@botbuddy/cli 1.59.7 → 1.59.9

package/daemon-release/darwin-arm64.json

@@ -0,0 +1,7 @@
+{
+  "release_version": "1.59.9",
+  "source_commit": "d9c73efb211e953ac2d57257a0d7d3cd21660d67",
+  "source_sha256": "57b561506694e9a2d326bba24731ab1b0354ef38c509b452686b8a450b59bd4b",
+  "target": "darwin-arm64",
+  "sha256": "ad8d7b6e3255d85f1c1237ae1b6bbd0a6b359b7909fba60b4819566bd7362c31"
+}

package/daemon-release/linux-x64.json

@@ -0,0 +1,7 @@
+{
+  "release_version": "1.59.9",
+  "source_commit": "d9c73efb211e953ac2d57257a0d7d3cd21660d67",
+  "source_sha256": "57b561506694e9a2d326bba24731ab1b0354ef38c509b452686b8a450b59bd4b",
+  "target": "linux-x64",
+  "sha256": "bf2f3a46ef151ace3e5b21633c03dc1824bee2e42fc6edd8f6898ca35d48f10c"
+}

package/daemon-release/manifest.json

@@ -0,0 +1,22 @@
+{
+  "schema_version": 1,
+  "release_version": "1.59.9",
+  "source_commit": "d9c73efb211e953ac2d57257a0d7d3cd21660d67",
+  "source_sha256": "57b561506694e9a2d326bba24731ab1b0354ef38c509b452686b8a450b59bd4b",
+  "targets": {
+    "darwin-arm64": {
+      "goos": "darwin",
+      "goarch": "arm64",
+      "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
+      "sha256": "ad8d7b6e3255d85f1c1237ae1b6bbd0a6b359b7909fba60b4819566bd7362c31",
+      "mode": "0755"
+    },
+    "linux-x64": {
+      "goos": "linux",
+      "goarch": "amd64",
+      "binary": "daemon/bin/linux-x64/botbuddy-daemon",
+      "sha256": "bf2f3a46ef151ace3e5b21633c03dc1824bee2e42fc6edd8f6898ca35d48f10c",
+      "mode": "0755"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.59.7",
+  "version": "1.59.9",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {
@@ -16,6 +16,8 @@
   },
   "files": [
     "bin/",
+    "daemon/",
+    "daemon-release/",
     "src/",
     "!src/**/*.test.mjs"
   ],

package/src/api.mjs

@@ -392,6 +392,68 @@ function toolEndpoint(tenant) {
   return url.toString();
 }
 
+// The Helper control plane is deliberately owner-wide. It is a REST sibling of
+// MCP's JSON-RPC endpoint, not an Edge admin shortcut: it authenticates through
+// the same owner/agent resolver, rejects every tenant selector server-side, and
+// applies its own host-owner fence. Keep its URL construction exact so a caller
+// cannot silently redirect registration to a generic functions route.
+export function containerHostRegisterEndpoint(serverUrl = SERVER_URL) {
+  let url;
+  try { url = new URL(serverUrl); } catch { throw new Error("container_host_register_endpoint_invalid"); }
+  if (url.username || url.password || url.search || url.hash ||
+      !/^(https:|http:)$/.test(url.protocol) ||
+      url.pathname.replace(/\/$/, "") !== "/functions/v1/mcp-server") {
+    throw new Error("container_host_register_endpoint_invalid");
+  }
+  url.pathname = "/functions/v1/mcp-server/container-hosts/register";
+  return url.toString();
+}
+
+/**
+ * Programmatic client for the source-backed `POST mcp-server/container-hosts/register`
+ * contract. It never adds a tenant pin and never manufactures an Edge user JWT.
+ */
+export async function registerContainerHost(body, {
+  fetchImpl = fetch,
+  auth: pinnedAuth = null,
+  resolveAuth = resolveCallAuth,
+  serverUrl = SERVER_URL,
+  signal,
+} = {}) {
+  if (!body || typeof body !== "object" || Array.isArray(body) || typeof fetchImpl !== "function") {
+    return { ok: false, error: "invalid_request" };
+  }
+  let endpoint;
+  try { endpoint = containerHostRegisterEndpoint(serverUrl); }
+  catch { return { ok: false, error: "endpoint_invalid" }; }
+  let auth = pinnedAuth;
+  if (!auth) {
+    const resolved = await resolveAuth({ toolName: "container_host_register", preferSession: false });
+    if (resolved?.error || !resolved?.auth) return { ok: false, auth: true, error: resolved?.error?.error ?? "not_authenticated" };
+    auth = resolved.auth;
+  }
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...auth },
+      body: JSON.stringify(body),
+      signal,
+    });
+  } catch {
+    return { ok: false, error: "transport" };
+  }
+  let data;
+  try { data = await response.json(); } catch { return { ok: false, status: response.status, error: "invalid_json" }; }
+  if (response.status === 401 || response.status === 403) {
+    return { ok: false, auth: true, status: response.status, error: typeof data?.code === "string" ? data.code : "unauthorized" };
+  }
+  if (response.status < 200 || response.status > 299) {
+    return { ok: false, status: response.status, error: typeof data?.code === "string" ? data.code : `http_${response.status}` };
+  }
+  return { ok: true, data };
+}
+
 export async function callToolJson(toolName, args = {}, {
   fetchImpl = fetch, signal, auth: pinnedAuth = null, tenant = null, resolvePin = resolveDefaultTenantPin,
   requireSessionToken = false, resolveAuth = resolveCallAuth,

