@botbuddy/cli 1.49.0 → 1.50.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.49.0",
+  "version": "1.50.1",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -32,7 +32,9 @@ import { doctorAgentAuth, doctorHelp, parseDoctorArgs, readClientKeyStrict, repa
 import { formatPublishIp, isLoopbackIp, probeEnginePublishIp, publishIpFix } from "./docker-publish-ip.mjs";
 import { cmdHost, fixHelperWorkers, formatHelperWorkersLines, inspectHelperWorkers } from "./helper-host.mjs";
 import { clearAgentState, selfHealAgentSession } from "./agent-session.mjs";
+import { readAgentState } from "./agent-state.mjs";
 import { runUsage, usageStatus } from "./usage/sync.mjs";
+import { cmdTestIngest, doctorTestIngest, formatTestIngestLine } from "./test-ingest.mjs";
 import { installUsageAgent, usageAgentStatus } from "./usage/launchd.mjs";
 
 // BOT-1566 D2: the stale-CLI check runs for every command EXCEPT `wait` and any
@@ -41,7 +43,8 @@ import { installUsageAgent, usageAgentStatus } from "./usage/launchd.mjs";
 // runs inside every `git push` under a 5 s budget.
 export function shouldCheckForUpdates(argv) {
   const [command] = argv;
-  if (command === "wait" || command === "telemetry" || command === "usage") return false;
+  // BOT-1982: nor `test-ingest`, which runs at the tail of every test harness.
+  if (command === "wait" || command === "telemetry" || command === "usage" || command === "test-ingest") return false;
   if (argv.includes("--json")) return false;
   return true;
 }
@@ -109,6 +112,7 @@ export async function run(argv, {
       return code;
     }
     case "test": return cmdTest(args);
+    case "test-ingest": return cmdTestIngest(args);
     case "wait": return runWait(args);
     case "pw": return runPw(args);
     case "mcp": return cmdMcp(args);
@@ -231,6 +235,8 @@ ${bold("DURABLE WORKLOADS")}
                               Run locally with a durable lifecycle outbox
   telemetry <status|replay|doctor>
                               Inspect, replay, or gate durable lifecycle delivery
+  test-ingest --file <payload.json|-> [--tenant <slug>]
+                              Upload a test-run report with this worktree's agent session
 
 ${bold("USAGE INGEST")}
   usage sync [--since 2d] [--provider claude|codex|all] [--file <transcript>] [--dry-run] [--quiet]
@@ -264,6 +270,9 @@ export async function cmdDoctor(args, {
   publishReport = () => probeEnginePublishIp(),
   helperWorkersReport = async () => inspectHelperWorkers(),
   helperWorkersFix = (report) => fixHelperWorkers(report),
+  // BOT-1982: which credential test-run uploads would use — the ONE place a
+  // missing upload credential is reported (the harnesses skip silently).
+  testIngestReport = () => doctorTestIngest(),
 } = {}) {
   const parsed = parseDoctorArgs(args);
   if (parsed.help) { log(doctorHelp()); return 0; }
@@ -288,8 +297,10 @@ export async function cmdDoctor(args, {
     const recheck = await helperWorkersReport().catch(() => null);
     helperWorkers = recheck ? { ...recheck, fix: helperFix } : { ...helperWorkers, fix: helperFix };
   }
+  // BOT-1982: informational, like usage sync — never changes the exit code.
+  const testIngest = await Promise.resolve().then(testIngestReport).catch(() => null);
   if (parsed.json) {
-    log(JSON.stringify({ ...result.report, ...(usage ? { usage_sync: usage } : {}), ...(bootstrap ? { bootstrap } : {}), ...(helperWorkers ? { helper_workers: helperWorkers } : {}) }));
+    log(JSON.stringify({ ...result.report, ...(usage ? { usage_sync: usage } : {}), ...(bootstrap ? { bootstrap } : {}), ...(helperWorkers ? { helper_workers: helperWorkers } : {}), ...(testIngest ? { test_ingest: testIngest } : {}) }));
   } else {
     log(`binding: ${result.report.binding.status}${result.report.binding.tenant ? ` (${result.report.binding.tenant})` : ""}`);
     log(`client key: ${result.report.client_key.status}`);
@@ -306,6 +317,7 @@ export async function cmdDoctor(args, {
     if (bootstrap) log(formatBootstrapLine(bootstrap));
     if (usage) log(formatUsageSyncLine(usage));
     for (const line of formatHelperWorkersLines(helperWorkers, helperFix)) log(line);
+    if (testIngest) log(formatTestIngestLine(testIngest));
   }
   if (result.exports) log(result.exports);
   return result.exitCode;
@@ -569,6 +581,7 @@ export async function cmdSetup(args, {
   now = () => Date.now(),
   binding = readAgentBinding,
   clearState = clearAgentState,
+  readState = readAgentState,
   selfHeal = selfHealAgentSession,
   callerResolver = resolveCaller,
   usageAgent = installUsageAgent,
@@ -643,12 +656,22 @@ export async function cmdSetup(args, {
         signedIn = true;
       }
     }
-    // Setup is an explicit session bootstrap/repair command. Rotate before
-    // resolving so it cannot merely report an old cache as ready.
