@botbuddy/cli 1.45.6 → 1.46.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.45.6",
+  "version": "1.46.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/run.mjs

@@ -15,7 +15,9 @@ import { fileURLToPath } from "node:url";
 import { callToolJson } from "./api.mjs";
 import { parseLaneEvents, laneCaseCounts, flushLaneCases, buildLaneSummary, laneSummaryFilename } from "./test-lane-events.mjs";
 import { AGENT_KEY_RE, readAgentSessionTokenEnv, legacyAgentAliasHint } from "./agent-key.mjs";
-import { clearAgentState, isRejectedCachedMcpSession, resolveAgentSessionCredential } from "./agent-session.mjs";
+import { hasAgentSessionRuntime, isRejectedCachedMcpSession, resolveAgentSessionCredential, selfHealAgentSession } from "./agent-session.mjs";
+import { isAgentStateFresh, readAgentState, worktreeRoot } from "./agent-state.mjs";
+import { readAgentBinding } from "./wait-profile.mjs";
 import { createTelemetryOutbox } from "./telemetry-outbox.mjs";
 import { deliverExecutionEvent } from "./telemetry-delivery.mjs";
 import { attestTelemetryCredential, loadTelemetryIdentity } from "./telemetry-config.mjs";
@@ -231,49 +233,82 @@ function workerInvocation(context) {
   return [process.execPath, [bin, "run", "--worker", context]];
 }
 
