@botbuddy/cli 1.6.1 → 1.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.6.1",
+  "version": "1.6.3",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-credential-store.mjs

@@ -27,9 +27,21 @@ function keychainService(profile) {
   return profileCredentialEnvironment(profile);
 }
 
-function writePasswordPrompt(command, args, password) {
+// A keychain/credential-store write failed AFTER OAuth + registration already
+// succeeded. It carries its own code so the CLI never mislabels a storage
+// failure as an auth failure (which would tell the user to re-`login`).
+export class ProfileCredentialStoreError extends Error {
+  constructor(message, { cause } = {}) {
+    super(message);
+    this.name = "ProfileCredentialStoreError";
+    this.code = "profile_credential_store_failed";
+    if (cause !== undefined) this.cause = cause;
+  }
+}
+
+function writePasswordPrompt(command, args, password, spawnProcess) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { stdio: ["pipe", "ignore", "pipe"] });
+    const child = spawnProcess(command, args, { stdio: ["pipe", "ignore", "pipe"] });
     let stderr = "";
     child.stderr.on("data", (chunk) => { stderr += chunk; });
     child.once("error", reject);
@@ -37,16 +49,37 @@ function writePasswordPrompt(command, args, password) {
       if (code === 0) resolve();
       else reject(new Error(`${command} exited ${code}${stderr ? `: ${stderr.trim()}` : ""}`));
     });
-    // `security -w` prompts from standard input when it is the last option.
-    // Keeping the password off argv prevents process-list disclosure.
-    child.stdin.end(`${password}\n`);
+    // `security -w` prompt mode reads the secret from standard input TWICE (the
+    // value and a retype). A single piped line leaves the retype empty, so
+    // `security` exits with "passwords don't match" the moment there is no TTY.
+    // Feeding the same value twice satisfies both reads without an interactive
+    // terminal, and keeping it off argv prevents process-list disclosure.
+    child.stdin.end(`${password}\n${password}\n`);
   });
 }
 
-async function writeKeychain(profile, token) {
+export async function writeKeychain(profile, token, { spawnProcess = spawn } = {}) {
   const service = keychainService(profile);
-  if (!service) throw new Error("unknown profile keychain service");
-  await writePasswordPrompt("security", ["add-generic-password", "-U", "-s", service, "-a", userInfo().username, "-w"], token);
+  if (!service) throw new ProfileCredentialStoreError(`unknown profile keychain service for "${profile}"`);
+  try {
+    await writePasswordPrompt(
+      "security",
+      ["add-generic-password", "-U", "-s", service, "-a", userInfo().username, "-w"],
+      token,
+      spawnProcess,
+    );
+  } catch (error) {
+    // `security` cancels its authorization when the login keychain is locked in
+    // a headless session; guide the user to unlock it rather than re-login.
+    const detail = String(error?.message ?? error);
+    if (/authorization was cancell?ed/i.test(detail)) {
+      throw new ProfileCredentialStoreError(
+        "macOS Keychain authorization was canceled — unlock your login keychain (`security unlock-keychain`) and retry; a headless session needs it already unlocked",
+        { cause: error },
+      );
+    }
+    throw new ProfileCredentialStoreError(`could not write the profile credential to the macOS Keychain: ${detail}`, { cause: error });
+  }
 }
 
 async function readKeychain(profile) {

package/src/commands.mjs

@@ -10,7 +10,7 @@ import { cmdRun } from "./run.mjs";
 import { runWait } from "./wait.mjs";
 import { green, red, cyan, dim, bold, die } from "./utils.mjs";
 import { VERSION } from "./version.mjs";
-import { bootstrapProfile, ProfileBootstrapError, profileShellRefresh } from "./profile-bootstrap.mjs";
+import { bootstrapProfile, ProfileBootstrapError, profileBootstrapRecovery, profileShellRefresh } from "./profile-bootstrap.mjs";
 import { runPw } from "./pw/run.mjs";
 
 export async function run(argv) {
@@ -325,7 +325,7 @@ async function cmdProfile(args) {
       schema_version: 1,
       outcome: "error",
       error: code,
-      recovery: "botbuddy login && botbuddy profile setup " + args[1],
+      recovery: profileBootstrapRecovery(code, args[1]),
     }));
     process.exitCode = 3;
   }

package/src/profile-bootstrap.mjs

@@ -1,7 +1,7 @@
 import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
 
-import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment } from "./agent-credential-store.mjs";
+import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment, ProfileCredentialStoreError } from "./agent-credential-store.mjs";
 import { callToolJson } from "./api.mjs";
 import { latestPublicCliCommand } from "./public-invocation.mjs";
 
@@ -79,13 +79,31 @@ export async function bootstrapProfile(profileName, {
   const token = registrationCredential(data);
   if (!token) throw new ProfileBootstrapError("profile_agent_required");
 
