@botbuddy/cli 1.5.3 → 1.5.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/botbuddy-release-repair.json

@@ -1 +1 @@
-{"schema_version":1,"source_version":"1.5.1","source_identity":"1bc59a77cac3a2df9a24764a6ae8c4df3fc9e002701396f6a97dd2dfa84589c6"}
+{"schema_version":1,"source_version":"1.5.1","source_identity":"7bee97ef5e6148138f44fc770322b2bfffe059e2187b6ab7970ab98548f73763"}

package/src/docker-hygiene.mjs

@@ -78,6 +78,11 @@ SAFETY
   • Re-inspects every candidate immediately before deletion.
   • Never force-removes a resource, never runs a prune command, and never removes volumes.
 
+PERSISTENT ORBSTACK GHOSTS
+  If an exact ID remains listed but OrbStack cannot inspect it, inventory is
+  reported but cleanup refuses. Restart or repair OrbStack, then rerun the
+  hygiene dry run with the same explicit selector. Never use broad cleanup.
+
 EXAMPLES
   botbuddy docker hygiene --context orbstack --ticket BOT-1405 --json
   botbuddy docker hygiene --context orbstack --apply --ticket BOT-1405 \\
@@ -327,18 +332,143 @@ function nonEmptyLines(text) {
   return text.split(/\r?\n/).map((value) => value.trim()).filter(Boolean);
 }
 
