@botbuddy/cli 1.60.8 → 1.60.10

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.60.8",
-  "source_commit": "057670de6f7ac5dc8e8e673dab13a317aef876e9",
-  "source_sha256": "3678a4ff49dda524b2b97e5a9d57249b64041f587da4db0c936b2f650647c6ec",
+  "release_version": "1.60.10",
+  "source_commit": "311044889f28c3b22902954ec29c3c117f46d638",
+  "source_sha256": "a82e951ccda7aa65571953e874a01cf30f75bc218ed5592a2bffa2e7b0d3219a",
   "target": "darwin-arm64",
-  "sha256": "234246b7e1b8634420dbe2bceba35a4efa51a0ade206b09882f9c80a0aa66bfb"
+  "sha256": "c078605d49201ad3532212bbac322216b06c108c425024a7f68f6ecdab89fd5a"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.60.8",
-  "source_commit": "057670de6f7ac5dc8e8e673dab13a317aef876e9",
-  "source_sha256": "3678a4ff49dda524b2b97e5a9d57249b64041f587da4db0c936b2f650647c6ec",
+  "release_version": "1.60.10",
+  "source_commit": "311044889f28c3b22902954ec29c3c117f46d638",
+  "source_sha256": "a82e951ccda7aa65571953e874a01cf30f75bc218ed5592a2bffa2e7b0d3219a",
   "target": "linux-x64",
-  "sha256": "c29069dc84ea8273ea4b560816eb130a82dfbba083a6d8149edecd8cc85b534c"
+  "sha256": "af6bfdf5e66b133356c620a5dd9aaacc1cee11d8f0f594bb8f5e8447cb932704"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.60.8",
-  "source_commit": "057670de6f7ac5dc8e8e673dab13a317aef876e9",
-  "source_sha256": "3678a4ff49dda524b2b97e5a9d57249b64041f587da4db0c936b2f650647c6ec",
+  "release_version": "1.60.10",
+  "source_commit": "311044889f28c3b22902954ec29c3c117f46d638",
+  "source_sha256": "a82e951ccda7aa65571953e874a01cf30f75bc218ed5592a2bffa2e7b0d3219a",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "234246b7e1b8634420dbe2bceba35a4efa51a0ade206b09882f9c80a0aa66bfb",
+      "sha256": "c078605d49201ad3532212bbac322216b06c108c425024a7f68f6ecdab89fd5a",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "c29069dc84ea8273ea4b560816eb130a82dfbba083a6d8149edecd8cc85b534c",
+      "sha256": "af6bfdf5e66b133356c620a5dd9aaacc1cee11d8f0f594bb8f5e8447cb932704",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.60.8",
+  "version": "1.60.10",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -278,8 +278,8 @@ ${bold("STAGING SIGN-IN")} (BOT-2084)
                               persona, no password (${cyan("bb pw auth --help")})
   staging-pool status [--check]
                               Pool health: one reason, who acts, the next command
-  staging-pool install|tick|mint-one|uninstall
-                              Human only, from Terminal.app (${cyan("bb staging-pool --help")})
+  staging-pool install --tenant <slug> | tick | mint-one | uninstall
+                              Human only, any directory (${cyan("bb staging-pool --help")})
   help symptom staging-pool   Every refusal code with its cause and next command
 
