@botbuddy/cli 1.33.9 → 1.33.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.33.9",
+  "version": "1.33.11",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-doctor.mjs

@@ -67,7 +67,13 @@ function prerequisiteRecovery(report) {
  * credential-store failure must point at unlocking the store — not `bb login` or a
  * binding repair — matching prerequisiteRecovery's wording.
  */
-function repairFailureRecovery(code) {
+function repairFailureRecovery(code, error = null) {
+  // BOT-1891: a tier-2 MCP key the server rejected (revoked/rotated) is replaced by
+  // minting a new one and re-delivering it — not by `bb login`, which a Background
+  // job cannot run anyway. Name the variable, never the value.
+  if (code === "session_mint_unauthorized" && error?.mintedWith === "mcp_key") {
+    return `the tier-2 MCP key in ${error.mcpEnv ?? "the binding's mcp_env"} was rejected (revoked?); mint a new one, store it in Keychain under that name, then re-run \`bash scripts/install-stack-canary.sh\` (or re-export it) and \`bb doctor --fix\``;
+  }
   if (code === "client_key_unavailable") {
     return "the client key could not be read (locked or failing credential store); unlock it, then run `bb doctor --fix`";
   }
@@ -120,11 +126,17 @@ export async function doctorAgentAuth({
   ]);
   try { owner = await ownerToken(); } catch { ownerReadFailed = true; }
   const fresh = Boolean(state && isFresh(state, new Date()));
+  // BOT-1891: whether the binding's tier-2 MCP key is in THIS process's env — the
+  // self-heal fallback when the owner token is unreachable (a Background
+  // LaunchAgent). Env only, exactly like selfHealAgentSession; never the value.
+  const mcpEnv = typeof bound?.mcpEnv === "string" && bound.mcpEnv ? bound.mcpEnv : null;
+  const mcpKeyInEnv = Boolean(mcpEnv && typeof env?.[mcpEnv] === "string" && env[mcpEnv]);
   const report = {
     schema_version: 1,
     worktree: cwd,
     binding: bound?.tenant ? { status: "available", tenant: bound.tenant } : { status: "missing" },
     client_key: clientKeyStatus(owner, now(), ownerReadFailed),
+    ...(mcpEnv ? { mcp_key: { env: mcpEnv, in_env: mcpKeyInEnv } } : {}),
     session: fresh
       ? { status: "fresh", agent_id: state.agent_id, session_id: state.session_id, expires_at: state.expires_at }
       : { status: state ? "stale" : "missing" },
@@ -147,14 +159,28 @@ export async function doctorAgentAuth({
   // `bb doctor --fix` (the remedy the stack refusal points at) would reuse a fresh but
   // never-attested session and never re-establish the capability. `force` makes the
   // self-heal run a registration/attestation round regardless of cache freshness.
-  if (fix && report.binding.status === "available" && report.client_key.status === "available") {
+  // BOT-1891: an UNREADABLE client key (a Background LaunchAgent cannot reach the
+  // login Keychain) is repairable when the binding's tier-2 MCP key is in the env —
+  // selfHeal mints with it. A missing or expired key keeps its `bb login` verdict.
+  const mintCredentialAvailable = report.client_key.status === "available"
+    || (mcpKeyInEnv && report.client_key.status === "unavailable");
+  if (fix && report.binding.status === "available" && mintCredentialAvailable) {
     try {
       credential = await selfHeal({ cwd, env, force: true });
-      report.session = { status: credential.source === "minted" ? "minted" : credential.source, agent_id: credential.agentId ?? null, session_id: credential.sessionId ?? null };
+      report.session = {
+        status: credential.source === "minted" ? "minted" : credential.source,
+        agent_id: credential.agentId ?? null,
+        session_id: credential.sessionId ?? null,
+        ...(credential.mintedWith ? { minted_with: credential.mintedWith } : {}),
+      };
       applyStackLeaseCapability(report, credential.stackLeaseCapability);
     } catch (error) {
-      report.session = { status: "repair_failed", error: error?.code ?? "agent_session_unavailable" };
-      report.recovery = repairFailureRecovery(error?.code);
+      report.session = {
+        status: "repair_failed",
+        error: error?.code ?? "agent_session_unavailable",
+        ...(error?.mintedWith ? { minted_with: error.mintedWith } : {}),
+      };
+      report.recovery = repairFailureRecovery(error?.code, error);
       return { exitCode: 3, report, exports: null };
     }
   }
@@ -173,7 +199,7 @@ export async function doctorAgentAuth({
   // cached session left `credential` populated, report THAT prerequisite — not the
   // Helper/capability message below, since registration never ran and the real remedy
   // is `bb login` or restoring the binding.
-  if (fix && (report.binding.status !== "available" || report.client_key.status !== "available")) {
+  if (fix && (report.binding.status !== "available" || !mintCredentialAvailable)) {
     report.recovery = prerequisiteRecovery(report) ?? "run `bb doctor --fix` to mint a replacement session";
     return { exitCode: 3, report, exports };
   }
@@ -194,5 +220,5 @@ export async function doctorAgentAuth({
 }
 