package/src/commands.mjs

@@ -37,6 +37,7 @@ import { readAgentState } from "./agent-state.mjs";
 import { runUsage, usageStatus } from "./usage/sync.mjs";
 import { cmdTestIngest, doctorTestIngest, formatTestIngestLine } from "./test-ingest.mjs";
 import { installUsageAgent, usageAgentStatus } from "./usage/launchd.mjs";
+import { cmdDaemon } from "./daemon/commands.mjs";
 
 // BOT-1566 D2: the stale-CLI check runs for every command EXCEPT `wait` and any
 // invocation carrying `--json` — those are hot paths whose receipts (BOT-1229)
@@ -100,6 +101,7 @@ export async function run(argv, {
     case "stack": return cmdStack(args);
     case "allocation": return managedAllocation(args);
     case "docker": return cmdDocker(args);
+    case "daemon": return cmdDaemon(args);
     case "run": return cmdRun(args);
     case "telemetry": return cmdTelemetry(args);
     // BOT-803: local Claude/Codex token usage → usage-ingest (fail-open).
@@ -232,6 +234,10 @@ ${bold("DOCKER HYGIENE")}
   docker preflight [options] Refuse a managed-stack start before network pressure exhausts the host
   docker help                Full explicit-context safety contract
 
+${bold("GO DAEMON")}
+  daemon <render|install|status|enroll|bootstrap> …
+                             Verify and manage the native Go daemon service
+
 ${bold("DURABLE WORKLOADS")}
   run --session-id <id> --environment <env> -- <command>
                               Launch a receipt-bearing command under a detached owner