+function sessionFailure(code) { return Object.assign(new Error(code), { code }); }
+
+// A selected ID is metadata, not a credential. Require positive private-cache
+// authority before resolving it; never let the API's ambient owner key stand in.
+async function resolveRunCredential({ cwd, env, opts, resolveCredential }) {
+  const cached = await readAgentState(cwd);
+  const explicitId = opts.sessionId;
+  const validateBinding = async (identity) => {
+    const bound = await readAgentBinding(cwd);
+    if (!bound?.tenant || identity?.tenant !== bound.tenant || !identity?.worktree
+      || await worktreeRoot(identity.worktree) !== await worktreeRoot(cwd)) {
+      throw sessionFailure("run_session_binding_mismatch");
+    }
+  };
+  if (explicitId && !cached) throw sessionFailure("run_session_authority_missing");
+  if (cached) {
+    if (explicitId && cached.session_id !== explicitId) throw sessionFailure("run_session_mismatch");
+    await validateBinding(cached);
+    if (explicitId && !isAgentStateFresh(cached, new Date())) throw sessionFailure("run_session_expired");
+  } else if (await hasAgentSessionRuntime({ cwd })) {
+    throw sessionFailure("run_session_authority_missing");
+  }
+  const credential = await (resolveCredential ?? resolveAgentSessionCredential)({ cwd, env,
+    sessionId: explicitId, flagToken: null });
+  // The resolver reads again. A concurrent replacement must satisfy the same
+  // binding and explicit ID rather than silently adopting unrelated authority.
+  if (credential.source === "cache") {
+    await validateBinding(credential.identity);
+    if (explicitId && credential.identity?.sessionId !== explicitId) throw sessionFailure("run_session_mismatch");
+  }
+  return credential;
+}
+
+function rejectedSessionReceipt(error, runId) {
+  const code = error?.code ?? "agent_session_unavailable";
+  const exitCode = ["session_mint_failed", "session_mint_invalid"].includes(code) ? EXIT.BACKEND : EXIT.AUTH;
+  return { exitCode, receipt: { schema_version: RUN_SCHEMA_VERSION, outcome: "rejected",
+    ...(runId ? { run_id: runId } : {}), error: code,
+    recovery: code === "client_key_required"
+      ? "run `bb login` to install the durable client key, then retry"
+      : "run `bb doctor --fix` and select the current worktree session, then retry",
+    exit_code: exitCode } };
+}
+
 export async function launchRun(argv, {
   cwd = process.cwd(), spawnImpl = spawn, call = null, childEnv = null, testRun = null,
-  resolveCredential = null, env = process.env,
+  resolveCredential = null, renewCredential = selfHealAgentSession, env = process.env,
 } = {}) {
-  let effectiveArgv = argv;
-  let parsed = parseRunArgs(effectiveArgv, env);
+  const parsed = parseRunArgs(argv, env);
   let managedCredential = null;
   // A local test double owns its credential boundary; production invocations
   // self-heal when the session credential was not supplied by flag or env.
   // Keep all other usage failures local and deterministic before minting.
   const onlyMissingIdentity = parsed.errors.length === 1 && parsed.errors[0].includes("session-id");
-  if (!parsed.opts.foreground && !parsed.opts.sessionId && !parsed.opts.sessionToken
-    && onlyMissingIdentity && (resolveCredential || call === null)) {
+  if (!parsed.opts.foreground && !parsed.opts.sessionToken
+    && (parsed.errors.length === 0 || onlyMissingIdentity)
+    && (resolveCredential || call === null || call === callToolJson)) {
     try {
-      const credential = await (resolveCredential ?? resolveAgentSessionCredential)({ argv, env, cwd });
+      const credential = await resolveRunCredential({ cwd, env, opts: parsed.opts, resolveCredential });
       managedCredential = credential;
-      effectiveArgv = ["--agent-session-token", credential.token, ...argv];
-      parsed = parseRunArgs(effectiveArgv, env);
+      parsed.opts.sessionToken = credential.token;
+      if (!SESSION_TOKEN_RE.test(credential.token)) throw sessionFailure("session_mint_invalid");
+      if (onlyMissingIdentity) parsed.errors.length = 0;
     } catch (error) {
-      return {
-        exitCode: EXIT.AUTH,
-        receipt: {
-          schema_version: RUN_SCHEMA_VERSION,
-          outcome: "rejected",
-          error: error?.code ?? "agent_session_unavailable",
-          recovery: error?.code === "client_key_required"
-            ? "run `bb login` to install the durable client key, then retry"
-            : "run `bb doctor --fix` to repair agent authentication, then retry",
-          exit_code: EXIT.AUTH,
-        },
-      };
+      return rejectedSessionReceipt(error);
     }
   }
   const { opts, command, errors } = parsed;
   if (errors.length) return { exitCode: EXIT.INVALID, receipt: { schema_version: RUN_SCHEMA_VERSION, outcome: "rejected", errors, exit_code: EXIT.INVALID } };
   // BOT-1572 (AC-8): when a session token is present it is the credential — pin it
   // so register_command authenticates as the session's agent and derives session_id
-  // from the token. Tests inject `call` directly and bypass this.
-  const effectiveCall = call ?? (opts.sessionToken
-    ? (t, a) => callToolJson(t, a, { auth: { "x-agent-api-key": opts.sessionToken } })
-    : callToolJson);
+  // from the token. Read the current token on each call, including after renewal.
+  const effectiveCall = (t, a) => (call ?? callToolJson)(t, a,
+    opts.sessionToken ? { auth: { "x-agent-api-key": opts.sessionToken } } : {});
   const runId = randomUUID();
-  const registerArgs = {
+  const registerArgs = () => ({
     // Omit session_id entirely when only a token is present — the backend derives
     // it. A plain id is still sent (and honoured) when supplied.
     ...(opts.sessionId ? { session_id: opts.sessionId } : {}),
@@ -281,18 +316,22 @@ export async function launchRun(argv, {
     command_hash: commandHash(command), environment_hash: environmentHash(cwd, opts.environment),
     environment: opts.environment, command_kind: opts.kind, expected_duration_seconds: opts.expectedDuration,
     rerun_reason: opts.rerunReason,
-  };
-  let registration = await effectiveCall("register_command", registerArgs);
+  });
+  let registration = await effectiveCall("register_command", registerArgs());
   // A cached session can be revoked server-side before its local expiry.  The
   // managed cache is ours to replace once; explicit flag/env credentials belong
   // to the caller and are never silently rotated.
   if (isRejectedCachedMcpSession(registration, managedCredential?.source, 0)) {
-    await clearAgentState(cwd);
-    const credential = await (resolveCredential ?? resolveAgentSessionCredential)({ argv, env, cwd });
-    managedCredential = credential;
-    opts.sessionToken = credential.token;
-    opts.sessionId = credential.sessionId ?? opts.sessionId;
-    registration = await effectiveCall("register_command", registerArgs);
+    try {
+      const credential = await renewCredential({ cwd, env, force: true, rejectedCredential: {
+        token: managedCredential.token, identity: managedCredential.identity,
+      } });
+      managedCredential = credential;
+      opts.sessionToken = credential.token;
+      opts.sessionId = credential.identity?.sessionId ?? credential.sessionId;
+      if (!SESSION_TOKEN_RE.test(opts.sessionToken) || !opts.sessionId) throw sessionFailure("session_mint_invalid");
+      registration = await effectiveCall("register_command", registerArgs());
+    } catch (error) { return rejectedSessionReceipt(error, runId); }
   }
   if (!registration.ok || registration.isError || !registration.data?.accepted || !registration.data?.run_credential) {
     return { exitCode: EXIT.BACKEND, receipt: { schema_version: RUN_SCHEMA_VERSION, outcome: "rejected", run_id: runId, error: registration.data?.error ?? registration.error ?? "durable_owner_not_established", exit_code: EXIT.BACKEND } };
@@ -310,7 +349,10 @@ export async function launchRun(argv, {
     await effectiveCall("update_command_run", { run_id: runId, run_credential: registration.data.run_credential, status: "owner_lost", invalidated_reason: `launcher_failed:${error instanceof Error ? error.message : String(error)}` });
     return { exitCode: EXIT.INTERNAL, receipt: { schema_version: RUN_SCHEMA_VERSION, outcome: "owner_lost", run_id: runId, exit_code: EXIT.INTERNAL } };
   }
-  return { exitCode: EXIT.OK, receipt: { schema_version: RUN_SCHEMA_VERSION, outcome: "launched", run_id: runId, session_id: opts.sessionId, durable_owner: "detached_worker", receipt_path: receipt, reentry: "update_command_run publishes the terminal callback for this run_id", exit_code: EXIT.OK } };
+  const knownSession = opts.sessionId ?? managedCredential?.identity?.sessionId ?? managedCredential?.sessionId;
+  return { exitCode: EXIT.OK, receipt: { schema_version: RUN_SCHEMA_VERSION, outcome: "launched", run_id: runId,
+    ...(knownSession ? { session_id: knownSession } : { session_binding: "server_derived" }),
+    durable_owner: "detached_worker", receipt_path: receipt, reentry: "update_command_run publishes the terminal callback for this run_id", exit_code: EXIT.OK } };
 }
 
