@botbuddy/cli 1.40.2 → 1.40.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.40.2",
+  "version": "1.40.4",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-doctor.mjs

@@ -67,7 +67,7 @@ function prerequisiteRecovery(report) {
  * credential-store failure must point at unlocking the store — not `bb login` or a
  * binding repair — matching prerequisiteRecovery's wording.
  */
-function repairFailureRecovery(code, error = null) {
+export function repairFailureRecovery(code, error = null) {
   // BOT-1891: a tier-2 MCP key the server rejected (revoked/rotated) is replaced by
   // minting a new one and re-delivering it — not by `bb login`, which a Background
   // job cannot run anyway. Name the variable, never the value.
@@ -102,6 +102,19 @@ function applyStackLeaseCapability(report, capability) {
   }
 }
 
+/**
+ * Read the client key STRICTLY: a locked/failing credential store throws instead
+ * of reading as absent, so callers can tell "unlock it" from "sign in". Shared by
+ * `bb doctor` and `bb setup` (BOT-2067) so both classify the key identically.
+ */
+export function readClientKeyStrict() {
+  return resolveOwnerToken({
+    getConfig,
+    keychainRead: () => readKeychainSecret(CLIENT_KEY_SERVICE, { strict: true }),
+    keychainReadLegacy: () => readKeychainSecret(OWNER_TOKEN_SERVICE, { strict: true }),
+  });
+}
+
 /** Inspect a worktree credential. Only `exports` ever contains the secret. */
 export async function doctorAgentAuth({
   cwd = process.cwd(), env = process.env, fix = false, printExports = false,
@@ -111,11 +124,7 @@ export async function doctorAgentAuth({
   // probe distinguishes a locked/failing credential store (throws → `unavailable`)
   // from a genuinely absent key (`missing`) — the strict read must not live only
   // inside selfHeal, which the `--fix` gate skips when it reports the key missing.
-  ownerToken = () => resolveOwnerToken({
-    getConfig,
-    keychainRead: () => readKeychainSecret(CLIENT_KEY_SERVICE, { strict: true }),
-    keychainReadLegacy: () => readKeychainSecret(OWNER_TOKEN_SERVICE, { strict: true }),
-  }),
+  ownerToken = readClientKeyStrict,
   selfHeal = selfHealAgentSession,
   hostFn = hostname, machineUuidFn = machineUuid,
 } = {}) {

package/src/commands.mjs

@@ -27,7 +27,7 @@ import { maybeWarnStale, cmdUpdate } from "./update-check.mjs";
 import { createTelemetryOutbox } from "./telemetry-outbox.mjs";
 import { attestTelemetryCredential, loadTelemetryIdentity, loadTelemetryLocation } from "./telemetry-config.mjs";
 import { deliverExecutionEvent } from "./telemetry-delivery.mjs";
-import { doctorAgentAuth, doctorHelp, parseDoctorArgs } from "./agent-doctor.mjs";
+import { doctorAgentAuth, doctorHelp, parseDoctorArgs, readClientKeyStrict, repairFailureRecovery } from "./agent-doctor.mjs";
 import { clearAgentState, selfHealAgentSession } from "./agent-session.mjs";
 import { runUsage, usageStatus } from "./usage/sync.mjs";
 import { installUsageAgent, usageAgentStatus } from "./usage/launchd.mjs";
@@ -446,7 +446,10 @@ export function deriveCallerHint({ env = process.env, cwd = process.cwd(), git =
   return {
     caller: env.BOTBUDDY_AGENT_NAME || (cachedAgentId ? `agent ${cachedAgentId}` : repo),
     callerHarness: harness,
-    callerTicket: ticket ? `https://linear.app/botbuddy/issue/${ticket}` : null,
+    // BOT-2067: only a BOT ticket lives in the botbuddy Linear workspace. Any
+    // other prefix (ENT on a Supply Guard branch) is sent as plain text — the
+    // consent screen shows it unlinked rather than linking the wrong workspace.
+    callerTicket: ticket ? (ticket.startsWith("BOT-") ? `https://linear.app/botbuddy/issue/${ticket}` : ticket) : null,
   };
 }
 
@@ -495,9 +498,33 @@ async function cmdLogin(args, { errorLog = (line) => console.error(line) } = {})
   }
 }
 
