@botbuddy/cli 1.34.2 → 1.34.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.34.2",
+  "version": "1.34.4",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { callTool, callToolJson, readResource } from "./api.mjs";
 import { doLogin } from "./auth.mjs";
 import { runBridge } from "./codex-bridge.mjs";
-import { bootstrapHarnessSession, clearHarnessSession, loadHarnessSession, withHarnessBootstrapLock } from "./session-bootstrap.mjs";
+import { bootstrapHarnessSession, clearHarnessSession, doctorBootstrapState, formatBootstrapLine, loadHarnessSession, withHarnessBootstrapLock } from "./session-bootstrap.mjs";
 import { loadConfig, getConfig, clearConfig, getConfigPath, SERVER_URL } from "./config.mjs";
 import { resolveOwnerToken, resolveAgentKey, clearOwnerToken } from "./cli-credentials.mjs";
 import { agentProfileKeyLabel } from "./credential-kinds.mjs";
@@ -236,7 +236,7 @@ ${SETUP_BLOCK}`);
 
 export async function cmdDoctor(args, {
   log = (line) => console.log(line), errorLog = (line) => console.error(line),
-  doctor = doctorAgentAuth, usageReport = doctorUsageSync,
+  doctor = doctorAgentAuth, usageReport = doctorUsageSync, bootstrapReport = doctorBootstrapState,
 } = {}) {
   const parsed = parseDoctorArgs(args);
   if (parsed.help) { log(doctorHelp()); return 0; }
@@ -244,8 +244,10 @@ export async function cmdDoctor(args, {
   const result = await doctor({ fix: parsed.fix, printExports: parsed.printExports });
   // BOT-1021: informational only — never changes doctor's exit code.
   const usage = await usageReport().catch(() => null);
+  // BOT-1945 (AC-3): informational, like usage sync — never changes the exit code.
+  const bootstrap = await bootstrapReport().catch(() => null);
   if (parsed.json) {
-    log(JSON.stringify(usage ? { ...result.report, usage_sync: usage } : result.report));
+    log(JSON.stringify({ ...result.report, ...(usage ? { usage_sync: usage } : {}), ...(bootstrap ? { bootstrap } : {}) }));
   } else {
     log(`binding: ${result.report.binding.status}${result.report.binding.tenant ? ` (${result.report.binding.tenant})` : ""}`);
     log(`client key: ${result.report.client_key.status}`);
@@ -256,6 +258,7 @@ export async function cmdDoctor(args, {
       log(`stack lease: ${sl.capability} (host ${sl.host}, machine id ${sl.machine_id_readable ? "readable" : "unavailable"})${sl.reason ? ` — ${sl.reason}` : ""}`);
     }
     if (result.report.recovery) log(`recovery: ${result.report.recovery}`);
+    if (bootstrap) log(formatBootstrapLine(bootstrap));
     if (usage) log(formatUsageSyncLine(usage));
   }
   if (result.exports) log(result.exports);
@@ -784,7 +787,9 @@ async function cmdBootstrap(args) {
     harness: `botbuddy-${type}-launcher`,
   });
   if (state.linkage?.status === "gap") die(state.linkage.warning || "bb bootstrap requires ticket attribution or --no-ticket-reason.");
-  console.log(JSON.stringify({ agent_id: state.agent_id, display_name: state.display_name, session_id: state.session_id, expires_at: state.expires_at }));
+  // BOT-1945: name (never the bearer of) an unowned cached session this bootstrap
+  // replaced, so a leftover live holder is visible instead of silent.
+  console.log(JSON.stringify({ agent_id: state.agent_id, display_name: state.display_name, session_id: state.session_id, expires_at: state.expires_at, ...(state.replaced_cached_session ? { replaced_cached_session: state.replaced_cached_session } : {}) }));
 }
 
 // BOT-1566 A4: after the local-metadata lines, ask the SERVER whether the stored

package/src/session-bootstrap.mjs

@@ -153,6 +153,55 @@ export async function heartbeatHarnessSession({
   return response.data;
 }
 
