@botbuddy/cli 1.60.7 → 1.60.8

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.60.7",
-  "source_commit": "6299d1f0f325871a33f5aa28bff8dc8029e7350c",
-  "source_sha256": "ac9f92aeaec3cf0cb18de06f1e16b0ee2c44c413ec7c84866f949909611098f1",
+  "release_version": "1.60.8",
+  "source_commit": "057670de6f7ac5dc8e8e673dab13a317aef876e9",
+  "source_sha256": "3678a4ff49dda524b2b97e5a9d57249b64041f587da4db0c936b2f650647c6ec",
   "target": "darwin-arm64",
-  "sha256": "1e24ee9c3fa9ac6447ff9f0c8096d80c4e2a98348d0e3b0277d406dfe8109e17"
+  "sha256": "234246b7e1b8634420dbe2bceba35a4efa51a0ade206b09882f9c80a0aa66bfb"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.60.7",
-  "source_commit": "6299d1f0f325871a33f5aa28bff8dc8029e7350c",
-  "source_sha256": "ac9f92aeaec3cf0cb18de06f1e16b0ee2c44c413ec7c84866f949909611098f1",
+  "release_version": "1.60.8",
+  "source_commit": "057670de6f7ac5dc8e8e673dab13a317aef876e9",
+  "source_sha256": "3678a4ff49dda524b2b97e5a9d57249b64041f587da4db0c936b2f650647c6ec",
   "target": "linux-x64",
-  "sha256": "68dfb56ddf1b4647dcd00644d88489fe2022b4136d72443e33f83a86ecb270bb"
+  "sha256": "c29069dc84ea8273ea4b560816eb130a82dfbba083a6d8149edecd8cc85b534c"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.60.7",
-  "source_commit": "6299d1f0f325871a33f5aa28bff8dc8029e7350c",
-  "source_sha256": "ac9f92aeaec3cf0cb18de06f1e16b0ee2c44c413ec7c84866f949909611098f1",
+  "release_version": "1.60.8",
+  "source_commit": "057670de6f7ac5dc8e8e673dab13a317aef876e9",
+  "source_sha256": "3678a4ff49dda524b2b97e5a9d57249b64041f587da4db0c936b2f650647c6ec",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "1e24ee9c3fa9ac6447ff9f0c8096d80c4e2a98348d0e3b0277d406dfe8109e17",
+      "sha256": "234246b7e1b8634420dbe2bceba35a4efa51a0ade206b09882f9c80a0aa66bfb",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "68dfb56ddf1b4647dcd00644d88489fe2022b4136d72443e33f83a86ecb270bb",
+      "sha256": "c29069dc84ea8273ea4b560816eb130a82dfbba083a6d8149edecd8cc85b534c",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.60.7",
+  "version": "1.60.8",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/pw/args.mjs

@@ -67,16 +67,20 @@ export function planInvocation(argv, env = process.env) {
     const authArgs = argv.slice(2);
     const strayAuth = authArgs.find((value) => credentialFlagOf(value));
     if (strayAuth) throw misplacedCredentialFlag(strayAuth);
-    const usage = "bb-pw: usage: bb pw --environment staging <lane> auth --persona <slug>";
+    const usage = "bb-pw: usage: bb pw --environment staging <lane> auth --persona <slug> [--pool <pool_id>]";
     let persona = null;
+    let pool = null;
     for (let i = 0; i < authArgs.length; i++) {
       const token = String(authArgs[i]);
       if (token === "--persona" && persona === null && authArgs[i + 1] !== undefined && !String(authArgs[i + 1]).startsWith("--")) { persona = String(authArgs[++i]); continue; }
       if (token.startsWith("--persona=") && persona === null && token.length > "--persona=".length) { persona = token.slice("--persona=".length); continue; }
+      // BOT-2648: which installed pool, when several are installed.
+      if (token === "--pool" && pool === null && authArgs[i + 1] !== undefined && /^[a-z0-9][a-z0-9-]{0,63}$/.test(String(authArgs[i + 1]))) { pool = String(authArgs[++i]); continue; }
+      if (token.startsWith("--pool=") && pool === null && /^[a-z0-9][a-z0-9-]{0,63}$/.test(token.slice("--pool=".length))) { pool = token.slice("--pool=".length); continue; }
       throw new Error(`${usage} (unexpected '${token}')`);
     }
     if (!persona) throw new Error(`${usage} (--persona is required)`);
-    return { scope: "lane", lane, session: `lane-${lane}`, verb, mode: "auth", persona };
+    return { scope: "lane", lane, session: `lane-${lane}`, verb, mode: "auth", persona, pool };
   }
   if (verb === "status") {
     // `status` has no workload, so — like the global verbs — there is no `--`