+// BOT-2067: setup's failure line names the recovery for THIS code. A server-side
+// mint failure is repaired by `bb doctor --fix` without a new sign-in (BOT-1789);
+// a rejected key needs a sign-in; store/binding failures keep the classifier
+// `bb doctor` uses. The error message itself is never printed (it may echo a
+// credential); only the code is.
+function setupFailureRecovery(error) {
+  const code = error?.code ?? "setup_failed";
+  if (code === "session_mint_failed" || code === "session_mint_invalid") {
+    return "the BotBuddy service could not mint a session (transient/server error); run `bb doctor --fix`, which repairs this worktree's session without signing in again";
+  }
+  if ((code === "session_mint_unauthorized" && error?.mintedWith !== "mcp_key") || code === "client_key_required") {
+    return "the server rejected this machine's sign-in; run `bb login`, then `bb setup`";
+  }
+  if (code === "tenant_binding_required" || code === "invalid_binding") {
+    return "fix the committed .botbuddy-agent.json binding, then retry `bb setup`";
+  }
+  if (code === "client_key_unavailable" || code === "session_mint_unauthorized") return repairFailureRecovery(code, error);
+  return "retry `bb setup`";
+}
+
+const SIGN_IN_REJECTED = new Set(["session_mint_unauthorized", "client_key_required"]);
+
 /** Bootstrap a bound worktree without exposing credential or registration steps. */
 export async function cmdSetup(args, {
   login = doLogin,
+  ownerToken = readClientKeyStrict,
+  now = () => Date.now(),
   binding = readAgentBinding,
   clearState = clearAgentState,
   selfHeal = selfHealAgentSession,
@@ -509,16 +536,19 @@ export async function cmdSetup(args, {
   log = (line) => console.log(line),
   errorLog = (line) => console.error(line),
 } = {}) {
+  // BOT-2067: `--relogin` is setup-only (forces a fresh sign-in); `bb login`
+  // always signs in, so its parser does not accept it.
+  const relogin = args.includes("--relogin");
   let options;
   try {
-    options = parseLoginArgs(args);
+    options = parseLoginArgs(args.filter((arg) => arg !== "--relogin"));
   } catch (error) {
     if (!(error instanceof LoginUsageError)) throw error;
     errorLog(error.message);
     return error.exitCode === 2 ? 2 : 4;
   }
   if (options.help) {
-    log("bb setup [--no-browser] [--tenant <slug>] [--device | --loopback]\n\nSigns in, verifies the committed .botbuddy-agent.json binding, and caches this worktree's session. Over SSH the sign-in uses a device code you approve from any browser (--device / --loopback force a mode). --loopback or --no-browser over SSH keeps the localhost callback on the remote host, so first forward its port with ssh -L <port>:127.0.0.1:<port> <host> (the port is in the printed URL), or setup times out. After it succeeds, use `bb wait <condition>` with no credential flags or environment variables.");
+    log("bb setup [--relogin] [--no-browser] [--tenant <slug>] [--device | --loopback]\n\nVerifies the committed .botbuddy-agent.json binding and caches this worktree's session. It reuses this machine's existing sign-in (one per machine, valid 30 days) and signs in only when there is none, it expired, or the server rejects it; --relogin forces a fresh sign-in. Over SSH the sign-in uses a device code you approve from any browser (--device / --loopback force a mode). --loopback or --no-browser over SSH keeps the localhost callback on the remote host, so first forward its port with ssh -L <port>:127.0.0.1:<port> <host> (the port is in the printed URL), or setup times out. After it succeeds, use `bb wait <condition>` with no credential flags or environment variables.");
     return 0;
   }
   let bound;
@@ -537,20 +567,55 @@ export async function cmdSetup(args, {
     return 4;
   }
   const tenant = bound.tenant;
+  // Login owns a machine/user credential, not a worktree tenant credential.
+  // The committed binding below is the only place setup scopes the minted
+  // session.  Forwarding --tenant here would overwrite a multi-tenant user's
+  // reusable client key with a tenant-sealed one.
+  const signIn = () => login({
+    noBrowser: options.noBrowser,
+    device: resolveLoginDevice(options, { env, platform }),
+    ...callerResolver(options, env),
+  });
   try {
-    // Login owns a machine/user credential, not a worktree tenant credential.
-    // The committed binding below is the only place setup scopes the minted
-    // session.  Forwarding --tenant here would overwrite a multi-tenant user's
-    // reusable client key with a tenant-sealed one.
-    await login({
-      noBrowser: options.noBrowser,
-      device: resolveLoginDevice(options, { env, platform }),
-      ...callerResolver(options, env),
-    });
+    // BOT-2067: the client key is per machine and lasts 30 days. Reuse it rather
+    // than putting an OAuth approval in front of the operator for every worktree.
+    let signedIn = false;
+    if (relogin) {
+      await signIn();
+      signedIn = true;
+    } else {
+      let owner;
+      try {
+        owner = await ownerToken();
+      } catch {
+        // A locked/failing store is not "signed out": signing in again would not
+        // help and would open a browser for nothing.
+        throw Object.assign(new Error("client key unreadable"), { code: "client_key_unavailable" });
+      }
+      const valid = owner?.token && !(typeof owner.expiresAt === "number" && owner.expiresAt <= now());
+      if (valid) {
+        const expires = typeof owner.expiresAt === "number" ? ` (expires ${new Date(owner.expiresAt).toISOString().slice(0, 10)})` : "";
+        log(`bb setup: using this machine's existing sign-in${expires}.`);
+      } else {
+        await signIn();
+        signedIn = true;
+      }
+    }
     // Setup is an explicit session bootstrap/repair command. Rotate before
     // resolving so it cannot merely report an old cache as ready.
     await clearState(cwd);
-    const session = await selfHeal({ cwd, env });
+    let session;
+    try {
+      session = await selfHeal({ cwd, env });
+    } catch (error) {
+      // A locally-valid key the server rejects (revoked, rotated) needs exactly
+      // one fresh sign-in and one retried mint. Never loop, and never re-sign a
+      // key this run just minted.
+      if (signedIn || !SIGN_IN_REJECTED.has(error?.code) || error?.mintedWith === "mcp_key") throw error;
+      errorLog(`bb setup: this machine's saved sign-in was rejected (${error.code}); signing in again.`);
+      await signIn();
+      session = await selfHeal({ cwd, env });
+    }
     // BOT-2058: register_agent reports any OTHER live session already holding
     // this ticket (heartbeat < 15m) in `ticket_signals`. This is advisory: a
     // previous harness can remain visible while a human intentionally resumes
@@ -569,7 +634,7 @@ export async function cmdSetup(args, {
     await reportUsageAgent(usageAgent, { cwd, log });
     return 0;
   } catch (error) {
-    errorLog(`bb setup: could not prepare this worktree (${error?.code ?? "setup_failed"}). Retry bb setup after completing sign-in.`);
+    errorLog(`bb setup: could not prepare this worktree (${error?.code ?? "setup_failed"}); ${setupFailureRecovery(error)}.`);
     return 3;
   }
 }

