@botbuddy/cli 1.53.0 → 1.54.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.53.0",
+  "version": "1.54.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-doctor.mjs

@@ -83,6 +83,11 @@ export function repairFailureRecovery(code, error = null) {
   if (code === "agent_tenant_immutable") {
     return "this worktree's agent identity belongs to another tenant; run `bb setup` to register this tenant, then `bb doctor --fix`";
   }
+  // BOT-2415: the cached session names a different agent than the one holding this
+  // worktree's technical name. Deterministic: a retry repeats the same conflict.
+  if (code === "agent_name_conflict") {
+    return "this worktree's cached session (.botbuddy/agent-state.json) names a different agent than the one holding the worktree's technical name; move that file aside, then run `bb doctor --fix`";
+  }
   // BOT-1750 (Codex R9 P2): `session_mint_unauthorized` means a locally-unexpired
   // client key was revoked/rejected server-side — only a fresh login replaces it, so
   // point at `bb login`, not a binding repair (the binding is valid).

package/src/agent-session.mjs

@@ -345,6 +345,9 @@ export async function selfHealAgentSession({
       branch: currentBranch || undefined,
       ticket_id: ticketFromBranch(currentBranch),
       agent_id: presentedAgentId ?? undefined,
+      // A rejected-token renewal may still own locks or leases under this agent.
+      // Ask the server to keep it; ordinary setup/doctor repair may adopt a holder.
+      ...(renewal ? { preserve_agent_identity: true } : {}),
       harness_session_id: presentedHarness ?? undefined,
       harness: env.CLAUDE_CODE || env.CLAUDECODE ? "claude-code" : Object.keys(env).some((key) => key.startsWith("CODEX_")) ? "codex" : "cli",
       model: env.BOTBUDDY_MODEL || undefined,
@@ -372,8 +375,14 @@ export async function selfHealAgentSession({
       const typedCode = typeof response?.code === "string"
         ? response.code
         : typeof data.code === "string" ? data.code : null;
-      const code = typedCode === "agent_tenant_immutable"
+      // BOT-2415: a technical-name conflict is deterministic (the cached agent_id
+      // names a different agent than the one holding this worktree's name), so no
+      // retry fixes it. Recognise the typed refusal and an older server's raw 23505.
+      const nameConflict = typedCode === "agent_name_taken"
+        || /agents_name_key/.test(String(response?.error ?? data.error ?? ""));
+      const code = ["agent_tenant_immutable", "session_identity_mismatch"].includes(typedCode)
         ? typedCode
+        : nameConflict ? "agent_name_conflict"
         : response?.auth ? "session_mint_unauthorized" : "session_mint_failed";
       // BOT-1891: name the credential (never its value) so `bb doctor` can point a
       // rejected tier-2 key at rotation instead of `bb login`.

package/src/commands.mjs

@@ -568,7 +568,7 @@ function setupFailureRecovery(error) {
   if (code === "tenant_binding_required" || code === "invalid_binding") {
     return "fix the committed .botbuddy-agent.json binding, then retry `bb setup`";
   }
-  if (code === "client_key_unavailable" || code === "session_mint_unauthorized") return repairFailureRecovery(code, error);
+  if (code === "client_key_unavailable" || code === "session_mint_unauthorized" || code === "agent_name_conflict") return repairFailureRecovery(code, error);
   return "retry `bb setup`";
 }
 

package/src/stack.mjs

@@ -586,6 +586,7 @@ const CONSIDERED_VERDICT_TEXT = {
   HOST_CAPACITY_WAIT: () => "Docker pressure full",
   HOST_CAPACITY_BUDGET_FULL: () => "slot budget full",
   HOST_CAPACITY_INVENTORY_UNKNOWN: () => "unknown Docker resources in its census",
+  HOST_PRESSURE: () => "host under pressure",
   TENANT_RESERVATION_FULL: () => "tenant reservation full",
   SLOT_HELD: () => "this slot is already leased there",
   HOST_HELPER_OUTDATED: () => "Helper predates remote leases (protocol < 4)",
@@ -605,6 +606,33 @@ export function describeConsidered(considered) {
     });
 }
 
