@botbuddy/cli 1.33.2 → 1.33.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.33.2",
+  "version": "1.33.4",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack-isolation.mjs

@@ -22,7 +22,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { cpSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
-import { basename, join } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
 import { lockPathForProject, projectIdFromConfig } from "./stack-file-lock.mjs";
 
 /** Where materialized leased stacks live inside the worktree (gitignored). */
@@ -871,6 +871,202 @@ function prune(stackSupabaseDir, { readdir, remove }) {
   }
 }
 
+// ── BOT-1828: functions that import a file outside supabase/ ───────────────
+//
+// Supply Guard's `supabase/functions/admin-api-keys/index.ts` imports
+// `../../../src/lib/platformApiKeysCatalog.ts` — outside `supabase/`, so the whole-tree
+// copy above never brings it along. The Supabase CLI resolves function imports when it
+// STARTS the edge runtime, so `supabase start` inside the isolated stack fails deep
+// inside the Helper with a raw ENOENT. This is a dependency-free regex walk over
+// `import …/export …/from "…"` and dynamic `import("…")` string literals — not a real
+// module resolver (the published CLI is Node-stdlib only) — so it can miss an exotic
+// re-export form, but every specifier it DOES find is resolved for real (existence +
+// worktree-containment) before anything is trusted.
+const ESCAPING_IMPORT_SCAN_EXTENSIONS = [".ts", ".js", ".mjs"];
+const ESCAPING_IMPORT_MANIFEST_NAMES = ["import_map.json", "deno.json"];
+const SUPABASE_DIR_PREFIX = `supabase${sep}`;
+
+const IMPORT_SPECIFIER_PATTERNS = [
+  // `import … from "…"` / `export … from "…"` (default, named, namespace, type-only).
+  /\b(?:import|export)\b[^'";]*?\bfrom\s*["']([^"']+)["']/g,
+  // dynamic `import("…")`.
+  /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g,
+  // bare side-effecting `import "…"` (no `from` clause).
+  /^[ \t]*import\s*["']([^"']+)["']\s*;?/gm,
+];
+
+/** Strip comments before scanning for import specifiers (Codex #946 R1 P2): a
+ * `// import { old } from "../../../removed.ts"` note (or block comment) is not a
+ * live dependency, but the plain regex above has no idea — treating it as one turns
+ * a stale comment into a hard refusal of the whole stack. Block comments are removed
+ * outright; `//` line comments are stripped with a quote-aware per-character scan so
+ * a real specifier like `"https://deno.land/std/foo.ts"` (a `//` INSIDE a string) is
+ * never mistaken for a comment. Not a real tokenizer — a `/*`/`//` inside a template
+ * literal can still confuse it — but it closes the concrete failure mode a bare
+ * comment caused, which is what actually shipped in real function source. */
+function stripComments(source) {
+  const noBlockComments = source.replace(/\/\*[\s\S]*?\*\//g, "");
+  return noBlockComments
+    .split("\n")
+    .map((line) => {
+      let inString = null;
+      for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (inString) {
+          if (ch === "\\") { i++; continue; }
+          if (ch === inString) inString = null;
+          continue;
+        }
+        if (ch === '"' || ch === "'" || ch === "`") { inString = ch; continue; }
+        if (ch === "/" && line[i + 1] === "/") return line.slice(0, i);
+      }
+      return line;
+    })
+    .join("\n");
+}
+
+/** Every string-literal specifier this source imports or re-exports, deduped. */
+function extractImportSpecifiers(source) {
+  const specifiers = new Set();
+  const clean = stripComments(source);
+  for (const pattern of IMPORT_SPECIFIER_PATTERNS) {
+    pattern.lastIndex = 0;
+    let match;
+    while ((match = pattern.exec(clean)) !== null) specifiers.add(match[1]);
+  }
+  return specifiers;
+}
+
+function isRelativeSpecifier(specifier) {
