@botbuddy/cli 1.32.1 → 1.32.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.32.1",
+  "version": "1.32.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/pw/args.mjs

@@ -1,6 +1,26 @@
 import { TARGET_VERBS, parseTargetFlags, hasTargetFlags, buildLocatorTarget, classifyTarget, isSnapshotRef } from "./targets.mjs";
 import { TRANSLATE_VERBS, planTranslateVerb, MAX_EXEC_ARG } from "./translate.mjs";
 export const GLOBAL_VERBS = new Set(["list", "close-all", "kill-all", "reap"]);
+// BOT-1682: the bb pw credential/session flags. They are accepted ONLY before the
+// lane (consumed in run.mjs). Once one reaches planInvocation it is after the lane
+// — the verb slot or the workload — which upstream @playwright/cli would reject
+// with an "Unknown option" + help dump; catch it here and name the fix (move it
+// before the lane) instead. `--tenant` after the lane also cannot be safely
+// honored for session/lane auth, another reason to refuse rather than forward it.
+export const PW_CREDENTIAL_FLAGS = ["--tenant", "--session-id", "--agent-session-token", "--agent-key", "--session-token"];
+const credentialFlagOf = (token) => PW_CREDENTIAL_FLAGS.find((flag) => token === flag || String(token).startsWith(`${flag}=`)) ?? null;
+function misplacedCredentialFlag(token) {
+  return new Error(`bb-pw: ${credentialFlagOf(token)} is a bb pw credential flag, not a Playwright argument — put it before the lane: bb-pw [--tenant <slug>] <lane> <verb> …`);
+}
+// BOT-1682: verbs that once existed under bb pw / an older @playwright/cli and now
+// map to a differently-named upstream command. On these, hint the rename in one
+// line instead of dumping ~110 lines of upstream usage. `console` and `status`
+// are NOT here — they are live commands.
+export const RETIRED_VERBS = { network: "use 'requests' (list) or 'request-headers <n>' / 'request <n>'" };
+// BOT-1682: everything after a bare `--` is a positional Playwright argument (the
+// upstream CLI treats `fill e1 -- --tenant` as literal text), so misplaced-flag
+// detection must not look past it. Mirrors legacyAgentAliasHint's own `--` cutoff.
+const beforeSeparator = (tokens) => { const sep = tokens.indexOf("--"); return sep === -1 ? tokens : tokens.slice(0, sep); };
 const secret = /^@ENV:(.+)$/;
 export function resolveRef(value, env = process.env) {
   const match = secret.exec(String(value));
@@ -12,16 +32,51 @@ export const normaliseLane = (token) => String(token).replace(/^agent-0*/, "").r
 function validLane(lane) { return /^[1-9]\d*$/.test(lane); }
 export function planInvocation(argv, env = process.env) {
   if (!argv.length) throw new Error("bb-pw: usage: bb-pw <lane> <verb> [args…]  (or: bb-pw <reap|list|close-all|kill-all>)");
-  if (GLOBAL_VERBS.has(argv[0])) return argv[0] === "reap" ? { scope: "global", verb: "reap", mode: "reap" } : { scope: "global", verb: argv[0], mode: "exec", execArgv: argv };
+  if (GLOBAL_VERBS.has(argv[0])) {
+    // BOT-1682: a credential flag after a global verb (`bb-pw list --tenant …`)
+    // has no lane to sit before, and would otherwise be forwarded to upstream —
+    // which rejects it with its own "Unknown option" dump. Refuse it here too.
+    // Global verbs (list/close-all/kill-all/reap) take NO positional workload, so
+    // unlike lane verbs there is no `--` exemption — a credential-shaped token in
+    // ANY position (incl. after `--`) is misplaced, never a literal value that
+    // upstream would accept (Codex: `list -- --tenant` otherwise reaches upstream,
+    // which errors "too many arguments").
+    const strayGlobal = argv.slice(1).find((value) => credentialFlagOf(value));
+    if (strayGlobal) throw misplacedCredentialFlag(strayGlobal);
+    return argv[0] === "reap" ? { scope: "global", verb: "reap", mode: "reap" } : { scope: "global", verb: argv[0], mode: "exec", execArgv: argv };
+  }
   const lane = normaliseLane(argv[0]), verb = argv[1];
   if (!validLane(lane) || !verb) throw new Error(`bb-pw: usage: lane must be a positive integer and include a verb`);
-  if (verb === "status") return { scope: "lane", lane, session: `lane-${lane}`, verb, mode: "status" };
+  // BOT-1682: a credential flag in the verb slot (`<lane> --tenant …`) or a
+  // retired verb — caught before status/target handling so neither leaks upstream.
