@botbuddy/cli 1.40.0 → 1.40.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.40.0",
+  "version": "1.40.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/codex-bridge.mjs

@@ -99,6 +99,23 @@ export function applyTurnModelOverride(bootstrappedSessions, threadId, model, re
   return true;
 }
 
+// BOT-2058: a bridge-created thread does not have a visible command-result
+// surface before its first turn. Put an advisory live-holder warning in that
+// turn's input, so the agent sees it before it can edit or claim a resource.
+export function prependTicketSessionWarning(prompt, concurrency) {
+  const warning = concurrency?.warning;
+  if (typeof warning !== "string" || !warning.trim()) return prompt;
+  return `BotBuddy ticket-session warning: ${warning}\n\n${prompt}`;
+}
+
+export function consumeTicketSessionWarning(bootstrappedSessions, threadId, result) {
+  if (result?.error) return false;
+  const stored = bootstrappedSessions?.get?.(threadId);
+  if (!stored?.ticket_session_warning) return false;
+  stored.ticket_session_warning = null;
+  return true;
+}
+
 // BOT-1650: retire a thread's admission only after its terminal (archived)
 // lifecycle update has persisted. relayPost returns the relay's error body (no
 // throw) on a transient 4xx/5xx, so a missing thread_id means the archived
@@ -677,8 +694,11 @@ export async function runBridge(args) {
               call: callToolJson,
               callOptions: { auth: await authHeaders() },
             });
-            if (bootstrap.ticket_signals?.concurrency) {
-              throw new Error(bootstrap.ticket_signals.concurrency.warning);
+            if (bootstrap.ticket_signals?.policy) {
+              throw new Error(bootstrap.ticket_signals.concurrency?.warning || "Ticket-session exclusivity could not be verified.");
+            }
+            if (bootstrap.ticket_signals?.concurrency?.holders?.length) {
+              console.warn(`  ${yellow("!")} Ticket-session warning: ${bootstrap.ticket_signals.concurrency.warning}`);
             }
             if (bootstrap.linkage?.status === "gap") {
               throw new Error(bootstrap.linkage.warning || "Session bootstrap requires ticket attribution.");
@@ -699,6 +719,7 @@ export async function runBridge(args) {
               // overwritten to the default on the first 15s heartbeat.
               model: cmd.params.model || model,
               cwd: requestedWorktree,
+              ticket_session_warning: bootstrap.ticket_signals?.concurrency || null,
             });
             const linkPayload = {
               session_id: sessionId,
@@ -725,6 +746,7 @@ export async function runBridge(args) {
               display_name: bootstrap.display_name,
               session_id: bootstrap.session_id,
               expires_at: bootstrap.expires_at,
+              ...(bootstrap.ticket_signals?.concurrency ? { ticket_session_warning: bootstrap.ticket_signals.concurrency } : {}),
             };
           }
           break;
@@ -740,9 +762,10 @@ export async function runBridge(args) {
             result = { error: "Thread session bootstrap did not complete; start a new thread after resolving its authentication or ticket conflict." };
             break;
           }
+          const bootstrap = bootstrappedSessions.get(codexThreadId);
           result = await sendWs("turn/start", {
             threadId: codexThreadId,
-            input: [{ type: "text", text: cmd.params.prompt || cmd.params.text || "" }],
+            input: [{ type: "text", text: prependTicketSessionWarning(cmd.params.prompt || cmd.params.text || "", bootstrap?.ticket_session_warning) }],
             ...(cmd.params.model && { model: cmd.params.model }),
           });
           // BOT-1650 (Codex round-35 P2): a per-turn model override must be written
@@ -750,6 +773,7 @@ export async function runBridge(args) {
           // creation-time model and overwrites agents.model — misattributing the
           // overridden turn on the dashboard and in effectiveness reporting.
           applyTurnModelOverride(bootstrappedSessions, codexThreadId, cmd.params.model, result);
+          consumeTicketSessionWarning(bootstrappedSessions, codexThreadId, result);
           break;
         }
 