+/**
+ * BOT-1630: the typed park reason of a queued lease, or null. The server holds a host under
+ * pressure (`docker info` failing, low memory, engine footprint) with verdict HOST_PRESSURE, and
+ * a Helper that hits it mid-provision defers the lease back to the queue with that reason.
+ */
+export function queuedParkReason(d) {
+  if (!d || typeof d !== "object") return null;
+  const ledger = d.ledger && typeof d.ledger === "object" ? d.ledger : null;
+  if (ledger?.verdict === "HOST_PRESSURE" || ledger?.capacity?.code === "HOST_PRESSURE") return "host_pressure";
+  const here = Array.isArray(d.considered) ? d.considered.find((c) => c?.host_key === d.host_key) : null;
+  if (here?.verdict_code === "HOST_PRESSURE") return "host_pressure";
+  if (d.provision_defer_reason === "HOST_PRESSURE") return "host_pressure";
+  return null;
+}
+
+/** BOT-1630: "docker_unresponsive (docker_command_failed:docker info:-2; clears …)" per binding dimension. */
+export function describePressure(d) {
+  const reasons = d?.ledger?.capacity?.pressure?.reasons;
+  if (!Array.isArray(reasons) || reasons.length === 0) return null;
+  return reasons.filter((r) => r && typeof r.dimension === "string").map((r) => {
+    const parts = [];
+    if (r.observed != null) parts.push(r.limit != null ? `${r.observed} vs limit ${r.limit}` : String(r.observed));
+    if (typeof r.clears_at === "string") parts.push(`clears ${r.clears_at}`);
+    return parts.length ? `${r.dimension} (${parts.join("; ")})` : r.dimension;
+  }).join(", ") || null;
+}
+
 export function describeUnitLedger(ledger) {
   if (!ledger || typeof ledger !== "object") return [];
   const cap = ledger.capacity ?? {};
@@ -985,7 +1013,7 @@ export function retryingStackCall({
 // taxonomy so automation sees AUTH/BACKEND, not a CLI-defect INTERNAL. Credential
 // problems are AUTH (3); a transport/server mint failure is BACKEND (5); anything
 // unrecognized stays INTERNAL (7).
-const AUTH_ERROR_CODES = new Set(["client_key_required", "client_key_unavailable", "tenant_binding_required", "session_token_malformed", "session_mint_unauthorized", "session_identity_mismatch"]);
+const AUTH_ERROR_CODES = new Set(["client_key_required", "client_key_unavailable", "tenant_binding_required", "session_token_malformed", "session_mint_unauthorized", "session_identity_mismatch", "agent_name_conflict"]);
 // BOT-1750 (Codex R11 P2): `session_mint_invalid` is an incompatible/malformed SERVER
 // response, not a credential problem — classify it with the transport/server failures.
 const BACKEND_ERROR_CODES = new Set(["session_mint_failed", "session_mint_invalid"]);
@@ -1423,6 +1451,7 @@ export const PARK_AUTH_BUDGET_MS = 5 * 60_000;
 // the regular auth budget; it is not evidence that the lease changed owner.
 const DEFINITIVE_REAUTH_CODES = new Set([
   "session_identity_mismatch", "client_key_required", "tenant_binding_required", "session_token_malformed", "agent_tenant_immutable",
+  "agent_name_conflict",
 ]);
 