-    await clearState(cwd);
+    // Setup is an explicit session bootstrap/repair command: it always mints a
+    // fresh session so it cannot merely report an old cache as ready.
+    // BOT-2171: but it keeps the worktree's AGENT. Deleting the cache first made
+    // the mint carry no agent_id, so the server fell back to a hostname-bearing
+    // name lookup and, after a hostname drift, inserted a new agent — every stack
+    // lease this worktree held then answered NOT_LEASE_OWNER. A cache bound to this
+    // tenant is re-minted in place (`force` re-registers with its agent_id); one
+    // bound elsewhere, or a legacy cache with no tenant to verify, is still
+    // discarded, since its agent may not serve this tenant (Codex #1180 R1).
+    const cached = await readState(cwd).catch(() => null);
+    const keepAgent = Boolean(cached?.agent_id) && cached.tenant === tenant;
+    if (!keepAgent) await clearState(cwd);
+    const mint = () => selfHeal({ cwd, env, ...(keepAgent ? { force: true } : {}) });
     let session;
     try {
-      session = await selfHeal({ cwd, env });
+      session = await mint();
     } catch (error) {
       // A locally-valid key the server rejects (revoked, rotated) needs exactly
       // one fresh sign-in and one retried mint. Never loop, and never re-sign a
@@ -656,7 +679,7 @@ export async function cmdSetup(args, {
       if (signedIn || !SIGN_IN_REJECTED.has(error?.code) || error?.mintedWith === "mcp_key") throw error;
       errorLog(`bb setup: this machine's saved sign-in was rejected (${error.code}); signing in again.`);
       await signIn();
-      session = await selfHeal({ cwd, env });
+      session = await mint();
     }
     // BOT-2058: register_agent reports any OTHER live session already holding
     // this ticket (heartbeat < 15m) in `ticket_signals`. This is advisory: a

package/src/test-ingest.mjs

@@ -0,0 +1,224 @@
+// BOT-1982 — upload a test-run payload to the `test-ingest` edge function with
+// THIS worktree's credential. One resolver + one transport, shared by
+// `bb test-ingest` (tenant repos' harnesses call the binary) and this repo's
+// pre-push reporter (scripts/report-test-runs.mjs imports the module).
+//
+// Why an ordered candidate list with 401 fall-through: the old reporters sent the
+// FIRST exported key, so a dead legacy `BOTBUDDY_API_KEY` left in a shell profile
+// shadowed a valid key and every upload 401'd. Now the worktree's agent session
+// (`bb setup`) is preferred, the durable keys follow, the legacy exports come
+// last, and a 401 tries the next candidate — a stale credential can never shadow
+// a valid one. A missing credential is NOT reported per run: callers stay silent
+// and `bb doctor` reports it once (doctorTestIngest).
+import { execFile } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { promisify } from "node:util";
+import { isAgentStateFresh, readAgentState } from "./agent-state.mjs";
+import { readAgentSessionTokenEnv } from "./agent-key.mjs";
+import { readKeychainSecret } from "./agent-credential-store.mjs";
+import { resolveAgentBinding } from "./wait-profile.mjs";
+
+const execFileP = promisify(execFile);
+export const DEFAULT_TEST_INGEST_URL = "https://api.bot-buddy.ai/functions/v1/test-ingest";
+export const DEFAULT_TIMEOUT_MS = 5_000;
+export const EXIT_DELIVERED = 0;
+export const EXIT_NO_CREDENTIAL = 3;
+export const EXIT_NOT_DELIVERED = 5;
+export const TEST_INGEST_FIX = "run `bb setup` in this worktree (or `bb doctor --fix`) so test-run uploads use its agent session";
+
+/** test-ingest URL: explicit → functions base → derived from the MCP server URL. */
+export function testIngestEndpoint(env = process.env) {
+  if (env.BOTBUDDY_TEST_INGEST_URL) return env.BOTBUDDY_TEST_INGEST_URL;
+  if (env.BOTBUDDY_FUNCTIONS_URL) return `${env.BOTBUDDY_FUNCTIONS_URL.replace(/\/+$/, "")}/test-ingest`;
+  if (env.BOTBUDDY_SERVER_URL) {
+    const url = new URL(env.BOTBUDDY_SERVER_URL);
+    url.pathname = url.pathname.replace(/\/mcp-server\/?$/, "/test-ingest");
+    return url.toString();
+  }
+  return DEFAULT_TEST_INGEST_URL;
+}
+
+// A time-bounded Keychain read: a locked/prompting Keychain must never hang a push.