 export async function runWorker(contextFile, { spawnImpl = spawn, call = callToolJson } = {}) {

package/src/stack.mjs

@@ -33,8 +33,7 @@ import { callToolJson, CALL_AUTH_ERROR_CODES } from "./api.mjs";
 import { SERVER_URL, getConfig } from "./config.mjs";
 import { resolveOwnerToken, resolveAgentKey } from "./cli-credentials.mjs";
 import { AGENT_KEY_RE, readAgentSessionTokenEnv } from "./agent-key.mjs";
-import { resolveAgentSessionCredential } from "./agent-session.mjs";
-import { clearAgentState } from "./agent-state.mjs";
+import { resolveAgentSessionCredential, selfHealAgentSession } from "./agent-session.mjs";
 import { runDockerCommand, runDockerWorkflow, ADMITTED_DOCKER_VALIDATIONS } from "./docker-hygiene.mjs";
 import { acquireStackLock, lockPathForProject, projectIdFromConfig } from "./stack-file-lock.mjs";
 import { assertLeasedStackIsolated, leasedStackIdentity, materializeRunStackDir, portMapInConfig, refreshLeasedStackRetention, releaseLeasedStackClaim, reservePortBlocks } from "./stack-isolation.mjs";
@@ -828,7 +827,7 @@ export async function stackAuthHeader({
     // and silently authenticate as the OAuth/MCP-key principal, which is the exact
     // principal switch the catch above guards against.
     if (typeof credential.token === "string" && AGENT_KEY_RE.test(credential.token)) {
-      return withSource({ "x-agent-api-key": credential.token }, credential.source);
+      return withSource({ "x-agent-api-key": credential.token }, credential.source, credential.identity);
     }
     throw Object.assign(new Error(`resolved agent session token has an unexpected shape (source: ${credential.source ?? "unknown"}); re-run \`bb doctor --fix\``), { code: "session_token_malformed" });
   }
@@ -848,37 +847,39 @@ export async function stackAuthHeader({
 }
 