+// BOT-1945: a worktree cache that this bootstrap path did not create — written by
+// the self-heal / `bb setup` / MCP registration path (no `harness_origin` marker),
+// or a legacy bootstrap cache with no stored generation — is not a harness
+// principal this bootstrap owns and cannot be retired through the fenced durable
+// close (the server refuses a generated row without its generation:
+// `session_generation_required`). Retire it best-effort and NEVER fail the
+// bootstrap because of it:
+//   1. its own scoped bearer self-closes with if_stale (the server derives the
+//      generation from the token, and still refuses a live holder);
+//   2. the durable credential confirms (with the generation when cached): an
+//      ended row answers already_closed, an active generated row stays refused;
+//   3. otherwise leave it: a session that is never closed simply ages out of the
+//      server's holder-liveness window and its short-lived token expires.
+// Returns a non-secret receipt `{ session_id, retired }`.
+export function cacheOwnedByBootstrap(cached) {
+  return cached?.harness_origin === "bootstrap_agent_session" && !!cached.session_token_generation;
+}
+
+async function retireUnownedCachedSession({ cached, call, callOptions, resolveCleanupOptions }) {
+  const receipt = { session_id: cached.session_id, retired: false };
+  const ok = (response) => !!response?.ok && !response.isError;
+  try {
+    if (cached.session_token) {
+      const self = await call("close_session", { session_id: cached.session_id, if_stale: true }, {
+        auth: { "x-agent-api-key": cached.session_token },
+      }).catch(() => null);
+      if (ok(self)) return { ...receipt, retired: true };
+      // A live holder is refused by if_stale; the durable credential would be
+      // refused the same way, so do not widen to it.
+      if ((self?.data?.error || self?.error) === "session_still_active") return receipt;
+    }
+    // Codex #986 P2: confirm with the durable credential even without a cached
+    // generation. A bearer that fails auth often means the row was already ended
+    // (e.g. superseded by registration reconciliation) — the durable close then
+    // answers idempotent `already_closed`; an ACTIVE generated row is still
+    // refused (`session_generation_required`) and `if_stale` protects a live one.
+    const durable = callOptions ?? await resolveCleanupOptions().catch(() => null);
+    if (!durable) return receipt;
+    const confirmed = await call("close_session", {
+      session_id: cached.session_id,
+      ...(cached.session_token_generation ? { session_token_generation: cached.session_token_generation } : {}),
+      if_stale: true,
+    }, durable).catch(() => null);
+    return { ...receipt, retired: ok(confirmed) };
+  } catch {
+    return receipt;
+  }
+}
+
 export async function bootstrapHarnessSession({
   name,
   type = "codex",
@@ -231,7 +280,10 @@ export async function bootstrapHarnessSession({
     // to retire the cached session *only if its authoritative holder-liveness
     // window elapsed*. The file's timestamp is intentionally not authority:
     // relay heartbeats can extend it after the snapshot was written.
-    if (cached && cached.session_id !== session.session_id) {
+    let replacedCachedSession = null;
+    if (cached && cached.session_id !== session.session_id && !cacheOwnedByBootstrap(cached)) {
+      replacedCachedSession = await retireUnownedCachedSession({ cached, call, callOptions, resolveCleanupOptions });
+    } else if (cached && cached.session_id !== session.session_id) {
       const cleanupOptions = callOptions ?? await resolveCleanupOptions();
       if (!cleanupOptions) {
         // BOT-1650 (Codex round-27): the new session was admitted but there is no
@@ -370,6 +422,29 @@ export async function bootstrapHarnessSession({
       }
       throw error;
     }
-    return { ...state, ...(displayName ? { display_name: displayName } : {}), ...(ticketSignals ? { ticket_signals: ticketSignals } : {}), ...(linkage ? { linkage } : {}) };
+    return { ...state, ...(replacedCachedSession ? { replaced_cached_session: replacedCachedSession } : {}), ...(displayName ? { display_name: displayName } : {}), ...(ticketSignals ? { ticket_signals: ticketSignals } : {}), ...(linkage ? { linkage } : {}) };
   });
 }
+
+/** BOT-1945 (AC-3): non-secret `bb doctor` view of whether this worktree's cache
+ * is a harness session linked by `bb bootstrap` (the SessionStart hook's job).
+ * Only ids and presence flags — never the bearer. */
+export async function doctorBootstrapState({ cwd = process.cwd(), readState = readAgentState } = {}) {
+  let root;
+  try { root = await worktreeRoot(cwd); } catch { root = cwd; }
+  const state = await readState(root).catch(() => null);
+  if (!state) return { status: "not_linked", cache: "none" };
+  const bootstrap = state.harness_origin === "bootstrap_agent_session";
+  return {
+    status: bootstrap ? "linked" : "not_linked",
+    cache: bootstrap ? "bootstrap" : "self_heal",
+    session_id: state.session_id ?? null,
+    generation: state.session_token_generation ? "cached" : "missing",
+  };
+}
+
+export function formatBootstrapLine(report) {
+  if (report?.status === "linked") return `bootstrap: linked (session ${report.session_id}, generation ${report.generation})`;
+  if (!report || report.cache === "none") return "bootstrap: not linked — no session cache in this worktree (the SessionStart hook runs bb bootstrap)";
+  return `bootstrap: not linked — cache is a self-heal session ${report.session_id} (generation ${report.generation}); the SessionStart hook's bb bootstrap replaces it`;
+}

package/src/stack.mjs

@@ -699,7 +699,8 @@ export function leaseRefusalExit(code) {
   // BOT-1896: an auth-class refusal (scope_denied, a tenant mismatch, …) is the
   // server refusing the credential — never BACKEND, which a gate reads as "down".
   if (CALL_AUTH_ERROR_CODES.has(code)) return EXIT.AUTH;
-  return code === STACK_PATH_ROOT_REFUSED_CODE ? EXIT.INVALID : EXIT.BACKEND;
+  // BOT-1926: a reused lease requested in the other execution mode is fixable by the caller.
+  return code === STACK_PATH_ROOT_REFUSED_CODE || code === "STACK_EXECUTION_MODE_MISMATCH" ? EXIT.INVALID : EXIT.BACKEND;
 }
 
 /** The refusal text for a receipt: the server's message, else its code. */
@@ -1372,6 +1373,10 @@ export async function cmdUp(opts, {
     stack_path: execution.stackPath,
     worktree_root: execution.worktreeRoot,
     machine_uuid: hardwareUuid,
+    // BOT-1926: fence the provision job from the Helper server-side. Without it a
+    // polling Helper wins the request→reserve race, provisions the stack itself and
+    // records a targetless connection that `done --local-exec` cannot release.
+    ...(opts.localExec ? { local_exec: true } : {}),
   };
   let req = await call("request_stack_lease", leaseArgs);
   if (!req.ok && req.auth) {
@@ -1627,6 +1632,10 @@ export async function cmdDone(leaseId, opts, {
   let legacyTargetProof = null;
   let teardownDir = process.cwd();
   let leaseBefore = null;
+  // BOT-1926: a lease the Helper provisioned (it won the provision-job race, or the
+  // server predates the local-exec fence) is torn down BY the Helper from its own
+  // manifest. Locally it is not ours to stop: release it and let the reap job run.
+  let helperTeardown = false;
   if (opts.localExec) {
     // BOT-1887: the disposition picks the local teardown (destroy deletes the project's
     // volumes); refuse an unknown one BEFORE the lease is released into `reaping`.
@@ -1640,10 +1649,23 @@ export async function cmdDone(leaseId, opts, {
         error: current.error || current.data?.code || "could not verify the lease Docker target" }), opts,
       current.auth ? EXIT.AUTH : EXIT.BACKEND);
     }
+    leaseBefore = current.data;
+    if (current.data.provisioner === "helper_provisioning") {
+      // Codex #984 P1: the Helper has claimed but not finished provisioning; its manifest
+      // is stored only by its receipt. Releasing now would strand that stack — stay fenced.
+      return emitResult(buildReceipt({ command: "done", outcome: "refused", lease_id: leaseId,
+        error: "the Helper is still provisioning this lease; retry `stack done` once it is active. Lease and slot remain fenced." }), opts, EXIT.LEASE_FAILED);
+    }
+    helperTeardown = current.data.provisioner === "helper";
+  }
+  // BOT-1926: an already-reaped lease has nothing left to tear down locally (only a
+  // `reaping` release runs the local stop), so its target guards cannot protect anything.
+  // Refusing it only kept the hermetic orphan sweep retrying a finished lease forever.
+  if (opts.localExec && !helperTeardown && leaseBefore.state !== "reaped") {
+    const current = { data: leaseBefore };
     // BOT-1711: tear down in the directory the stack was PROVISIONED in (the lease's
     // recorded worktree_root/stack_path), not the invoking cwd — otherwise `supabase
     // stop` at the worktree root would stop the shared canonical stack.
-    leaseBefore = current.data;
     teardownDir = leaseStackDir(current.data);
     // BOT-1711 (Codex P1, R4): refuse local-exec teardown of ANY lease whose target is the
     // worktree root / default project — BEFORE branching on the persisted Docker target.
@@ -1765,7 +1787,7 @@ export async function cmdDone(leaseId, opts, {
       error: `the lease's established reap disposition ${JSON.stringify(established)} is unknown — NOT tearing down; the slot stays fenced` }), opts, EXIT.BACKEND);
   }
   const disposition = alreadyReaped ? established : (established ?? opts.disposition);
-  if (opts.localExec && state === "reaping") {
+  if (opts.localExec && !helperTeardown && state === "reaping") {
     // Only finalize once the stack is PROVABLY down. A failed `supabase stop` (Docker
     // unavailable, etc.) must NOT finalize — finalize frees the slot lock and promotes
     // the next queued lease, which would collide with containers still running on this
@@ -1782,6 +1804,7 @@ export async function cmdDone(leaseId, opts, {
     else process.stderr.write(`${yellow("⚠")} stack: finalize failed (${fin.error || fin.data?.code}); the reaper will reconcile.\n`);
   }
   return emitResult(buildReceipt({ command: "done", outcome: "released", lease_id: leaseId, state, disposition,
+    ...(helperTeardown ? { teardown: "helper" } : {}),
     ...(legacyTargetProof ? { legacy_target_proof: legacyTargetProof } : {}) }), opts, EXIT.OK);
 }