-function inspectInBatches(runDocker, selector, kind, ids, extraArgs = []) {
+function boundedDockerError(value) {
+  return String(value || "Docker command failed").trim().replace(/\s+/g, " ").slice(0, 500);
+}
+
+function listInventoryRefs(runDocker, selector, kind, exactId = null) {
+  const args = [kind, "ls"];
+  if (kind === "container") args.push("--all");
+  args.push("--no-trunc");
+  if (kind === "container" && !exactId) args.push("--filter", "name=supabase_");
+  if (exactId) args.push("--filter", `id=${exactId}`);
+  args.push("--format", kind === "container" ? "{{.ID}}\t{{.Names}}" : "{{.ID}}\t{{.Name}}");
+
+  const refs = nonEmptyLines(selected(runDocker, selector, args)).map((line) => {
+    const [rawId, ...rawName] = line.split("\t");
+    const id = rawId.trim();
+    if (!id) throw new Error(`Docker ${kind} inventory returned an empty ID`);
+    return { id, name: rawName.join("\t").trim() };
+  });
+  const exact = exactId ? refs.filter((ref) => ref.id === exactId) : refs;
+  return [...new Map(exact.map((ref) => [ref.id, ref])).values()];
+}
+
+function inspectAttempt(runDocker, selector, kind, refs, extraArgs) {
+  const ids = refs.map((ref) => ref.id);
+  const args = [...selector, kind, "inspect", ...extraArgs, ...ids];
+  const result = runDocker(args);
+  if (result?.error || result?.status !== 0) {
+    return { ok: false, resources: [], error: commandFailure(args, result).message };
+  }
+
+  let inspected;
+  try {
+    inspected = JSON.parse(String(result.stdout || ""));
+  } catch {
+    return { ok: false, resources: [], error: `docker ${kind} inspect returned malformed JSON` };
+  }
+  if (!Array.isArray(inspected)) {
+    return { ok: false, resources: [], error: `Docker ${kind} inventory returned an unexpected shape` };
+  }
+  return { ok: true, resources: inspected, error: null };
+}
+
+function exactInspectedResource(attempt, id) {
+  if (!attempt.ok || attempt.resources.length !== 1) return null;
+  return String(attempt.resources[0]?.Id || "") === id ? attempt.resources[0] : null;
+}
+
+function exactInspectError(attempt, kind, id) {
+  if (!attempt.ok) return attempt.error;
+  return `docker ${kind} inspect did not return the exact requested ID ${id}`;
+}
+
+function inspectInBatches(runDocker, selector, kind, refs, extraArgs = []) {
   const resources = [];
-  for (let offset = 0; offset < ids.length; offset += INSPECT_BATCH_SIZE) {
-    const batch = ids.slice(offset, offset + INSPECT_BATCH_SIZE);
-    const inspected = parseJson(
-      selected(runDocker, selector, [kind, "inspect", ...extraArgs, ...batch]),
-      `docker ${kind} inspect`,
-    );
-    if (!Array.isArray(inspected)) throw new Error(`Docker ${kind} inventory returned an unexpected shape`);
-    resources.push(...inspected);
+  const skipped = [];
+  const errors = [];
+  for (let offset = 0; offset < refs.length; offset += INSPECT_BATCH_SIZE) {
+    const batch = refs.slice(offset, offset + INSPECT_BATCH_SIZE);
+    const attempt = inspectAttempt(runDocker, selector, kind, batch, extraArgs);
+    let isolate = batch;
+
+    if (attempt.ok) {
+      const byId = new Map();
+      let invalidIdentity = false;
+      for (const resource of attempt.resources) {
+        const id = String(resource?.Id || "");
+        if (!id || byId.has(id) || !batch.some((ref) => ref.id === id)) {
+          invalidIdentity = true;
+          break;
+        }
+        byId.set(id, resource);
+      }
+      if (!invalidIdentity) {
+        for (const ref of batch) {
+          const resource = byId.get(ref.id);
+          if (resource) resources.push(resource);
+        }
+        isolate = batch.filter((ref) => !byId.has(ref.id));
+      }
+    }
+
+    for (const ref of isolate) {
+      const isolated = inspectAttempt(runDocker, selector, kind, [ref], extraArgs);
+      const isolatedResource = exactInspectedResource(isolated, ref.id);
+      if (isolatedResource) {
+        resources.push(isolatedResource);
+        continue;
+      }
+
+      // Re-list through the same validated selector and require exact full-ID
+      // equality. A prefix match or same-name replacement is never authority.
+      const relisted = listInventoryRefs(runDocker, selector, kind, ref.id);
+      const current = relisted.find((item) => item.id === ref.id);
+      if (!current) {
+        skipped.push({
+          type: kind,
+          id: ref.id,
+          name: ref.name,
+          project: null,
+          reason: "disappeared_during_inventory",
+        });
+        continue;
+      }
+
+      const retried = inspectAttempt(runDocker, selector, kind, [current], extraArgs);
+      const retriedResource = exactInspectedResource(retried, ref.id);
+      if (retriedResource) {
+        resources.push(retriedResource);
+        continue;
+      }
+      // The row can disappear after the first exact re-list but before the
+      // retry returns. Confirm it still exists before calling the engine state
+      // persistently uninspectable; daemon/list failures still throw closed.
+      const finalRelisted = listInventoryRefs(runDocker, selector, kind, ref.id);
+      const finalCurrent = finalRelisted.find((item) => item.id === ref.id);
+      if (!finalCurrent) {
+        skipped.push({
+          type: kind,
+          id: ref.id,
+          name: current.name || ref.name,
+          project: null,
+          reason: "disappeared_during_inventory",
+        });
+        continue;
+      }
+      errors.push({
+        type: kind,
+        id: ref.id,
+        name: finalCurrent.name || current.name || ref.name,
+        project: null,
+        reason: "uninspectable_during_inventory",
+        error: boundedDockerError(exactInspectError(retried, kind, ref.id)
+          || exactInspectError(isolated, kind, ref.id)),
+      });
+    }
   }
-  return resources;
+  return { resources, skipped, errors };
 }
 
 function projectIdentity(resource) {
@@ -403,7 +533,7 @@ function skippedResource(type, resource, reason, extra = {}) {
   };
 }
 
