@botbuddy/cli 1.40.4 → 1.40.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.40.4",
+  "version": "1.40.5",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-credential-store.mjs

@@ -2,6 +2,7 @@ import { userInfo } from "node:os";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { existsSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 
 const execFileAsync = promisify(execFile);
 
@@ -41,6 +42,28 @@ export class ProfileCredentialStoreError extends Error {
   }
 }
 
+export const KEYCHAIN_UNLOCK_GUIDANCE = "the macOS login Keychain is locked in this SSH session — run `security unlock-keychain ~/Library/Keychains/login.keychain-db` on this host, then re-run. Alternatively set `BOTBUDDY_NO_KEYCHAIN=1` to use the explicit 0600-file store.";
+
+// `security` reports this locked-SSH-session condition inconsistently: some
+// paths say authorization was canceled, while the failed write in BOT-2078 was
+// exit 36 / "User interaction is not allowed". Keep one classifier so every
+// Keychain reader and writer gives the same recovery rather than suggesting an
+// unnecessary new login.
+export function isLockedKeychainError(error) {
+  const detail = String(error?.stderr ?? error?.message ?? error ?? "");
+  return Number(error?.code) === 36
+    || /(?:security\s+)?exited\s+36\b/i.test(detail)
+    || /user interaction is not allowed/i.test(detail)
+    || /authorization was cancell?ed/i.test(detail);
+}
+
+function unavailableKeychainError(cause) {
+  return new ProfileCredentialStoreError(KEYCHAIN_UNLOCK_GUIDANCE, {
+    cause,
+    code: "client_key_unavailable",
+  });
+}
+
 function writePasswordPrompt(command, args, password, spawnProcess) {
   return new Promise((resolve, reject) => {
     // BOT-1566: `security -w` (prompt mode) reads the secret with
@@ -134,14 +157,7 @@ export async function writeKeychainSecret(service, token, {
         { cause: error, code: "keychain_item_exists" },
       );
     }
-    // `security` cancels its authorization when the login keychain is locked in
-    // a headless session; guide the user to unlock it rather than re-login.
-    if (/authorization was cancell?ed/i.test(detail)) {
-      throw new ProfileCredentialStoreError(
-        "macOS Keychain authorization was canceled — unlock your login keychain (`security unlock-keychain`) and retry; a headless session needs it already unlocked",
-        { cause: error },
-      );
-    }
+    if (isLockedKeychainError(error)) throw unavailableKeychainError(error);
     throw new ProfileCredentialStoreError(`could not write the credential to the macOS Keychain: ${detail}`, { cause: error });
   }
   const stored = await readSecret(service);
@@ -183,6 +199,12 @@ export async function readKeychainSecret(service, { execFileImpl = execFileAsync
     const { stdout } = await execFileImpl("security", args);
     return stdout.trim() || null;
   } catch (error) {
+    // Non-strict readers participate in durable-credential resolution, where a
+    // valid MCP key may still be available from the worktree environment. Keep
+    // their historical null result for a locked Keychain so that fallback stays
+    // reachable. Strict readers (login/migration paths) must surface unlock
+    // guidance instead of treating the inaccessible slot as empty.
+    if (strict && isLockedKeychainError(error)) throw unavailableKeychainError(error);
     // Non-strict (default, back-compat): any failure reads as "no value". Strict:
     // only a genuine not-found is null; a real read failure is re-thrown so the
     // caller can fail closed instead of mistaking it for an empty slot.
@@ -191,6 +213,29 @@ export async function readKeychainSecret(service, { execFileImpl = execFileAsync
   }
 }
 
+// Test the actual store before an OAuth flow creates a one-time authorization
+// grant. A fresh random service avoids touching any durable credential. The
+// cleanup attempt lives in finally so a successful probe never leaves a scratch
+// item behind, even if removal itself is denied.
+export async function preflightKeychainWrite({
+  platform = process.platform,
+  exists = existsSync,
+  env = process.env,
+  random = randomUUID,
+  writeSecret = writeKeychainSecret,
+  deleteSecret = deleteKeychainSecret,
+} = {}) {
+  if (!keychainAvailable(platform, exists, env)) return false;
+  const service = `BOTBUDDY_LOGIN_PREFLIGHT_${random()}`;
+  const probe = random();
+  try {
+    await writeSecret(service, probe);
+    return true;
+  } finally {
+    await deleteSecret(service).catch(() => false);
+  }
+}
+
 export async function deleteKeychainSecret(service, { execFileImpl = execFileAsync, keychain = null } = {}) {
   if (!service) return false;
   const args = ["delete-generic-password", "-s", service, "-a", userInfo().username];

package/src/auth.mjs

@@ -17,6 +17,7 @@ import {
   pollDeviceToken,
 } from "./oauth-device.mjs";
 import { hostname as osHostname } from "node:os";
+import { preflightKeychainWrite } from "./agent-credential-store.mjs";
 
 // A login that could not complete. commands.mjs turns this into one terminal
 // error line; the core never calls process.exit so it stays unit-testable.
@@ -134,7 +135,17 @@ export async function doLogin(options = {}, deps = {}) {
     now = () => Date.now(),
     persist = persistOwnerToken,
     createReceiver = createLoopbackReceiver,
+    preflightKeychain = preflightKeychainWrite,
   } = deps;
+  // BOT-2078: minting a device grant before discovering that macOS cannot
+  // retain it wastes a human's one-time approval. Probe the active Keychain
+  // first; on Linux and explicit BOTBUDDY_NO_KEYCHAIN fallback this is a no-op.
+  try {
+    await preflightKeychain();
+  } catch (error) {
+    if (error?.code === "client_key_unavailable") throw new LoginError(error.message);
+    throw error;
+  }
   if (options.device === true) {
     return doDeviceLogin(options, { ...deps, serverUrl, fetchImpl, saveConfig, getConfig, log, errorLog, now, persist });
   }