package/src/wait-checkpoint.mjs

@@ -107,6 +107,20 @@ async function processStartedAt(pid) {
   }
 }
 
+// The real process-instance probe behind the ownership fence. Tests inject a
+// deterministic one instead of spawning `ps` (BOT-2031).
+const systemProcessProbe = Object.freeze({
+  async isAlive(pid) {
+    try { process.kill(pid, 0); }
+    catch (error) {
+      if (error?.code === "ESRCH") return false;
+      return true; // EPERM is deliberately conservative.
+    }
+    return true;
+  },
+  startedAt: processStartedAt,
+});
+
 function installFenceExitHook() {
   if (installedFenceExitHook) return;
   installedFenceExitHook = true;
@@ -120,7 +134,11 @@ function installFenceExitHook() {
   });
 }
 
-export function createWaitCheckpointStore({ root = process.cwd(), now = () => new Date() } = {}) {
+export function createWaitCheckpointStore({
+  root = process.cwd(),
+  now = () => new Date(),
+  processProbe = systemProcessProbe,
+} = {}) {
   const worktree = resolve(root);
   const directory = join(worktree, ".botbuddy", "waits");
   const pathFor = (id) => {
@@ -184,12 +202,8 @@ export function createWaitCheckpointStore({ root = process.cwd(), now = () => ne
     return lock;
   };
   const lockIsLive = async (lock) => {
-    try { process.kill(lock.pid, 0); }
-    catch (error) {
-      if (error?.code === "ESRCH") return false;
-      return true; // EPERM is deliberately conservative.
-    }
-    const startedAt = await processStartedAt(lock.pid);
+    if (!await processProbe.isAlive(lock.pid)) return false;
+    const startedAt = await processProbe.startedAt(lock.pid);
     // A live PID without a matching process-instance identity is never ownership proof.
     return startedAt != null && startedAt === lock.process_started_at;
   };
@@ -310,7 +324,7 @@ export function createWaitCheckpointStore({ root = process.cwd(), now = () => ne
       const localWaitId = safeId(id);
       await ensureDirectory();
       const path = lockPathFor(localWaitId);
-      const processStartedAtValue = await processStartedAt(process.pid);
+      const processStartedAtValue = await processProbe.startedAt(process.pid);
       if (!processStartedAtValue) {
         throw new WaitCheckpointError("wait_owner_unknown", "could not establish this process identity for wait recovery");
       }