-export function classifyInventory({ containers = [], networks = [] } = {}) {
+export function classifyInventory({ containers = [], networks = [], skipped: discoverySkipped = [], errors = [], listed = {} } = {}) {
   const activeProjects = new Set();
   for (const resource of containers) {
     const name = containerName(resource);
@@ -412,7 +542,7 @@ export function classifyInventory({ containers = [], networks = [] } = {}) {
   }
 
   const candidates = [];
-  const skipped = [];
+  const skipped = [...discoverySkipped];
   let supabaseContainers = 0;
 
   for (const resource of containers) {
@@ -490,9 +620,12 @@ export function classifyInventory({ containers = [], networks = [] } = {}) {
     active_projects: [...activeProjects].sort(),
     candidates: candidates.sort(resourceSort),
     skipped: skipped.sort(resourceSort),
+    inventory_errors: [...errors].sort(resourceSort),
     counts: {
       containers: containers.length,
       networks: networks.length,
+      listed_containers: listed.containers ?? containers.length,
+      listed_networks: listed.networks ?? networks.length,
       supabase_containers: supabaseContainers,
       supabase_networks: supabaseNetworks,
       user_bridge_networks: userBridgeNetworks,
@@ -502,15 +635,21 @@ export function classifyInventory({ containers = [], networks = [] } = {}) {
 }
 
 function readInventory(runDocker, selector) {
-  const containerIds = nonEmptyLines(selected(runDocker, selector, ["container", "ls", "--all", "--quiet", "--no-trunc", "--filter", "name=supabase_"]));
-  const containers = containerIds.length
-    ? inspectInBatches(runDocker, selector, "container", containerIds, ["--size"])
-    : [];
-  const networkIds = nonEmptyLines(selected(runDocker, selector, ["network", "ls", "--quiet", "--no-trunc"]));
-  const networks = networkIds.length
-    ? inspectInBatches(runDocker, selector, "network", networkIds)
-    : [];
-  return { containers, networks };
+  const containerRefs = listInventoryRefs(runDocker, selector, "container");
+  const containerResult = containerRefs.length
+    ? inspectInBatches(runDocker, selector, "container", containerRefs, ["--size"])
+    : { resources: [], skipped: [], errors: [] };
+  const networkRefs = listInventoryRefs(runDocker, selector, "network");
+  const networkResult = networkRefs.length
+    ? inspectInBatches(runDocker, selector, "network", networkRefs)
+    : { resources: [], skipped: [], errors: [] };
+  return {
+    containers: containerResult.resources,
+    networks: networkResult.resources,
+    skipped: [...containerResult.skipped, ...networkResult.skipped],
+    errors: [...containerResult.errors, ...networkResult.errors],
+    listed: { containers: containerRefs.length, networks: networkRefs.length },
+  };
 }
 
 function validateOrbStack(runDocker, opts) {
@@ -556,6 +695,7 @@ export function evaluatePressure({
 }) {
   const current = Number(bridgeNetworks) + (2 * Number(attachedEndpoints));
   const projected = current + 1 + (2 * Number(projectedEndpoints));
+  const status = projected >= fail ? "fail" : projected >= warn ? "warn" : "ok";
   return {
     metric: "conservative_network_pressure_units",
     formula: "bridge_networks + (2 * attached_endpoints)",
@@ -564,7 +704,18 @@ export function evaluatePressure({
     projected_endpoints: Number(projectedEndpoints),
     warn_pressure: Number(warn),
     fail_pressure: Number(fail),
-    status: projected >= fail ? "fail" : projected >= warn ? "warn" : "ok",
+    status,
+    // BOT-1412: a host-wide interface-pressure refusal is not a per-stack
+    // `supabase_local` lock wait.  Emit the relay's capacity condition in the
+    // machine receipt so callers park on the global policy and receive the
+    // eventual capacity signal, rather than retrying Docker locally.
+    ...(status === "fail" ? {
+      wait: {
+        kind: "global_capacity",
+        condition: "capacity:policy=host_docker_pressure_v1,slots>=1",
+        command: "bb-wait 'capacity:policy=host_docker_pressure_v1,slots>=1'",
+      },
+    } : {}),
     note: "Conservative pressure proxy; OrbStack does not expose a kernel interface ceiling through the Docker API.",
   };
 }
@@ -584,6 +735,7 @@ function baseReceipt(command, opts, now) {
     deleted: [],
     reclaimed_space_bytes: 0,
     skipped: [],
+    inventory_errors: [],
     pressure: null,
     warnings: [],
     errors: [],
@@ -686,6 +838,7 @@ export function runDockerWorkflow(argv, {
   receipt.inventory = inventory.counts;
   receipt.active_projects = inventory.active_projects;
   receipt.skipped = [...inventory.skipped];
+  receipt.inventory_errors = [...inventory.inventory_errors];
 