+  if (credentialFlagOf(verb)) throw misplacedCredentialFlag(verb);
+  if (Object.hasOwn(RETIRED_VERBS, verb)) throw new Error(`bb-pw: '${verb}' was retired — ${RETIRED_VERBS[verb]}`);
+  if (verb === "status") {
+    // `status` has no workload, so — like the global verbs — there is no `--`
+    // exemption: a credential flag in ANY position (incl. after `--`) is misplaced
+    // and must be refused, or `status -- --tenant` would return success while
+    // silently ignoring it and still leaving the id readable downstream (Codex).
+    const strayStatus = argv.slice(2).find((value) => credentialFlagOf(value));
+    if (strayStatus) throw misplacedCredentialFlag(strayStatus);
+    return { scope: "lane", lane, session: `lane-${lane}`, verb, mode: "status" };
+  }
   const rest = argv.slice(2); let forwarded = rest, target = null, fresh = false;
   // BOT-1702: bb-pw OWNS upload/route/unroute and translates them to upstream
   // `run-code` (see translate.mjs). A resolved `@ENV:` secret in any value routes
   // the generated code through the socket path so it never lands in argv, and is
   // tracked for redaction — mirroring the sibling verbs' guarantee.
   if (TRANSLATE_VERBS.has(verb)) {
+    // BOT-1682: run the misplaced-credential-flag guard BEFORE dispatching a
+    // translated verb (upload/route/unroute/route-list), so `route … stall --tenant …`
+    // gets the one-line "put it before the lane" refusal rather than an unrelated
+    // translate-parse error (Codex). But a translated verb's parsers consume the
+    // token AFTER an option as that option's VALUE (`upload --label --tenant`,
+    // `route … fulfill --body --session-token`), so a credential-shaped token whose
+    // predecessor is an option (`--x`) is a legitimate value and is left alone;
+    // only one in a non-value position is misplaced (Codex R17). `--` still exempts.
+    const scanT = beforeSeparator(rest);
+    const strayTranslate = scanT.find((value, i) => credentialFlagOf(value) && !(i > 0 && /^--[a-z]/.test(String(scanT[i - 1]))));
+    if (strayTranslate) throw misplacedCredentialFlag(strayTranslate);
     const { code, secretValues } = planTranslateVerb(verb, rest, { env, resolveRef });
     // Use the daemon socket (JSON, no argv limit) for a resolved secret OR a
     // payload too large for a single child-process argument (Codex R2 P2: a big
@@ -37,6 +92,11 @@ export function planInvocation(argv, env = process.env) {
     target = forwarded.find((value) => !String(value).startsWith("--")) ?? null;
     if (fresh && target && isSnapshotRef(target)) throw new Error("bb-pw: --fresh cannot target a snapshot ref; use a stable locator");
   }
+  // BOT-1682: a credential flag surviving into the workload (`<lane> <verb> …
+  // --tenant …`) is misplaced — target-flag VALUES have already been consumed by
+  // parseTargetFlags, so only a genuine standalone credential-flag token remains.
+  const stray = beforeSeparator(forwarded).find((value) => credentialFlagOf(value));
+  if (stray) throw misplacedCredentialFlag(stray);
   const resolved = forwarded.map((value) => resolveRef(value, env));
   const sensitive = resolved.some((value) => value.secret);
   return { scope: "lane", lane, session: `lane-${lane}`, verb, mode: sensitive ? "socket" : "exec", execArgv: sensitive ? null : [`-s=lane-${lane}`, verb, ...forwarded], socketArgs: sensitive ? [verb, ...resolved.map((value) => value.value)] : null, telemetryUrl: ["goto", "open", "go-back", "go-forward", "reload"].includes(verb) ? (resolved[0]?.secret ? resolved[0].ref : forwarded[0] ?? null) : null, secretValues: resolved.filter((value) => value.secret).map((value) => String(value.value)), rollup: verb === "close", target, targetKind: target === null ? null : classifyTarget(target), fresh };

package/src/pw/run.mjs

@@ -1,5 +1,5 @@
 import os from "node:os";
-import { planInvocation } from "./args.mjs";
+import { planInvocation, GLOBAL_VERBS } from "./args.mjs";
 import { actionTypeFromMethod, NAV } from "./readiness.mjs";
 import { isStaleRefError, staleRefRemediation } from "./targets.mjs";
 import { createSessionTokenCoordinator } from "./coordinator.mjs";
@@ -13,7 +13,7 @@ import { clearAgentState, isRejectedCachedMcpSession, resolveAgentSessionCredent
 // server-side, so the lane name bb-pw builds/matches/prints is the one the lock
 // kernel actually stored ("jonos-mbp:8", not "Jonos-MBP.localdomain:8").
