@botbuddy/cli 1.60.10 → 1.61.0

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.60.10",
-  "source_commit": "311044889f28c3b22902954ec29c3c117f46d638",
-  "source_sha256": "a82e951ccda7aa65571953e874a01cf30f75bc218ed5592a2bffa2e7b0d3219a",
+  "release_version": "1.61.0",
+  "source_commit": "5661e7d4d29c975fc925b0a6c47741db33598642",
+  "source_sha256": "c5c57ed492234165bee179842456b3bebce505b36145e96551c0ddbd0cdf605a",
   "target": "darwin-arm64",
-  "sha256": "c078605d49201ad3532212bbac322216b06c108c425024a7f68f6ecdab89fd5a"
+  "sha256": "afadb8e224f68209f4a2a0f8367d4aa289a76ac21f2ee57cbd376b90ab569469"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.60.10",
-  "source_commit": "311044889f28c3b22902954ec29c3c117f46d638",
-  "source_sha256": "a82e951ccda7aa65571953e874a01cf30f75bc218ed5592a2bffa2e7b0d3219a",
+  "release_version": "1.61.0",
+  "source_commit": "5661e7d4d29c975fc925b0a6c47741db33598642",
+  "source_sha256": "c5c57ed492234165bee179842456b3bebce505b36145e96551c0ddbd0cdf605a",
   "target": "linux-x64",
-  "sha256": "af6bfdf5e66b133356c620a5dd9aaacc1cee11d8f0f594bb8f5e8447cb932704"
+  "sha256": "830ff851e5d9d85957855af52a7c372cde56e2f9ddb315a31f5d2477c1c7d9d7"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.60.10",
-  "source_commit": "311044889f28c3b22902954ec29c3c117f46d638",
-  "source_sha256": "a82e951ccda7aa65571953e874a01cf30f75bc218ed5592a2bffa2e7b0d3219a",
+  "release_version": "1.61.0",
+  "source_commit": "5661e7d4d29c975fc925b0a6c47741db33598642",
+  "source_sha256": "c5c57ed492234165bee179842456b3bebce505b36145e96551c0ddbd0cdf605a",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "c078605d49201ad3532212bbac322216b06c108c425024a7f68f6ecdab89fd5a",
+      "sha256": "afadb8e224f68209f4a2a0f8367d4aa289a76ac21f2ee57cbd376b90ab569469",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "af6bfdf5e66b133356c620a5dd9aaacc1cee11d8f0f594bb8f5e8447cb932704",
+      "sha256": "830ff851e5d9d85957855af52a7c372cde56e2f9ddb315a31f5d2477c1c7d9d7",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.60.10",
+  "version": "1.61.0",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {
@@ -19,9 +19,7 @@
     "daemon/",
     "daemon-release/",
     "src/",
-    "!src/**/*.test.mjs",
-    "!src/staging-pool/test-helpers/",
-    "!src/staging-pool/fixtures/"
+    "!src/**/*.test.mjs"
   ],
   "keywords": [
     "mcp",

package/src/commands.mjs

@@ -284,6 +284,7 @@ ${bold("STAGING SIGN-IN")} (BOT-2084)
 
 ${bold("OTHER")}
   locks -m [--host name]    Reserve typed local resources, including Playwright MCP lanes
+  evidence require <file>    Record an exact-head evidence disposition → botbuddy/ready
   evidence publish <file>    Publish a local evidence statement → botbuddy/ready check-run
   update                     Install the latest @botbuddy/cli in the background via npm
   help                       Show this help

package/src/evidence.mjs

@@ -1,6 +1,9 @@
 // BOT-2341: `bb evidence publish <statement.json>` — post a local-E2E evidence
 // statement to the control plane (MCP `publish_evidence`), which stores it and
-// creates/updates the advisory `botbuddy/ready` check-run on the PR head.
+// creates/updates the `botbuddy/ready` check-run on the PR head.
+// BOT-786: `bb evidence require <requirement.json>` — record the impact
+// producer's exact-head disposition (MCP `publish_evidence_requirement`):
+// not_required completes botbuddy/ready as success on that head, e2e queues it.
 //
 // Auth prefers this worktree's agent session (the tenant the repo is bound to),
 // falling back to the owner/MCP-key ladder like every other `bb` call. Prints
@@ -11,14 +14,25 @@ import { CALL_EXIT, callToolJson as defaultCallToolJson, resolveCallAuth } from
 
 export const EVIDENCE_EXIT = Object.freeze({ ...CALL_EXIT, USAGE: 2, REFUSED: 4 });
 
-const USAGE = `Usage: bb evidence publish <statement.json>
+const USAGE = `Usage: bb evidence require <requirement.json>
+       bb evidence publish <statement.json>
 
