@botbuddy/cli 1.40.4 → 1.40.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.40.4",
+  "version": "1.40.6",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-credential-store.mjs

@@ -2,6 +2,7 @@ import { userInfo } from "node:os";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
 import { existsSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 
 const execFileAsync = promisify(execFile);
 
@@ -41,6 +42,28 @@ export class ProfileCredentialStoreError extends Error {
   }
 }
 
+export const KEYCHAIN_UNLOCK_GUIDANCE = "the macOS login Keychain is locked in this SSH session — run `security unlock-keychain ~/Library/Keychains/login.keychain-db` on this host, then re-run. Alternatively set `BOTBUDDY_NO_KEYCHAIN=1` to use the explicit 0600-file store.";
+
+// `security` reports this locked-SSH-session condition inconsistently: some
+// paths say authorization was canceled, while the failed write in BOT-2078 was
+// exit 36 / "User interaction is not allowed". Keep one classifier so every
+// Keychain reader and writer gives the same recovery rather than suggesting an
+// unnecessary new login.
+export function isLockedKeychainError(error) {
+  const detail = String(error?.stderr ?? error?.message ?? error ?? "");
+  return Number(error?.code) === 36
+    || /(?:security\s+)?exited\s+36\b/i.test(detail)
+    || /user interaction is not allowed/i.test(detail)
+    || /authorization was cancell?ed/i.test(detail);
+}
+
+function unavailableKeychainError(cause) {
+  return new ProfileCredentialStoreError(KEYCHAIN_UNLOCK_GUIDANCE, {
+    cause,
+    code: "client_key_unavailable",
+  });
+}
+
 function writePasswordPrompt(command, args, password, spawnProcess) {
   return new Promise((resolve, reject) => {
     // BOT-1566: `security -w` (prompt mode) reads the secret with
@@ -134,14 +157,7 @@ export async function writeKeychainSecret(service, token, {
         { cause: error, code: "keychain_item_exists" },
       );
     }
-    // `security` cancels its authorization when the login keychain is locked in
-    // a headless session; guide the user to unlock it rather than re-login.
-    if (/authorization was cancell?ed/i.test(detail)) {
-      throw new ProfileCredentialStoreError(
-        "macOS Keychain authorization was canceled — unlock your login keychain (`security unlock-keychain`) and retry; a headless session needs it already unlocked",
-        { cause: error },
-      );
-    }
+    if (isLockedKeychainError(error)) throw unavailableKeychainError(error);
     throw new ProfileCredentialStoreError(`could not write the credential to the macOS Keychain: ${detail}`, { cause: error });
   }
   const stored = await readSecret(service);
@@ -183,6 +199,12 @@ export async function readKeychainSecret(service, { execFileImpl = execFileAsync
     const { stdout } = await execFileImpl("security", args);
     return stdout.trim() || null;
   } catch (error) {
+    // Non-strict readers participate in durable-credential resolution, where a
+    // valid MCP key may still be available from the worktree environment. Keep
+    // their historical null result for a locked Keychain so that fallback stays
+    // reachable. Strict readers (login/migration paths) must surface unlock
+    // guidance instead of treating the inaccessible slot as empty.
+    if (strict && isLockedKeychainError(error)) throw unavailableKeychainError(error);
     // Non-strict (default, back-compat): any failure reads as "no value". Strict:
     // only a genuine not-found is null; a real read failure is re-thrown so the
     // caller can fail closed instead of mistaking it for an empty slot.
@@ -191,6 +213,29 @@ export async function readKeychainSecret(service, { execFileImpl = execFileAsync
   }
 }
 
+// Test the actual store before an OAuth flow creates a one-time authorization
+// grant. A fresh random service avoids touching any durable credential. The
+// cleanup attempt lives in finally so a successful probe never leaves a scratch
+// item behind, even if removal itself is denied.
+export async function preflightKeychainWrite({
+  platform = process.platform,
+  exists = existsSync,
+  env = process.env,
+  random = randomUUID,
+  writeSecret = writeKeychainSecret,
+  deleteSecret = deleteKeychainSecret,
+} = {}) {
+  if (!keychainAvailable(platform, exists, env)) return false;
+  const service = `BOTBUDDY_LOGIN_PREFLIGHT_${random()}`;
+  const probe = random();
+  try {
+    await writeSecret(service, probe);
+    return true;
+  } finally {
+    await deleteSecret(service).catch(() => false);
+  }
+}
+
 export async function deleteKeychainSecret(service, { execFileImpl = execFileAsync, keychain = null } = {}) {
   if (!service) return false;
   const args = ["delete-generic-password", "-s", service, "-a", userInfo().username];

package/src/auth.mjs

@@ -17,6 +17,7 @@ import {
   pollDeviceToken,
 } from "./oauth-device.mjs";
 import { hostname as osHostname } from "node:os";
+import { preflightKeychainWrite } from "./agent-credential-store.mjs";
 