 // BOT-1750 (Codex R7 P2): carry the credential SOURCE on the returned headers as a
-// NON-enumerable property, so callers can clear+self-heal+retry once on a
+// NON-enumerable property, so callers can renew+retry once on a
 // server-rejected cached session (parity with run/test/pw/wait) without the source
 // ever leaking into the spread fetch headers.
-function withSource(headers, source) {
+function withSource(headers, source, identity = null) {
   Object.defineProperty(headers, "__source", { value: source ?? null, enumerable: false });
+  Object.defineProperty(headers, "__identity", { value: identity, enumerable: false });
   return headers;
 }
 
 /**
  * BOT-1750 (Codex R7 P2): a locally-fresh cache whose token was revoked server-side
  * (e.g. a concurrent re-registration rotated the session) is rejected at the lease
- * RPC. Mirror the other consumers: when the FIRST auth came from the per-worktree
- * cache and the RPC returns an auth rejection, clear the cache and self-heal once,
- * then let the caller retry with the fresh headers. Returns the fresh headers, or
- * null when no retry applies (not cache-sourced, or the refresh could not authenticate).
+ * RPC. Renew once without deleting the cache or losing lease ownership identity.
+ * The shared lock re-reads and verifies the cache; a concurrent renewal wins.
+ * Failure leaves the existing cache untouched and propagates its typed error.
  */
 export async function refreshRejectedCacheAuth(auth, {
-  cwd = process.cwd(), authProvider = stackAuthHeader, clear = clearAgentState,
+  cwd = process.cwd(), renew = selfHealAgentSession,
 } = {}) {
   if (auth?.__source !== "cache") return null;
-  await clear(cwd);
-  const fresh = await authProvider();
-  // BOT-1750 (Codex R8 P2): retry ONLY with a genuinely self-healed session. If the
-  // client key or binding vanished after clearing the cache, authProvider falls
-  // through to the OAuth/MCP operator credential — a DIFFERENT principal whose token
-  // also differs, so a bare "different token" check would retry as the wrong agent.
-  // Require source "minted" AND a well-formed, changed session token.
-  if (fresh?.__source !== "minted") return null;
-  const token = fresh["x-agent-api-key"];
+  return renewStackSession(auth, { cwd, renew });
+}
+
+async function renewStackSession(auth, { cwd, renew }) {
+  const credential = await renew({ cwd, force: true,
+    rejectedCredential: { token: auth["x-agent-api-key"], identity: auth.__identity } });
+  // BOT-1750 (Codex R8 P2): the renewal adapter must never yield an operator
+  // principal. "cache" is permitted
+  // only for a newer same-identity session verified inside the renewal lock.
+  if (credential?.source !== "minted" && credential?.source !== "cache") return null;
+  const token = credential.token;
   if (typeof token !== "string" || !AGENT_KEY_RE.test(token) || token === auth["x-agent-api-key"]) return null;
-  return fresh;
+  return withSource({ "x-agent-api-key": token }, credential.source, credential.identity);
 }
 