   const ticketCandidates = parsed.opts.ticket
     ? inventory.candidates.filter((item) => projectMatchesTicket(item.project, parsed.opts.ticket))
@@ -700,6 +853,15 @@ export function runDockerWorkflow(argv, {
   receipt.candidates = ticketCandidates;
   receipt.candidate_reclaimable_bytes = ticketCandidates.reduce((total, item) => total + item.reclaimable_bytes, 0);
 
+  if (receipt.inventory_errors.length > 0) {
+    receipt.outcome = "refused";
+    for (const item of receipt.inventory_errors) {
+      receipt.errors.push(`${item.type} ${item.id}${item.name ? ` (${item.name})` : ""} remains listed but cannot be authoritatively inspected: ${item.error}`);
+    }
+    receipt.recommendation = "Persistent OrbStack inventory blocker: restart or repair OrbStack, then rerun the hygiene dry run with the same explicit selector; never use broad cleanup.";
+    return { exitCode: EXIT.DOCKER, receipt, json: parsed.opts.json };
+  }
+
   if (parsed.command === "preflight") {
     receipt.pressure = evaluatePressure({
       bridgeNetworks: inventory.counts.user_bridge_networks,
@@ -757,6 +919,17 @@ export function runDockerWorkflow(argv, {
       addSkipOnce(receipt, { ...candidate, reason: "revalidation_failed" });
       continue;
     }
+    if (fresh.inventory_errors.length > 0) {
+      for (const item of fresh.inventory_errors) {
+        if (!receipt.inventory_errors.some((existing) => existing.type === item.type && existing.id === item.id)) {
+          receipt.inventory_errors.push(item);
+          receipt.errors.push(`revalidation blocked by ${item.type} ${item.id}${item.name ? ` (${item.name})` : ""}: ${item.error}`);
+        }
+      }
+      receipt.recommendation = "Persistent OrbStack inventory blocker: restart or repair OrbStack, then rerun the hygiene dry run with the same explicit selector; never use broad cleanup.";
+      addSkipOnce(receipt, { ...candidate, reason: "revalidation_failed" });
+      continue;
+    }
     const revalidated = fresh.candidates.find((item) => item.type === candidate.type
       && item.id === candidate.id
       && projectMatchesTicket(item.project, parsed.opts.ticket));
@@ -843,6 +1016,11 @@ export function formatHumanReceipt(receipt) {
   lines.push(`Skipped (${receipt.skipped.length}):`);
   for (const item of receipt.skipped) lines.push(`  ${item.type} ${item.id} ${item.name} — ${item.reason}`);
   if (receipt.skipped.length === 0) lines.push("  none");
+  lines.push(`Inventory errors (${receipt.inventory_errors?.length || 0}):`);
+  for (const item of receipt.inventory_errors || []) {
+    lines.push(`  ${item.type} ${item.id} ${item.name || "(name unknown)"} — ${item.reason}: ${item.error}`);
+  }
+  if (!receipt.inventory_errors?.length) lines.push("  none");
   if (receipt.pressure) {
     lines.push(`Pressure: ${receipt.pressure.projected_pressure_units} projected (${receipt.pressure.status}; warn ${receipt.pressure.warn_pressure}, fail ${receipt.pressure.fail_pressure})`);
   }