@botbuddy/cli 1.33.1 → 1.33.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.33.1",
+  "version": "1.33.3",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack.mjs

@@ -713,6 +713,20 @@ async function registerLeaseWait(leaseId, timeoutSec, auth, signal, fetchImpl =
   return { waitSessionId: body.wait_session_id ?? null, cursorStart: body.cursor_start ?? null };
 }
 
+// BOT-1827: the abort reason is always one of these four explicit strings —
+// branch on the reason itself rather than inferring "anything but interrupted
+// is a timeout". "matched"/"failed" are only ever set AFTER the SSE loop has
+// already been left via `break` (never from inside the `for await`), so the
+// controller's own teardown can never race a `{ woke: true }` / `{ failed: true }`
+// return the way it did when `ac.abort()` was called before returning from
+// inside the loop.
+function resultForAbortReason(reason) {
+  if (reason === "interrupted") return { result: { interrupted: true }, status: "error" };
+  // "timeout", or any other/unset reason (e.g. an externally-triggered AbortError
+  // with no reason attached) — defensively treated the same as a real deadline.
+  return { result: { timeout: true }, status: "timeout" };
+}
+
 /**
  * Zero-poll wait for `lease:<leaseId>` to reach a state satisfying `isDone(state)`.
  * Registers a wait_session (visible on /waits), then blocks on the event-stream SSE.
@@ -751,11 +765,17 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
     }
     return result;
   };
-  if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
+  if (ac.signal.aborted) {
+    const { result, status } = resultForAbortReason(ac.signal.reason);
+    return finish(result, status);
+  }
   try {
     ({ cursorStart, waitSessionId } = await registerLeaseWait(leaseId, Math.max(0, Math.ceil((absoluteDeadlineMs - Date.now()) / 1000)), auth, ac.signal, fetchImpl));
   } catch (err) {
-    if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
+    if (ac.signal.aborted) {
+      const { result, status } = resultForAbortReason(ac.signal.reason);
+      return finish(result, status);
+    }
     process.stderr.write(`${yellow("⚠")} stack: wait registration failed (${err?.message ?? err}); the lease will not appear on /waits — parking live-only.\n`);
   }
   const url = new URL(eventStreamBase());
@@ -767,15 +787,27 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
   try {
     res = await fetchImpl(url, { headers: { ...relayAuthHeaders(auth), Accept: "text/event-stream", "Accept-Encoding": "identity" }, signal: ac.signal });
   } catch (err) {
-    if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
+    if (ac.signal.aborted) {
+      const { result, status } = resultForAbortReason(ac.signal.reason);
+      return finish(result, status);
+    }
     return finish({ error: `sse connect: ${err?.message ?? err}` }, "error");
   }
   if (res.status === 401 || res.status === 403) return finish({ auth: true }, "error");
   if (!res.ok || !res.body) return finish({ error: `sse responded ${res.status}` }, "error");
   const decoder = new TextDecoder();
   let buf = "";
+  // BOT-1827: record a match/failure locally and `break` out of BOTH loops
+  // without touching `ac`/`abort()` from inside the `for await`. Aborting the
+  // controller while it is still the signal driving the body iterator makes
+  // the implicit IteratorClose (triggered by `break`/`return`) reject with an
+  // AbortError, which used to land in the `catch` below and override the
+  // already-decided `{ woke: true }` / `{ failed: true }` result with a
+  // `{ timeout: true }` — finalizing the wait session twice. Deciding first,
+  // aborting only AFTER the loop has been left cleanly, removes the race.
+  let decided = null;
   try {
-    for await (const chunk of res.body) {
+    frameLoop: for await (const chunk of res.body) {
       buf += decoder.decode(chunk, { stream: true });
       const { frames, rest } = parseSseFrames(buf);
       buf = rest;
@@ -784,13 +816,26 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
         try { sig = JSON.parse(f.data); } catch { continue; }
         if (sig.signal_type !== "stack_lease" || sig.subject_key !== `lease:${leaseId}`) continue;
         const st = sig.payload?.state ?? null;
-        if (isFailed(st)) { ac.abort(); return finish({ failed: true, state: st }, "error"); }
-        if (isDone(st)) { ac.abort(); return finish({ woke: true, state: st }, "matched"); }
+        if (isFailed(st)) { decided = { reason: "failed", result: { failed: true, state: st }, status: "error" }; break frameLoop; }
+        if (isDone(st)) { decided = { reason: "matched", result: { woke: true, state: st }, status: "matched" }; break frameLoop; }
       }
     }
   } catch (err) {
-    if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
-    return finish({ error: `sse stream: ${err?.message ?? err}` }, "error");
+    // A decided result always wins over a teardown error surfaced by leaving
+    // the loop (e.g. the body iterator's `return()` rejecting during
+    // cleanup) — fall through to the `decided` handling below instead of
+    // reporting the teardown failure.