package/src/commands.mjs

@@ -399,6 +399,17 @@ export function parseLoginArgs(args) {
   return out;
 }
 
+/**
+ * BOT-2030/BOT-2044: the sign-in mode for parsed login options. `--device` /
+ * `--loopback` win; `--no-browser` is a loopback-only option (print the URL,
+ * keep the localhost listener), so on its own it is an explicit loopback
+ * choice; otherwise shouldUseDeviceFlow auto-detects (SSH, display-less Linux).
+ */
+export function resolveLoginDevice(options = {}, { env = process.env, platform = process.platform } = {}) {
+  const flag = typeof options.device === "boolean" ? options.device : options.noBrowser ? false : undefined;
+  return shouldUseDeviceFlow({ env, platform, flag });
+}
+
 // BOT-1580: resolve the caller identity from parsed flags, falling back to the
 // BOTBUDDY_CALLER* environment variables so an agent harness can advertise who it
 // is without every wrapper having to pass flags. A flag always wins over the env.
@@ -477,7 +488,7 @@ async function cmdLogin(args, { errorLog = (line) => console.error(line) } = {})
   // BOT-1580: merge caller flags with the BOTBUDDY_CALLER* env fallback.
   const caller = resolveCaller(options, process.env);
   try {
-    const device = shouldUseDeviceFlow({ env: process.env, platform: process.platform, flag: options.device });
+    const device = resolveLoginDevice(options, { env: process.env, platform: process.platform });
     await doLogin({ noBrowser: options.noBrowser, tenant: options.tenant, device, ...caller });
   } catch (err) {
     die(err.message);
@@ -507,7 +518,7 @@ export async function cmdSetup(args, {
     return error.exitCode === 2 ? 2 : 4;
   }
   if (options.help) {
-    log("bb setup [--no-browser] [--tenant <slug>] [--device | --loopback]\n\nSigns in, verifies the committed .botbuddy-agent.json binding, and caches this worktree's session. Over SSH the sign-in uses a device code you approve from any browser (--device / --loopback force a mode). After it succeeds, use `bb wait <condition>` with no credential flags or environment variables.");
+    log("bb setup [--no-browser] [--tenant <slug>] [--device | --loopback]\n\nSigns in, verifies the committed .botbuddy-agent.json binding, and caches this worktree's session. Over SSH the sign-in uses a device code you approve from any browser (--device / --loopback force a mode). --loopback or --no-browser over SSH keeps the localhost callback on the remote host, so first forward its port with ssh -L <port>:127.0.0.1:<port> <host> (the port is in the printed URL), or setup times out. After it succeeds, use `bb wait <condition>` with no credential flags or environment variables.");
     return 0;
   }
   let bound;
@@ -533,19 +544,18 @@ export async function cmdSetup(args, {
     // reusable client key with a tenant-sealed one.
     await login({
       noBrowser: options.noBrowser,
-      device: shouldUseDeviceFlow({ env, platform, flag: options.device }),
+      device: resolveLoginDevice(options, { env, platform }),
       ...callerResolver(options, env),
     });
     // Setup is an explicit session bootstrap/repair command. Rotate before
     // resolving so it cannot merely report an old cache as ready.
     await clearState(cwd);
     const session = await selfHeal({ cwd, env });
-    // BOT-1649 (Codex round-6 P1): register_agent reports any OTHER live session
-    // already holding this ticket (heartbeat < 15m) in `ticket_signals`. One
-    // ticket = one live session is a hard stop (AGENTS.md), so refuse to report
-    // the worktree ready — otherwise setup silently green-lights a second coding
-    // session on the ticket. The mint above re-adopts this worktree's own agent
-    // and is not itself a second holder.
+    // BOT-2058: register_agent reports any OTHER live session already holding
+    // this ticket (heartbeat < 15m) in `ticket_signals`. This is advisory: a
+    // previous harness can remain visible while a human intentionally resumes
+    // the ticket in a new session. Shared resources stay protected by typed
+    // locks, which remain exclusive.
     const holders = session.ticketSignals?.concurrency?.holders;
     if (Array.isArray(holders) && holders.length > 0) {
       const warning = session.ticketSignals.concurrency.warning
@@ -553,8 +563,7 @@ export async function cmdSetup(args, {
       const who = holders
         .map((h) => `${h.agent ?? h.agent_id}${h.branch ? ` (${h.branch})` : ""}`)
         .join(", ");
-      errorLog(`bb setup: ${warning} — held by ${who}. Do not start a second coding session on this ticket; hand off to the live holder or wait for it to finish.`);
-      return 5;
+      errorLog(`bb setup: warning: ${warning} — held by ${who}. Confirm the active work before editing shared resources; typed locks remain required.`);
     }
     log(`bb setup: ${tenant} is ready (${session.source} worktree session). Run bb wait '<condition>'.`);
     await reportUsageAgent(usageAgent, { cwd, log });
@@ -604,8 +613,9 @@ ${bold("HOW IT WORKS")}
 ${bold("OPTIONS")}
   --no-browser   Don't launch a browser; print the authorization URL to open
                  in a browser on THIS machine yourself. The callback listener
-                 still runs on this machine's localhost.
-  --device       Sign in with a device code: print a link and a short code,
+                 still runs on this machine's localhost, so this implies
+                 ${cyan("--loopback")} unless ${cyan("--device")} is also given.
+  --device      Sign in with a device code: print a link and a short code,
                  approve it in a browser on ANY machine (laptop, phone), and
                  the login finishes on its own. No browser or listener here.
   --loopback     Force the browser + localhost callback flow, even over SSH.
@@ -638,6 +648,9 @@ ${bold("NOTES")}
     listener and state.
   • ${bold("Remote / SSH:")} over SSH (or on Linux with no display) login uses the device
     code automatically: open the printed link on any machine and approve.
+    ${cyan("--loopback")} or ${cyan("--no-browser")} over SSH keeps the localhost callback on the
+    remote host, so first forward its port, e.g. ${cyan("ssh -L <port>:127.0.0.1:<port> <host>")}
+    (the port is in the printed URL), or the login times out.
 