+  return specifier.startsWith("./") || specifier.startsWith("../");
+}
+
+/** Recursively list files under `dir` (absolute) whose name matches one of `names`
+ * (exact basenames, e.g. "deno.json") or ends with one of `exts` (e.g. ".ts") — via
+ * the same low-level readdir/stat the rest of the materializer uses, so a
+ * fault-injecting test still exercises this path. A missing `dir` has nothing to scan. */
+function listMatchingFiles(dir, { exts = [], names = [] }, { readdir, stat }) {
+  const out = [];
+  const pending = [dir];
+  while (pending.length) {
+    const current = pending.pop();
+    let entries;
+    try { entries = readdir(current); } catch { continue; }
+    for (const entry of entries) {
+      const full = join(current, entry);
+      let info;
+      try { info = stat(full); } catch { continue; }
+      if (info.isDirectory()) { pending.push(full); continue; }
+      if (names.includes(entry) || exts.some((ext) => entry.endsWith(ext))) out.push(full);
+    }
+  }
+  return out;
+}
+
+/**
+ * Scan `supabase/functions/**` (source files plus `import_map.json`/`deno.json`
+ * "imports" entries) for RELATIVE specifiers that resolve outside `supabase/`, copy
+ * each into the stack directory at the identical worktree-relative path, and follow
+ * relative imports of the COPIED files transitively. Refuses loudly — before this
+ * call copies anything — if a specifier resolves outside the worktree root or to a
+ * file that does not exist, naming the importing file and the specifier. Returns the
+ * sorted list of worktree-relative paths copied (possibly empty).
+ */
+function copyEscapingImports(worktreeRoot, stackDir, { read, mkdir, copy, readdir, stat, realpath }) {
+  const functionsDir = join(worktreeRoot, "supabase", "functions");
+  const visited = new Set(); // worktree-relative paths already queued or copied
+  const queue = [];
+
+  const resolveSpecifier = (specifier, importingAbsDir, importingRelPath) => {
+    // Lexical: `join` collapses `..`/`.` as STRINGS but never follows a symlinked
+    // directory component. fs reads/copies below follow symlinks transparently, so
+    // this is a perfectly usable path for existence/content — and, per Codex #946
+    // R1 P2, it is the path an import specifier reads relative to the COPIED file's
+    // own on-disk location once materialized, so it is what the destination and any
+    // further relative-import resolution must use too.
+    const candidate = join(importingAbsDir, specifier);
+    let real;
+    try {
+      real = realpath(candidate);
+    } catch (error) {
+      throw new Error(
+        `refusing to materialize an isolated leased stack: ${importingRelPath} imports "${specifier}", which does not exist ` +
+          `(resolved to ${candidate}${error?.code ? `: ${error.code}` : ""}). Fix the import or add the missing file.`,
+      );
+    }
+    // Security containment uses the REAL, symlink-resolved location: a symlink
+    // whose TARGET is outside the worktree must be refused even when its own
+    // lexical path looks like it stays inside.
+    const realRel = relative(worktreeRoot, real);
+    if (realRel === ".." || realRel.startsWith(`..${sep}`) || isAbsolute(realRel)) {
+      throw new Error(
+        `refusing to materialize an isolated leased stack: ${importingRelPath} imports "${specifier}", which resolves to ` +
+          `${real} — outside the worktree root ${worktreeRoot}. Move the file into the worktree, or fix the import.`,
+      );
+    }
+    // The DESTINATION (and this file's own identity in `visited`/`queue`) mirrors
+    // the LEXICAL candidate, not `real`: copying to `real`'s location would place
+    // the file somewhere the unmodified import specifier never names, and the
+    // materialized stack would fail with the same missing-file error this ticket
+    // exists to fix (Codex #946 R1 P2).