+async function boundedKeychainRead(service, timeoutMs = 3_000) {
+  if (process.platform !== "darwin") return null;
+  const bounded = (cmd, args) => execFileP(cmd, args, { timeout: timeoutMs, killSignal: "SIGKILL" });
+  return readKeychainSecret(service, { execFileImpl: bounded });
+}
+
+async function bindingKey({ cwd, env, readCredential }) {
+  try {
+    const { token, tokenEnv } = await resolveAgentBinding({ cwd, env, readCredential });
+    return token ? { token, source: "mcp_key", env: tokenEnv } : null;
+  } catch {
+    return null; // no/malformed binding → no binding key; never throws into a push
+  }
+}
+
+/**
+ * Ordered, de-duplicated credential candidates `{ token, source }` (never logged):
+ *   1. BOTBUDDY_TEST_INGEST_KEY — an explicit override (CI's dedicated key)
+ *   2. the agent session — BOTBUDDY_AGENT_SESSION_TOKEN, else this worktree's
+ *      FRESH .botbuddy/agent-state.json (an expired cache is never offered or
+ *      advertised by `bb doctor`; offline, no self-heal registration from a hook)
+ *   3. the binding's tier-2 MCP key (env, else a bounded Keychain read)
+ *   4. legacy BOTBUDDY_API_KEY / BOTBUDDY_BB_AGENT_KEY — last, so a stale export
+ *      can never shadow a valid credential
+ */
+export async function resolveTestIngestCredentials({
+  env = process.env, cwd = process.cwd(), readState = readAgentState, isFresh = isAgentStateFresh,
+  readCredential = async (name, e) => (typeof e[name] === "string" && e[name].trim()) || (await boundedKeychainRead(name)),
+} = {}) {
+  const out = [];
+  const add = (token, source) => {
+    const value = typeof token === "string" ? token.trim() : "";
+    if (value && !out.some((c) => c.token === value)) out.push({ token: value, source });
+  };
+  add(env.BOTBUDDY_TEST_INGEST_KEY, "explicit");
+  add(readAgentSessionTokenEnv(env), "session_env");
+  try {
+    const state = await readState(cwd);
+    if (state?.agent_session_token && isFresh(state, new Date())) add(state.agent_session_token, "session");
+  } catch { /* unreadable cache = no session candidate */ }
+  const key = await bindingKey({ cwd, env, readCredential });
+  if (key) add(key.token, key.source);
+  add(env.BOTBUDDY_API_KEY, "legacy_api_key");
+  add(env.BOTBUDDY_BB_AGENT_KEY, "legacy_agent_key");
+  return out;
+}
+
+async function postOnce({ url, token, payload, fetchImpl, timeoutMs }) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: typeof payload === "string" ? payload : JSON.stringify(payload),
+      signal: controller.signal,
+    });
+    const text = res.text ? await res.text().catch(() => "") : "";
+    let body = null;
+    try { body = text ? JSON.parse(text) : null; } catch { body = null; }
+    return { status: res.status, ok: res.ok, text, body };
+  } catch (error) {
+    return { status: null, ok: false, error: controller.signal.aborted ? `timed out after ${timeoutMs}ms` : (error?.message ?? String(error)) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * POST `payload` with the first candidate test-ingest accepts. Only a 401 moves to
+ * the next candidate (any other answer is the server's verdict on the payload).
+ * Returns a token-free receipt:
+ *   { ok:true, status, source, attempts, summary, errors, deep_link }
+ *   { ok:false, code:"credential_missing", attempts:[] }
+ *   { ok:false, code:"ingest_errors", status, source, attempts, summary, errors }  (200 + row errors)
+ *   { ok:false, code:"rejected"|"unreachable", status, source, attempts, error }
+ */
+export async function uploadTestRun({
+  payload, url = testIngestEndpoint(), credentials, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS,
+} = {}) {
+  const candidates = Array.isArray(credentials) ? credentials : [];
+  if (candidates.length === 0) return { ok: false, code: "credential_missing", attempts: [] };
+  const attempts = [];
+  let last = null;
+  for (const candidate of candidates) {
+    const res = await postOnce({ url, token: candidate.token, payload, fetchImpl, timeoutMs });
+    attempts.push({ source: candidate.source, status: res.status });
+    last = { ...res, source: candidate.source };
+    if (res.status === 401) continue;
+    break;
+  }
+  if (last.ok) {
+    const summary = last.body?.summary ?? null;
+    const errors = Array.isArray(summary?.errors) ? summary.errors : [];
+    // test-ingest answers 200 with summary.errors for permanent per-row write
+    // failures: the request was accepted but rows are missing, so it is NOT a
+    // delivery (the harness must not treat it as one and drop its results).