 ${bold("OTHER")}

package/src/pw/run.mjs

@@ -11,6 +11,7 @@ import { VERSION } from "../version.mjs";
 import { readAgentSessionTokenEnv, AGENT_KEY_RE, legacyAgentAliasHint } from "../agent-key.mjs";
 import { clearAgentState, isRejectedCachedMcpSession, resolveAgentSessionCredential } from "../agent-session.mjs";
 import * as stagingAuth from "./staging-auth.mjs";
+import { DOC_SECTIONS, DOC_URL } from "../staging-pool/errors.mjs";
 // BOT-1488: canonicalize the raw hostname the SAME way acquire_resources does
 // server-side, so the lane name bb-pw builds/matches/prints is the one the lock
 // kernel actually stored ("jonos-mbp:8", not "Jonos-MBP.localdomain:8").
@@ -134,7 +135,12 @@ export async function runPw(argv, deps = {}) {
 // while-loop in runPwInner). Everything after the first non-option (the lane) is a
 // Playwright workload argument and is never a BotBuddy credential.
 const PW_LEADING_FLAGS = ["--tenant", "--session-id", "--agent-session-token", "--agent-key", "--session-token", "--environment"];
-const selfHealErrorLine = (error) => `bb-pw: ${error?.message ?? "agent session unavailable"}. ${error?.code === "client_key_required" ? "Run `bb login` then retry." : "Run `bb doctor --fix` then retry."}\n`;
+// BOT-2648 acceptance: with no tenant binding, `bb doctor --fix` cannot help: the
+// caller is outside a registered agent worktree, which lane locks need.
+const NO_BINDING_NEXT = "Agent: run this from your registered project worktree (the checkout with .botbuddy-agent.json; run `bb setup` there once), then retry. bb help symptom tenant_binding_required";
+const selfHealErrorLine = (error) => error?.code === "tenant_binding_required"
+  ? `bb-pw: tenant_binding_required — ${error?.message ?? "no BotBuddy tenant binding here"} ${NO_BINDING_NEXT}. Docs: ${DOC_URL}#${DOC_SECTIONS.take}\n`
+  : `bb-pw: ${error?.message ?? "agent session unavailable"}. ${error?.code === "client_key_required" ? "Run `bb login` then retry." : "Run `bb doctor --fix` then retry."}\n`;
 // The leading credential options, NORMALIZED to split `flag value` pairs so an
 // inline `--agent-key=<token>` is recognized by legacyAgentAliasHint (which
 // matches exact flag tokens) exactly like the split form. Credential flags are
@@ -247,6 +253,8 @@ async function runPwInner(argv, deps = {}) {
       // BOT-2648 (Codex P2, #1323): the credential's tenant picks the installed staging pool.
       deps = { ...deps, sessionToken: credential.token, sessionId: deps.sessionId ?? credential.sessionId ?? null, credentialAgentId: credential.agentId ?? null, credentialTenant: credential.identity?.tenant ?? null };
     } catch (error) {
+      // BOT-2648 acceptance: an auth refusal is the standard JSON receipt (actor, next, doc, symptom).
+      if (plan.mode === "auth" && error?.code === "tenant_binding_required") return stagingAuth.refuse({ stdout, stderr }, "tenant_binding_required", 3, {}, authVars(plan, deps));
       stderr.write(selfHealErrorLine(error)); return 3;
     }
   }

package/src/staging-pool/errors.mjs

@@ -52,6 +52,13 @@ export const ERROR_CODES = Object.freeze({
     "The lane lock is held by another agent session of your owner, not by this session.",
     "The lane was claimed from a different session or sub-agent; auth needs the exact holder.",
     `bb locks -m --lane {lane}{ticketFlag}   # from THIS session, then: ${AUTH}`),
+  // BOT-2648 acceptance: the take runs from a registered agent worktree. Lane locks
+  // are per agent worktree, so a directory with no .botbuddy-agent.json has no
+  // agent identity to hold the lane (the pool itself never needs a checkout).
+  tenant_binding_required: entry("agent", "take",
+    "bb pw needs a registered agent worktree, and this directory has no BotBuddy tenant binding.",
+    "No .botbuddy-agent.json was found here or above, so there is no per-worktree agent identity to hold the lane lock.",
+    `bb setup   # run inside your registered project worktree (the checkout with .botbuddy-agent.json); then from there: bb locks -m --lane {lane}{ticketFlag} && ${AUTH}`),
   persona_not_allowlisted: entry("agent", "take",
     "Persona \"{persona}\" is not one of this repository's staging_session_pool personas.",
     "A typo, or an email where the alias is expected. Allowed aliases: {allowed}.",
@@ -310,7 +317,7 @@ export const ERROR_CODES = Object.freeze({
 // Codes only `bb pw … auth` can raise; every other code can come from `bb staging-pool`.
 export const AUTH_ONLY_CODES = Object.freeze(new Set([
   "auth_requires_staging_environment", "auth_requires_lane_lock", "lane_not_claimed", "exact_lane_holder_required",
-  "persona_not_allowlisted", "lane_browser_not_open", "browser_session_not_staging", "persistent_profile_refused",
+  "tenant_binding_required", "persona_not_allowlisted", "lane_browser_not_open", "browser_session_not_staging", "persistent_profile_refused",
   "session_install_failed", "staging_session_cleanup_pending", "session_not_aal2", "session_expired",
   "session_persona_mismatch", "slot_state_invalid", "slot_state_unreadable", "daemon_node_unsupported",
   "daemon_run_failed", "daemon_result_missing", "daemon_result_invalid", "pool_take_failed", "pool_empty",