 const hostFor = (env) => canonicalizeHostString(env.PLAYWRIGHT_MCP_HOST || env.HOSTNAME || os.hostname());
-function help(out) { out.write("Usage: pw [--tenant <slug>] [--session-id <id>] [--agent-session-token <token>] <lane> <verb> [args…]\n\nAliases: bb-pw <lane> <verb> [args…]   ·   botbuddy pw <lane> <verb> [args…]\n         (all three drive the same lock-gated Playwright lane)\n\n--session-id <id>  accept a lane held by this arming-session agent id (from\n                   register_agent); defaults to $BOTBUDDY_SESSION_ID, then the\n                   id saved by `botbuddy register`.\n--agent-session-token <token>  session credential (env $BOTBUDDY_AGENT_SESSION_TOKEN);\n                   --agent-key / --session-token are one-release legacy aliases.\n--tenant <slug>    override the worktree .botbuddy-agent.json tenant when falling\n                   back to the .mcp.json ($BOTBUDDY_MCP_KEY) credential.\n\nFile upload (BOT-1702) — works on a hidden <input type=file>:\n  bb-pw <lane> upload <selector> <path...>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,size=<bytes>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,bytes=@base64:<b64>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,text=<str>\n     --inline repeats; builds synthetic files in memory (no workstation FS).\n     <selector> also accepts --testid/--role/--label/--text like click/fill.\n\nNetwork mocking (BOT-1702) — routes persist on the lane across invocations:\n  bb-pw <lane> route <url-glob> stall                 hold the request pending\n                                                      (screenshot the loading state)\n  bb-pw <lane> route <url-glob> abort [--error <code>] fail the request (default: failed)\n  bb-pw <lane> route <url-glob> fulfill --status <n> [--content-type <ct>]\n                                        [--body <str|@base64:..|@file:PATH>]\n  bb-pw <lane> unroute [<url-glob>]                    release one route, or all\n  bb-pw <lane> route-list                              list the routes owned on this lane\n  (offline mode already exists upstream: bb-pw <lane> network-state-set offline)\n"); }
+function help(out) { out.write("Usage: pw [--tenant <slug>] [--session-id <id>] [--agent-session-token <token>] <lane> <verb> [args…]\n\nAliases: bb-pw <lane> <verb> [args…]   ·   botbuddy pw <lane> <verb> [args…]\n         (all three drive the same lock-gated Playwright lane)\n\n--session-id <id>  accept a lane held by this arming-session agent id (from\n                   register_agent); defaults to $BOTBUDDY_SESSION_ID, then the\n                   id saved by `botbuddy register`.\n--agent-session-token <token>  session credential (env $BOTBUDDY_AGENT_SESSION_TOKEN);\n                   --agent-key / --session-token are one-release legacy aliases.\n--tenant <slug>    accepted before the lane but currently INERT — the tenant\n                   comes from your resolved credential, so bb pw does not act on\n                   this flag for session/lane auth yet (server-validated tenant\n                   selection is tracked in BOT-1732).\n\nCredential flags (--tenant / --session-id / --agent-session-token) go BEFORE the\nlane. Placed after the lane they are refused with guidance (they are not\nPlaywright arguments, and a --tenant after the lane cannot be safely honored).\n\nFile upload (BOT-1702) — works on a hidden <input type=file>:\n  bb-pw <lane> upload <selector> <path...>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,size=<bytes>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,bytes=@base64:<b64>\n  bb-pw <lane> upload <selector> --inline name=<n>,mime=<m>,text=<str>\n     --inline repeats; builds synthetic files in memory (no workstation FS).\n     <selector> also accepts --testid/--role/--label/--text like click/fill.\n\nNetwork mocking (BOT-1702) — routes persist on the lane across invocations:\n  bb-pw <lane> route <url-glob> stall                 hold the request pending\n                                                      (screenshot the loading state)\n  bb-pw <lane> route <url-glob> abort [--error <code>] fail the request (default: failed)\n  bb-pw <lane> route <url-glob> fulfill --status <n> [--content-type <ct>]\n                                        [--body <str|@base64:..|@file:PATH>]\n  bb-pw <lane> unroute [<url-glob>]                    release one route, or all\n  bb-pw <lane> route-list                              list the routes owned on this lane\n  (offline mode already exists upstream: bb-pw <lane> network-state-set offline)\n"); }
 // Redact LONGEST secrets first: replacing a short value that is a substring of a
 // longer secret (e.g. a filename that also appears inside the payload's base64)
 // would otherwise break the longer match and leave the remainder recoverable
@@ -114,14 +114,58 @@ export async function runPw(argv, deps = {}) {
 // while-loop in runPwInner). Everything after the first non-option (the lane) is a
 // Playwright workload argument and is never a BotBuddy credential.