 export function doctorHelp() {
-  return "bb doctor [--fix] [--print-exports] [--json]\n\nChecks the client key, repo binding, cached agent session, and this worktree's stack-lease capability (registered host + attested machine). --fix mints a replacement session and (re)establishes the stack-lease capability; --print-exports prints its canonical shell exports.";
+  return "bb doctor [--fix] [--print-exports] [--json]\n\nChecks the client key, repo binding, cached agent session, and this worktree's stack-lease capability (registered host + attested machine). --fix mints a replacement session and (re)establishes the stack-lease capability; --print-exports prints its canonical shell exports. When the client key is unreachable (a Background LaunchAgent cannot read the login Keychain), --fix mints from the tier-2 MCP key exported under the binding's mcp_env name (env only, never Keychain).";
 }

package/src/commands.mjs

@@ -226,7 +226,8 @@ export async function cmdDoctor(args, { log = (line) => console.log(line), error
   } else {
     log(`binding: ${result.report.binding.status}${result.report.binding.tenant ? ` (${result.report.binding.tenant})` : ""}`);
     log(`client key: ${result.report.client_key.status}`);
-    log(`agent session: ${result.report.session.status}`);
+    if (result.report.mcp_key) log(`mcp key: ${result.report.mcp_key.env} ${result.report.mcp_key.in_env ? "in env" : "not in env"}`);
+    log(`agent session: ${result.report.session.status}${result.report.session.minted_with ? ` (minted_with: ${result.report.session.minted_with})` : ""}`);
     if (result.report.stack_lease) {
       const sl = result.report.stack_lease;
       log(`stack lease: ${sl.capability} (host ${sl.host}, machine id ${sl.machine_id_readable ? "readable" : "unavailable"})${sl.reason ? ` — ${sl.reason}` : ""}`);

package/src/stack.mjs

@@ -1264,10 +1264,25 @@ export function localProvision(opts, dockerTarget, execution, spawn = spawnSync,
   return conn;
 }
 