 // A login that could not complete. commands.mjs turns this into one terminal
 // error line; the core never calls process.exit so it stays unit-testable.
@@ -134,7 +135,17 @@ export async function doLogin(options = {}, deps = {}) {
     now = () => Date.now(),
     persist = persistOwnerToken,
     createReceiver = createLoopbackReceiver,
+    preflightKeychain = preflightKeychainWrite,
   } = deps;
+  // BOT-2078: minting a device grant before discovering that macOS cannot
+  // retain it wastes a human's one-time approval. Probe the active Keychain
+  // first; on Linux and explicit BOTBUDDY_NO_KEYCHAIN fallback this is a no-op.
+  try {
+    await preflightKeychain();
+  } catch (error) {
+    if (error?.code === "client_key_unavailable") throw new LoginError(error.message);
+    throw error;
+  }
   if (options.device === true) {
     return doDeviceLogin(options, { ...deps, serverUrl, fetchImpl, saveConfig, getConfig, log, errorLog, now, persist });
   }

package/src/stack.mjs

@@ -88,6 +88,8 @@ ${bold("up OPTIONS")}
   --idle-ttl <seconds>   Idle seconds before the reaper STOPS an unused stack (default 1800).
   --timeout <seconds>    Max seconds to park for capacity before giving up (default ${DEFAULT_TIMEOUT_SEC}).
   --no-wait              If the host is full, print the queue position and exit (don't park).
+  --claim-only           LOCAL-EXEC only: wait for and hold a provisioning lease without starting
+                         Supabase. Resume with the identical \`stack up --local-exec\` command.
   --wait-capacity <dur>  Opt-in (BOT-2024): on a TRANSIENT HOST_CAPACITY_SOURCE_STALE refusal, park
                          on the server's \`bb wait 'capacity:…'\` up to <dur> (90s, 10m, 1h) and
                          re-attempt admission once when it matches. Sustained refusals, the
@@ -189,7 +191,7 @@ export function parseStackArgs(argv) {
     slot: null, host: null, repo: null, ticket: null, ticketUrl: null,
     prId: null, prUrl: null, purpose: null, idleTtl: null, stackPath: ".", stackPathExplicit: false,
     timeout: DEFAULT_TIMEOUT_SEC, provisionTimeout: null, reapTimeout: 300, hardTtl: null,
-    connectionFile: null, noWait: false, localExec: false, waitCapacity: null,
+    connectionFile: null, noWait: false, claimOnly: false, localExec: false, waitCapacity: null,
     dockerContext: null, dockerEndpoint: null,
     disposition: "destroy", json: false, receiptMaxBytes: DEFAULT_RECEIPT_MAX_BYTES,
   };
@@ -271,6 +273,7 @@ export function parseStackArgs(argv) {
         break;
       }
       case "--no-wait": opts.noWait = true; break;
+      case "--claim-only": opts.claimOnly = true; break;
       case "--local-exec": opts.localExec = true; break;
       case "--docker-context": if (need(a, rest[i + 1])) opts.dockerContext = rest[++i]; break;
       case "--docker-endpoint": if (need(a, rest[i + 1])) opts.dockerEndpoint = rest[++i]; break;
@@ -305,6 +308,9 @@ export function parseStackArgs(argv) {
   if (opts.waitCapacity != null && !["up", "run"].includes(command)) {
     errors.push("--wait-capacity is valid only with `stack up` or `stack run`");
   }
+  if (opts.claimOnly && (command !== "up" || !opts.localExec)) {
+    errors.push("--claim-only is valid only with `stack up --local-exec`");
+  }
   if ((opts.dockerContext || opts.dockerEndpoint) && !(["up", "done"].includes(command) && opts.localExec)) {
     errors.push("--docker-context and --docker-endpoint are valid only with `stack up --local-exec` or `stack done --local-exec`");
   }
@@ -1696,6 +1702,23 @@ export async function cmdUp(opts, {
   }
   reportLaneStatus({ phase: "testing", reason: "provisioning" });
 
+  // BOT-2089: an expensive hermetic preparation (template restore) must not lose
+  // an admission slot after the queue grants it. Keep this deliberately narrow:
+  // only a local-exec caller may hold an unreserved provisioning lease, and it
+  // must resume through the normal `stack up` path that reserves before start.
+  if (opts.claimOnly) {
+    if (state !== "provisioning") {
+      return emitResult(buildReceipt({
+        command: "up", outcome: "error", lease_id: leaseId, state, slot,
+        error: `claim-only lease is ${state}, not provisioning`,
+      }), opts, EXIT.LEASE_FAILED);
+    }
+    return emitResult(buildReceipt({
+      command: "up", outcome: "claimed", lease_id: leaseId, state, host_key: d.host_key, slot,
+      idle_ttl_secs: d.idle_ttl_secs, resource_name: d.resource_name,
+    }), opts, EXIT.OK);
+  }
+
   // Reach `active`: local-exec provisions itself; otherwise wait for the Helper.
   if (state !== "active") {
     if (opts.localExec) {