package/src/pw/run.mjs

@@ -244,7 +244,8 @@ async function runPwInner(argv, deps = {}) {
     try {
       const credential = await (deps.resolveCredential ?? resolveAgentSessionCredential)({ argv, env, cwd: deps.cwd ?? process.cwd(), sessionId: deps.sessionId ?? env.BOTBUDDY_SESSION_ID ?? null, flagToken: null });
       managedCredential = credential;
-      deps = { ...deps, sessionToken: credential.token, sessionId: deps.sessionId ?? credential.sessionId ?? null, credentialAgentId: credential.agentId ?? null };
+      // BOT-2648 (Codex P2, #1323): the credential's tenant picks the installed staging pool.
+      deps = { ...deps, sessionToken: credential.token, sessionId: deps.sessionId ?? credential.sessionId ?? null, credentialAgentId: credential.agentId ?? null, credentialTenant: credential.identity?.tenant ?? null };
     } catch (error) {
       stderr.write(selfHealErrorLine(error)); return 3;
     }

package/src/pw/staging-auth.mjs

@@ -273,20 +273,28 @@ export async function runStagingAuth({ plan, host, env, deps, socketRun, resolve
   const poolModule = deps.stagingPoolModule ?? await loadPool();
   const poolOptions = deps.stagingPool ?? {};
   const cwd = deps.cwd ?? process.cwd();
-  const vars = { lane: plan.lane, persona: plan.persona, cwd, ticketFlag: ticketFlagFor(cwd) };
-  let found;
+  const authLine = `bb pw --environment staging ${plan.lane} auth --persona ${plan.persona}`;
+  // The lane credential's tenant (resolved by run.mjs), else an explicit hint.
+  const tenantHint = deps.credentialTenant ?? deps.tenant ?? env.BOTBUDDY_TENANT ?? null;
+  const vars = { lane: plan.lane, persona: plan.persona, ticketFlag: ticketFlagFor(cwd), consequence: "bb pw auth has no pool to take a session from" };
+  // BOT-2648: the pool comes from the installed pool home (--pool, the only one,
+  // or the one for this tenant), never from the working directory.
+  let ctxPool;
   try {
-    found = await (await loadBinding()).readRepoPoolBinding(cwd);
+    ctxPool = poolModule.resolveInstalledPool({ ...(poolOptions.home ? { home: poolOptions.home } : {}), poolId: plan.pool ?? null, tenantHint });
   } catch (error) {
-    return refuse(io, error?.code === "pool_binding_invalid" ? "pool_binding_invalid" : "pool_not_configured", 3, { detail: String(error?.message ?? error) }, vars);
+    const poolIds = Array.isArray(error?.poolIds) ? error.poolIds : [];
+    const code = error?.code === "pool_ambiguous" ? "pool_ambiguous" : "pool_not_installed";
+    return refuse(io, code, 3, { detail: String(error?.message ?? error).slice(0, 300) }, {
+      ...vars,
+      tenant: tenantHint ?? undefined,
+      poolIds,
+      poolId: plan.pool ?? undefined,
+      retryWithPool: poolIds.length ? `${authLine} --pool ${poolIds[0]}` : undefined,
+    });
   }
-  if (!found) {
-    // Name a stable checkout that declares a pool, if this Mac has one on record.
-    const { findKnownCheckouts } = await import("../staging-pool/checkouts.mjs");
-    const [candidate] = await findKnownCheckouts({ ...(poolOptions.home ? { home: poolOptions.home } : {}), ...(poolOptions.isStableCheckout ? { isStable: poolOptions.isStableCheckout } : {}) }).catch(() => []);
-    return refuse(io, "pool_not_configured", 3, {}, { ...vars, checkout: candidate?.path });
-  }
-  Object.assign(vars, { allowed: Object.keys(found.binding.personas ?? {}) });
+  const found = { binding: ctxPool.poolBinding };
+  Object.assign(vars, { allowed: Object.keys(found.binding.personas ?? {}), tenant: ctxPool.tenant ?? undefined, poolId: ctxPool.poolId ?? undefined });
   const { findPersona } = await loadBinding();
   const persona = findPersona(found.binding, plan.persona);
   if (!persona) return refuse(io, "persona_not_allowlisted", 2, {}, vars);
@@ -303,7 +311,7 @@ export async function runStagingAuth({ plan, host, env, deps, socketRun, resolve
   dropGone(ctx, generation);
   let claim;
   try {
-    claim = await poolModule.takeForLane({ persona: persona.email, owner: `lane-${plan.lane}@${host}`, cwd, ...poolOptions });
+    claim = await poolModule.takeForLane({ persona: persona.email, owner: `lane-${plan.lane}@${host}`, poolId: ctxPool.poolId, tenantHint, ...poolOptions });
   } catch (error) {
     if (error?.code === "pool_empty") {
       return refuse(io, "pool_empty", 3, Object.fromEntries(["reason", "detail", ...GUIDED_FIELDS].filter((key) => error[key] !== undefined).map((key) => [key, error[key]])), vars);

package/src/staging-pool/binding.mjs

@@ -1,14 +1,10 @@
-// BOT-2084: the per-repo staging session pool binding.
+// BOT-2084 / BOT-2648: the staging session pool binding.
 //
-// A repository opts in by declaring `staging_session_pool` in its committed
-// `.botbuddy-agent.json` (next to its tenant binding). This module parses and
-// validates that section into the camelCase shape the pool uses. Node-stdlib-only
-// and self-contained: the installed job keeps a validated snapshot in its config.
-
-import { readFile } from "node:fs/promises";
-import { dirname, join, parse } from "node:path";
-
-export const AGENT_BINDING_FILE = ".botbuddy-agent.json";
+// A tenant registers its binding in the BotBuddy control plane
+// (register_staging_pool); `bb staging-pool install --tenant` reads it and
+// this module parses and validates it into the camelCase shape the pool uses. It
+// is never read from a repository checkout. Node-stdlib-only and self-contained:
+// the installed job keeps a validated snapshot in its config.
 