+    if (errors.length > 0) {
+      return { ok: false, code: "ingest_errors", status: last.status, source: last.source, attempts, summary, errors, deep_link: last.body?.deep_link ?? null };
+    }
+    return { ok: true, status: last.status, source: last.source, attempts, summary, errors, deep_link: last.body?.deep_link ?? null };
+  }
+  if (last.status === null) return { ok: false, code: "unreachable", status: null, source: last.source, attempts, error: last.error };
+  const message = last.body?.error ?? last.body?.message ?? String(last.text ?? "").slice(0, 200);
+  return { ok: false, code: "rejected", status: last.status, source: last.source, attempts, error: message || `http_${last.status}` };
+}
+
+/** `bb doctor` line for test-run uploads: which credential would be tried first. */
+export async function doctorTestIngest(opts = {}) {
+  const candidates = await resolveTestIngestCredentials(opts);
+  if (candidates.length === 0) return { status: "missing", fix: TEST_INGEST_FIX };
+  return { status: "available", source: candidates[0].source, candidates: candidates.map((c) => c.source) };
+}
+
+export function formatTestIngestLine(report) {
+  if (!report) return null;
+  return report.status === "available"
+    ? `test-run upload: available (${report.source})`
+    : `test-run upload: MISSING — ${report.fix}`;
+}
+
+export function parseTestIngestArgs(argv = []) {
+  const args = { file: null, tenant: null, timeoutMs: null, help: false, errors: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const value = () => {
+      const v = argv[i + 1];
+      if (v === undefined || (v.startsWith("--") && v !== "-")) { args.errors.push(`${a} requires a value`); return null; }
+      i++;
+      return v;
+    };
+    if (a === "--help" || a === "-h" || a === "help") args.help = true;
+    else if (a === "--file") args.file = value();
+    else if (a === "--tenant") args.tenant = value();
+    else if (a === "--timeout-ms") {
+      const v = value();
+      if (v !== null) { const n = Number(v); if (Number.isInteger(n) && n > 0) args.timeoutMs = n; else args.errors.push("--timeout-ms must be a positive integer"); }
+    } else args.errors.push(`unknown argument ${a}`);
+  }
+  if (!args.help && !args.file) args.errors.push("--file <path|-> is required");
+  return args;
+}
+
+export function testIngestHelp() {
+  return [
+    "bb test-ingest --file <payload.json|-> [--tenant <slug>] [--timeout-ms <n>]",
+    "",
+    "POSTs a test-run payload ({ executions: [...] }, or a raw vitest/playwright --reporter=json",
+    "report plus context fields) to BotBuddy's test-ingest with this worktree's credential:",
+    "BOTBUDDY_TEST_INGEST_KEY → agent session (bb setup) → the binding's MCP key → legacy exports.",
+    "A 401 tries the next credential. Prints one JSON receipt (never a secret).",
+    "Exit 0 delivered · 3 no credential (see `bb doctor`) · 5 rejected, unreachable, or accepted with row errors.",
+  ].join("\n");
+}
+
+export async function cmdTestIngest(argv, {
+  env = process.env, cwd = process.cwd(), log = (l) => console.log(l), errorLog = (l) => console.error(l),
+  readStdin = () => readFileSync(0, "utf8"), readFile = (p) => readFileSync(p, "utf8"),
+  resolveCredentials = resolveTestIngestCredentials, upload = uploadTestRun,
+} = {}) {
+  const args = parseTestIngestArgs(argv);
+  if (args.help) { log(testIngestHelp()); return 0; }
+  if (args.errors.length) { errorLog(`bb test-ingest: ${args.errors.join("; ")}`); return 2; }
+  let payload;
+  try {
+    payload = JSON.parse(args.file === "-" ? readStdin() : readFile(args.file));
+  } catch (error) {
+    errorLog(`bb test-ingest: cannot read a JSON payload from ${args.file}: ${error?.message ?? error}`);
+    return 2;
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    errorLog("bb test-ingest: the payload must be a JSON object");
+    return 2;
+  }
+  if (args.tenant && !payload.tenant) payload.tenant = args.tenant;
+  const credentials = await resolveCredentials({ env, cwd });
+  const receipt = await upload({
+    payload, credentials, url: testIngestEndpoint(env), timeoutMs: args.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+  });
+  log(JSON.stringify(receipt));
+  if (receipt.ok) return EXIT_DELIVERED;
+  return receipt.code === "credential_missing" ? EXIT_NO_CREDENTIAL : EXIT_NOT_DELIVERED;
+}