 ${bold("RECOVERY")}
   If ${cyan("botbuddy status")} shows no client key, run ${cyan("botbuddy login")}. For an
@@ -813,7 +826,10 @@ async function cmdBootstrap(args) {
   if (state.linkage?.status === "gap") die(state.linkage.warning || "bb bootstrap requires ticket attribution or --no-ticket-reason.");
   // BOT-1945: name (never the bearer of) an unowned cached session this bootstrap
   // replaced, so a leftover live holder is visible instead of silent.
-  console.log(JSON.stringify({ agent_id: state.agent_id, display_name: state.display_name, session_id: state.session_id, expires_at: state.expires_at, ...(state.replaced_cached_session ? { replaced_cached_session: state.replaced_cached_session } : {}) }));
+  // BOT-2058: the launcher must see a known-holder warning before it starts a
+  // new harness. Keep it out of the credential cache, but preserve the
+  // non-secret concurrency payload in this command receipt.
+  console.log(JSON.stringify({ agent_id: state.agent_id, display_name: state.display_name, session_id: state.session_id, expires_at: state.expires_at, ...(state.ticket_signals?.concurrency ? { ticket_session_warning: state.ticket_signals.concurrency } : {}), ...(state.replaced_cached_session ? { replaced_cached_session: state.replaced_cached_session } : {}) }));
 }
 
 // BOT-1566 A4: after the local-metadata lines, ask the SERVER whether the stored

package/src/session-bootstrap.mjs

@@ -273,7 +273,11 @@ export async function bootstrapHarnessSession({
     // Persist only the four session-secret fields. Ticket signals are intentionally
     // returned to the launcher, never copied into the runtime credential file.
     const { ticket_signals: ticketSignals, display_name: displayName, linkage, ...session } = response.data;
-    if (ticketSignals?.concurrency) throw new Error(ticketSignals.concurrency.warning || "Another live session holds this ticket.");
+    // A live-holder report is advisory: agents frequently resume a ticket in a
+    // new harness session after a previous session's shutdown was not observed.
+    // The signal remains on the returned result so callers can show the holder;
+    // resource locks, not ticket presence, continue to arbitrate shared state.
+    if (ticketSignals?.policy) throw new Error(ticketSignals.concurrency?.warning || "Ticket-session exclusivity could not be verified.");
     if (linkage?.status === "gap") throw new Error(linkage.warning || "Session bootstrap requires ticket attribution.");
     // A new harness may be admitted only after an abandoned cache aged out of
     // the server's liveness window. Before replacing that file, ask the server