package/src/daemon/approval-wait.mjs

@@ -0,0 +1,126 @@
+// BOT-2324/BOT-2057: bridge a fresh-host approval to the existing pushed
+// `bb wait` protocol. This module never polls and treats the SSE wake as a
+// prompt to re-register, not as authority to issue a device profile.
+import { spawn as spawnChild } from "node:child_process";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { EXIT } from "../wait-core.mjs";
+
+const HOST_KEY_RE = /^bbh-[0-9a-f]{24}$/;
+const CANONICAL_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const MAX_WAIT_RECEIPT_BYTES = 128 * 1024;
+const BOTBUDDY_BIN = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "bin", "botbuddy.mjs");
+
+const fail = (code) => { throw new Error(code); };
+
+function checkedHostKey(hostKey) {
+  if (typeof hostKey !== "string" || !HOST_KEY_RE.test(hostKey)) fail("daemon_bootstrap_approval_wait_invalid");
+  return hostKey;
+}
+
+function checkedTimeout(timeoutSeconds) {
+  if (!Number.isSafeInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3_600) {
+    fail("daemon_bootstrap_approval_wait_invalid");
+  }
+  return timeoutSeconds;
+}
+
+/** The exact raw wait selector published by BOT-2324. */
+export function hostApprovalWaitCondition(hostKey) {
+  return `event:type=host_approval,subject=${checkedHostKey(hostKey)}`;
+}
+
+/** Fixed-argv call into this CLI's existing pushed wait client; never a sleep/poll loop. */
+export function defaultRunHostApprovalWait(condition, timeoutSeconds, { spawnImpl = spawnChild } = {}) {
+  if (typeof condition !== "string" || !/^event:type=host_approval,subject=bbh-[0-9a-f]{24}$/.test(condition)) {
+    return Promise.resolve({ exitCode: EXIT.INVALID, receipt: null, error: "invalid_condition" });
+  }
+  if (!Number.isSafeInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 3_600) {
+    return Promise.resolve({ exitCode: EXIT.INVALID, receipt: null, error: "invalid_timeout" });
+  }
+  return new Promise((resolve) => {
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process -- fixed Node executable and checked local CLI argv.
+    const child = spawnImpl(process.execPath, [BOTBUDDY_BIN, "wait", condition, "--timeout", String(timeoutSeconds), "--allow-short-timeout", "host approval is bounded by the enrollment deadline"], {
+      stdio: ["ignore", "pipe", "inherit"],
+    });
+    let settled = false;
+    let output = "";
+    let overflow = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
+    child.stdout.on("data", (chunk) => {
+      if (overflow) return;
+      output += String(chunk);
+      if (Buffer.byteLength(output, "utf8") > MAX_WAIT_RECEIPT_BYTES) {
+        overflow = true;
+        child.kill();
+      }
+    });
+    child.once("error", () => finish({ exitCode: EXIT.INTERNAL, receipt: null, error: "wait_spawn_failed" }));
+    child.once("close", (code) => {
+      if (overflow) return finish({ exitCode: EXIT.INTERNAL, receipt: null, error: "wait_receipt_too_large" });
+      const line = output.trim().split(/\r?\n/).filter(Boolean).at(-1);
+      let receipt = null;
+      try { receipt = line ? JSON.parse(line) : null; } catch { /* typed below as invalid evidence */ }
+      finish({ exitCode: Number.isInteger(code) ? code : EXIT.INTERNAL, receipt });
+    });
+  });
+}
+
+function receiptMatchesExactHostApproval(receipt, hostKey) {
+  if (!receipt || typeof receipt !== "object" || Array.isArray(receipt) ||
+      receipt.schema_version !== 1 || receipt.outcome !== "matched" || !Array.isArray(receipt.matched) ||
+      receipt.matched.length !== 1) return false;
+  const [match] = receipt.matched;
+  return match && typeof match === "object" && !Array.isArray(match) &&
+    match.signal_type === "host_approval" && match.subject_key === hostKey &&
+    exactApprovalPayload(match.payload);
+}
+
+function exactApprovalPayload(payload) {
+  const keys = ["settings_version", "policy_version", "plan_id", "source"];
+  return payload && typeof payload === "object" && !Array.isArray(payload) &&
+    Object.keys(payload).length === keys.length && keys.every((key) => Object.hasOwn(payload, key)) &&
+    Number.isSafeInteger(payload.settings_version) && payload.settings_version >= 1 && payload.settings_version <= 2_147_483_647 &&
+    Number.isSafeInteger(payload.policy_version) && payload.policy_version >= 1 && payload.policy_version <= 2_147_483_647 &&
+    typeof payload.plan_id === "string" && CANONICAL_UUID_RE.test(payload.plan_id) &&
+    (payload.source === "arm" || payload.source === "state");
+}
+
+function receiptIsCancelled(receipt) {
+  return receipt && typeof receipt === "object" && !Array.isArray(receipt) &&
+    receipt.schema_version === 1 && receipt.outcome === "cancelled";
+}
+
+/**
+ * Convert a real `bb wait` terminal receipt into bootstrap's narrow wake seam.
+ * A match merely permits the required post-wake registration re-check in
+ * bootstrap.mjs; it never itself conveys profile-issuance authority.
+ */
+export async function awaitHostApproval({ hostKey, timeoutSeconds } = {}, { runWait = defaultRunHostApprovalWait } = {}) {
+  const exactHostKey = checkedHostKey(hostKey);
+  const boundedTimeout = checkedTimeout(timeoutSeconds);
+  if (typeof runWait !== "function") fail("daemon_bootstrap_approval_wait_invalid");
+  let result;
+  try {
+    result = await runWait(hostApprovalWaitCondition(exactHostKey), boundedTimeout);
+  } catch {
+    fail("daemon_bootstrap_approval_wait_failed");
+  }
+  if (!result || typeof result !== "object" || !Number.isInteger(result.exitCode)) {
+    fail("daemon_bootstrap_approval_wait_failed");
+  }
+  if (result.exitCode === EXIT.MATCHED) {
+    // `bb wait cancel` deliberately exits 0 for its own successful local
+    // operation. Inspect the receipt before treating a zero as a policy wake.
+    if (receiptIsCancelled(result.receipt)) return { state: "cancelled" };
+    if (!receiptMatchesExactHostApproval(result.receipt, exactHostKey)) fail("daemon_bootstrap_approval_wait_invalid");
+    return { state: "approved" };
+  }
+  if (result.exitCode === EXIT.TIMEOUT) return { state: "expired" };
+  fail("daemon_bootstrap_approval_wait_failed");
+}