 /**
@@ -886,8 +887,8 @@ export async function refreshRejectedCacheAuth(auth, {
  * server-rejected cached session ONCE — the owner-scoped management commands
  * (`status`/`touch`/`done`) need the same recovery as the lease-creating paths, or a
  * revoked-but-locally-fresh cache leaves an active lease unreleasable. `init()`
- * resolves auth; `call()` runs the RPC and, on the FIRST auth rejection, clears +
- * self-heals + retries with the fresh credential (every later `call` reuses it).
+ * resolves auth; `call()` runs the RPC and, on the FIRST auth rejection, renews +
+ * retries with the fresh credential (every later `call` reuses it).
  */
 export function retryingStackCall({
   callTool = callToolJson, authProvider = stackAuthHeader,
@@ -1362,25 +1363,18 @@ function abortableSleep(ms, signal) {
  * BOT-2099: re-establish the credential a parked lease waits with. On a transport failure
  * the credential is fine — keep it. On an auth rejection, first re-read (another process in
  * this worktree may already have re-minted, and minting again would supersede it), then
- * clear the per-worktree cache and self-heal once. Only a well-formed agent SESSION token
+ * renew under the shared cache lock without removing recovery identity. Only a well-formed agent SESSION token
  * replaces a session credential: the operator fallback is a different principal that
  * cannot see the lease (BOT-1750 R8), so it is never adopted. Throws the mint error, which
  * the park treats as one more failed attempt.
  */
 export async function reauthenticateParkedLease(current, kind, {
-  cwd = process.cwd(), authProvider = stackAuthHeader, clear = clearAgentState,
+  cwd = process.cwd(), renew = selfHealAgentSession,
 } = {}) {
   if (kind !== "auth") return current;
   const source = current?.__source ?? null;
   if (source !== "cache" && source !== "minted") return current;
-  const isFreshSession = (h) => (h?.__source === "cache" || h?.__source === "minted")
-    && typeof h["x-agent-api-key"] === "string" && AGENT_KEY_RE.test(h["x-agent-api-key"])
-    && h["x-agent-api-key"] !== current["x-agent-api-key"];
-  const reread = await authProvider();
-  if (isFreshSession(reread)) return reread;
-  await clear(cwd);
-  const minted = await authProvider();
-  return isFreshSession(minted) ? minted : current;
+  return (await renewStackSession(current, { cwd, renew })) ?? current;
 }
 
 /**
@@ -2482,7 +2476,7 @@ export async function cmdDone(leaseId, opts, {
 } = {}) {
   // BOT-1750 (Codex R10 P2): `done` must recover a server-rejected cached session on
   // its own — otherwise an active lease can't be released until the cache is manually
-  // repaired. The retrying caller clears+self-heals+retries the FIRST auth rejection.
+  // repaired. The retrying caller renews+retries the FIRST auth rejection.
   const rpc = retryingStackCall({ callTool, authProvider, refresh: refreshAuth });
   const auth = await rpc.init();
   if (!auth) return emitResult(buildReceipt({ command: "done", outcome: "error", lease_id: leaseId, error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
@@ -2839,7 +2833,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   // BOT-1750 (Codex R9/R11 P2): `stack run` is a lease-creating entry point AND a
   // long-lived one (queue → provision → child → heartbeat → cleanup). A cached token
   // can be rotated server-side at ANY of those points, so EVERY RPC — not just the
-  // initial request — must be able to clear + self-heal + retry once. Route them all
+  // initial request — must be able to renew + retry once. Route them all
   // through one retryingStackCall so a single self-heal re-authenticates the rest
   // (heartbeat, get, cleanup release), instead of fencing a healthy child or leaking
   // an unreleasable lease. Retry only when we own the credential or a test provides an
@@ -3110,7 +3104,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       ...(bundle?.included?.length ? { bundle_included: bundle.included } : {}),
       ...(opts.callbackPort != null ? { callback_port: opts.callbackPort } : {}),
     };
-    // The retrying caller (api → rpc.call) transparently clears+self-heals+retries the
+    // The retrying caller (api → rpc.call) transparently renews+retries the
     // FIRST auth rejection among any of request/get/touch/release.
     // BOT-2024: a stale-capacity refusal prints phase-aware guidance; with the opt-in
     // --wait-capacity a TRANSIENT one parks on the server's capacity wait and re-admits once.