 function abortableSleep(ms, signal) {
@@ -3546,16 +3575,28 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       const cleanup = await requestCleanup();
       return { exitCode: SIGNAL_EXIT[receivedSignal], outcome: "interrupted", leaseId, cleanup };
     }
+    // BOT-1630: ONE park budget (--timeout) across every park. A Helper that finds the host under
+    // pressure mid-provision defers the lease back to `queued` (its place kept); run then parks
+    // again against the same deadline instead of timing out on the provision clock.
+    const parkDeadlineMs = (adapters.now ?? Date.now)() + opts.timeout * 1000;
+    let parkView = request.data;
+    let parkReason = null;
+    for (;;) {
     if (state === "queued") {
       // BOT-2019: say where the lease sits (server dispatch rank, or why it has none) before parking.
-      stderrLine(`stack: lease ${leaseId} queued — ${describeQueuePosition(request.data)}`);
-      for (const line of describeUnitLedger(request.data.ledger)) stderrLine(`stack: ${line}`);
-      for (const line of describeConsidered(request.data.considered)) stderrLine(`stack: ${line}`);
+      stderrLine(`stack: lease ${leaseId} queued — ${describeQueuePosition(parkView)}`);
+      for (const line of describeUnitLedger(parkView.ledger)) stderrLine(`stack: ${line}`);
+      for (const line of describeConsidered(parkView.considered)) stderrLine(`stack: ${line}`);
+      parkReason = queuedParkReason(parkView) ?? parkReason;
+      if (parkReason === "host_pressure") {
+        const why = describePressure(parkView);
+        stderrLine(`stack: parked — park_reason host_pressure${why ? `: ${why}` : ""}; the lease keeps its queue place and starts when the host's pressure clears`);
+      }
       activeWaitAbort = new AbortController();
       // BOT-2013: every reap state (reaping / reaped / reap_failed) means the queued lease is lost.
       // BOT-2099: an auth/availability blip is retried inside the park until its deadline;
       // it never releases a queued lease or becomes the lease's outcome.
-      const parked = await resilientWait(leaseId, (s) => s !== "queued" && s != null, isReaped, { timeoutSec: opts.timeout, auth: rpc.auth, signal: activeWaitAbort.signal });
+      const parked = await resilientWait(leaseId, (s) => s !== "queued" && s != null, isReaped, { timeoutSec: opts.timeout, deadlineMs: parkDeadlineMs, auth: rpc.auth, signal: activeWaitAbort.signal });
       activeWaitAbort = null;
       const incident = parkIncident ? { incident: parkIncident } : {};
       if (parked?.interrupted || receivedSignal) { const cleanup = await requestCleanup(); return { exitCode: SIGNAL_EXIT[receivedSignal], outcome: "interrupted", leaseId, cleanup, ...incident }; }
@@ -3577,7 +3618,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
             error: `lease ${leaseId} parked ${opts.timeout}s inside a platform incident (${parkIncident.reason} since ${parkIncident.first_at}), so its admission was never observed`,
           };
         }
-        return { exitCode: EXIT.TIMEOUT, outcome: "timeout", leaseId, error: `parked ${opts.timeout}s without capacity`, cleanup, ...incident, ...(ledger ? { ledger } : {}) };
+        return { exitCode: EXIT.TIMEOUT, outcome: "timeout", leaseId, error: `parked ${opts.timeout}s without capacity`, cleanup, ...incident, ...(ledger ? { ledger } : {}), ...(parkReason ? { parkReason } : {}) };
       }
       if (parked?.failed) { const cleanup = await requestCleanup(); return { exitCode: EXIT.LEASE_FAILED, outcome: "error", leaseId, error: `lease was ${parked.state} while queued (reap_reason=${parked.reap_reason ?? "unknown"})`, cleanup, ...incident }; }
       if (parked?.error || parked?.auth) { const cleanup = await requestCleanup(); return { exitCode: parked?.auth ? EXIT.AUTH : EXIT.LEASE_FAILED, outcome: "error", leaseId, error: parked?.error || "lease did not leave queue", cleanup, ...incident }; }
@@ -3592,17 +3633,33 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       // provisionTimeout before the belt-and-braces recheck below ever notices
       // the lease is no longer provisioning. isReaped (== "reaping" || "reaped")
       // already covers both; cmdUp's equivalent waits use it for this reason.
-      const active = await resilientWait(leaseId, (s) => s === "active", isReaped, { timeoutSec: provisionTimeout, auth: rpc.auth, signal: activeWaitAbort.signal });
+      // BOT-1630: `queued` also ends this wait — a deferred provision (HOST_PRESSURE, capacity).
+      const active = await resilientWait(leaseId, (s) => s === "active" || s === "queued", isReaped, { timeoutSec: provisionTimeout, auth: rpc.auth, signal: activeWaitAbort.signal });
       activeWaitAbort = null;
       if (active?.interrupted || receivedSignal) { const cleanup = await requestCleanup(); return { exitCode: SIGNAL_EXIT[receivedSignal], outcome: "interrupted", leaseId, cleanup }; }
       if (active?.authUnavailable) { const cleanup = await requestCleanup(); return authUnavailableResult(active, "provisioning", cleanup); }
+      if (active?.state === "queued" && !active.timeout && !active.failed && !active.error && !active.auth) {
+        const read = await readLeaseQuietly(leaseId);
+        parkView = read?.ok && read.data?.success ? read.data : { host_key: placement.hostKey };
+        const why = parkView.provision_defer_reason ?? "host capacity";
+        stderrLine(`stack: lease ${leaseId} was deferred back to the queue while provisioning (${why}) — its place is kept; parking again`);
+        state = "queued";
+        continue;
+      }
       if (active?.timeout) {
         // BOT-1822 belt-and-braces: the zero-poll wait can still miss a live
         // `stack_lease` signal (an older server before this fix, a relay hiccup,
         // BOT-1816's class of dropped wakes) even though the lease genuinely went
-        // active. One direct read before declaring a timeout tells that apart from
-        // a lease that truly never provisioned, instead of reaping a healthy stack.
+        // active or was deferred back to queued. One direct read before declaring
+        // a timeout avoids reaping a healthy stack or destroying a kept queue place.
         const recheck = await api.get(leaseId);
+        if (recheck?.ok && recheck.data?.success && recheck.data.state === "queued") {
+          parkView = recheck.data;
+          const why = parkView.provision_defer_reason ?? "host capacity";
+          stderrLine(`stack: lease ${leaseId} was deferred back to the queue while provisioning (${why}) — its place is kept; parking again`);
+          state = "queued";
+          continue;
+        }
         if (!(recheck?.ok && recheck.data?.success && recheck.data.state === "active")) {
           const cleanup = await requestCleanup();
           return { exitCode: EXIT.TIMEOUT, outcome: "timeout", leaseId, error: `physical provision did not reach active in ${provisionTimeout}s`, cleanup, ...(parkIncident ? { incident: parkIncident } : {}) };
@@ -3620,6 +3677,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         return { exitCode: active?.auth ? EXIT.AUTH : EXIT.LEASE_FAILED, outcome: "error", leaseId, error: active?.error || `lease ${active?.state ?? "failed"} before reaching active${why}`, cleanup, ...(parkIncident ? { incident: parkIncident } : {}) };
       }
     }
+    break;
+    }
     const current = await api.get(leaseId);
     if (!current?.ok || !current.data?.success || current.data.state !== "active" || !current.data.connection || typeof current.data.connection !== "object") {
       const cleanup = await requestCleanup();