+    const rel = relative(worktreeRoot, candidate);
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+      throw new Error(
+        `refusing to materialize an isolated leased stack: ${importingRelPath} imports "${specifier}", which resolves to ` +
+          `${candidate} — outside the worktree root ${worktreeRoot}. Move the file into the worktree, or fix the import.`,
+      );
+    }
+    if (rel === "supabase" || rel.startsWith(SUPABASE_DIR_PREFIX)) return; // already copied whole
+    if (visited.has(rel)) return;
+    visited.add(rel);
+    queue.push({ absPath: candidate, relPath: rel });
+  };
+
+  const scanForImports = (absPath, relPath) => {
+    let source;
+    try { source = read(absPath, "utf8"); } catch { return; }
+    for (const specifier of extractImportSpecifiers(source)) {
+      if (isRelativeSpecifier(specifier)) resolveSpecifier(specifier, dirname(absPath), relPath);
+    }
+  };
+
+  for (const file of listMatchingFiles(functionsDir, { exts: ESCAPING_IMPORT_SCAN_EXTENSIONS }, { readdir, stat })) {
+    scanForImports(file, relative(worktreeRoot, file));
+  }
+  for (const file of listMatchingFiles(functionsDir, { names: ESCAPING_IMPORT_MANIFEST_NAMES }, { readdir, stat })) {
+    let parsed;
+    try { parsed = JSON.parse(read(file, "utf8")); } catch { continue; }
+    const imports = parsed?.imports;
+    if (!imports || typeof imports !== "object") continue;
+    const relPath = relative(worktreeRoot, file);
+    for (const specifier of Object.values(imports)) {
+      if (typeof specifier === "string" && isRelativeSpecifier(specifier)) {
+        resolveSpecifier(specifier, dirname(file), relPath);
+      }
+    }
+  }
+
+  const extraFiles = [];
+  while (queue.length) {
+    const item = queue.shift();
+    const dest = join(stackDir, item.relPath);
+    mkdir(dirname(dest), { recursive: true });
+    // An import-map "imports" entry may be a PREFIX mapping to a directory (e.g.
+    // `"@lib/": "../../../src/lib/"`, valid Deno import-map syntax) rather than a
+    // single file — cpSync without `recursive` throws ERR_FS_EISDIR on that (Codex
+    // #946 R1 P1). Copy the whole directory in that case; there is no single file
+    // whose text to scan for further imports.
+    let isDir = false;
+    try { isDir = stat(item.absPath).isDirectory(); } catch { /* copy() will report it */ }
+    copy(item.absPath, dest, isDir ? { recursive: true, force: true } : { force: true });
+    extraFiles.push(item.relPath);
+    if (!isDir && ESCAPING_IMPORT_SCAN_EXTENSIONS.some((ext) => item.relPath.endsWith(ext))) {
+      scanForImports(item.absPath, item.relPath);
+    }
+  }
+  return extraFiles.sort();
+}
+
 /**
  * Materialize (or refresh) the isolated stack directory for this run and return
  * its path RELATIVE to the worktree root — never `"."`. The directory belongs to
@@ -941,7 +1137,7 @@ export function materializeRunStackDir(cwd, { slot, ticket, nonce, idleTtlSecs }
   // stable per-slot one, so the project id is exactly as specific (and keeps a
   // refresh idempotent).
   const invocationToken = nonce ? String(nonce) : identity.projectId;
-  const marker = (portBase) => JSON.stringify({
+  const marker = (portBase, extraFiles = []) => JSON.stringify({
     schema: 1,
     project_id: identity.projectId,
     invocation_token: invocationToken,
@@ -953,6 +1149,10 @@ export function materializeRunStackDir(cwd, { slot, ticket, nonce, idleTtlSecs }
     retain_until: createdAt + Math.max(LEASED_STACK_GC_MIN_AGE_MS, ttlMs + LEASED_STACK_RETENTION_GRACE_MS),
     owner_pid: process.pid,
     host: host(),
+    // BOT-1828: worktree-relative paths copied because an edge function imports
+    // outside supabase/ — recorded so an operator can see why this stack dir has
+    // (e.g.) a src/ directory, instead of guessing at a `supabase start` failure.
+    extra_files: extraFiles,
   });
   const registryDir = io.portRegistryDir ?? defaultPortRegistryDir();
   const writeExclusive = io.writeExclusive ?? ((path, data) => writeFileSync(path, data, { flag: "wx" }));
@@ -1016,11 +1216,18 @@ export function materializeRunStackDir(cwd, { slot, ticket, nonce, idleTtlSecs }
       filter: (source) => !SKIP_ENTRIES.has(basename(source)),
     });
     write(join(stackDir, "supabase", "config.toml"), text);
+
+    // BOT-1828: bring along any file an edge function imports OUTSIDE supabase/
+    // (Supply Guard's admin-api-keys/index.ts pulls in ../../../src/lib/…) —
+    // `supabase start` resolves function imports when it starts the edge runtime, so
+    // without this the Helper fails deep inside `supabase start` with a raw ENOENT.