 export class BindingError extends Error {
   constructor(message, code = "pool_binding_invalid") {
@@ -29,8 +25,21 @@ const PUBLIC_KEY_RE = /^(sb_publishable_[A-Za-z0-9_-]{16,128}|eyJ[A-Za-z0-9_-]+\
 export const ADAPTERS = Object.freeze(["supabase-gotrue-totp"]);
 export const MAX_POOL_SIZE = 4;
 
+// A legacy Supabase key is a JWT; only the public `anon` role is a publishable key
+// (Codex P1, #1323: a service_role JWT is a secret and is never installed).
+export function isPublicAnonJwt(value) {
+  const parts = String(value).split(".");
+  if (parts.length !== 3) return false;
+  try {
+    const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return claims !== null && typeof claims === "object" && claims.role === "anon";
+  } catch {
+    return false;
+  }
+}
+
 function need(condition, message) {
-  if (!condition) throw new BindingError(`${AGENT_BINDING_FILE} staging_session_pool: ${message}`);
+  if (!condition) throw new BindingError(`staging_session_pool binding: ${message}`);
 }
 
 // raw: the parsed .botbuddy-agent.json object. Returns null when the repo does not
@@ -48,12 +57,15 @@ export function parsePoolBinding(raw) {
   need(typeof section.app_origin === "string", "app_origin is required");
   need(typeof section.supabase_url === "string", "supabase_url is required");
   need(typeof section.publishable_key === "string" && PUBLIC_KEY_RE.test(section.publishable_key), "publishable_key must be the public publishable/anon key");
+  need(!section.publishable_key.startsWith("eyJ") || isPublicAnonJwt(section.publishable_key), "a legacy JWT publishable_key must carry role anon (a service_role key is a secret)");
   need(typeof section.storage_key === "string" && STORAGE_KEY_RE.test(section.storage_key), "storage_key must be the app's supabase-js auth storage key");
   need(Array.isArray(section.production_origins ?? []), "production_origins must be an array");
   need(typeof section.password_env_file === "string" && /^(~\/|\/)/.test(section.password_env_file), "password_env_file must be an absolute or ~/ path");
   need(typeof section.launchd_label === "string" && LABEL_RE.test(section.launchd_label), "launchd_label must be a reverse-DNS label");
-  need(typeof section.docs === "string" && section.docs.length > 0, "docs (where the pool is documented) is required");
-  need(typeof section.install_command === "string" && section.install_command.length > 0, "install_command (the human's install line) is required");
+  // BOT-2648: docs is optional, and install_command is retired (install reads the
+  // control plane by tenant); a pre-registry snapshot may still carry it.
+  need(section.docs === undefined || (typeof section.docs === "string" && section.docs.length > 0), "docs must be a non-empty string when present");
+  need(section.install_command === undefined || typeof section.install_command === "string", "install_command must be a string when present");
   const personas = section.personas;
   need(personas && typeof personas === "object" && Object.keys(personas).length > 0, "personas must name at least one persona");
   const parsedPersonas = {};
@@ -84,7 +96,6 @@ export function parsePoolBinding(raw) {
     personas: Object.freeze(parsedPersonas),
     launchdLabel: section.launchd_label,
     docs: section.docs,
-    installCommand: section.install_command,
   });
 }
 
@@ -94,29 +105,3 @@ export function findPersona(binding, aliasOrEmail) {
   if (Object.hasOwn(binding.personas, key)) return binding.personas[key];
   return Object.values(binding.personas).find((persona) => persona.email === key) ?? null;
 }
-
-// Walk up from cwd to the committed binding file; null when none or no section.
-export async function readRepoPoolBinding(cwd = process.cwd(), { read = readFile } = {}) {
-  let dir = cwd;
-  const root = parse(dir).root;
-  while (true) {
-    let text = null;
-    try {
-      text = await read(join(dir, AGENT_BINDING_FILE), "utf8");
-    } catch (error) {
-      if (error?.code !== "ENOENT") throw error;
-    }
-    if (text !== null) {
-      let raw;
-      try {
-        raw = JSON.parse(text);
-      } catch {
-        throw new BindingError(`${AGENT_BINDING_FILE} is not valid JSON`);
-      }
-      const binding = parsePoolBinding(raw);
-      return binding ? { binding, repoRoot: dir } : null;
-    }
-    if (dir === root) return null;
-    dir = dirname(dir);
-  }
-}