@botbuddy/cli 1.45.2 → 1.45.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.45.2",
+  "version": "1.45.4",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-doctor.mjs

@@ -77,6 +77,12 @@ export function repairFailureRecovery(code, error = null) {
   if (code === "client_key_unavailable") {
     return "the client key could not be read (locked or failing credential store); unlock it, then run `bb doctor --fix`";
   }
+  // BOT-1787: this is a server-side identity conflict, not an authentication
+  // failure. Preserve the real remedy so a healthy credential is never needlessly
+  // rotated; `bb setup` clears this worktree's cache and re-registers it.
+  if (code === "agent_tenant_immutable") {
+    return "this worktree's agent identity belongs to another tenant; run `bb setup` to register this tenant, then `bb doctor --fix`";
+  }
   // BOT-1750 (Codex R9 P2): `session_mint_unauthorized` means a locally-unexpired
   // client key was revoked/rejected server-side — only a fresh login replaces it, so
   // point at `bb login`, not a binding repair (the binding is valid).

package/src/api.mjs

@@ -445,7 +445,13 @@ export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, sig
   }
   let payload;
   try { payload = await res.json(); } catch { return { ok: false, status: res.status, error: "invalid_json" }; }
-  if (payload.error?.message) return { ok: false, status: res.status, error: payload.error.message };
+  if (payload.error?.message) {
+    // Typed domain errors retain their verdict inside the HTTP-200 JSON-RPC
+    // envelope. Do not infer credential failure from an identity conflict.
+    const code = payload.error.data?.code;
+    return { ok: false, status: res.status, error: payload.error.message,
+      ...(typeof code === "string" && code ? { code } : {}) };
+  }
   const text = payload.result?.content?.map((c) => c.text).filter(Boolean).join("\n") ?? "";
   let data;
   try { data = text ? JSON.parse(text) : {}; } catch { data = { raw: text }; }

package/src/wait-core.mjs

@@ -234,8 +234,9 @@ const VALIDATORS = {
   // BOT-1507 — scope=next adds a fourth, LIVE-ONLY selector: it names no run or PR
   // (they must already exist at arm time) and wakes on the first terminal CI run for
   // the repo delivered AFTER the wait was armed — the post-merge / cron train case.
-  // Optional branch=/workflow= filter that first run; both are valid ONLY with
-  // scope=next (a run_id/sha/latest wait already names its run).
+  // Optional branch=/workflow= filter that first run; branch is valid only with
+  // scope=next. A workflow also pins a level-triggered sha= recovery to one
+  // canonical workflow identity.
   // BOT-1685 — scope=next also accepts an optional sha= FILTER (distinct from the
   // level-triggered sha= selector): a wait armed BEFORE re-dispatching a run for a
   // known commit then wakes on the NEXT terminal run for THAT commit, instead of
@@ -253,10 +254,11 @@ const VALIDATORS = {
     if ((shaIsNextFilter ? selectors.length - 1 : selectors.length) !== 1) {
       throw new Error("ci needs exactly one of scope=latest|next | run_id=<id> | sha=<sha>");
     }
-    const hasFilter = p.branch !== undefined || p.workflow !== undefined;
+    const hasBranchFilter = p.branch !== undefined;
+    const hasWorkflowFilter = p.workflow !== undefined;
     if (p.scope !== undefined) {
       if (p.scope === "latest") {
-        if (hasFilter) throw new Error("ci branch=/workflow= are only valid with scope=next");
+        if (hasBranchFilter || hasWorkflowFilter) throw new Error("ci branch=/workflow= are only valid with scope=next");
         if (p.pr === undefined || !/^\d+$/.test(String(p.pr).trim())) {
           throw new Error("ci scope=latest needs pr=<number>");
         }
@@ -278,13 +280,17 @@ const VALIDATORS = {
       }
       throw new Error("ci scope must be 'latest' or 'next' (or use run_id=/sha=)");
     }
-    if (hasFilter) throw new Error("ci branch=/workflow= are only valid with scope=next");
+    if (hasBranchFilter || (hasWorkflowFilter && p.sha === undefined)) {
+      throw new Error("ci branch= is only valid with scope=next; workflow= also accepts an exact sha selector");
+    }
     if (p.run_id !== undefined) {
       if (!String(p.run_id).trim()) throw new Error("ci run_id must be non-empty");
       return { repo, scope: "run_id", runId: String(p.run_id).trim(), pr: p.pr != null ? String(p.pr).trim() : null };
     }
     if (!String(p.sha).trim()) throw new Error("ci sha must be non-empty");
-    return { repo, scope: "sha", sha: String(p.sha).trim(), pr: p.pr != null ? String(p.pr).trim() : null };
+    const workflow = p.workflow === undefined ? null : String(p.workflow).trim();
+    if (p.workflow !== undefined && workflow === "") throw new Error("ci workflow= must be non-empty");
+    return { repo, scope: "sha", sha: String(p.sha).trim(), workflow, pr: p.pr != null ? String(p.pr).trim() : null };
   },
   "staging-green"(p) {
     const repo = p.repo != null ? String(p.repo).trim() : null;
@@ -986,7 +992,12 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
       // Repo is pinned via the payload (subject may be run:<id> for uncorrelated runs).
       if (String(signal.payload?.repo ?? "").toLowerCase() !== params.repo.toLowerCase()) return false;
       if (params.scope === "run_id") return String(signal.payload?.run_id) === params.runId;
-      if (params.scope === "sha") return signal.payload?.head_sha === params.sha;
+      if (params.scope === "sha") {
+        if (signal.payload?.head_sha !== params.sha) return false;
+        if (params.workflow == null) return true;
+        const workflow = signal.payload?.workflow_name;
+        return typeof workflow === "string" && workflow.trim().toLowerCase() === params.workflow.trim().toLowerCase();
+      }
       if (params.scope === "next") {
         // BOT-1507 — live-only: the first TERMINAL run for the repo. Never keys on
         // subject_key (it is run:<id> for post-merge runs and owner/repo#n for PR

package/src/botbuddy-release-repair.json

@@ -1 +0,0 @@
-{"schema_version":1,"source_version":"1.45.1","source_identity":"2fa051c4d0ee5cb09fda8d9e15c4952af94d701a6a43e98c8831912040cb41f2"}