slot,
+        error: `refusing --local-exec: the active lease is bound to ${g.worktree_root || "<unknown>"} / stack_path "${leaseStackPath}", ` +
+          `not the validated ${execution.worktreeRoot} / "${execution.stackPath}" — an existing lease for this slot was reused and ` +
+          "points at a different (possibly shared) stack. Release that lease with `stack done`, or use a slot dedicated to this stack.",
+        observed_worktree_root: g.worktree_root || null, observed_stack_path: leaseStackPath,
+      }), opts, EXIT.LEASE_FAILED);
+    }
+    // BOT-1711 (Codex R13 P1): a REUSED lease whose metadata matches can still be a pre-1.32
+    // lease that recorded this path but actually provisioned the worktree ROOT — its recorded
+    // stack_path lies. The only trustworthy signal is a persisted provisioned identity, which
+    // only BOT-1711+ local provisioning writes. Refuse a reused lease that lacks it.
+    if (reusedExisting && !g.connection?.project_id) {
+      return emitResult(buildReceipt({
+        command: "up", outcome: "refused", lease_id: leaseId, state: "active", slot,
+        error: "refusing --local-exec: reused an existing active lease with no persisted provisioned identity " +
+          "(project_id) — a pre-1.32 lease recorded this stack_path but may have provisioned the shared worktree root, so its " +
+          "connection cannot be trusted as the isolated stack. Release it with `stack done` and re-provision, or use a dedicated slot.",
+      }), opts, EXIT.LEASE_FAILED);
+    }
+  }
   return emitResult(buildReceipt({
     command: "up", outcome: "active", lease_id: leaseId, state: "active",
     host_key: g.host_key, slot: g.slot, connection: g.connection,
@@ -934,6 +1246,7 @@ export async function cmdDone(leaseId, opts, {
   const call = (name, args, callOptions = {}) => callTool(name, args, { ...callOptions, auth });
   let dockerTarget = null;
   let legacyTargetProof = null;
+  let teardownDir = process.cwd();
   if (opts.localExec) {
     const current = await call("get_stack_lease", { lease_id: leaseId });
     if (!current.ok || !current.data?.success) {
@@ -941,7 +1254,57 @@ export async function cmdDone(leaseId, opts, {
         error: current.error || current.data?.code || "could not verify the lease Docker target" }), opts,
       current.auth ? EXIT.AUTH : EXIT.BACKEND);
     }
+    // BOT-1711: tear down in the directory the stack was PROVISIONED in (the lease's
+    // recorded worktree_root/stack_path), not the invoking cwd — otherwise `supabase
+    // stop` at the worktree root would stop the shared canonical stack.
+    teardownDir = leaseStackDir(current.data);
+    // BOT-1711 (Codex P1, R4): refuse local-exec teardown of ANY lease whose target is the
+    // worktree root / default project — BEFORE branching on the persisted Docker target.
+    // This covers a modern lease minted at the root by a pre-1.32 client AND a pre-1.5
+    // targetless legacy lease: the legacy connection-match proof would otherwise authorize
+    // `supabase stop --workdir <worktreeRoot>`, which stops the shared canonical stack.
+    // Matching endpoints do not prove the shared stack is disposable. Fail closed; the
+    // operator / `botbuddy docker hygiene` reclaims it. (A legacy lease with a genuinely
+    // isolated non-root stack_path still reaches the proof path below.)
+    if (localExecTeardownIsNonIsolated(current.data)) {
+      return emitResult(buildReceipt({ command: "done", outcome: "refused", lease_id: leaseId,
+        error: "refusing --local-exec teardown: this lease targets the worktree root (default/shared canonical project); " +
+          "`supabase stop` here would stop the shared stack. Reclaim it with `botbuddy docker hygiene` or the operator, not local-exec. " +
+          "Lease and slot remain fenced.",
+        observed_stack_path: current.data.stack_path || ".",
+      }), opts, EXIT.LEASE_FAILED);
+    }
+    // BOT-1711 (Codex R5 P2): if the stack directory's config was edited/regenerated between
+    // `up` and `done`, its project_id no longer matches what was provisioned — `supabase stop`
+    // there would stop a REPLACEMENT stack while the original containers keep running, and the
+    // old lease would still finalize. Refuse on project drift (the provisioned project_id is
+    // persisted on the lease connection at `up`).
+    const provisionedProject = current.data.connection?.project_id;
+    if (provisionedProject) {
+      const currentProject = projectIdUnder(teardownDir);
+      if (currentProject && currentProject !== provisionedProject) {
+        return emitResult(buildReceipt({ command: "done", outcome: "refused", lease_id: leaseId,
+          error: `refusing --local-exec teardown: ${teardownDir} now declares project_id "${currentProject}" but the lease ` +
+            `provisioned "${provisionedProject}" — its config changed since provisioning, so \`supabase stop\` could stop a ` +
+            "replacement stack and orphan the original. Reclaim with `botbuddy docker hygiene` or the operator.",
+          provisioned_project_id: provisionedProject, observed_project_id: currentProject,
+        }), opts, EXIT.LEASE_FAILED);
+      }
+    }
     const expected = current.data.connection?.botbuddy_docker_target;
+    // BOT-1711 (Codex R13 P1): a modern-target lease that lacks a persisted provisioned
+    // project_id was NOT provisioned by BOT-1711+ local-exec (e.g. a pre-1.32 lease that
+    // recorded a non-root stack_path but actually started the worktree ROOT). Its recorded
+    // path cannot be trusted to point `supabase stop` at the right stack, and there is no
+    // identity to compare, so fail closed rather than risk stopping an unrelated stack.
+    if (expected && !current.data.connection?.project_id) {
+      return emitResult(buildReceipt({ command: "done", outcome: "refused", lease_id: leaseId,
+        error: "refusing --local-exec teardown: this lease has a Docker target but no persisted provisioned identity " +
+          "(project_id) — it predates BOT-1711 isolated provisioning and its recorded stack_path may not match the stack it " +
+          "actually started. Reclaim it with `botbuddy docker hygiene` or the operator, not local-exec.",
+        observed_stack_path: current.data.stack_path || ".",
+      }), opts, EXIT.LEASE_FAILED);
+    }
     let checked;
     try { checked = await runPreflight(opts); } catch (error) {
       return emitResult(buildReceipt({ command: "done", outcome: "refused", lease_id: leaseId,
@@ -988,7 +1351,7 @@ export async function cmdDone(leaseId, opts, {
     // the next queued lease, which would collide with containers still running on this
     // slot (Codex P1). Leave the lease in `reaping` (slot stays fenced) for a retry /
     // the reaper. Fail with a non-zero exit so the caller knows teardown is incomplete.
-    if (!localTeardownFn(opts, dockerTarget)) {
+    if (!localTeardownFn(teardownDir, dockerTarget)) {
       return emitResult(buildReceipt({
         command: "done", outcome: "error", lease_id: leaseId, state,
         error: "local `supabase stop` failed — NOT finalizing; the slot stays fenced. Tear the stack down and re-run `stack done --local-exec`, or let the reaper reconcile.",