@botbuddy/cli 1.45.0 → 1.45.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.45.0",
+  "version": "1.45.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/wait-core.mjs

@@ -436,10 +436,13 @@ function prSubjectMatches(subjectKey, params) {
   return subjectKey.startsWith(`${params.repo}#`);
 }
 
-// Does a commit field on a signal payload start with the condition's sha prefix?
-// A missing / non-string field never matches a sha-scoped condition.
+// Does a commit field on a signal payload identify the same commit as the
+// condition's SHA? GitHub may send either side as a 7–40-character prefix, so
+// accept either prefix direction while refusing malformed payload values.
 function shaPrefixMatches(value, sha) {
-  return typeof value === "string" && value.trim().toLowerCase().startsWith(sha);
+  if (typeof value !== "string") return false;
+  const candidate = value.trim().toLowerCase();
+  return /^[0-9a-f]{7,40}$/.test(candidate) && (candidate.startsWith(sha) || sha.startsWith(candidate));
 }
 
 // BOT-1975: optional head scoping for pr-state. pr_state signals carry the PR

package/src/wait.mjs

@@ -78,8 +78,8 @@ CONDITIONS  (TYPE:key=val,key=val — repeat for several; --any wakes on the fir
                                       by the PR read model. Omit pr= to wake on ANY of your PRs
                                       in the repo; or pass pr=<owner/repo#n> in one value. A
                                       conflict/clean flip sets payload.mergeable_changed. The
-                                      payload carries head_ref_oid; sha=<head> (7-40 hex, a
-                                      prefix is fine) wakes only on signals for that head, so a
+                                      payload carries head_ref_oid; sha=<head> (7-40 hex; either
+                                      side may be an abbreviated prefix) wakes only on signals for that head, so a
                                       previous head's check result can't wake you. A push alone
                                       emits nothing — the head rides on the next transition.
   pr-review:repo=<owner/repo>[,pr=<n>][,reviewer=<login>][,sha=<commit>]
@@ -96,7 +96,7 @@ CONDITIONS  (TYPE:key=val,key=val — repeat for several; --any wakes on the fir
                                       existing review will not re-wake it.
                                       reviewer=<login> wakes only on that reviewer (case-
                                       insensitive; a trailing [bot] is ignored). sha=<commit>
-                                      wakes only on verdicts for that commit (submitted reviews
+                                      wakes only on verdicts for that commit (either side may be an abbreviated prefix; submitted reviews
                                       and clean passes carry commit_sha; thread comments do not,
                                       so they never match sha=); the usage-limit decline always
                                       passes sha=. Any other key is refused (exit 4).