package/src/daemon/bootstrap-resume.mjs

@@ -0,0 +1,151 @@
+// BOT-2057: requester-local, non-secret state that lets an operator resume an
+// approved fresh target without creating another target P-256 identity. This is
+// deliberately metadata only; target private material and device credentials
+// never pass through or persist here.
+import { randomUUID } from "node:crypto";
+import { chmod, link, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+
+const HOST_KEY_RE = /^bbh-[0-9a-f]{24}$/;
+const PATH_RE = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+const RECORD_KEYS = Object.freeze([
+  "schema_version", "host_key", "public_key_spki_sha256", "server_url", "ssh_host", "service_user",
+  "daemon_binary", "profile_path", "requesting_host", "runtime_engine_id", "platform", "arch",
+  "release_root", "home", "config", "approval_timeout_seconds", "profile_phase",
+]);
+const fail = (code) => { throw new Error(code); };
+
+function exactObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) &&
+    Object.keys(value).length === RECORD_KEYS.length && RECORD_KEYS.every((key) => Object.hasOwn(value, key));
+}
+
+function validRecord(value) {
+  return exactObject(value) &&
+    value.schema_version === 2 && typeof value.host_key === "string" && HOST_KEY_RE.test(value.host_key) &&
+    typeof value.public_key_spki_sha256 === "string" && /^sha256:[0-9a-f]{64}$/.test(value.public_key_spki_sha256) &&
+    value.server_url === "https://xymjddoobrfnsmawmtbc.supabase.co/functions/v1/mcp-server" &&
+    typeof value.ssh_host === "string" && /^[A-Za-z0-9._-]+(?:@[A-Za-z0-9._-]+)?$/.test(value.ssh_host) &&
+    typeof value.service_user === "string" && /^[a-z_][a-z0-9_-]*$/i.test(value.service_user) && value.service_user !== "root" &&
+    [value.daemon_binary, value.profile_path, value.release_root, value.home, value.config].every((path) => typeof path === "string" && PATH_RE.test(path)) &&
+    value.profile_path.endsWith("/profile.json") &&
+    typeof value.requesting_host === "string" && value.requesting_host.length > 0 && Buffer.byteLength(value.requesting_host, "utf8") <= 80 &&
+    typeof value.runtime_engine_id === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(value.runtime_engine_id) &&
+    ["darwin", "linux"].includes(value.platform) && typeof value.arch === "string" && value.arch.length > 0 &&
+    Number.isSafeInteger(value.approval_timeout_seconds) && value.approval_timeout_seconds >= 1 && value.approval_timeout_seconds <= 3_600 &&
+    ["pending", "profile_delivered"].includes(value.profile_phase);
+}
+
+function sameCustodyRecord(left, right) {
+  return RECORD_KEYS.filter((key) => key !== "profile_phase").every((key) => left[key] === right[key]);
+}
+
+function isPermittedPhaseTransition(existing, next) {
+  return existing.profile_phase === next.profile_phase ||
+    (existing.profile_phase === "pending" && next.profile_phase === "profile_delivered");
+}
+
+async function checkedDirectory(path, code = "daemon_bootstrap_resume_unsafe_root") {
+  const stat = await lstat(path).catch((error) => error?.code === "ENOENT" ? null : Promise.reject(error));
+  if (!stat) return false;
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail(code);
+  return true;
+}
+
+async function checkedPrivateDirectory(path) {
+  const stat = await lstat(path).catch((error) => error?.code === "ENOENT" ? null : Promise.reject(error));
+  if (!stat) return false;
+  if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) fail("daemon_bootstrap_resume_unsafe_root");
+  return true;
+}
+
+async function readRecord(path, missingCode) {
+  let stat;
+  try { stat = await lstat(path); } catch (error) {
+    if (error?.code === "ENOENT") fail(missingCode);