-  await store({
-    profile: profileName,
-    tenant: profile.tenant,
-    agentId: data.agent_id,
-    name: agentName,
-    token,
-  });
+  try {
+    await store({
+      profile: profileName,
+      tenant: profile.tenant,
+      agentId: data.agent_id,
+      name: agentName,
+      token,
+    });
+  } catch (error) {
+    // OAuth + registration + tenant attestation all succeeded; only persisting
+    // the credential failed. Give the two persistence failures accurate,
+    // distinct recoveries — never the `botbuddy login` OAuth recovery:
+    //   • a Keychain write failure (ProfileCredentialStoreError) is resolved by
+    //     unlocking the login keychain;
+    //   • a filesystem/lock failure writing ~/.botbuddy/agent-profiles.json
+    //     (EACCES/ENOSPC/busy store lock) is NOT — unlocking the keychain would
+    //     not help, so it gets its own code.
+    if (error instanceof ProfileBootstrapError) throw error;
+    const code = error instanceof ProfileCredentialStoreError
+      ? "profile_credential_store_failed"
+      : "profile_credential_persist_failed";
+    const failure = new ProfileBootstrapError(code);
+    failure.cause = error;
+    throw failure;
+  }
   return {
     schema_version: 1,
     outcome: "installed",
@@ -98,6 +116,19 @@ export async function bootstrapProfile(profileName, {
   };
 }
 
+// Maps a bootstrap error code to the recovery hint shown in the CLI receipt.
+// A credential-store/Keychain failure gets its own actionable recovery; every
+// other failure keeps the historical login-first recovery verbatim.
+export function profileBootstrapRecovery(code, profileName) {
+  if (code === "profile_credential_store_failed") {
+    return `unlock your login keychain (security unlock-keychain), then re-run: botbuddy profile setup ${profileName}`;
+  }
+  if (code === "profile_credential_persist_failed") {
+    return `ensure ~/.botbuddy is writable and no other setup is running, then re-run: botbuddy profile setup ${profileName}`;
+  }
+  return `botbuddy login && botbuddy profile setup ${profileName}`;
+}
+
 export function profileShellRefresh(profileName) {
   const tokenEnv = profileCredentialEnvironment(profileName);
   if (!tokenEnv) throw new ProfileBootstrapError("profile_required");

package/src/wait-core.mjs

@@ -228,6 +228,35 @@ const VALIDATORS = {
     }
     return { repo };
   },
+  // BOT-1458 — staging-release: wake when the first staging release train whose
+  // head commit CONTAINS this PR's merge commit reaches a terminal conclusion
+  // (success OR failure). Unlike `staging-green` this is PR-scoped and reports
+  // the train's outcome, never a health verdict. Inclusion is decided server-side
+  // by git ancestry (GitHub compare API), never by wall-clock ordering, so the
+  // condition only names the repo + PR; the relay stamps the resolved
+  // merge_commit_sha and workspace at registration. Optional
+  // `after_run=<run_id>[:<attempt>]` lets a wait re-armed from a failure receipt
+  // skip the run it already saw and park for the NEXT train.
+  "staging-release"(p) {
+    const { repo, number } = parsePrTarget(p, "staging-release");
+    if (number == null) {
+      throw new Error("staging-release needs pr=<number> (or pr=<owner/repo#number>)");
+    }
+    const out = { repo, pr: number };
+    if (p.after_run !== undefined) {
+      const raw = String(p.after_run).trim();
+      const m = /^(\d+)(?::(\d+))?$/.exec(raw);
+      if (!m) throw new Error("staging-release after_run must be <run_id>[:<attempt>]");
+      out.afterRunId = m[1];
+      if (m[2] !== undefined) out.afterRunAttempt = Number(m[2]);
+    }
+    const allowed = new Set(["repo", "pr", "number", "after_run"]);
+    const extras = Object.keys(p).filter((key) => !allowed.has(key));
+    if (extras.length > 0) {
+      throw new Error(`staging-release accepts only repo=<owner/repo>, pr=<number>, after_run=<run_id>[:<attempt>] (got: ${extras.join(", ")})`);
+    }
+    return out;
+  },
   // BOT-1247 — unblocked: wake when a ticket's LAST open blocker clears (its
   // open-blocker count transitions >0 → 0). Level-triggered: a ticket already
   // unblocked (or never blocked) at registration is granted immediately with
@@ -666,6 +695,27 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
         payload.gate_open === false &&
         payload.operational_status === "healthy";
     }
+    case "staging-release": {
+      // BOT-1458: a PR-scoped staging release train reached a terminal conclusion
+      // and its head commit contains this PR's merge (`includes_pr:true`, decided
+      // server-side by ancestry). The signal is tenant-scoped, so the central
+      // guard already fenced foreign workspaces. Subject is `<owner/repo>#<pr>`.
+      if (signal.signal_type !== "staging_release") return false;
+      const payload = signal.payload ?? {};
+      const subject = typeof signal.subject_key === "string" ? signal.subject_key.toLowerCase() : "";
+      if (subject !== `${params.repo}#${params.pr}`.toLowerCase()) return false;
+      if (payload.includes_pr !== true) return false;
+      // AC-9: a wait re-armed with after_run ignores the run it already saw — that
+      // run id, and (when an attempt was named) that attempt or lower — so a
+      // re-registration after a failure receipt parks for the NEXT train instead
+      // of instantly replaying the same failure via `--since`.
+      if (params.afterRunId != null && String(payload.workflow_run_id) === String(params.afterRunId)) {
+        if (params.afterRunAttempt == null) return false;
+        const attempt = Number(payload.workflow_run_attempt);
+        if (Number.isFinite(attempt) && attempt <= params.afterRunAttempt) return false;
+      }
+      return true;
+    }
     case "unblocked": {
       // Wakes on the ticket_unblocked spine signal for this ticket (the server emits both
       // the genuine >0→0 transition and the level-triggered `already_unblocked` echo).