-Publish a local evidence statement for a PR head. BotBuddy stores it and posts
-the advisory botbuddy/ready check-run. The statement is a JSON object with:
-  repo, pr, headSha, mainSha, base, fingerprint, requirement, runs[],
-  verdict ("pass" | "fail"), fixCommand
+require  Record the impact producer's decision for one exact PR head. The file
+         is a JSON object with: repo, pr, headSha, disposition
+         ("not_required" | "e2e"), reason, command (required for e2e).
+         not_required completes botbuddy/ready as success on that head; e2e
+         queues it with the command to run.
+publish  Publish a local evidence statement for a PR head (after an e2e
+         requirement). The statement is a JSON object with:
+           repo, pr, headSha, mainSha, base, fingerprint, requirement, runs[]
+           (each with the BotBuddy runId), verdict ("pass" | "fail"), fixCommand
 
-Exit codes: 0 published · 2 usage · 3 auth · 4 refused · 5 unreachable`;
+Exit codes: 0 recorded · 2 usage · 3 auth · 4 refused · 5 unreachable`;
+
+const SUBCOMMANDS = Object.freeze({
+  require: { tool: "publish_evidence_requirement", argName: "requirement" },
+  publish: { tool: "publish_evidence", argName: "statement" },
+});
 
 export async function cmdEvidence(args, {
   resolveAuth = resolveCallAuth,
@@ -31,7 +45,8 @@ export async function cmdEvidence(args, {
     log(USAGE);
     return sub === undefined ? EVIDENCE_EXIT.USAGE : EVIDENCE_EXIT.OK;
   }
-  if (sub !== "publish") {
+  const spec = Object.hasOwn(SUBCOMMANDS, sub) ? SUBCOMMANDS[sub] : null;
+  if (!spec) {
     errorLog(`Unknown evidence subcommand: ${sub}\n\n${USAGE}`);
     return EVIDENCE_EXIT.USAGE;
   }
@@ -40,22 +55,22 @@ export async function cmdEvidence(args, {
     return EVIDENCE_EXIT.USAGE;
   }
 
-  let statement;
+  let body;
   try {
-    statement = JSON.parse(readFileSync(file, "utf8"));
+    body = JSON.parse(readFileSync(file, "utf8"));
   } catch (error) {
     errorLog(`✗ Could not read ${file} as JSON: ${error?.message ?? error}`);
     return EVIDENCE_EXIT.USAGE;
   }
 
-  const resolved = await resolveAuth({ toolName: "publish_evidence", preferSession: true });
+  const resolved = await resolveAuth({ toolName: spec.tool, preferSession: true });
   if (resolved?.error || !resolved?.auth) {
     log(JSON.stringify(resolved?.error ?? { ok: false, auth: true, error: "not_authenticated" }, null, 2));
     errorLog("✗ Not authenticated — run `bb doctor --fix` in this worktree.");
     return EVIDENCE_EXIT.AUTH;
   }
 
-  const res = await callToolJson("publish_evidence", { statement }, { auth: resolved.auth });
+  const res = await callToolJson(spec.tool, { [spec.argName]: body }, { auth: resolved.auth });
   if (!res.ok) {
     log(JSON.stringify(res, null, 2));
     if (res.auth) {
@@ -66,15 +81,24 @@ export async function cmdEvidence(args, {
       errorLog(`✗ BotBuddy unreachable: ${res.error}`);
       return EVIDENCE_EXIT.TRANSPORT;
     }
-    errorLog(`✗ publish_evidence failed: ${res.error}`);
+    errorLog(`✗ ${spec.tool} failed: ${res.error}`);
     return EVIDENCE_EXIT.ERROR;
   }
 
   log(JSON.stringify(res.data, null, 2));
   if (res.isError || res.data?.ok === false) {
-    errorLog(`✗ ${res.data?.error ?? "publish_evidence refused"}: ${res.data?.message ?? ""}`.trimEnd());
+    errorLog(`✗ ${res.data?.error ?? `${spec.tool} refused`}: ${res.data?.message ?? ""}`.trimEnd());
     return EVIDENCE_EXIT.REFUSED;
   }
+  if (sub === "require") {
+    // Success means the control plane echoed the recorded disposition — an
+    // outage body that normalises to an empty result is never "recorded".
+    if (res.data?.ok !== true || typeof res.data?.disposition !== "string") {
+      errorLog("✗ BotBuddy returned no disposition — nothing is known to be recorded; retry.");
+      return EVIDENCE_EXIT.ERROR;
+    }
+    return EVIDENCE_EXIT.OK;
+  }
   // Codex #1169 R4: success means a receipt came back — an outage body that
   // normalises to an empty result is never "published".
   if (res.data?.ok !== true || typeof res.data?.receipt_id !== "string") {

package/src/staging-pool/fixtures/2026-10-05-botbuddy-get-totp-code.json

@@ -0,0 +1,11 @@
+{
+  "_captured": "2026-10-05 from `botbuddy call get_totp_code --json {app_slug:supplyspark-ent, seed_user_slug:seed-super-admin@supplyguard.local, environment:local}` (@botbuddy/cli 1.40.4, launchd-like env -i). Key set and value types are real; the code value is replaced and remaining_seconds is illustrative.",
+  "app_slug": "supplyspark-ent",
+  "seed_user_slug": "seed-super-admin@supplyguard.local",
+  "environment": "local",
+  "authz": "org",
+  "code": "000000",
+  "remaining_seconds": 17,
+  "digits": 6,
+  "period": 30
+}

package/src/staging-pool/fixtures/2026-10-05-gotrue-session-lifecycle.json

@@ -0,0 +1,37 @@
+{
+  "_captured": "2026-10-05 against the ENT-5120 isolated local stack (GoTrue v2.196.0; staging reported v2.197.0 the same day). Error bodies show the error_code and msg fields as returned; tokens, which are never recorded. Experiment: scratch rotation-experiment.mjs, recorded on ENT-5120.",
+  "challengeAfterAal1SessionDeleted": {
+    "status": 403,
+    "body": {
+      "error_code": "session_not_found",
+      "msg": "Session from session_id claim in JWT does not exist"
+    }
+  },
+  "refreshAfterSessionDeleted": {
+    "status": 400,
+    "body": {
+      "error_code": "refresh_token_not_found",
+      "msg": "Invalid Refresh Token: Refresh Token Not Found"
+    }
+  },
+  "aal2SessionRefreshAfterAnotherMfaVerify": {
+    "status": 200,
+    "aal": "aal2"
+  },
+  "adminDeleteFactor": {
+    "status": 200,
+    "sessionsBefore": "4 sessions, all aal2",
+    "sessionsAfter": "4 sessions, all aal1 (downgraded, not deleted)"
+  },
+  "refreshAal2SessionAfterAdminDeleteFactor": {
+    "status": 200,
+    "aal": "aal1"
+  },
+  "userEndpointWithOldAal2JwtAfterAdminDeleteFactor": {
+    "status": 200
+  },
+  "reEnrolVerifyAfterDowngrade": {
+    "sessionsBefore": "4 sessions, all aal1 (downgraded)",
+    "sessionsAfter": "1 session (aal2): the downgraded aal1 sessions were deleted by the ensure script re-enrol + MFA verify"
+  }
+}

package/src/staging-pool/test-helpers/bindings.mjs

@@ -0,0 +1,41 @@
+// BOT-2084 test helper: pool bindings. SG_* mirrors supplyspark-ent's staging
+// values (the pool's original consumer, ENT-5120) so the lifted tests keep their
+// meaning; BOTBUDDY_* is BotBuddy's registered binding (its registration input).
+import { readFileSync } from "node:fs";
+
+import { parsePoolBinding } from "../binding.mjs";
+import { stagingTargetFromBinding } from "../policy.mjs";
+
+export const SG_RAW_BINDING = Object.freeze({
+  schema_version: 1,
+  tenant: "supply-guard",
+  staging_session_pool: {
+    schema_version: 1,
+    pool_id: "supplyspark-ent-staging",
+    environment: "staging",
+    app_slug: "supplyspark-ent",
+    adapter: "supabase-gotrue-totp",
+    app_origin: "https://enterprise-staging.vercel.app",
+    supabase_url: "https://ikdoydgubernmxzdqtxz.supabase.co",
+    publishable_key: "sb_publishable_gysKy2GcBNO0Gfv3d_p60Q_yMbCMUPD",
+    storage_key: "sb-ikdoydgubernmxzdqtxz-auth-token",
+    production_origins: ["https://app.supply-guard.io", "https://enterprise.vercel.app"],
+    password_env_file: "~/supply-guard/shared/.env.staging-personas",
+    personas: {
+      "super-admin": { email: "seed-super-admin@supplyguard.local", password_env: "SEED_PERSONA_PASSWORD", default_count: 2 },
+      "acme-admin": { email: "seed-customer-admin@acme-industrial.test", password_env: "SEED_PERSONA_PASSWORD", default_count: 0 },
+      "msp-admin": { email: "seed-msp-admin@supplyguard.local", password_env: "SEED_PERSONA_PASSWORD", default_count: 0 },
+    },
+    launchd_label: "com.supplyguard.staging-session-pool",
+    docs: "docs/2026-07-25-agent-workstation-notes.md#staging-session-pool",
+    install_command: "cd ~/supply-guard/development/supplyspark-ent && bb staging-pool install --botbuddy-bin \"$(command -v botbuddy)\"",
+  },
+});
+export const SG_BINDING = parsePoolBinding(SG_RAW_BINDING);
+export const SG_TARGET = stagingTargetFromBinding(SG_BINDING);
+
+// BOT-2648: BotBuddy's registration input (the staging seed job registers it in
+// the control plane); the repo's .botbuddy-agent.json no longer carries a pool block.
+const { _comment: _note, ...BOTBUDDY_REGISTRATION } = JSON.parse(readFileSync(new URL("../../../../scripts/staging-session-pool.botbuddy.json", import.meta.url), "utf8"));
+export const BOTBUDDY_RAW_BINDING = Object.freeze({ schema_version: 1, ...BOTBUDDY_REGISTRATION });
+export const BOTBUDDY_BINDING = parsePoolBinding(BOTBUDDY_RAW_BINDING);

package/src/staging-pool/test-helpers/fake-signin.mjs

@@ -0,0 +1,60 @@
+// BOT-2084 (lifted from supplyspark-ent ENT-5120) test helper: an in-memory GoTrue stand-in for pool tests. Every mint
+// returns a fresh aal2 session; refresh rotates the refresh token and enforces the
+// single-holder rule (a refresh token is usable once).
+
+let counter = 0;
+
+export function fakeJwt(claims) {
+  const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${encode({ alg: "HS256" })}.${encode(claims)}.sig`;
+}
+
+export function fakeStoredSession({ persona, aal = "aal2", sessionId, nowMs = Date.now(), refreshToken } = {}) {
+  counter += 1;
+  const exp = Math.floor(nowMs / 1000) + 3600;
+  return {
+    access_token: fakeJwt({ aal, email: persona, exp, session_id: sessionId ?? `sess-${counter}`, amr: [{ method: "totp" }] }),
+    token_type: "bearer",
+    expires_in: 3600,
+    expires_at: exp,
+    refresh_token: refreshToken ?? `rt-${process.pid}-${counter}-${Math.random().toString(36).slice(2)}`,
+    user: { id: `user-${persona}`, email: persona },
+  };
+}
+
+export function createFakeSignIn({ nowMs = () => Date.now(), onRefresh, onMint } = {}) {
+  const live = new Map(); // refresh_token -> { persona, sessionId, aal }
+  const calls = { mint: 0, refresh: 0 };
+  return {
+    calls,
+    live,
+    downgrade(sessionId) {
+      for (const entry of live.values()) if (entry.sessionId === sessionId) entry.aal = "aal1";
+    },
+    revokeAll() {
+      live.clear();
+    },
+    async mint({ persona }) {
+      calls.mint += 1;
+      if (onMint) await onMint({ persona });
+      const session = fakeStoredSession({ persona, nowMs: nowMs() });
+      const sessionId = JSON.parse(Buffer.from(session.access_token.split(".")[1], "base64url")).session_id;
+      live.set(session.refresh_token, { persona, sessionId, aal: "aal2" });
+      return session;
+    },
+    async refresh({ storedSession, persona }) {
+      calls.refresh += 1;
+      if (onRefresh) {
+        const injected = await onRefresh({ storedSession, persona });
+        if (injected) return injected;
+      }
+      const entry = live.get(storedSession.refresh_token);
+      if (!entry) return { ok: false, transient: false, reason: "refresh_token_not_found" };
+      live.delete(storedSession.refresh_token);
+      if (entry.aal !== "aal2") return { ok: false, transient: false, reason: "aal_downgraded" };
+      const next = fakeStoredSession({ persona: entry.persona, sessionId: entry.sessionId, nowMs: nowMs() });
+      live.set(next.refresh_token, entry);
+      return { ok: true, storedSession: next };
+    },
+  };
+}

package/src/staging-pool/test-helpers/take-worker.mjs

@@ -0,0 +1,28 @@
+// BOT-2084 (lifted from supplyspark-ent ENT-5120) test helper: one OS process racing
+// `take` against others on a shared pool dir.
+import { createSessionPool } from "../pool.mjs";
+import { SG_TARGET } from "./bindings.mjs";
+import { fakeStoredSession } from "./fake-signin.mjs";
+
+const [poolDir, persona, startAtMs] = process.argv.slice(2);
+const pool = createSessionPool({
+  poolDir,
+  target: SG_TARGET,
+  signIn: {
+    mint: async () => {
+      throw new Error("workers never mint");
+    },
+    refresh: async () => ({ ok: true, storedSession: fakeStoredSession({ persona }) }),
+  },
+  logger: () => {},
+});
+
+// Line up all workers on the same instant so the renames genuinely race.
+const delay = Number(startAtMs) - Date.now();
+if (delay > 0) await new Promise((resolve) => setTimeout(resolve, delay));
+try {
+  const taken = await pool.take({ persona, owner: `worker-${process.pid}` });
+  process.stdout.write(JSON.stringify({ slotId: taken.slotId }));
+} catch (error) {
+  process.stdout.write(JSON.stringify({ error: error.code ?? error.message }));
+}