package/src/wait.mjs

@@ -20,6 +20,7 @@ import { fileURLToPath } from "node:url";
 import { latestPublicCliCommand } from "./public-invocation.mjs";
 import { AGENT_KEY_RE, readAgentSessionTokenEnv, legacyAgentAliasHint } from "./agent-key.mjs";
 import { clearAgentState, hasAgentSessionRuntime, isRejectedCachedSession, resolveAgentSessionCredential, selfHealAgentSession } from "./agent-session.mjs";
+import { repairFailureRecovery } from "./agent-doctor.mjs";
 import { touchAgentStateExpiry } from "./agent-state.mjs";
 import { SETUP_BLOCK } from "./setup-block.mjs";
 import { createWaitCheckpointStore, WaitCheckpointError } from "./wait-checkpoint.mjs";
@@ -1679,7 +1680,10 @@ export async function runWait(argv, { recoveryLocalWaitId = null } = {}) {
       opts.credentialSource = credential.source;
     } catch (error) {
       const code = error?.code ?? "session_mint_failed";
-      const recovery = code === "client_key_required"
+      // BOT-2415: a stale cache naming another agent is not fixed by `bb setup` + retry.
+      const recovery = code === "agent_name_conflict"
+        ? repairFailureRecovery(code)
+        : code === "client_key_required"
         ? "run `bb setup` from this project worktree, then retry"
         : code === "tenant_binding_required"
         ? "run from a configured project worktree, then run `bb setup` and retry"