package/src/usage/sync.mjs

@@ -10,6 +10,7 @@
 // success). It carries row COUNTS only — never paths, never prompt text, never
 // token totals. Fail-open: any failure exits 0 unless --strict.
 import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { readdir, stat } from "node:fs/promises";
 import { homedir, hostname as systemHostname } from "node:os";
@@ -90,16 +91,20 @@ export function transcriptRoots(env = process.env, home = homedir()) {
  * subdirectories) modified since `cutoffMs`. `shouldStop` is checked before
  * every directory read and stat, so a huge history or a slow filesystem cannot
  * outlive the run's time budget (the pre-push lane runs with 5 s).
- * @returns {Promise<{ files: string[], stopped: boolean }>}
+ * `errors` counts directories or files that exist but could not be read
+ * (EACCES, EPERM, …); a missing root or a file that vanished is not an error.
+ * @returns {Promise<{ files: string[], stopped: boolean, errors: number }>}
  */
 export async function listTranscripts(root, cutoffMs, { shouldStop = () => false, keep = () => false } = {}) {
   const out = [];
   let stopped = false;
+  let errors = 0;
+  const benign = (error) => error?.code === "ENOENT" || error?.code === "ENOTDIR";
   const halt = () => (stopped = stopped || shouldStop());
   async function walk(dir) {
     if (halt()) return;
     let entries;
-    try { entries = await readdir(dir, { withFileTypes: true }); } catch { return; }
+    try { entries = await readdir(dir, { withFileTypes: true }); } catch (error) { if (!benign(error)) errors += 1; return; }
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (halt()) return;
@@ -109,12 +114,12 @@ export async function listTranscripts(root, cutoffMs, { shouldStop = () => false
         try {
           const info = await stat(path);
           if (info.mtimeMs >= cutoffMs || keep(path, info)) out.push(path);
-        } catch { /* vanished between readdir and stat */ }
+        } catch (error) { if (!benign(error)) errors += 1; /* ENOENT: vanished between readdir and stat */ }
       }
     }
   }
   await walk(root);
-  return { files: out, stopped };
+  return { files: out, stopped, errors };
 }
 
 /** Which adapter owns a single `--file`: under a Codex root, or a rollout whose first record is session_meta. */
@@ -373,19 +378,24 @@ export async function syncUsage(opts, deps = {}) {
     roots = transcriptRoots(env, home), repoFor = createRepoResolver(), branchFor = createBranchResolver({ env }), cliVersion = "0.0.0",
     tenantFor = createTenantResolver({ env }), resolveTarget = defaultResolveTarget, readLines = readCompleteLines,
     serverUrl = env.BOTBUDDY_SERVER_URL || DEFAULT_SERVER_URL, statePath = cursorPath(home),
+    newSyncId = randomUUID,
   } = deps;
   const startedMs = now();
   const deadlineMs = startedMs + opts.maxSeconds * 1000;
   const parseDeadlineMs = startedMs + opts.maxSeconds * 1000 * PARSE_BUDGET_FRACTION;
   const startedAt = new Date(startedMs).toISOString();
+  // BOT-2649: one id for this whole invocation, sent with every batch (both
+  // providers), so v_usage_sync_hosts judges the attempt as a whole: one
+  // refused batch fails the sync even when a later batch succeeded.
+  const syncId = newSyncId();
   const receipt = {
     schema_version: 1, command: "usage sync", outcome: "ok", trigger: opts.trigger, dry_run: opts.dryRun,
     providers: [], files_scanned: 0, files_read: 0, envelopes: 0, batches: 0,
     tenant: null, skipped_other_tenant: 0, skipped_unbound: 0,
     seen: 0, inserted: 0, superseded: 0, deduped: 0, refused: 0, refusal_reasons: {}, batches_all_refused: 0,
-    refused_local: 0, parse_errors: 0,
+    refused_local: 0, parse_errors: 0, read_errors: 0,
     held_open_messages: 0, cost_state_withheld: 0,
-    privacy: "pass", budget_exhausted: false, run_ids: [], started_at: startedAt, duration_ms: 0,
+    privacy: "pass", budget_exhausted: false, run_ids: [], started_at: startedAt, sync_id: syncId, duration_ms: 0,
   };
   const finish = (outcome, error) => {
     receipt.outcome = outcome;
@@ -441,6 +451,8 @@ export async function syncUsage(opts, deps = {}) {
         },
       });
       if (listed.stopped) receipt.budget_exhausted = true;
+      // BOT-2649: an unreadable transcript directory is a read failure, not an idle host.
+      receipt.read_errors += listed.errors ?? 0;
       plan.push({ provider, files: listed.stopped ? [] : listed.files });
     }
   }
@@ -466,7 +478,7 @@ export async function syncUsage(opts, deps = {}) {
       : createClaudeAdapter({ hmac, environment, repoFor, tenantFor });
     const run = {
       host: hostname(), trigger: opts.trigger, provider, cli_version: cliVersion,
-      parser_version: adapter.parserVersion, started_at: startedAt,
+      parser_version: adapter.parserVersion, started_at: startedAt, sync_id: syncId,
     };
 
