@botbuddy/cli 1.51.0 → 1.52.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.51.0",
+  "version": "1.52.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack.mjs

@@ -3804,7 +3804,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       incidentBox.portBlock = !provenReap
         ? { released: false, reason: retainBlock
           ? `a lease on this stack slot may still hold its ports (idle, unreaped, or another live batch)${retained} so its stack is never double-booked`
-          : `reap not proven (${cleanupResult?.error ?? "no cleanup ran"})${retained} so a stack the Helper may still run is never double-booked` }
+          // BOT-2418: an idle release is a deliberate keep (BOT-1803), not an unproven reap.
+          : cleanupResult?.ok === true && cleanupResult.idle === true
+            ? `the lease is idle and keeps its stack for the next run on this slot, so its claim stays reserved with it (\`bb stack done ${leaseId} --reap\` reaps the lease; it does not release this host's claim)`
+            : `reap not proven (${cleanupResult?.error ?? "no cleanup ran"})${retained} so a stack the Helper may still run is never double-booked` }
         : releaseError || disposition?.released === false
           ? { released: false, reason: `the reap was proven but the claim could not be removed (${releaseError?.message ?? "it is still on disk"})${retained}` }
           : { released: true };

package/src/wait-core.mjs

@@ -1231,6 +1231,20 @@ const nowIso = () => new Date().toISOString();
 // deadline race, so an unbounded probe would blow past a short --timeout.
 const FEED_PROBE_BUDGET_MS = 2000;
 
+// BOT-2407: transport failures that cut an established event stream. undici reports a
+// socket closed mid-body as `TypeError: terminated` with the socket error as its cause
+// (ENT-5478 prod, 2026-10-15: three exit-7 deaths in 2 h). These are a stream END — the
+// relay is reconnected from the safe cursor — never an internal error.
+const STREAM_TRANSPORT_CODES = new Set(["UND_ERR_SOCKET", "UND_ERR_BODY_TIMEOUT", "ECONNRESET", "EPIPE", "ETIMEDOUT"]);
+export function isStreamTransportError(err) {
+  if (!err || typeof err !== "object") return false;
+  if (err.name === "AbortError") return true;
+  for (let e = err, depth = 0; e && typeof e === "object" && depth < 4; e = e.cause, depth += 1) {
+    if (STREAM_TRANSPORT_CODES.has(e.code)) return true;
+  }
+  return err instanceof TypeError && err.message === "terminated";
+}
+
 /**
  * Run one wait to a terminal outcome, driven by an injected `connect(since)`
  * that returns an async iterable of parsed SSE frames.
@@ -1350,6 +1364,7 @@ export async function runWaitLoop({
   let reconnects = 0;
   let failures = 0;
   const noteBackendUnreachable = () => { if (!degraded.includes("backend_unreachable")) degraded.push("backend_unreachable"); };
+  const noteDegraded = (marker) => { if (!degraded.includes(marker)) degraded.push(marker); };
 
   // Internal one-shot alarms (the deadline, the pre-deadline feed probe, reconnect backoff)
   // are REAL timers via the default sleep. Each exists only to resolve a race — once the loop
@@ -1682,13 +1697,29 @@ export async function runWaitLoop({
     // previous one has actually settled into a frame we consumed.
     let pendingNext = null;
     while (!streamEnded) {
-      if (!pendingNext) pendingNext = iterator.next();
+      // BOT-2407: a rejected read settles into a marker instead of escaping the loop. A
+      // transport cut ends the stream (reconnect); anything else is a typed error receipt.
+      if (!pendingNext) {
+        pendingNext = iterator.next().catch((err) => (
+          isStreamTransportError(err) ? { __streamDropped: err } : { __streamError: err }
+        ));
+      }
       const racers = [deadlinePromise, pendingNext];
       if (staleConfirmPromise) racers.push(staleConfirmPromise);
       if (preDeadlineProbePromise && !preDeadlineProbeDone) racers.push(preDeadlineProbePromise);
       const raced = await Promise.race(racers);
 
       if (raced && raced.__deadline) return fireReplayGraceExpired();
+      if (raced && raced.__streamDropped) {
+        pendingNext = null;
+        noteDegraded("stream_dropped");
+        streamEnded = true;
+        break;
+      }
+      if (raced && raced.__streamError) {
+        const err = raced.__streamError;
+        return finalize("error", { exitCode: EXIT.INTERNAL, error: `stream_error: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}` });
+      }
       // BOT-1147 (Codex round-27 P2): the pre-deadline feed probe fired. Fold a
       // mid-wait stall/recovery into `degraded` before the imminent timeout receipt,
       // then keep waiting — pendingNext stays in flight (hoisted), re-raced next
@@ -1988,6 +2019,10 @@ export async function runWaitLoop({
     if (!deliveredFrame) {
       failures += 1;
       if (failures > maxReconnects) {
+        // BOT-2407 AC-4: only consecutive failures spend the budget, so a give-up is always
+        // an outage — name it. A connection that ended before any frame is
+        // `stream_ended_empty`; `backend_unreachable` / `stream_dropped` are already noted.
+        noteDegraded("stream_ended_empty");
         return finalize("error", { exitCode: EXIT.BACKEND, error: "reconnect budget exhausted" });
       }
     }

