@botbuddy/cli 1.33.10 → 1.33.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.33.10",
+  "version": "1.33.11",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack.mjs

@@ -1264,10 +1264,25 @@ export function localProvision(opts, dockerTarget, execution, spawn = spawnSync,
   return conn;
 }
 
-/** LOUD local-exec fallback: tear the stack down in `stackDir`. Returns true iff it succeeded. */
-export function localTeardown(stackDir, dockerTarget, spawn = spawnSync, env = process.env) {
-  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — running ${bold("supabase stop")} in ${stackDir}.\n`);
-  const res = spawn("supabase", ["stop", "--workdir", stackDir], {
+/** Release dispositions `stack done` accepts (`--destroy` is the default, `--stop` keeps volumes). */
+export const STACK_DISPOSITIONS = Object.freeze(["destroy", "stop"]);
+
+/**
+ * LOUD local-exec fallback: tear the stack down in `stackDir`. Returns true iff it succeeded.
+ *
+ * BOT-1887: the teardown honours the lease's release `disposition`. `destroy` (the `done`
+ * default, and what the receipt reports) runs `supabase stop --no-backup`, which also deletes
+ * the project's data volumes (`supabase_db_/storage_/edge_runtime_<project_id>`); `--workdir`
+ * scopes that to the stack's own project_id, never `--all`. `stop` keeps the volumes for a
+ * cheap re-provision. An unknown disposition throws before Docker is touched.
+ */
+export function localTeardown(stackDir, dockerTarget, disposition, spawn = spawnSync, env = process.env) {
+  if (!STACK_DISPOSITIONS.includes(disposition)) {
+    throw new Error(`localTeardown: unknown disposition ${JSON.stringify(disposition)} (expected one of ${STACK_DISPOSITIONS.join(", ")})`);
+  }
+  const args = ["stop", "--workdir", stackDir, ...(disposition === "destroy" ? ["--no-backup"] : [])];
+  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — running ${bold(`supabase ${args.join(" ")}`)} (disposition ${disposition}).\n`);
+  const res = spawn("supabase", args, {
     encoding: "utf8",
     env: dockerEnvForTarget(dockerTarget, env),
   });
@@ -1608,7 +1623,14 @@ export async function cmdDone(leaseId, opts, {
   let dockerTarget = null;
   let legacyTargetProof = null;
   let teardownDir = process.cwd();
+  let leaseBefore = null;
   if (opts.localExec) {
+    // BOT-1887: the disposition picks the local teardown (destroy deletes the project's
+    // volumes); refuse an unknown one BEFORE the lease is released into `reaping`.
+    if (!STACK_DISPOSITIONS.includes(opts.disposition)) {
+      return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId,
+        error: `unknown disposition ${JSON.stringify(opts.disposition)} (expected one of ${STACK_DISPOSITIONS.join(", ")})` }), opts, EXIT.INVALID);
+    }
     const current = await call("get_stack_lease", { lease_id: leaseId });
     if (!current.ok || !current.data?.success) {
       return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId,
@@ -1618,6 +1640,7 @@ export async function cmdDone(leaseId, opts, {
     // BOT-1711: tear down in the directory the stack was PROVISIONED in (the lease's
     // recorded worktree_root/stack_path), not the invoking cwd — otherwise `supabase
     // stop` at the worktree root would stop the shared canonical stack.
+    leaseBefore = current.data;
     teardownDir = leaseStackDir(current.data);
     // BOT-1711 (Codex P1, R4): refuse local-exec teardown of ANY lease whose target is the
     // worktree root / default project — BEFORE branching on the persisted Docker target.
@@ -1706,13 +1729,46 @@ export async function cmdDone(leaseId, opts, {
   if (!r.ok) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, error: r.error }), opts, r.auth ? EXIT.AUTH : EXIT.BACKEND);
   if (!r.data.success) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, code: r.data.code, error: r.data.code }), opts, EXIT.BACKEND);
   let state = r.data.state;
+  // BOT-1887 (Codex #972 P1): a lease that is ALREADY reaping (an idle reap that
+  // established `stop`, or a retried `destroy`) keeps its in-flight teardown contract —
+  // `release_stack_lease` returns that established `reap_disposition` and ignores the
+  // requested one. Tear down (and report) by the established contract, never the flag,
+  // so a retry can neither delete volumes a `stop` meant to keep nor keep a `destroy`'s.
+  // Codex #972 R2 (P2): a lease that was ALREADY reaped answers `noop` with no
+  // reap_disposition — nothing was torn down by this call, so report the disposition it
+  // was actually reaped with (the lease row carries it), never the newly requested flag;
+  // unknown → null. A never-provisioned lease is terminalized as `destroy` server-side.
+  let established = r.data.reap_disposition;
+  const alreadyReaped = established == null && state === "reaped" && r.data.noop === true;
+  if (alreadyReaped) {
+    // Codex #972 R3: the pre-release read is only authoritative if it ALREADY saw the
+    // lease reaped — a Helper can finalize it between that read and the release. Otherwise
+    // re-read, and refuse to emit an unverifiable receipt if that read fails.
+    let stored = leaseBefore?.state === "reaped" ? leaseBefore : null;
+    if (!stored) {
+      const got = await call("get_stack_lease", { lease_id: leaseId });
+      stored = got.ok && got.data?.success ? got.data : null;
+      if (!stored) {
+        return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, state,
+          error: `the lease was already reaped but its reap disposition could not be read (${got.error || got.data?.code || "unreadable"}); nothing was torn down` }), opts, got.auth ? EXIT.AUTH : EXIT.BACKEND);
+      }
+    }
+    established = stored.reap_disposition ?? null;
+  } else if (established == null && r.data.never_provisioned === true) {
+    established = "destroy";
+  }
+  if (established != null && !STACK_DISPOSITIONS.includes(established)) {
+    return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, state,
+      error: `the lease's established reap disposition ${JSON.stringify(established)} is unknown — NOT tearing down; the slot stays fenced` }), opts, EXIT.BACKEND);
+  }
+  const disposition = alreadyReaped ? established : (established ?? opts.disposition);
   if (opts.localExec && state === "reaping") {
     // Only finalize once the stack is PROVABLY down. A failed `supabase stop` (Docker
     // unavailable, etc.) must NOT finalize — finalize frees the slot lock and promotes
     // the next queued lease, which would collide with containers still running on this
     // slot (Codex P1). Leave the lease in `reaping` (slot stays fenced) for a retry /
     // the reaper. Fail with a non-zero exit so the caller knows teardown is incomplete.
-    if (!localTeardownFn(teardownDir, dockerTarget)) {
+    if (!localTeardownFn(teardownDir, dockerTarget, disposition)) {
       return emitResult(buildReceipt({
         command: "done", outcome: "error", lease_id: leaseId, state,
         error: "local `supabase stop` failed — NOT finalizing; the slot stays fenced. Tear the stack down and re-run `stack done --local-exec`, or let the reaper reconcile.",
@@ -1722,7 +1778,7 @@ export async function cmdDone(leaseId, opts, {
     if (fin.ok && fin.data?.success) state = fin.data.state;
     else process.stderr.write(`${yellow("⚠")} stack: finalize failed (${fin.error || fin.data?.code}); the reaper will reconcile.\n`);
   }
-  return emitResult(buildReceipt({ command: "done", outcome: "released", lease_id: leaseId, state, disposition: opts.disposition,
+  return emitResult(buildReceipt({ command: "done", outcome: "released", lease_id: leaseId, state, disposition,
     ...(legacyTargetProof ? { legacy_target_proof: legacyTargetProof } : {}) }), opts, EXIT.OK);
 }