     // Envelopes are queued with a global sequence; a file's cursor commits only
@@ -535,7 +547,9 @@ export async function syncUsage(opts, deps = {}) {
     for (const path of files) {
       if (now() >= parseDeadlineMs) { receipt.budget_exhausted = true; break; }
       let info;
-      try { info = await stat(path); } catch { continue; }
+      // A file that vanished since listing is benign; any other stat failure
+      // (e.g. EACCES) means this run could not read pending usage (BOT-2649).
+      try { info = await stat(path); } catch (error) { if (error?.code !== "ENOENT") receipt.read_errors += 1; continue; }
       const sourceHmac = hmac(resolve(path));
       // Cursors are per (tenant, file): a run skips other tenants' records, so a
       // shared per-file cursor would consume them for every later tenant's run.
@@ -560,6 +574,7 @@ export async function syncUsage(opts, deps = {}) {
           parser.parseRecord(record, offset);
         }, { shouldStop: () => now() >= parseDeadlineMs });
       } catch {
+        receipt.read_errors += 1; // counted: a run that could not read is not a clean idle run
         continue; // unreadable file: skip, cursor unchanged
       }
       if (result.stopped) receipt.budget_exhausted = true;
@@ -606,8 +621,43 @@ export async function syncUsage(opts, deps = {}) {
     }
     commitDelivered();
   }
+  // BOT-2649: a run that uploaded nothing still records one empty ok run, so an
+  // idle but healthy host is not aged into "stale" by v_usage_sync_hosts. Only a
+  // CLEAN idle run does: one that refused records locally, hit unparseable lines,
+  // could not read a transcript or ran out of budget did not prove usage lands, so it records nothing and the
+  // host ages as before rather than reading healthy (independent review on #1324).
+  if (!opts.dryRun && receipt.batches === 0) {
+    const withheld = receipt.budget_exhausted ? "budget_exhausted"
+      : receipt.refused_local > 0 ? "refused_local"
+      : receipt.parse_errors > 0 ? "parse_errors"
+      : receipt.read_errors > 0 ? "read_errors" : null;
+    if (withheld) {
+      receipt.empty_run_withheld = withheld;
+    } else {
+      const error = await postEmptyRun();
+      if (error === OUT_OF_TIME) return finalize(null);
+      if (error) return finalize(error);
+    }
+  }
   return finalize(null);
 
+  async function postEmptyRun() {
+    // Same deadline rules as a batch: never START a request past the budget.
+    if (now() >= deadlineMs) { receipt.budget_exhausted = true; return OUT_OF_TIME; }
+    const resolved = await ensureAuth();
+    if (resolved.error) return resolved.error;
+    if (now() >= deadlineMs) { receipt.budget_exhausted = true; return OUT_OF_TIME; }
+    const run = { host: hostname(), trigger: opts.trigger, cli_version: cliVersion, started_at: startedAt, sync_id: syncId };
+    const result = await postBatch({
+      endpoint: usageIngestEndpoint(serverUrl), tenant: resolved.tenant,
+      headers: resolved.headers, run, envelopes: [], fetchImpl, timeoutMs: deadlineMs - now(),
+    });
+    if (!result.ok) return result.error;
+    receipt.empty_run = true;
+    if (result.run_id) receipt.run_ids.push(result.run_id);
+    return null;
+  }
+
   async function finalize(error) {
     const outcome = error ? "error" : opts.dryRun ? "dry_run" : receipt.budget_exhausted ? "partial" : "ok";
     finish(outcome, error);