@botbuddy/cli 1.47.0 → 1.47.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.47.0",
+  "version": "1.47.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/api.mjs

@@ -353,7 +353,7 @@ export async function resolveCallAuth({
       if (typeof session.token !== "string" || !AGENT_KEY_RE.test(session.token)) {
         return { error: { ok: false, auth: true, error: "session_token_malformed", source: session.source ?? null } };
       }
-      return { auth: { "x-agent-api-key": session.token }, source: session.source ?? null };
+      return { auth: { "x-agent-api-key": session.token }, source: session.source ?? null, sessionToken: true };
     }
   }
   const owner = await resolveOwner();
@@ -392,12 +392,20 @@ function toolEndpoint(tenant) {
   return url.toString();
 }
 
-export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null, resolvePin = resolveDefaultTenantPin } = {}) {
+export async function callToolJson(toolName, args = {}, {
+  fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null, resolvePin = resolveDefaultTenantPin,
+  requireSessionToken = false, resolveAuth = resolveCallAuth,
+} = {}) {
   let auth = pinnedAuth;
+  let sessionTokenSelected = false;
   if (!auth) {
-    const resolved = await resolveCallAuth();
+    const resolved = await resolveAuth({ toolName, preferSession: requireSessionToken });
     if (resolved.error) return resolved.error;
     auth = resolved.auth;
+    sessionTokenSelected = resolved.sessionToken === true;
+  }
+  if (requireSessionToken && !sessionTokenSelected) {
+    return { ok: false, auth: true, error: "session_token_required" };
   }
   // BOT-1571 (Codex P1, round 2): `botbuddy stack` and every other
   // callToolJson caller that passes no explicit tenant would send a USER token

package/src/commands.mjs

@@ -13,6 +13,7 @@ import { agentProfileKeyLabel } from "./credential-kinds.mjs";
 import { buildAcquireResourcesPayload, LocksUsageError } from "./locks.mjs";
 import { CallUsageError, discoveryUrlFor, formatDiscovery, parseCallArgs } from "./discovery.mjs";
 import { cmdStack } from "./stack.mjs";
+import { cmdManagedAllocation } from "./managed-allocation.mjs";
 import { cmdDocker } from "./docker-hygiene.mjs";
 import { cmdRun } from "./run.mjs";
 import { cmdTest } from "./test-lane.mjs";
@@ -59,6 +60,7 @@ export async function run(argv, {
   warnStale = maybeWarnStale,
   errorLog = (line) => console.error(line),
   bootstrap = cmdBootstrap,
+  managedAllocation = cmdManagedAllocation,
 } = {}) {
   const [command, ...args] = argv;
   // BOT-2069: `bootstrap close` can retire a live server session. Parse its
@@ -89,6 +91,7 @@ export async function run(argv, {
     case "unlock": return cmdUnlock(args);
     // BOT-1220: batch-scoped local stack leases (request/park/status/touch/done).
     case "stack": return cmdStack(args);
+    case "allocation": return managedAllocation(args);
     case "docker": return cmdDocker(args);
     case "run": return cmdRun(args);
     case "telemetry": return cmdTelemetry(args);
@@ -209,6 +212,7 @@ ${bold("STACK LEASES")}
   stack touch  <lease_id>    Bump the lease idle clock
   stack done   <lease_id>    Release (done) a lease — reap the stack
   stack help                 Full stack usage + exit codes
+  allocation status <id> <generation> <target_revision>  Verify managed placement before Compose
 
 ${bold("DOCKER HYGIENE")}
   docker hygiene [options]   Dry-run/apply safe stale Supabase cleanup on OrbStack