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) fail("daemon_bootstrap_resume_invalid");
+  let parsed;
+  try { parsed = JSON.parse(await readFile(path, "utf8")); } catch { fail("daemon_bootstrap_resume_invalid"); }
+  if (!validRecord(parsed)) fail("daemon_bootstrap_resume_invalid");
+  return parsed;
+}
+
+export function createBootstrapResumeStore({ cwd = process.cwd() } = {}) {
+  const root = resolve(cwd, ".botbuddy", "daemon-bootstrap");
+  const base = resolve(cwd);
+  if (!root.startsWith(`${base}/`)) fail("daemon_bootstrap_resume_unsafe_root");
+  const recordPath = (hostKey) => {
+    if (typeof hostKey !== "string" || !HOST_KEY_RE.test(hostKey)) fail("daemon_bootstrap_resume_invalid");
+    return join(root, `${hostKey}.json`);
+  };
+  const ensureRoot = async () => {
+    const parent = join(base, ".botbuddy");
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    // `chmod` follows a symlink. Verify the existing requester root before
+    // correcting its mode so a hostile cwd cannot redirect that operation.
+    await checkedDirectory(parent);
+    await chmod(parent, 0o700);
+    await checkedPrivateDirectory(parent);
+    if (!await checkedPrivateDirectory(root)) {
+      await mkdir(root, { mode: 0o700 });
+      await chmod(root, 0o700);
+    }
+    await checkedPrivateDirectory(root);
+  };
+  return {
+    async save(record) {
+      if (!validRecord(record)) fail("daemon_bootstrap_resume_invalid");
+      await ensureRoot();
+      const finalPath = recordPath(record.host_key);
+      let replacePending = false;
+      try {
+        const existing = await readRecord(finalPath, "daemon_bootstrap_resume_missing");
+        if (!sameCustodyRecord(existing, record) || !isPermittedPhaseTransition(existing, record)) {
+          fail("daemon_bootstrap_resume_conflict");
+        }
+        if (existing.profile_phase === record.profile_phase) return existing;
+        replacePending = true;
+      } catch (error) {
+        if (error?.message !== "daemon_bootstrap_resume_missing") throw error;
+      }
+      const temporary = join(root, `.${record.host_key}.${randomUUID()}.tmp`);
+      try {
+        await writeFile(temporary, `${JSON.stringify(record)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        if (replacePending) {
+          // A phase may advance only after the existing private, regular record
+          // was bound to the same target/spec above. Rename makes the completed
+          // profile marker visible atomically; no reverse transition exists.
+          await rename(temporary, finalPath);
+          return record;
+        }
+        await link(temporary, finalPath);
+      } catch (error) {
+        if (error?.code === "EEXIST") {
+          const existing = await readRecord(finalPath, "daemon_bootstrap_resume_missing");
+          if (!sameCustodyRecord(existing, record) || !isPermittedPhaseTransition(existing, record)) {
+            fail("daemon_bootstrap_resume_conflict");
+          }
+          if (existing.profile_phase !== record.profile_phase) fail("daemon_bootstrap_resume_conflict");
+          return existing;
+        }
+        throw error;
+      } finally {
+        await rm(temporary, { force: true }).catch(() => {});
+      }
+      return record;
+    },
+    async load(hostKey) {
+      await ensureRoot();
+      return readRecord(recordPath(hostKey), "daemon_bootstrap_resume_missing");
+    },
+    async remove(hostKey) {
+      await ensureRoot();
+      const target = recordPath(hostKey);
+      const record = await readRecord(target, "daemon_bootstrap_resume_missing");
+      await rm(target, { force: false });
+      return record;
+    },
+  };
+}