@botbuddy/cli 1.33.9 → 1.33.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.33.9",
+  "version": "1.33.10",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-doctor.mjs

@@ -67,7 +67,13 @@ function prerequisiteRecovery(report) {
  * credential-store failure must point at unlocking the store — not `bb login` or a
  * binding repair — matching prerequisiteRecovery's wording.
  */
-function repairFailureRecovery(code) {
+function repairFailureRecovery(code, error = null) {
+  // BOT-1891: a tier-2 MCP key the server rejected (revoked/rotated) is replaced by
+  // minting a new one and re-delivering it — not by `bb login`, which a Background
+  // job cannot run anyway. Name the variable, never the value.
+  if (code === "session_mint_unauthorized" && error?.mintedWith === "mcp_key") {
+    return `the tier-2 MCP key in ${error.mcpEnv ?? "the binding's mcp_env"} was rejected (revoked?); mint a new one, store it in Keychain under that name, then re-run \`bash scripts/install-stack-canary.sh\` (or re-export it) and \`bb doctor --fix\``;
+  }
   if (code === "client_key_unavailable") {
     return "the client key could not be read (locked or failing credential store); unlock it, then run `bb doctor --fix`";
   }
@@ -120,11 +126,17 @@ export async function doctorAgentAuth({
   ]);
   try { owner = await ownerToken(); } catch { ownerReadFailed = true; }
   const fresh = Boolean(state && isFresh(state, new Date()));
+  // BOT-1891: whether the binding's tier-2 MCP key is in THIS process's env — the
+  // self-heal fallback when the owner token is unreachable (a Background
+  // LaunchAgent). Env only, exactly like selfHealAgentSession; never the value.
+  const mcpEnv = typeof bound?.mcpEnv === "string" && bound.mcpEnv ? bound.mcpEnv : null;
+  const mcpKeyInEnv = Boolean(mcpEnv && typeof env?.[mcpEnv] === "string" && env[mcpEnv]);
   const report = {
     schema_version: 1,
     worktree: cwd,
     binding: bound?.tenant ? { status: "available", tenant: bound.tenant } : { status: "missing" },
     client_key: clientKeyStatus(owner, now(), ownerReadFailed),
+    ...(mcpEnv ? { mcp_key: { env: mcpEnv, in_env: mcpKeyInEnv } } : {}),
     session: fresh
       ? { status: "fresh", agent_id: state.agent_id, session_id: state.session_id, expires_at: state.expires_at }
       : { status: state ? "stale" : "missing" },
@@ -147,14 +159,28 @@ export async function doctorAgentAuth({
   // `bb doctor --fix` (the remedy the stack refusal points at) would reuse a fresh but
   // never-attested session and never re-establish the capability. `force` makes the
   // self-heal run a registration/attestation round regardless of cache freshness.
-  if (fix && report.binding.status === "available" && report.client_key.status === "available") {
+  // BOT-1891: an UNREADABLE client key (a Background LaunchAgent cannot reach the
+  // login Keychain) is repairable when the binding's tier-2 MCP key is in the env —
+  // selfHeal mints with it. A missing or expired key keeps its `bb login` verdict.
+  const mintCredentialAvailable = report.client_key.status === "available"
+    || (mcpKeyInEnv && report.client_key.status === "unavailable");
+  if (fix && report.binding.status === "available" && mintCredentialAvailable) {
     try {
       credential = await selfHeal({ cwd, env, force: true });
-      report.session = { status: credential.source === "minted" ? "minted" : credential.source, agent_id: credential.agentId ?? null, session_id: credential.sessionId ?? null };
+      report.session = {
+        status: credential.source === "minted" ? "minted" : credential.source,
+        agent_id: credential.agentId ?? null,
+        session_id: credential.sessionId ?? null,
+        ...(credential.mintedWith ? { minted_with: credential.mintedWith } : {}),
+      };
       applyStackLeaseCapability(report, credential.stackLeaseCapability);
     } catch (error) {
-      report.session = { status: "repair_failed", error: error?.code ?? "agent_session_unavailable" };
-      report.recovery = repairFailureRecovery(error?.code);
+      report.session = {
+        status: "repair_failed",
+        error: error?.code ?? "agent_session_unavailable",
+        ...(error?.mintedWith ? { minted_with: error.mintedWith } : {}),
+      };
+      report.recovery = repairFailureRecovery(error?.code, error);
       return { exitCode: 3, report, exports: null };
     }
   }
@@ -173,7 +199,7 @@ export async function doctorAgentAuth({
   // cached session left `credential` populated, report THAT prerequisite — not the
   // Helper/capability message below, since registration never ran and the real remedy
   // is `bb login` or restoring the binding.
-  if (fix && (report.binding.status !== "available" || report.client_key.status !== "available")) {
+  if (fix && (report.binding.status !== "available" || !mintCredentialAvailable)) {
     report.recovery = prerequisiteRecovery(report) ?? "run `bb doctor --fix` to mint a replacement session";
     return { exitCode: 3, report, exports };
   }
@@ -194,5 +220,5 @@ export async function doctorAgentAuth({
 }
 
 export function doctorHelp() {
-  return "bb doctor [--fix] [--print-exports] [--json]\n\nChecks the client key, repo binding, cached agent session, and this worktree's stack-lease capability (registered host + attested machine). --fix mints a replacement session and (re)establishes the stack-lease capability; --print-exports prints its canonical shell exports.";
+  return "bb doctor [--fix] [--print-exports] [--json]\n\nChecks the client key, repo binding, cached agent session, and this worktree's stack-lease capability (registered host + attested machine). --fix mints a replacement session and (re)establishes the stack-lease capability; --print-exports prints its canonical shell exports. When the client key is unreachable (a Background LaunchAgent cannot read the login Keychain), --fix mints from the tier-2 MCP key exported under the binding's mcp_env name (env only, never Keychain).";
 }

package/src/commands.mjs

@@ -226,7 +226,8 @@ export async function cmdDoctor(args, { log = (line) => console.log(line), error
   } else {
     log(`binding: ${result.report.binding.status}${result.report.binding.tenant ? ` (${result.report.binding.tenant})` : ""}`);
     log(`client key: ${result.report.client_key.status}`);
-    log(`agent session: ${result.report.session.status}`);
+    if (result.report.mcp_key) log(`mcp key: ${result.report.mcp_key.env} ${result.report.mcp_key.in_env ? "in env" : "not in env"}`);
+    log(`agent session: ${result.report.session.status}${result.report.session.minted_with ? ` (minted_with: ${result.report.session.minted_with})` : ""}`);
     if (result.report.stack_lease) {
       const sl = result.report.stack_lease;
       log(`stack lease: ${sl.capability} (host ${sl.host}, machine id ${sl.machine_id_readable ? "readable" : "unavailable"})${sl.reason ? ` — ${sl.reason}` : ""}`);