@botbuddy/cli 1.6.2 → 1.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-credential-store.mjs

@@ -27,9 +27,21 @@ function keychainService(profile) {
   return profileCredentialEnvironment(profile);
 }
 
-function writePasswordPrompt(command, args, password) {
+// A keychain/credential-store write failed AFTER OAuth + registration already
+// succeeded. It carries its own code so the CLI never mislabels a storage
+// failure as an auth failure (which would tell the user to re-`login`).
+export class ProfileCredentialStoreError extends Error {
+  constructor(message, { cause } = {}) {
+    super(message);
+    this.name = "ProfileCredentialStoreError";
+    this.code = "profile_credential_store_failed";
+    if (cause !== undefined) this.cause = cause;
+  }
+}
+
+function writePasswordPrompt(command, args, password, spawnProcess) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { stdio: ["pipe", "ignore", "pipe"] });
+    const child = spawnProcess(command, args, { stdio: ["pipe", "ignore", "pipe"] });
     let stderr = "";
     child.stderr.on("data", (chunk) => { stderr += chunk; });
     child.once("error", reject);
@@ -37,16 +49,37 @@ function writePasswordPrompt(command, args, password) {
       if (code === 0) resolve();
       else reject(new Error(`${command} exited ${code}${stderr ? `: ${stderr.trim()}` : ""}`));
     });
-    // `security -w` prompts from standard input when it is the last option.
-    // Keeping the password off argv prevents process-list disclosure.
-    child.stdin.end(`${password}\n`);
+    // `security -w` prompt mode reads the secret from standard input TWICE (the
+    // value and a retype). A single piped line leaves the retype empty, so
+    // `security` exits with "passwords don't match" the moment there is no TTY.
+    // Feeding the same value twice satisfies both reads without an interactive
+    // terminal, and keeping it off argv prevents process-list disclosure.
+    child.stdin.end(`${password}\n${password}\n`);
   });
 }
 
-async function writeKeychain(profile, token) {
+export async function writeKeychain(profile, token, { spawnProcess = spawn } = {}) {
   const service = keychainService(profile);
-  if (!service) throw new Error("unknown profile keychain service");
-  await writePasswordPrompt("security", ["add-generic-password", "-U", "-s", service, "-a", userInfo().username, "-w"], token);
+  if (!service) throw new ProfileCredentialStoreError(`unknown profile keychain service for "${profile}"`);
+  try {
+    await writePasswordPrompt(
+      "security",
+      ["add-generic-password", "-U", "-s", service, "-a", userInfo().username, "-w"],
+      token,
+      spawnProcess,
+    );
+  } catch (error) {
+    // `security` cancels its authorization when the login keychain is locked in
+    // a headless session; guide the user to unlock it rather than re-login.
+    const detail = String(error?.message ?? error);
+    if (/authorization was cancell?ed/i.test(detail)) {
+      throw new ProfileCredentialStoreError(
+        "macOS Keychain authorization was canceled — unlock your login keychain (`security unlock-keychain`) and retry; a headless session needs it already unlocked",
+        { cause: error },
+      );
+    }
+    throw new ProfileCredentialStoreError(`could not write the profile credential to the macOS Keychain: ${detail}`, { cause: error });
+  }
 }
 
 async function readKeychain(profile) {

package/src/botbuddy-release-repair.json

@@ -1 +1 @@
-{"schema_version":1,"source_version":"1.6.1","source_identity":"9cc6a78baeb0da589214386daad729a2e8909936a2407da801777f9902e8667f"}
+{"schema_version":1,"source_version":"1.6.3","source_identity":"2deb439f7afdbb1918d76fe15665ed6ca14c30bcfd5d65524083695cc939814c"}

package/src/commands.mjs

@@ -10,7 +10,7 @@ import { cmdRun } from "./run.mjs";
 import { runWait } from "./wait.mjs";
 import { green, red, cyan, dim, bold, die } from "./utils.mjs";
 import { VERSION } from "./version.mjs";
-import { bootstrapProfile, ProfileBootstrapError, profileShellRefresh } from "./profile-bootstrap.mjs";
+import { bootstrapProfile, ProfileBootstrapError, profileBootstrapRecovery, profileShellRefresh } from "./profile-bootstrap.mjs";
 import { runPw } from "./pw/run.mjs";
 
 export async function run(argv) {
@@ -325,7 +325,7 @@ async function cmdProfile(args) {
       schema_version: 1,
       outcome: "error",
       error: code,
-      recovery: "botbuddy login && botbuddy profile setup " + args[1],
+      recovery: profileBootstrapRecovery(code, args[1]),
     }));
     process.exitCode = 3;
   }

package/src/profile-bootstrap.mjs

@@ -1,7 +1,7 @@
 import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
 
-import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment } from "./agent-credential-store.mjs";
+import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment, ProfileCredentialStoreError } from "./agent-credential-store.mjs";
 import { callToolJson } from "./api.mjs";
 import { latestPublicCliCommand } from "./public-invocation.mjs";
 
@@ -79,13 +79,31 @@ export async function bootstrapProfile(profileName, {
   const token = registrationCredential(data);
   if (!token) throw new ProfileBootstrapError("profile_agent_required");
 
-  await store({
-    profile: profileName,
-    tenant: profile.tenant,
-    agentId: data.agent_id,
-    name: agentName,
-    token,
-  });
+  try {
+    await store({
+      profile: profileName,
+      tenant: profile.tenant,
+      agentId: data.agent_id,
+      name: agentName,
+      token,
+    });
+  } catch (error) {
+    // OAuth + registration + tenant attestation all succeeded; only persisting
+    // the credential failed. Give the two persistence failures accurate,
+    // distinct recoveries — never the `botbuddy login` OAuth recovery:
+    //   • a Keychain write failure (ProfileCredentialStoreError) is resolved by
+    //     unlocking the login keychain;
+    //   • a filesystem/lock failure writing ~/.botbuddy/agent-profiles.json
+    //     (EACCES/ENOSPC/busy store lock) is NOT — unlocking the keychain would
+    //     not help, so it gets its own code.
+    if (error instanceof ProfileBootstrapError) throw error;
+    const code = error instanceof ProfileCredentialStoreError
+      ? "profile_credential_store_failed"
+      : "profile_credential_persist_failed";
+    const failure = new ProfileBootstrapError(code);
+    failure.cause = error;
+    throw failure;
+  }
   return {
     schema_version: 1,
     outcome: "installed",
@@ -98,6 +116,19 @@ export async function bootstrapProfile(profileName, {
   };
 }
 
+// Maps a bootstrap error code to the recovery hint shown in the CLI receipt.
+// A credential-store/Keychain failure gets its own actionable recovery; every
+// other failure keeps the historical login-first recovery verbatim.
+export function profileBootstrapRecovery(code, profileName) {
+  if (code === "profile_credential_store_failed") {
+    return `unlock your login keychain (security unlock-keychain), then re-run: botbuddy profile setup ${profileName}`;
+  }
+  if (code === "profile_credential_persist_failed") {
+    return `ensure ~/.botbuddy is writable and no other setup is running, then re-run: botbuddy profile setup ${profileName}`;
+  }
+  return `botbuddy login && botbuddy profile setup ${profileName}`;
+}
+
 export function profileShellRefresh(profileName) {
   const tokenEnv = profileCredentialEnvironment(profileName);
   if (!tokenEnv) throw new ProfileBootstrapError("profile_required");