-/** LOUD local-exec fallback: tear the stack down in `stackDir`. Returns true iff it succeeded. */
-export function localTeardown(stackDir, dockerTarget, spawn = spawnSync, env = process.env) {
-  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — running ${bold("supabase stop")} in ${stackDir}.\n`);
-  const res = spawn("supabase", ["stop", "--workdir", stackDir], {
+/** Release dispositions `stack done` accepts (`--destroy` is the default, `--stop` keeps volumes). */
+export const STACK_DISPOSITIONS = Object.freeze(["destroy", "stop"]);
+
+/**
+ * LOUD local-exec fallback: tear the stack down in `stackDir`. Returns true iff it succeeded.
+ *
+ * BOT-1887: the teardown honours the lease's release `disposition`. `destroy` (the `done`
+ * default, and what the receipt reports) runs `supabase stop --no-backup`, which also deletes
+ * the project's data volumes (`supabase_db_/storage_/edge_runtime_<project_id>`); `--workdir`
+ * scopes that to the stack's own project_id, never `--all`. `stop` keeps the volumes for a
+ * cheap re-provision. An unknown disposition throws before Docker is touched.
+ */
+export function localTeardown(stackDir, dockerTarget, disposition, spawn = spawnSync, env = process.env) {
+  if (!STACK_DISPOSITIONS.includes(disposition)) {
+    throw new Error(`localTeardown: unknown disposition ${JSON.stringify(disposition)} (expected one of ${STACK_DISPOSITIONS.join(", ")})`);
+  }
+  const args = ["stop", "--workdir", stackDir, ...(disposition === "destroy" ? ["--no-backup"] : [])];
+  process.stderr.write(`${yellow("⚠ LOCAL-EXEC FALLBACK")} — running ${bold(`supabase ${args.join(" ")}`)} (disposition ${disposition}).\n`);
+  const res = spawn("supabase", args, {
     encoding: "utf8",
     env: dockerEnvForTarget(dockerTarget, env),
   });
@@ -1608,7 +1623,14 @@ export async function cmdDone(leaseId, opts, {
   let dockerTarget = null;
   let legacyTargetProof = null;
   let teardownDir = process.cwd();
+  let leaseBefore = null;
   if (opts.localExec) {
+    // BOT-1887: the disposition picks the local teardown (destroy deletes the project's
+    // volumes); refuse an unknown one BEFORE the lease is released into `reaping`.
+    if (!STACK_DISPOSITIONS.includes(opts.disposition)) {
+      return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId,
+        error: `unknown disposition ${JSON.stringify(opts.disposition)} (expected one of ${STACK_DISPOSITIONS.join(", ")})` }), opts, EXIT.INVALID);
+    }
     const current = await call("get_stack_lease", { lease_id: leaseId });
     if (!current.ok || !current.data?.success) {
       return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId,
@@ -1618,6 +1640,7 @@ export async function cmdDone(leaseId, opts, {
     // BOT-1711: tear down in the directory the stack was PROVISIONED in (the lease's
     // recorded worktree_root/stack_path), not the invoking cwd — otherwise `supabase
     // stop` at the worktree root would stop the shared canonical stack.
+    leaseBefore = current.data;
     teardownDir = leaseStackDir(current.data);
     // BOT-1711 (Codex P1, R4): refuse local-exec teardown of ANY lease whose target is the
     // worktree root / default project — BEFORE branching on the persisted Docker target.
@@ -1706,13 +1729,46 @@ export async function cmdDone(leaseId, opts, {
   if (!r.ok) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, error: r.error }), opts, r.auth ? EXIT.AUTH : EXIT.BACKEND);
   if (!r.data.success) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, code: r.data.code, error: r.data.code }), opts, EXIT.BACKEND);
   let state = r.data.state;
+  // BOT-1887 (Codex #972 P1): a lease that is ALREADY reaping (an idle reap that
+  // established `stop`, or a retried `destroy`) keeps its in-flight teardown contract —
+  // `release_stack_lease` returns that established `reap_disposition` and ignores the
+  // requested one. Tear down (and report) by the established contract, never the flag,
+  // so a retry can neither delete volumes a `stop` meant to keep nor keep a `destroy`'s.
+  // Codex #972 R2 (P2): a lease that was ALREADY reaped answers `noop` with no
+  // reap_disposition — nothing was torn down by this call, so report the disposition it
+  // was actually reaped with (the lease row carries it), never the newly requested flag;
+  // unknown → null. A never-provisioned lease is terminalized as `destroy` server-side.
+  let established = r.data.reap_disposition;
+  const alreadyReaped = established == null && state === "reaped" && r.data.noop === true;
+  if (alreadyReaped) {
+    // Codex #972 R3: the pre-release read is only authoritative if it ALREADY saw the
+    // lease reaped — a Helper can finalize it between that read and the release. Otherwise
+    // re-read, and refuse to emit an unverifiable receipt if that read fails.
+    let stored = leaseBefore?.state === "reaped" ? leaseBefore : null;
+    if (!stored) {
+      const got = await call("get_stack_lease", { lease_id: leaseId });
+      stored = got.ok && got.data?.success ? got.data : null;
+      if (!stored) {
+        return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, state,
+          error: `the lease was already reaped but its reap disposition could not be read (${got.error || got.data?.code || "unreadable"}); nothing was torn down` }), opts, got.auth ? EXIT.AUTH : EXIT.BACKEND);
+      }
+    }
+    established = stored.reap_disposition ?? null;
+  } else if (established == null && r.data.never_provisioned === true) {
+    established = "destroy";
+  }
+  if (established != null && !STACK_DISPOSITIONS.includes(established)) {
+    return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, state,
+      error: `the lease's established reap disposition ${JSON.stringify(established)} is unknown — NOT tearing down; the slot stays fenced` }), opts, EXIT.BACKEND);
+  }
+  const disposition = alreadyReaped ? established : (established ?? opts.disposition);
   if (opts.localExec && state === "reaping") {
     // Only finalize once the stack is PROVABLY down. A failed `supabase stop` (Docker
     // unavailable, etc.) must NOT finalize — finalize frees the slot lock and promotes
     // the next queued lease, which would collide with containers still running on this
     // slot (Codex P1). Leave the lease in `reaping` (slot stays fenced) for a retry /
     // the reaper. Fail with a non-zero exit so the caller knows teardown is incomplete.
-    if (!localTeardownFn(teardownDir, dockerTarget)) {
+    if (!localTeardownFn(teardownDir, dockerTarget, disposition)) {
       return emitResult(buildReceipt({
         command: "done", outcome: "error", lease_id: leaseId, state,
         error: "local `supabase stop` failed — NOT finalizing; the slot stays fenced. Tear the stack down and re-run `stack done --local-exec`, or let the reaper reconcile.",
@@ -1722,7 +1778,7 @@ export async function cmdDone(leaseId, opts, {
     if (fin.ok && fin.data?.success) state = fin.data.state;
     else process.stderr.write(`${yellow("⚠")} stack: finalize failed (${fin.error || fin.data?.code}); the reaper will reconcile.\n`);
   }
-  return emitResult(buildReceipt({ command: "done", outcome: "released", lease_id: leaseId, state, disposition: opts.disposition,
+  return emitResult(buildReceipt({ command: "done", outcome: "released", lease_id: leaseId, state, disposition,
     ...(legacyTargetProof ? { legacy_target_proof: legacyTargetProof } : {}) }), opts, EXIT.OK);
 }