 const PW_LEADING_FLAGS = ["--tenant", "--session-id", "--agent-session-token", "--agent-key", "--session-token"];
+const selfHealErrorLine = (error) => `bb-pw: ${error?.message ?? "agent session unavailable"}. ${error?.code === "client_key_required" ? "Run `bb login` then retry." : "Run `bb doctor --fix` then retry."}\n`;
+// The leading credential options, NORMALIZED to split `flag value` pairs so an
+// inline `--agent-key=<token>` is recognized by legacyAgentAliasHint (which
+// matches exact flag tokens) exactly like the split form. Credential flags are
+// only accepted BEFORE the lane (BOT-1682 P1: `--tenant` after the lane cannot be
+// safely honored for session/lane auth and is refused, see planInvocation), so
+// this leading scan is the whole surface the alias hint needs to consider.
 function leadingPwOptions(args) {
   const lead = [];
-  for (let i = 0; i < args.length && PW_LEADING_FLAGS.includes(args[i]); i += 2) {
-    lead.push(args[i]);
-    if (i + 1 < args.length) lead.push(args[i + 1]);
+  let rest = [...args];
+  let match;
+  while ((match = matchWrapperFlag(rest[0]))) {
+    lead.push(match.flag);
+    if (match.inline !== null) { lead.push(match.inline); rest = rest.slice(1); }
+    else { if (rest[1] === undefined) break; lead.push(rest[1]); rest = rest.slice(2); }
   }
   return lead;
 }
+// BOT-1682: match a leading credential flag in either `--flag value` or
+// `--flag=value` form. Returns the base flag + its inline value (null when the
+// value is the NEXT token), or null when the token is not a credential flag.
+function matchWrapperFlag(token) {
+  for (const flag of PW_LEADING_FLAGS) {
+    if (token === flag) return { flag, inline: null };
+    if (typeof token === "string" && token.startsWith(`${flag}=`)) return { flag, inline: token.slice(flag.length + 1) };
+  }
+  return null;
+}
+const applyWrapperFlag = (deps, flag, value) => flag === "--tenant"
+  ? { ...deps, tenant: value }
+  : ["--agent-session-token", "--agent-key", "--session-token"].includes(flag)
+    ? { ...deps, sessionToken: value }
+    : { ...deps, sessionId: value };
+// Consume a run of credential flags from `list` starting at `start`, folding each
+// into deps. Returns { deps, rest } on success, or { error: flag } when a flag
+// has no value. `rest` is the tokens after the consumed run.
+function consumeWrapperFlags(list, deps, start = 0) {
+  let rest = list.slice(start);
+  let match;
+  while ((match = matchWrapperFlag(rest[0]))) {
+    let value;
+    if (match.inline !== null) { value = match.inline; rest = rest.slice(1); }
+    else { if (rest[1] === undefined) return { error: match.flag }; value = rest[1]; rest = rest.slice(2); }
+    // An empty value (`--flag=` or `--flag ""`) is a usage error, not a silent
+    // no-op: an empty session token would make `!deps.sessionToken` true and fall
+    // back to another credential, executing under a different identity (Codex P2).
+    // Matches the old `if (!args[1])` guard this helper replaced.
+    if (value === "") return { error: match.flag };
+    deps = applyWrapperFlag(deps, match.flag, value);
+  }
+  return { deps, rest };
+}
 
 async function runPwInner(argv, deps = {}) {
   const env = deps.env ?? process.env, stdout = deps.stdout ?? process.stdout, stderr = deps.stderr ?? process.stderr; let args = [...argv]; if (["--help", "-h"].includes(args[0])) { help(stdout); return 0; }
@@ -137,7 +181,14 @@ async function runPwInner(argv, deps = {}) {
   // session identity alongside --session-id, so a token-armed session need not
   // pass an id. Holder matching still rides on the server's owner_is_caller and
   // the resolved agent ids (gate()).