+    const extraFiles = copyEscapingImports(worktreeRoot, stackDir, { read, mkdir, copy, readdir, stat, realpath: resolveRoot });
+
   // Re-state the claim after the copy: the marker records who owns this directory,
   // which port block it holds, and how long a later run must keep it (Codex #928
   // R7/R12). It lives beside `supabase/`, which the refresh replaces wholesale.
-    atomicWrite(join(stackDir, LEASED_STACK_MARKER), marker(portBase), { write, rename });
-    atomicWrite(portClaimPath(registryDir, portBase), marker(portBase), { write, rename });
+    atomicWrite(join(stackDir, LEASED_STACK_MARKER), marker(portBase, extraFiles), { write, rename });
+    atomicWrite(portClaimPath(registryDir, portBase), marker(portBase, extraFiles), { write, rename });
     return stackPath;
   } catch (error) {
     try { remove(portClaimPath(registryDir, portBase), { force: true }); } catch { /* best effort */ }

package/src/stack.mjs

@@ -713,6 +713,20 @@ async function registerLeaseWait(leaseId, timeoutSec, auth, signal, fetchImpl =
   return { waitSessionId: body.wait_session_id ?? null, cursorStart: body.cursor_start ?? null };
 }
 
+// BOT-1827: the abort reason is always one of these four explicit strings —
+// branch on the reason itself rather than inferring "anything but interrupted
+// is a timeout". "matched"/"failed" are only ever set AFTER the SSE loop has
+// already been left via `break` (never from inside the `for await`), so the
+// controller's own teardown can never race a `{ woke: true }` / `{ failed: true }`
+// return the way it did when `ac.abort()` was called before returning from
+// inside the loop.
+function resultForAbortReason(reason) {
+  if (reason === "interrupted") return { result: { interrupted: true }, status: "error" };
+  // "timeout", or any other/unset reason (e.g. an externally-triggered AbortError
+  // with no reason attached) — defensively treated the same as a real deadline.
+  return { result: { timeout: true }, status: "timeout" };
+}
+
 /**
  * Zero-poll wait for `lease:<leaseId>` to reach a state satisfying `isDone(state)`.
  * Registers a wait_session (visible on /waits), then blocks on the event-stream SSE.
@@ -751,11 +765,17 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
     }
     return result;
   };
-  if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
+  if (ac.signal.aborted) {
+    const { result, status } = resultForAbortReason(ac.signal.reason);
+    return finish(result, status);
+  }
   try {
     ({ cursorStart, waitSessionId } = await registerLeaseWait(leaseId, Math.max(0, Math.ceil((absoluteDeadlineMs - Date.now()) / 1000)), auth, ac.signal, fetchImpl));
   } catch (err) {
-    if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
+    if (ac.signal.aborted) {
+      const { result, status } = resultForAbortReason(ac.signal.reason);
+      return finish(result, status);
+    }
     process.stderr.write(`${yellow("⚠")} stack: wait registration failed (${err?.message ?? err}); the lease will not appear on /waits — parking live-only.\n`);
   }
   const url = new URL(eventStreamBase());
@@ -767,15 +787,27 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
   try {
     res = await fetchImpl(url, { headers: { ...relayAuthHeaders(auth), Accept: "text/event-stream", "Accept-Encoding": "identity" }, signal: ac.signal });
   } catch (err) {
-    if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
+    if (ac.signal.aborted) {
+      const { result, status } = resultForAbortReason(ac.signal.reason);
+      return finish(result, status);
+    }
     return finish({ error: `sse connect: ${err?.message ?? err}` }, "error");
   }
   if (res.status === 401 || res.status === 403) return finish({ auth: true }, "error");
   if (!res.ok || !res.body) return finish({ error: `sse responded ${res.status}` }, "error");
   const decoder = new TextDecoder();
   let buf = "";
+  // BOT-1827: record a match/failure locally and `break` out of BOTH loops
+  // without touching `ac`/`abort()` from inside the `for await`. Aborting the
+  // controller while it is still the signal driving the body iterator makes
+  // the implicit IteratorClose (triggered by `break`/`return`) reject with an
+  // AbortError, which used to land in the `catch` below and override the
+  // already-decided `{ woke: true }` / `{ failed: true }` result with a
+  // `{ timeout: true }` — finalizing the wait session twice. Deciding first,
+  // aborting only AFTER the loop has been left cleanly, removes the race.
