@botbuddy/cli 1.40.1 → 1.40.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.40.1",
+  "version": "1.40.3",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/codex-bridge.mjs

@@ -99,6 +99,23 @@ export function applyTurnModelOverride(bootstrappedSessions, threadId, model, re
   return true;
 }
 
+// BOT-2058: a bridge-created thread does not have a visible command-result
+// surface before its first turn. Put an advisory live-holder warning in that
+// turn's input, so the agent sees it before it can edit or claim a resource.
+export function prependTicketSessionWarning(prompt, concurrency) {
+  const warning = concurrency?.warning;
+  if (typeof warning !== "string" || !warning.trim()) return prompt;
+  return `BotBuddy ticket-session warning: ${warning}\n\n${prompt}`;
+}
+
+export function consumeTicketSessionWarning(bootstrappedSessions, threadId, result) {
+  if (result?.error) return false;
+  const stored = bootstrappedSessions?.get?.(threadId);
+  if (!stored?.ticket_session_warning) return false;
+  stored.ticket_session_warning = null;
+  return true;
+}
+
 // BOT-1650: retire a thread's admission only after its terminal (archived)
 // lifecycle update has persisted. relayPost returns the relay's error body (no
 // throw) on a transient 4xx/5xx, so a missing thread_id means the archived
@@ -677,8 +694,11 @@ export async function runBridge(args) {
               call: callToolJson,
               callOptions: { auth: await authHeaders() },
             });
-            if (bootstrap.ticket_signals?.concurrency) {
-              throw new Error(bootstrap.ticket_signals.concurrency.warning);
+            if (bootstrap.ticket_signals?.policy) {
+              throw new Error(bootstrap.ticket_signals.concurrency?.warning || "Ticket-session exclusivity could not be verified.");
+            }
+            if (bootstrap.ticket_signals?.concurrency?.holders?.length) {
+              console.warn(`  ${yellow("!")} Ticket-session warning: ${bootstrap.ticket_signals.concurrency.warning}`);
             }
             if (bootstrap.linkage?.status === "gap") {
               throw new Error(bootstrap.linkage.warning || "Session bootstrap requires ticket attribution.");
@@ -699,6 +719,7 @@ export async function runBridge(args) {
               // overwritten to the default on the first 15s heartbeat.
               model: cmd.params.model || model,
               cwd: requestedWorktree,
+              ticket_session_warning: bootstrap.ticket_signals?.concurrency || null,
             });
             const linkPayload = {
               session_id: sessionId,
@@ -725,6 +746,7 @@ export async function runBridge(args) {
               display_name: bootstrap.display_name,
               session_id: bootstrap.session_id,
               expires_at: bootstrap.expires_at,
+              ...(bootstrap.ticket_signals?.concurrency ? { ticket_session_warning: bootstrap.ticket_signals.concurrency } : {}),
             };
           }
           break;
@@ -740,9 +762,10 @@ export async function runBridge(args) {
             result = { error: "Thread session bootstrap did not complete; start a new thread after resolving its authentication or ticket conflict." };
             break;
           }
+          const bootstrap = bootstrappedSessions.get(codexThreadId);
           result = await sendWs("turn/start", {
             threadId: codexThreadId,
-            input: [{ type: "text", text: cmd.params.prompt || cmd.params.text || "" }],
+            input: [{ type: "text", text: prependTicketSessionWarning(cmd.params.prompt || cmd.params.text || "", bootstrap?.ticket_session_warning) }],
             ...(cmd.params.model && { model: cmd.params.model }),
           });
           // BOT-1650 (Codex round-35 P2): a per-turn model override must be written
@@ -750,6 +773,7 @@ export async function runBridge(args) {
           // creation-time model and overwrites agents.model — misattributing the
           // overridden turn on the dashboard and in effectiveness reporting.
           applyTurnModelOverride(bootstrappedSessions, codexThreadId, cmd.params.model, result);
+          consumeTicketSessionWarning(bootstrappedSessions, codexThreadId, result);
           break;
         }
 