package/src/wait.mjs

@@ -2192,12 +2192,80 @@ export async function runWait(argv, { recoveryLocalWaitId = null } = {}) {
     }
     process.exit(exitCode);
   } catch (err) {
-    try { if (checkpoint?.local_wait_id) await store.update(checkpoint.local_wait_id, { status: "interrupted" }); } catch { /* retain original diagnostic state */ }
-    if (err instanceof WaitCheckpointError) return emitSavedWaitError(err);
+    // A checkpoint-store failure is its own typed outcome (wait_checkpoint_write_failed):
+    // the store is what failed, so it is not settled as `internal` (Codex #1190 R2).
+    if (err instanceof WaitCheckpointError) {
+      try { if (checkpoint?.local_wait_id) await store.update(checkpoint.local_wait_id, { status: "interrupted" }); } catch { /* retain original diagnostic state */ }
+      return emitSavedWaitError(err);
+    }
+    const settled = await settleInternalError({
+      err, checkpoint, store, waitSessionId, buildPublicReceipt,
+      finalize: (receipt) => finalizeWait(opts, waitSessionId, receipt),
+    });
     process.stderr.write(`bb-wait: ${err && err.stack || err}\n`);
-    emitReceipt({ schema_version: 1, outcome: "error", error: "internal" });
-    process.exit(EXIT.INTERNAL);
+    // Receipt first, stdout second, cloud finalization last — as on the normal path.
+    emitReceipt(settled.receipt, { versioned: true });
+    await settled.finalizeCloud();
+    process.exit(settled.exitCode);
+  }
+}
+
+/**
+ * BOT-2407 AC-2: the last-resort path for an unexpected throw (other than a
+ * WaitCheckpointError, which the caller emits as its own typed receipt) while a wait runs. It
+ * ends with a durable terminal receipt saying why — `interrupted` with no receipt is
+ * reserved for a killed process — and returns the receipt to print, the exit code, and
+ * `finalizeCloud` to call once the receipt is on stdout.
+ *   - The bounded public receipt is built once and is the same object that is persisted,
+ *     printed and finalized, so `bb wait resume` replays exactly what stdout carried.
+ *   - A registered wait is finalized in the cloud (best effort), so /waits learns why
+ *     instead of the row waiting for the reaper.
+ *   - A terminal receipt already saved (a match persisted from its frame) stays
+ *     authoritative: it is never overwritten by the internal error.
+ * Never throws, and neither does `finalizeCloud`.
+ */
+export async function settleInternalError({ err, checkpoint, store, waitSessionId = null, buildPublicReceipt, finalize = null }) {
+  if (checkpoint?.status === "terminal" && checkpoint.terminal_receipt != null) {
+    return {
+      receipt: checkpoint.terminal_receipt,
+      exitCode: Number.isInteger(checkpoint.exit_code) ? checkpoint.exit_code : EXIT.INTERNAL,
+      finalizeCloud: async () => {},
+    };
   }
+  const internalReceipt = {
+    schema_version: 1,
+    outcome: "error",
+    error: "internal",
+    detail: err instanceof Error ? `${err.name}: ${err.message}` : String(err),
+    wait_session_id: waitSessionId ?? null,
+    next_cursor: checkpoint?.safe_cursor ?? null,
+  };
+  let receipt = internalReceipt;
+  try { receipt = buildPublicReceipt(internalReceipt); } catch { /* keep the raw receipt */ }
+  const id = checkpoint?.local_wait_id;
+  if (id) {
+    try {
+      await store.update(id, {
+        status: "terminal",
+        terminal_receipt: receipt,
+        exit_code: EXIT.INTERNAL,
+        safe_cursor: receipt.next_cursor ?? checkpoint.safe_cursor ?? null,
+        cloud_finalize_pending: Boolean(waitSessionId),
+      });
+    } catch { /* retain original diagnostic state */ }
+  }
+  const finalizeCloud = async () => {
+    if (!waitSessionId || !finalize) return;
+    try {
+      const finalized = await finalize(receipt);
+      if (id) {
+        await store.update(id, finalized?.delivered
+          ? { cloud_finalize_pending: false, cloud_finalized_at: new Date().toISOString(), cloud_finalize_error: null }
+          : { cloud_finalize_pending: true, cloud_finalize_error: finalized?.error ?? null });
+      }
+    } catch { /* the pending marker stays for recovery */ }
+  };
+  return { receipt, exitCode: EXIT.INTERNAL, finalizeCloud };
 }
 
 if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {