@botbuddy/cli 1.6.3 → 1.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.6.3",
+  "version": "1.7.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/reconcile.mjs

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+// BOT-1400: plan a lossless multi-version reconciliation for the CLI publish
+// workflow.
+//
+// The publish workflow serializes all runs through one static concurrency
+// group so its dist-tag backward-move guard is correct (only one run publishes
+// at a time). GitHub keeps at most one running + one pending run per group, so
+// if 3+ CLI version bumps land inside a single ~2-minute publish window the
+// *middle* version's queued run is dropped and that version never publishes.
+//
+// This module closes that gap without weakening the serialization: the single
+// surviving run (always the newest push, which becomes the pending run) walks
+// main's recent first-parent history, collects every distinct CLI version
+// between the most recently *published* version and HEAD, and orders them
+// ascending. The workflow then publishes each intermediate from its own
+// historical tree — in ascending order, so every stable publish moves `latest`
+// forward and every prerelease moves `next` forward — before its existing
+// single-version logic handles HEAD. No version is lost; no dist-tag moves
+// backward under any interleaving.
+//
+// The git walk is bounded (recent commits touching cli/package.json) and stops
+// at the first already-published version, so an ancient, deliberately
+// superseded version is never resurrected. Per-version publish-vs-skip against
+// the live dist-tag is still decided in the workflow (it reflects live registry
+// state as the loop advances); this module only orders the candidates.
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+import { compareSemver, isPrerelease } from "./publish-equal.mjs";
+
+// How far back to walk commits that touched the `cli/` tree. The loss window is
+// a handful of rapid bumps (each a few commits); 60 is comfortably generous
+// while bounding the git work and guaranteeing termination. planReconciliation
+// stops at the first already-published version, so this only bounds pathological
+// cases — and even an over-broad tail is caught by the workflow's per-version
+// already-published check before anything is republished.
+const DEFAULT_LIMIT = 60;
+
+// Reduce a newest→oldest history of { version, commit } to the ascending list
+// of distinct versions that must be reconciled: everything strictly newer than
+// the most recently published version in that history, excluding anything
+// already on npm. Each version keeps its NEWEST commit so the published tarball
+// carries every change shipped under that version.
+export function planReconciliation(history, published) {
+  const publishedSet = new Set((published ?? []).map(String));
+  const tail = [];
+  const seen = new Set();
+  for (const entry of history) {
+    const version = String(entry.version);
+    if (seen.has(version)) continue; // dedupe; the newest commit was seen first
+    seen.add(version);
+    // Stop at the first already-published version: everything older than it was
+    // reconciled when it (or a later version) published. This is what prevents
+    // resurrecting an old, superseded version.
+    if (publishedSet.has(version)) break;
+    tail.push({ version, commit: entry.commit });
+  }
+  return tail
+    .sort((a, b) => compareSemver(a.version, b.version))
+    .map((e) => ({ version: e.version, commit: e.commit, prerelease: isPrerelease(e.version) }));
+}
+
+// Accepts the raw `npm view <pkg> versions --json` payload (an array, or a bare
+// string when only one version exists) and returns the reconciliation plan.
+export function planFromHistory(history, publishedRaw) {
+  const published = Array.isArray(publishedRaw) ? publishedRaw : [publishedRaw];
+  return planReconciliation(history, published);
+}
+
+function git(args, cwd) {
+  // Strip the location-override git env vars so `cwd` always selects the repo.
+  // Git sets GIT_DIR / GIT_WORK_TREE / GIT_INDEX_FILE while running a hook; if we
+  // inherited them, a git command here would silently target the hook's repo
+  // instead of `cwd` (e.g. a reconcile invoked from a pre-push hook, or a test
+  // exercising a scratch repo under one). Everything else is inherited.
+  const env = { ...process.env };
+  delete env.GIT_DIR;
+  delete env.GIT_WORK_TREE;
+  delete env.GIT_INDEX_FILE;
+  return execFileSync("git", args, { cwd, env, encoding: "utf8" });
+}
+
+// Walk main's first-parent history from `headSha` over commits that touched the
+// publishable CLI tree (`cli/`), reading the package version at each, newest →
+// oldest. Walking the whole `cli/` tree — not just `cli/package.json` — is what
+// lets a CLI-only fix committed AFTER a version bump (same version, no
+// package.json change) be the newest commit for that version, so the archived
+// tree carries that fix rather than the older bump commit's tree. First-parent
+// keeps us on the mainline (side-branch commits from a merge never inject a
+// version). Returns [{ version, commit }].
+export function buildHistory(headSha, { limit = DEFAULT_LIMIT, cwd = process.cwd() } = {}) {
+  const raw = git(
+    ["log", "--first-parent", "-n", String(limit), "--format=%H", headSha, "--", "cli"],
+    cwd,
+  );
+  const commits = raw.split("\n").map((l) => l.trim()).filter(Boolean);
+  const history = [];
+  for (const commit of commits) {
+    let version;
+    try {
+      const pkg = JSON.parse(git(["show", `${commit}:cli/package.json`], cwd));
+      version = pkg?.version;
+    } catch {
+      // cli/package.json did not exist / was unparseable at this commit — we
+      // have walked past the package's introduction; stop.
+      break;
+    }
+    if (typeof version !== "string" || version.length === 0) break;
+    history.push({ version, commit });
+  }
+  return history;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const args = process.argv.slice(2);
+  // `--plan <headSha>`: read the registry versions JSON on stdin, print the
+  // ascending reconciliation plan as `<version>\t<commit>\t<stable|prerelease>`
+  // (one row per version to publish, newest last). Prints nothing when there is
+  // nothing to reconcile.
+  if (args[0] === "--plan") {
+    const headSha = args[1];
+    if (!headSha) {
+      console.error("usage: reconcile.mjs --plan <headSha>  (registry versions JSON on stdin)");
+      process.exit(2);
+    }
+    try {
+      const publishedRaw = JSON.parse(readFileSync(0, "utf8"));
+      const history = buildHistory(headSha, { cwd: process.cwd() });
+      for (const entry of planFromHistory(history, publishedRaw)) {
+        process.stdout.write(`${entry.version}\t${entry.commit}\t${entry.prerelease ? "prerelease" : "stable"}\n`);
+      }
+      process.exit(0);
+    } catch (err) {
+      console.error(String(err?.message ?? err));
+      process.exit(2);
+    }
+  }
+  console.error("usage: reconcile.mjs --plan <headSha>");
+  process.exit(2);
+}

package/src/wait-profile.mjs

@@ -79,6 +79,10 @@ export function withPrincipalReceipt(receipt, profile, registration = {}) {
       profile: profile.name,
       tenant_id: registration.sessionTenant ?? profile.tenant,
       agent_id: registration.agentId ?? null,
+      // BOT-1467: the arming session's agent, when the relay attributed the wait
+      // to it instead of the profile agent (null for an ordinary profile wait).
+      session_id: registration.sessionId ?? null,
+      session_agent_id: registration.sessionAgentId ?? null,
     },
   };
 }

package/src/wait.mjs

@@ -93,6 +93,7 @@ OPTIONS
   --heartbeat           keep this agent session alive while waiting (so it is not reaped)
   --url <base>          relay base URL (default $BOTBUDDY_RELAY_URL or https://api.bot-buddy.ai/functions/v1)
   --profile <name>      tenant-bound machine profile (normally read from .botbuddy-agent.json)
+  --session-id <uuid>   attribute this wait to the arming session (the work-graph session id from register_agent); default $BOTBUDDY_SESSION_ID
   --token <key>         explicit agent key override; otherwise the profile-specific env is used
   --help                show this help
 
@@ -133,6 +134,9 @@ function parseArgv(argv) {
     url: process.env.BOTBUDDY_RELAY_URL || "https://api.bot-buddy.ai/functions/v1",
     token: null,
     profile: null,
+    // BOT-1467: attribute this wait to the arming session's agent (the id from
+    // register_agent) instead of the tenant-bound profile agent. Env fallback.
+    sessionId: process.env.BOTBUDDY_SESSION_ID || null,
     help: false,
   };
   for (let i = 0; i < argv.length; i++) {
@@ -155,6 +159,7 @@ function parseArgv(argv) {
     else if (a === "--url") opts.url = optionValue();
     else if (a === "--token") opts.token = optionValue();
     else if (a === "--profile") opts.profile = optionValue();
+    else if (a === "--session-id") opts.sessionId = optionValue();
     else if (a.startsWith("--")) opts.unknown = a;
     else opts.conditions.push(a);
   }
@@ -176,6 +181,9 @@ async function registerWait(opts, conditions, deadlineIso) {
       action: "register",
       profile: opts.agentProfile.name,
       expected_tenant: opts.agentProfile.tenant,
+      // BOT-1467: name the arming work-graph session so the relay resolves and attributes
+      // the wait to its agent (validated same-owner) instead of the profile agent.
+      ...(opts.sessionId ? { session_id: opts.sessionId } : {}),
       client_version: VERSION,
       wait_protocol_version: WAIT_PROTOCOL_VERSION,
       conditions,
@@ -224,6 +232,11 @@ async function registerWait(opts, conditions, deadlineIso) {
       // can't bind to one workspace (ci / pr-review / bare tenant-primary event). A hard
       // stop — arming it untracked would only ever park to timeout.
       "tenant_ambiguous",
+      // BOT-1467: a caller-actionable session-attribution rejection — a malformed
+      // --session-id, or one passed without a profile. Arming it untracked would
+      // only ever park to timeout, so it's a hard stop, not the live-only fallback.
+      "invalid_session_agent",
+      "session_agent_requires_profile",
     ]);
     if (INVALID_CONDITION_CODES.has(body.error)) {
       const err = new Error(body.detail || body.error);
@@ -293,6 +306,10 @@ async function registerWait(opts, conditions, deadlineIso) {
     // new relay (the deploy-skew case, acceptable because waits are short-lived).
     sessionTenant: body.session_tenant ?? null,
     agentId: body.agent_id ?? null,
+    // BOT-1467: the session agent the relay attributed the wait to, if any (it
+    // echoes session_agent_id only when it overrode the profile agent).
+    sessionId: body.session_id ?? null,
+    sessionAgentId: body.session_agent_id ?? null,
   };
 }
 
@@ -565,6 +582,9 @@ export async function runWait(argv) {
   // pre-BOT-1259 behaviour for a wait the server never scoped.
   let sessionTenant;
   let registeredAgentId = null;
+  // BOT-1467: the session agent the relay attributed the wait to (when overridden).
+  let registeredSessionAgentId = null;
+  let registeredSessionId = null;
   if (needsRelay) {
     try {
       const reg = await registerWait(opts, conditions, new Date(deadlineMs).toISOString());
@@ -572,6 +592,8 @@ export async function runWait(argv) {
       opts.waitSessionId = waitSessionId;
       sessionTenant = reg.sessionTenant;
       registeredAgentId = reg.agentId;
+      registeredSessionAgentId = reg.sessionAgentId;
+      registeredSessionId = reg.sessionId;
       // BOT-1184: adopt the server's canonical host for each lock condition so the
       // local matcher builds the same subject_key the availability/claim-grant
       // signals carry (armed under an alias like 'jono-mac', the signal uses the
@@ -709,6 +731,8 @@ export async function runWait(argv) {
       withClientIdentity(withPrincipalReceipt(receipt, opts.agentProfile, {
         sessionTenant,
         agentId: registeredAgentId,
+        sessionAgentId: registeredSessionAgentId,
+        sessionId: registeredSessionId,
       })),
       opts.receiptMaxBytes,
     );