+    if (!decided) {
+      if (ac.signal.aborted) {
+        const { result, status } = resultForAbortReason(ac.signal.reason);
+        return finish(result, status);
+      }
+      return finish({ error: `sse stream: ${err?.message ?? err}` }, "error");
+    }
+  }
+  if (decided) {
+    ac.abort(decided.reason);
+    return finish(decided.result, decided.status);
   }
   // A clean relay EOF is not a timeout: the server intentionally closes on
   // scope changes and proxies can recycle idle streams. Re-arm from a fresh
@@ -805,7 +850,13 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
 
 const isActive = (s) => s === "active";
 const nonQueued = (s) => s != null && s !== "queued";
-const isReaped = (s) => s === "reaping" || s === "reaped";
+// BOT-1822 (Codex round 3 P2): `reap_failed` is a distinct terminal wake
+// (accept_stack_lease_receipt's fenced-reap-failure branch) alongside the real
+// DB states "reaping"/"reaped" — a wait parked on isReaped as its failure
+// predicate must end on it too, or a `reap_failed` wake that arrives while
+// still waiting for activation is silently dropped and the wait parks until
+// its full timeout instead of surfacing the failure immediately.
+const isReaped = (s) => s === "reaping" || s === "reaped" || s === "reap_failed";
 
 /** Read-only pressure gate used before local managed-stack provisioning. */
 export async function runLocalExecPreflight(opts, runCommand = runDockerCommand) {
@@ -1833,8 +1884,46 @@ export async function runStackLifecycle(opts, childArgv, adapters = {}) {
       return cleanupResult = { ok: false, error: release?.error || release?.data?.code || "release failed" };
     }
     if (release.data.state === "reaped") return cleanupResult = { ok: true, state: "reaped" };
-    const reaped = await wait(leaseId, (state) => state === "reaped", () => false, { timeoutSec: opts.reapTimeout, auth: rpc.auth });
+    // BOT-1822 (Codex P2 round 2, extended round 3): `reap_failed` is synthetic
+    // (never a real DB state), so a Helper's failed receipt landing in the split
+    // second between this release RPC returning and the wait below registering
+    // cannot be replayed from the spine's initial snapshot the way every other
+    // signal type can — the wake is already behind the cursor, and the initial
+    // snapshot only surfaces the durable `reaping` state, which neither
+    // predicate accepts. Recover the durable failure reason directly:
+    // `stack_leases.error` (which `get_stack_lease` already returns) holds the
+    // most recent failure message regardless of which live signal was or
+    // wasn't seen.
+    const durableReapFailure = (read) => (read?.ok && read.data?.success && read.data.state === "reaping" && read.data.error)
+      ? { ok: false, error: `the lease is still reaping and may still hold containers — ${read.data.error}` }
+      : null;
+    // BOT-1822 (Codex round 3 P2): check BEFORE opening the wait, not only after
+    // it times out — a failure already persisted must be reported at once
+    // instead of burning the entire --reap-timeout waiting for a wake that will
+    // never arrive because it predates the wait's registration.
+    const preCheck = durableReapFailure(await api.get(leaseId));
+    if (preCheck) return cleanupResult = preCheck;
+    // BOT-1822 (Codex P2): a signed reap that FAILS on a provisioned (fenced) lease
+    // emits `state: "reap_failed"` — a distinct terminal outcome, never a real DB
+    // state — instead of leaving this wait to park until --reap-timeout on a reap
+    // that already failed. Report that specific outcome instead of the generic
+    // "was not proven" timeout message.