-  while (["--tenant", "--session-id", "--agent-session-token", "--agent-key", "--session-token"].includes(args[0])) { const flag = args[0]; if (!args[1]) { stderr.write(`bb-pw: ${flag} needs a value\n`); return 2; } deps = flag === "--tenant" ? { ...deps, tenant: args[1] } : ["--agent-session-token", "--agent-key", "--session-token"].includes(flag) ? { ...deps, sessionToken: args[1] } : { ...deps, sessionId: args[1] }; args = args.slice(2); }
+  // Credential flags are accepted ONLY as LEADING options (before the lane). A
+  // `--tenant` after the lane cannot be safely honored — bb pw would authenticate
+  // with the resolved session/key regardless of the named tenant, so a tenant B
+  // request could run under tenant A's cached session (Codex P1). Anything
+  // credential-flag-shaped still present once we reach the verb is refused by
+  // planInvocation with guidance to move it before the lane; a real, server-pinned
+  // `--tenant` lane fallback is BOT-1732.
+  { const consumed = consumeWrapperFlags(args, deps, 0); if (consumed.error) { stderr.write(`bb-pw: ${consumed.error} needs a value\n`); return 2; } deps = consumed.deps; args = consumed.rest; }
   let plan; try { plan = planInvocation(args, env); } catch (error) { stderr.write(`${error.message}\n`); return 2; }
   const { spawnExec, socketRun } = deps.daemon ?? await import("./daemon.mjs");
   if (plan.scope === "global") { if (plan.mode === "reap") { await (deps.reap ?? (await import("./reap.mjs")).reap)({ env, stdout }); return 0; } if (env.BB_PW_NO_LOCK !== "1") { stderr.write("bb-pw: close-all and kill-all require BB_PW_NO_LOCK=1 because they can affect lanes you do not own.\n"); return 3; } return spawnExec(plan, env); }
@@ -146,12 +197,11 @@ async function runPwInner(argv, deps = {}) {
   let managedCredential = null;
   if (env.BB_PW_NO_LOCK !== "1" && !deps.sessionToken && !readAgentSessionTokenEnv(env) && (!deps.coordinator || deps.resolveCredential)) {
     try {
-      const credential = await (deps.resolveCredential ?? resolveAgentSessionCredential)({ argv, env, cwd: deps.cwd ?? process.cwd() });
+      const credential = await (deps.resolveCredential ?? resolveAgentSessionCredential)({ argv, env, cwd: deps.cwd ?? process.cwd(), sessionId: deps.sessionId ?? env.BOTBUDDY_SESSION_ID ?? null, flagToken: null });
       managedCredential = credential;
       deps = { ...deps, sessionToken: credential.token, sessionId: deps.sessionId ?? credential.sessionId ?? null };
     } catch (error) {
-      stderr.write(`bb-pw: ${error?.message ?? "agent session unavailable"}. ${error?.code === "client_key_required" ? "Run `bb login` then retry." : "Run `bb doctor --fix` then retry."}\n`);
-      return 3;
+      stderr.write(selfHealErrorLine(error)); return 3;
     }
   }
   const telemetry = deps.telemetry ?? (await import("./telemetry.mjs")).makeTelemetry({ env }); const host = deps.host ?? hostFor(env);
@@ -161,9 +211,17 @@ async function runPwInner(argv, deps = {}) {
   // allowed:false with NO errorCode and must never rotate the session (Codex round-5).
   if (!auth.allowed && !deps.coordinator && auth.errorCode != null && isRejectedCachedMcpSession({ auth: true, code: auth.errorCode }, managedCredential?.source, 0)) {
     await clearAgentState(deps.cwd ?? process.cwd());
-    const credential = await (deps.resolveCredential ?? resolveAgentSessionCredential)({ argv, env, cwd: deps.cwd ?? process.cwd() });
-    managedCredential = credential;
-    deps = { ...deps, sessionToken: credential.token, sessionId: credential.sessionId ?? deps.sessionId ?? null };
+    try {
+      const credential = await (deps.resolveCredential ?? resolveAgentSessionCredential)({ argv, env, cwd: deps.cwd ?? process.cwd(), sessionId: deps.sessionId ?? env.BOTBUDDY_SESSION_ID ?? null, flagToken: null });
+      managedCredential = credential;
+      // Keep an explicit --session-id holder authoritative over the freshly minted
+      // one, same precedence as the initial resolution (Codex).
+      deps = { ...deps, sessionToken: credential.token, sessionId: deps.sessionId ?? credential.sessionId ?? null };
+    } catch (error) {
+      // BOT-1682: the renewal after a revoked cache can also fail self-heal; fail
+      // closed with a clear message rather than letting the error escape to exit 1.
+      stderr.write(selfHealErrorLine(error)); return 3;
+    }
     auth = await gate({ env, host, lane: plan.lane, deps });
   }
   if (!auth.allowed) { stderr.write(`${auth.message}\n`); return 3; }