+  let decided = null;
   try {
-    for await (const chunk of res.body) {
+    frameLoop: for await (const chunk of res.body) {
       buf += decoder.decode(chunk, { stream: true });
       const { frames, rest } = parseSseFrames(buf);
       buf = rest;
@@ -784,13 +816,26 @@ export async function waitForLease(leaseId, isDone, isFailed, { timeoutSec, auth
         try { sig = JSON.parse(f.data); } catch { continue; }
         if (sig.signal_type !== "stack_lease" || sig.subject_key !== `lease:${leaseId}`) continue;
         const st = sig.payload?.state ?? null;
-        if (isFailed(st)) { ac.abort(); return finish({ failed: true, state: st }, "error"); }
-        if (isDone(st)) { ac.abort(); return finish({ woke: true, state: st }, "matched"); }
+        if (isFailed(st)) { decided = { reason: "failed", result: { failed: true, state: st }, status: "error" }; break frameLoop; }
+        if (isDone(st)) { decided = { reason: "matched", result: { woke: true, state: st }, status: "matched" }; break frameLoop; }
       }
     }
   } catch (err) {
-    if (ac.signal.aborted) return finish(ac.signal.reason === "interrupted" ? { interrupted: true } : { timeout: true }, ac.signal.reason === "interrupted" ? "error" : "timeout");
-    return finish({ error: `sse stream: ${err?.message ?? err}` }, "error");
+    // A decided result always wins over a teardown error surfaced by leaving
+    // the loop (e.g. the body iterator's `return()` rejecting during
+    // cleanup) — fall through to the `decided` handling below instead of
+    // reporting the teardown failure.
+    if (!decided) {
+      if (ac.signal.aborted) {
+        const { result, status } = resultForAbortReason(ac.signal.reason);
+        return finish(result, status);
+      }
+      return finish({ error: `sse stream: ${err?.message ?? err}` }, "error");
+    }
+  }
+  if (decided) {
+    ac.abort(decided.reason);
+    return finish(decided.result, decided.status);
   }
   // A clean relay EOF is not a timeout: the server intentionally closes on
   // scope changes and proxies can recycle idle streams. Re-arm from a fresh
@@ -1868,8 +1913,16 @@ export async function runStackLifecycle(opts, childArgv, adapters = {}) {
     if (reaped?.failed) return cleanupResult = { ok: false, error: "the signed reap failed and the lease may still hold containers (fenced) — see stack hygiene" };
     // Belt-and-braces: the same race can still slip between the pre-check above
     // and the wait registering (or the wait's own live-signal miss), so recheck
-    // once more before falling back to a generic timeout/error message.
-    const postCheck = durableReapFailure(await api.get(leaseId));
+    // once more before falling back to a generic timeout/error message. Mirrors
+    // the provision wait's BOT-1822 recheck (which only ever needed to confirm
+    // failure), but the reap wait can miss EITHER terminal outcome the same
+    // way — BOT-1827 (lease 239af20d): the reap genuinely completed (server
+    // `reaped` live emit) while the zero-poll wait still reported `{ timeout }`,
+    // so a healthy stack was reported as a hard failure. One direct read tells
+    // a real timeout apart from a missed wake in either direction.
+    const recheck = await api.get(leaseId);
+    if (recheck?.ok && recheck.data?.success && recheck.data.state === "reaped") return cleanupResult = { ok: true, state: "reaped" };
+    const postCheck = durableReapFailure(recheck);
     if (postCheck) return cleanupResult = postCheck;
     return cleanupResult = { ok: false, error: reaped?.timeout ? `signed reap did not arrive within ${opts.reapTimeout}s` : (reaped?.error || "signed reap was not proven") };
     })();