+    const reaped = await wait(leaseId, (state) => state === "reaped", (state) => state === "reap_failed", { timeoutSec: opts.reapTimeout, auth: rpc.auth });
     if (reaped?.woke || reaped?.state === "reaped") return cleanupResult = { ok: true, state: "reaped" };
+    if (reaped?.failed) return cleanupResult = { ok: false, error: "the signed reap failed and the lease may still hold containers (fenced) — see stack hygiene" };
+    // Belt-and-braces: the same race can still slip between the pre-check above
+    // and the wait registering (or the wait's own live-signal miss), so recheck
+    // once more before falling back to a generic timeout/error message. Mirrors
+    // the provision wait's BOT-1822 recheck (which only ever needed to confirm
+    // failure), but the reap wait can miss EITHER terminal outcome the same
+    // way — BOT-1827 (lease 239af20d): the reap genuinely completed (server
+    // `reaped` live emit) while the zero-poll wait still reported `{ timeout }`,
+    // so a healthy stack was reported as a hard failure. One direct read tells
+    // a real timeout apart from a missed wake in either direction.
+    const recheck = await api.get(leaseId);
+    if (recheck?.ok && recheck.data?.success && recheck.data.state === "reaped") return cleanupResult = { ok: true, state: "reaped" };
+    const postCheck = durableReapFailure(recheck);
+    if (postCheck) return cleanupResult = postCheck;
     return cleanupResult = { ok: false, error: reaped?.timeout ? `signed reap did not arrive within ${opts.reapTimeout}s` : (reaped?.error || "signed reap was not proven") };
     })();
     return cleanupPromise;
@@ -1944,11 +2033,29 @@ export async function runStackLifecycle(opts, childArgv, adapters = {}) {
     }
     if (state !== "active") {
       activeWaitAbort = new AbortController();
-      const active = await wait(leaseId, (s) => s === "active", (s) => s === "reaped", { timeoutSec: provisionTimeout, auth: rpc.auth, signal: activeWaitAbort.signal });
+      // BOT-1822 (Codex P2 round 2): a provision failure now emits a live
+      // `reaping` signal (accept_stack_lease_receipt's provision-failed branch),
+      // so this wait must treat it as terminal too — not just `reaped` — or the
+      // live-wake fix is defeated: the run would still burn the FULL
+      // provisionTimeout before the belt-and-braces recheck below ever notices
+      // the lease is no longer provisioning. isReaped (== "reaping" || "reaped")
+      // already covers both; cmdUp's equivalent waits use it for this reason.
+      const active = await wait(leaseId, (s) => s === "active", isReaped, { timeoutSec: provisionTimeout, auth: rpc.auth, signal: activeWaitAbort.signal });
       activeWaitAbort = null;
       if (active?.interrupted || receivedSignal) { const cleanup = await requestCleanup(); return { exitCode: SIGNAL_EXIT[receivedSignal], outcome: "interrupted", leaseId, cleanup }; }
-      if (active?.timeout) { const cleanup = await requestCleanup(); return { exitCode: EXIT.TIMEOUT, outcome: "timeout", leaseId, error: `physical provision did not reach active in ${provisionTimeout}s`, cleanup }; }
-      if (active?.failed || active?.error || active?.auth) { const cleanup = await requestCleanup(); return { exitCode: active?.auth ? EXIT.AUTH : EXIT.LEASE_FAILED, outcome: "error", leaseId, error: active?.error || "lease was reaped before active", cleanup }; }
+      if (active?.timeout) {
+        // BOT-1822 belt-and-braces: the zero-poll wait can still miss a live
+        // `stack_lease` signal (an older server before this fix, a relay hiccup,
+        // BOT-1816's class of dropped wakes) even though the lease genuinely went
+        // active. One direct read before declaring a timeout tells that apart from
+        // a lease that truly never provisioned, instead of reaping a healthy stack.
+        const recheck = await api.get(leaseId);
+        if (!(recheck?.ok && recheck.data?.success && recheck.data.state === "active")) {
+          const cleanup = await requestCleanup();
+          return { exitCode: EXIT.TIMEOUT, outcome: "timeout", leaseId, error: `physical provision did not reach active in ${provisionTimeout}s`, cleanup };
+        }
+      }
+      if (active?.failed || active?.error || active?.auth) { const cleanup = await requestCleanup(); return { exitCode: active?.auth ? EXIT.AUTH : EXIT.LEASE_FAILED, outcome: "error", leaseId, error: active?.error || `lease ${active?.state ?? "failed"} before reaching active`, cleanup }; }
     }
     const current = await api.get(leaseId);
     if (!current?.ok || !current.data?.success || current.data.state !== "active" || !current.data.connection || typeof current.data.connection !== "object") {