package/src/commands.mjs

@@ -551,12 +551,11 @@ export async function cmdSetup(args, {
     // resolving so it cannot merely report an old cache as ready.
     await clearState(cwd);
     const session = await selfHeal({ cwd, env });
-    // BOT-1649 (Codex round-6 P1): register_agent reports any OTHER live session
-    // already holding this ticket (heartbeat < 15m) in `ticket_signals`. One
-    // ticket = one live session is a hard stop (AGENTS.md), so refuse to report
-    // the worktree ready — otherwise setup silently green-lights a second coding
-    // session on the ticket. The mint above re-adopts this worktree's own agent
-    // and is not itself a second holder.
+    // BOT-2058: register_agent reports any OTHER live session already holding
+    // this ticket (heartbeat < 15m) in `ticket_signals`. This is advisory: a
+    // previous harness can remain visible while a human intentionally resumes
+    // the ticket in a new session. Shared resources stay protected by typed
+    // locks, which remain exclusive.
     const holders = session.ticketSignals?.concurrency?.holders;
     if (Array.isArray(holders) && holders.length > 0) {
       const warning = session.ticketSignals.concurrency.warning
@@ -564,8 +563,7 @@ export async function cmdSetup(args, {
       const who = holders
         .map((h) => `${h.agent ?? h.agent_id}${h.branch ? ` (${h.branch})` : ""}`)
         .join(", ");
-      errorLog(`bb setup: ${warning} — held by ${who}. Do not start a second coding session on this ticket; hand off to the live holder or wait for it to finish.`);
-      return 5;
+      errorLog(`bb setup: warning: ${warning} — held by ${who}. Confirm the active work before editing shared resources; typed locks remain required.`);
     }
     log(`bb setup: ${tenant} is ready (${session.source} worktree session). Run bb wait '<condition>'.`);
     await reportUsageAgent(usageAgent, { cwd, log });
@@ -828,7 +826,10 @@ async function cmdBootstrap(args) {
   if (state.linkage?.status === "gap") die(state.linkage.warning || "bb bootstrap requires ticket attribution or --no-ticket-reason.");
   // BOT-1945: name (never the bearer of) an unowned cached session this bootstrap
   // replaced, so a leftover live holder is visible instead of silent.
-  console.log(JSON.stringify({ agent_id: state.agent_id, display_name: state.display_name, session_id: state.session_id, expires_at: state.expires_at, ...(state.replaced_cached_session ? { replaced_cached_session: state.replaced_cached_session } : {}) }));
+  // BOT-2058: the launcher must see a known-holder warning before it starts a
+  // new harness. Keep it out of the credential cache, but preserve the
+  // non-secret concurrency payload in this command receipt.
+  console.log(JSON.stringify({ agent_id: state.agent_id, display_name: state.display_name, session_id: state.session_id, expires_at: state.expires_at, ...(state.ticket_signals?.concurrency ? { ticket_session_warning: state.ticket_signals.concurrency } : {}), ...(state.replaced_cached_session ? { replaced_cached_session: state.replaced_cached_session } : {}) }));
 }
 
 // BOT-1566 A4: after the local-metadata lines, ask the SERVER whether the stored

package/src/session-bootstrap.mjs

@@ -273,7 +273,11 @@ export async function bootstrapHarnessSession({
     // Persist only the four session-secret fields. Ticket signals are intentionally
     // returned to the launcher, never copied into the runtime credential file.
     const { ticket_signals: ticketSignals, display_name: displayName, linkage, ...session } = response.data;
-    if (ticketSignals?.concurrency) throw new Error(ticketSignals.concurrency.warning || "Another live session holds this ticket.");
+    // A live-holder report is advisory: agents frequently resume a ticket in a
+    // new harness session after a previous session's shutdown was not observed.
+    // The signal remains on the returned result so callers can show the holder;
+    // resource locks, not ticket presence, continue to arbitrate shared state.
+    if (ticketSignals?.policy) throw new Error(ticketSignals.concurrency?.warning || "Ticket-session exclusivity could not be verified.");
     if (linkage?.status === "gap") throw new Error(linkage.warning || "Session bootstrap requires ticket attribution.");
     // A new harness may be admitted only after an abandoned cache aged out of
     // the server's liveness window. Before replacing that file, ask the server

package/src/wait-checkpoint.mjs

@@ -107,6 +107,20 @@ async function processStartedAt(pid) {
   }
 }
 
+// The real process-instance probe behind the ownership fence. Tests inject a
+// deterministic one instead of spawning `ps` (BOT-2031).
+const systemProcessProbe = Object.freeze({
+  async isAlive(pid) {
+    try { process.kill(pid, 0); }
+    catch (error) {
+      if (error?.code === "ESRCH") return false;
+      return true; // EPERM is deliberately conservative.
+    }
+    return true;
+  },
+  startedAt: processStartedAt,
+});
+
 function installFenceExitHook() {
   if (installedFenceExitHook) return;
   installedFenceExitHook = true;
@@ -120,7 +134,11 @@ function installFenceExitHook() {
   });
 }
 
-export function createWaitCheckpointStore({ root = process.cwd(), now = () => new Date() } = {}) {
+export function createWaitCheckpointStore({
+  root = process.cwd(),
+  now = () => new Date(),
+  processProbe = systemProcessProbe,
+} = {}) {
   const worktree = resolve(root);
   const directory = join(worktree, ".botbuddy", "waits");
   const pathFor = (id) => {
@@ -184,12 +202,8 @@ export function createWaitCheckpointStore({ root = process.cwd(), now = () => ne
     return lock;
   };
   const lockIsLive = async (lock) => {
-    try { process.kill(lock.pid, 0); }
-    catch (error) {
-      if (error?.code === "ESRCH") return false;
-      return true; // EPERM is deliberately conservative.
-    }
-    const startedAt = await processStartedAt(lock.pid);
+    if (!await processProbe.isAlive(lock.pid)) return false;
+    const startedAt = await processProbe.startedAt(lock.pid);
     // A live PID without a matching process-instance identity is never ownership proof.
     return startedAt != null && startedAt === lock.process_started_at;
   };
@@ -310,7 +324,7 @@ export function createWaitCheckpointStore({ root = process.cwd(), now = () => ne
       const localWaitId = safeId(id);
       await ensureDirectory();
       const path = lockPathFor(localWaitId);
-      const processStartedAtValue = await processStartedAt(process.pid);
+      const processStartedAtValue = await processProbe.startedAt(process.pid);
       if (!processStartedAtValue) {
         throw new WaitCheckpointError("wait_owner_unknown", "could not establish this process identity for wait recovery");
       }