package/src/managed-allocation.mjs

@@ -0,0 +1,77 @@
+import { callToolJson, CALL_EXIT } from "./api.mjs";
+import { readMachineUuid } from "./machine-id.mjs";
+
+export function parseManagedAllocationArgs(args) {
+  if (args.length === 1 && ["help", "--help", "-h"].includes(args[0])) return { help: true };
+  if (args.length !== 4 || args[0] !== "status") {
+    return { error: "Usage: bb allocation status <allocation_uuid> <generation> <target_revision>" };
+  }
+  const [, id, rawGeneration, rawRevision] = args;
+  const uuid = String(id).trim().toLowerCase();
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(uuid)) {
+    return { error: "allocation id must be a canonical UUID" };
+  }
+  const generation = Number(rawGeneration);
+  const targetRevision = Number(rawRevision);
+  if (!Number.isSafeInteger(generation) || generation < 1 || !Number.isSafeInteger(targetRevision) || targetRevision < 1) {
+    return { error: "generation and target_revision must be positive integers" };
+  }
+  return { command: "status", allocationId: uuid, generation, targetRevision };
+}
+
+export function evaluateLocalStartEligibility(receipt, localMachineUuid) {
+  const server = receipt?.server_start_eligibility;
+  if (server?.eligible !== true) return { eligible: false, reason: server?.reason ?? "server_placement_unverified" };
+  if (typeof localMachineUuid !== "string" || !localMachineUuid.trim()) {
+    return { eligible: false, reason: "local_machine_identity_unavailable" };
+  }
+  const selected = receipt?.placement?.hardware_uuid;
+  if (typeof selected !== "string" || !selected.trim()) {
+    return { eligible: false, reason: "machine_binding_unavailable" };
+  }
+  if (selected.trim().toLowerCase() !== localMachineUuid.trim().toLowerCase()) {
+    return { eligible: false, reason: "selected_machine_mismatch" };
+  }
+  return { eligible: true, reason: null };
+}
+
+export const MANAGED_ALLOCATION_HELP = `bb allocation status <allocation_uuid> <generation> <target_revision>
+
+Read the exact managed-container placement and cleanup receipt using the current
+bb_agent_ work-session token, then compare its enrolled machine binding with this
+machine's OS-reported identity. An active registered session is required. This
+command is read-only; it never starts Docker or Compose.`;
+
+export async function cmdManagedAllocation(args, {
+  call = callToolJson,
+  machineUuid = () => readMachineUuid({ env: {} }),
+  log = (line) => process.stdout.write(`${line}\n`),
+  errorLog = (line) => process.stderr.write(`${line}\n`),
+} = {}) {
+  const parsed = parseManagedAllocationArgs(args);
+  if (parsed.help) { log(MANAGED_ALLOCATION_HELP); return 0; }
+  if (parsed.error) { errorLog(parsed.error); return 4; }
+  const response = await call("get_managed_container_allocation_status", {
+    allocation_id: parsed.allocationId,
+    generation: parsed.generation,
+    target_revision: parsed.targetRevision,
+  }, { requireSessionToken: true });
+  if (!response?.ok || response.isError) {
+    const sessionRequired = response?.error === "session_token_required";
+    const payload = { schema_version: 1, outcome: "error",
+      code: response?.code ?? response?.error_code ?? response?.data?.code ?? (sessionRequired ? "session_token_required" : response?.isError ? "allocation_status_denied" : "status_unavailable"),
+      error: response?.error ?? response?.data?.error ?? (response?.isError ? "managed allocation status was refused by the server" : "managed allocation status unavailable") };
+    log(JSON.stringify(payload));
+    return response?.auth ? CALL_EXIT.AUTH : response?.isError ? CALL_EXIT.ERROR
+      : response?.status == null || response.status >= 500 ? CALL_EXIT.TRANSPORT : CALL_EXIT.ERROR;
+  }
+  const receipt = response.data;
+  const result = {
+    ...receipt,
+    local_start_eligibility: evaluateLocalStartEligibility(receipt, machineUuid()),
+  };
+  log(JSON.stringify(result));
+  // Keep shell chaining safe: a status receipt that shows the wrong/unknown
+  // machine must not look like a successful preflight to `&&` callers.
+  return result.local_start_eligibility.eligible ? 0 : CALL_EXIT.ERROR;
+}

package/src/wait-core.mjs

@@ -28,6 +28,9 @@ export const EXIT = Object.freeze({
   // reap_failed) before it was granted — re-request the lease. BOT-1754 reserves the name
   // LEASE_LOST and forbids reusing 2-8; 9 is the first free code.
   LEASE_LOST: 9,
+  // BOT-2330: an exact managed-allocation cleanup failed. The waiter must not
+  // report a successful terminal match when the signed Helper outcome failed.
+  MANAGED_ALLOCATION_FAILED: 10,
 });
 
 // BOT-2013: the uuid spellings Postgres accepts for a lease id (uuid_in), mirrored by the SQL
@@ -50,6 +53,16 @@ export function leaseLostDetail(signal, condition) {
   };
 }
 