package/src/reconcile.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// BOT-1400: plan a lossless multi-version reconciliation for the CLI publish
+// workflow.
+//
+// The publish workflow serializes all runs through one static concurrency
+// group so its dist-tag backward-move guard is correct (only one run publishes
+// at a time). GitHub keeps at most one running + one pending run per group, so
+// if 3+ CLI version bumps land inside a single ~2-minute publish window the
+// *middle* version's queued run is dropped and that version never publishes.
+//
+// This module closes that gap without weakening the serialization: the single
+// surviving run (always the newest push, which becomes the pending run) walks
+// main's recent first-parent history, collects every distinct CLI version
+// between the most recently *published* version and HEAD, and orders them
+// ascending. The workflow then publishes each intermediate from its own
+// historical tree — in ascending order, so every stable publish moves `latest`
+// forward and every prerelease moves `next` forward — before its existing
+// single-version logic handles HEAD. No version is lost; no dist-tag moves
+// backward under any interleaving.
+//
+// The git walk is bounded (recent commits touching cli/package.json) and stops
+// at the first already-published version, so an ancient, deliberately
+// superseded version is never resurrected. Per-version publish-vs-skip against
+// the live dist-tag is still decided in the workflow (it reflects live registry
+// state as the loop advances); this module only orders the candidates.
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+import { compareSemver, isPrerelease } from "./publish-equal.mjs";
+
+// How far back to walk commits that touched the `cli/` tree. The loss window is
+// a handful of rapid bumps (each a few commits); 60 is comfortably generous
+// while bounding the git work and guaranteeing termination. planReconciliation
+// stops at the first already-published version, so this only bounds pathological
+// cases — and even an over-broad tail is caught by the workflow's per-version
+// already-published check before anything is republished.
+const DEFAULT_LIMIT = 60;
+
+// Reduce a newest→oldest history of { version, commit } to the ascending list
+// of distinct versions that must be reconciled: everything strictly newer than
+// the most recently published version in that history, excluding anything
+// already on npm. Each version keeps its NEWEST commit so the published tarball
+// carries every change shipped under that version.
+export function planReconciliation(history, published) {
+  const publishedSet = new Set((published ?? []).map(String));
+  const tail = [];
+  const seen = new Set();
+  for (const entry of history) {
+    const version = String(entry.version);
+    if (seen.has(version)) continue; // dedupe; the newest commit was seen first
+    seen.add(version);
+    // Stop at the first already-published version: everything older than it was
+    // reconciled when it (or a later version) published. This is what prevents
+    // resurrecting an old, superseded version.
+    if (publishedSet.has(version)) break;
+    tail.push({ version, commit: entry.commit });
+  }
+  return tail
+    .sort((a, b) => compareSemver(a.version, b.version))
+    .map((e) => ({ version: e.version, commit: e.commit, prerelease: isPrerelease(e.version) }));
+}
+
+// Accepts the raw `npm view <pkg> versions --json` payload (an array, or a bare
+// string when only one version exists) and returns the reconciliation plan.
+export function planFromHistory(history, publishedRaw) {
+  const published = Array.isArray(publishedRaw) ? publishedRaw : [publishedRaw];
+  return planReconciliation(history, published);
+}
+
+function git(args, cwd) {
+  // Strip the location-override git env vars so `cwd` always selects the repo.
+  // Git sets GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE while running a hook; if we
+  // inherited them, a git command here would silently target the hook's repo
+  // instead of `cwd` (e.g. a reconcile invoked from a pre-push hook, or a test
+  // exercising a scratch repo under one). Everything else is inherited.
+  const env = { ...process.env };
+  delete env.GIT_DIR;
+  delete env.GIT_WORK_TREE;
+  delete env.GIT_INDEX_FILE;
+  return execFileSync("git", args, { cwd, env, encoding: "utf8" });
+}
+
+// Walk main's first-parent history from `headSha` over commits that touched the
+// publishable CLI tree (`cli/`), reading the package version at each, newest →
+// oldest. Walking the whole `cli/` tree — not just `cli/package.json` — is what
+// lets a CLI-only fix committed AFTER a version bump (same version, no
+// package.json change) be the newest commit for that version, so the archived
+// tree carries that fix rather than the older bump commit's tree. First-parent
+// keeps us on the mainline (side-branch commits from a merge never inject a
+// version). Returns [{ version, commit }].
+export function buildHistory(headSha, { limit = DEFAULT_LIMIT, cwd = process.cwd() } = {}) {
+  const raw = git(
+    ["log", "--first-parent", "-n", String(limit), "--format=%H", headSha, "--", "cli"],
+    cwd,
+  );
+  const commits = raw.split("\n").map((l) => l.trim()).filter(Boolean);
+  const history = [];
+  for (const commit of commits) {
+    let version;
+    try {
+      const pkg = JSON.parse(git(["show", `${commit}:cli/package.json`], cwd));
+      version = pkg?.version;
+    } catch {
+      // cli/package.json did not exist / was unparseable at this commit — we
+      // have walked past the package's introduction; stop.
+      break;
+    }
+    if (typeof version !== "string" || version.length === 0) break;
+    history.push({ version, commit });
+  }
+  return history;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const args = process.argv.slice(2);
+  // `--plan <headSha>`: read the registry versions JSON on stdin, print the
+  // ascending reconciliation plan as `<version>\t<commit>\t<stable|prerelease>`
+  // (one row per version to publish, newest last). Prints nothing when there is
+  // nothing to reconcile.
+  if (args[0] === "--plan") {
+    const headSha = args[1];
+    if (!headSha) {
+      console.error("usage: reconcile.mjs --plan <headSha>  (registry versions JSON on stdin)");
+      process.exit(2);
+    }
+    try {
+      const publishedRaw = JSON.parse(readFileSync(0, "utf8"));
+      const history = buildHistory(headSha, { cwd: process.cwd() });
+      for (const entry of planFromHistory(history, publishedRaw)) {
+        process.stdout.write(`${entry.version}\t${entry.commit}\t${entry.prerelease ? "prerelease" : "stable"}\n`);
+      }
+      process.exit(0);
+    } catch (err) {
+      console.error(String(err?.message ?? err));
+      process.exit(2);
+    }
+  }
+  console.error("usage: reconcile.mjs --plan <headSha>");
+  process.exit(2);
+}