+function managedAllocationFailureDetail(signal, condition) {
+  if (condition?.type !== "managed-allocation" || signal?.signal_type !== "managed_allocation" || signal.payload?.state !== "cleanup_failed") return null;
+  return {
+    allocation_id: signal.payload.allocation_id,
+    generation: signal.payload.generation,
+    target_revision: signal.payload.target_revision,
+    cleanup_error: typeof signal.payload.cleanup_error === "string" ? signal.payload.cleanup_error : "cleanup_failed",
+  };
+}
+
 // BOT-1249: the internal CONTROL signal_type the reconciler emits when a wait's
 // resource identity is canonicalized away. runWaitLoop treats a wait_superseded frame
 // targeting its OWN wait_session as terminal (exit 8) before matchFrame sees it. It is
@@ -190,6 +203,24 @@ const VALIDATORS = {
     const id = hex ? `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}` : raw;
     return { id };
   },
+  // BOT-2330: terminal state for one owner/session-bound managed allocation.
+  // Both fences are required so a stale wait cannot observe a later reuse.
+  "managed-allocation"(p) {
+    const unexpected = Object.keys(p).filter((key) => !["id", "generation", "target_revision"].includes(key));
+    if (unexpected.length) throw new Error(`managed-allocation does not accept ${unexpected.join(", ")}`);
+    const id = String(p.id ?? "").trim().toLowerCase();
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id)) {
+      throw new Error("managed-allocation needs id=<canonical allocation UUID>");
+    }
+    const generation = Number(p.generation);
+    const targetRevision = Number(p.target_revision);
+    if (!Number.isSafeInteger(generation) || generation < 1 || !Number.isSafeInteger(targetRevision) || targetRevision < 1) {
+      throw new Error("managed-allocation needs positive integer generation=<n> and target_revision=<n>");
+    }
+    // Keep the condition parameters in the event-stream wire shape. The server
+    // validates `target_revision` before it normalizes this saved condition.
+    return { id, generation, target_revision: targetRevision };
+  },
   // BOT-1064 / BOT-2112 — linear: wake on a logical state change of a named
   // issue in any Linear team bound to the authenticated tenant.
   // The spine subject_key is the issue identifier as stored on the tickets
@@ -933,6 +964,14 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
       // →active). The relay only delivers it to the lease's owning agent, so any
       // stack_lease frame for this lease id is ours to wake on.
       return signal.signal_type === "stack_lease" && signal.subject_key === `lease:${params.id}`;
+    case "managed-allocation": {
+      const p = signal.payload;
+      return signal.signal_type === "managed_allocation" && signal.subject_key === `allocation:${params.id}` &&
+        p?.allocation_id === params.id && p?.generation === params.generation &&
+        p?.target_revision === params.target_revision &&
+        ((p?.state === "released" && p?.permit_count === 0 && p?.cleanup_receipt_accepted === true) ||
+          (p?.state === "cleanup_failed" && p?.cleanup_receipt_accepted === true));
+    }
     case "linear": {
       if (signal.signal_type !== "linear_issue") return false;
       // Identity (BOT-1260): prefer the STABLE Linear issue UUID when BOTH the wait
@@ -1355,10 +1394,15 @@ export async function runWaitLoop({
   // reaped: that wait ends lease_lost (BOT-2013) so the caller can re-request instead of
   // provisioning against a dead lease.
   const finalizeMatch = async (entry, signal) => {
-    const lost = leaseLostDetail(signal, conditions.find((c) => c.id === entry.condition_id));
+    const condition = conditions.find((c) => c.id === entry.condition_id);
+    const lost = leaseLostDetail(signal, condition);
     if (lost) {
       return finalize("lease_lost", { exitCode: EXIT.LEASE_LOST, matched: [entry], state: lost, error: "lease_lost" });
     }
+    const allocationFailure = managedAllocationFailureDetail(signal, condition);
+    if (allocationFailure) {
+      return finalize("error", { exitCode: EXIT.MANAGED_ALLOCATION_FAILED, matched: [entry], state: allocationFailure, error: allocationFailure.cleanup_error });
+    }
     return finalize("matched", { exitCode: EXIT.MATCHED, matched: [entry] });
   };