@botbuddy/cli 1.61.3 → 1.61.5

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.61.3",
-  "source_commit": "7c2f279f36d7ceb5f8d7a84e5698fe2dcf2f22e8",
-  "source_sha256": "170bd3f629a5bc5f894ae46191da975ff49f6761fd1b64da2aa6c2f76cc2472a",
+  "release_version": "1.61.5",
+  "source_commit": "f53c37db06f6fc5ab544623f2a273c4e21de1b72",
+  "source_sha256": "7280c8ff78ee957cc06bc7d07ed12a4b36a4c64c3a5968a710a1d371ab1b33c9",
   "target": "darwin-arm64",
-  "sha256": "612de50e3fd1d37a43007f8aaca735dbb2f5cc92e9c2b8d96fd198f0153ef6ec"
+  "sha256": "c57ada939dcf3d5c0ad7cefdbf27ae9995a06a14446ca8774a94c76c61083b00"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.61.3",
-  "source_commit": "7c2f279f36d7ceb5f8d7a84e5698fe2dcf2f22e8",
-  "source_sha256": "170bd3f629a5bc5f894ae46191da975ff49f6761fd1b64da2aa6c2f76cc2472a",
+  "release_version": "1.61.5",
+  "source_commit": "f53c37db06f6fc5ab544623f2a273c4e21de1b72",
+  "source_sha256": "7280c8ff78ee957cc06bc7d07ed12a4b36a4c64c3a5968a710a1d371ab1b33c9",
   "target": "linux-x64",
-  "sha256": "75f71518b6446f547153e71e5c2a2cf15c8c475fd0e2039acfe561fa5cd66309"
+  "sha256": "1002356a262f413e793af8779bec4208426d47bc38d6e5ef115a06b0fa4fd64c"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.61.3",
-  "source_commit": "7c2f279f36d7ceb5f8d7a84e5698fe2dcf2f22e8",
-  "source_sha256": "170bd3f629a5bc5f894ae46191da975ff49f6761fd1b64da2aa6c2f76cc2472a",
+  "release_version": "1.61.5",
+  "source_commit": "f53c37db06f6fc5ab544623f2a273c4e21de1b72",
+  "source_sha256": "7280c8ff78ee957cc06bc7d07ed12a4b36a4c64c3a5968a710a1d371ab1b33c9",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "612de50e3fd1d37a43007f8aaca735dbb2f5cc92e9c2b8d96fd198f0153ef6ec",
+      "sha256": "c57ada939dcf3d5c0ad7cefdbf27ae9995a06a14446ca8774a94c76c61083b00",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "75f71518b6446f547153e71e5c2a2cf15c8c475fd0e2039acfe561fa5cd66309",
+      "sha256": "1002356a262f413e793af8779bec4208426d47bc38d6e5ef115a06b0fa4fd64c",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.61.3",
+  "version": "1.61.5",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/daemon/bootstrap.mjs

@@ -4,15 +4,18 @@
 // no local approval polling loop: host policy wakes only through the pushed
 // BOT-2324 raw wait condition, then this flow re-registers server-side.
 import { createHash } from "node:crypto";
+import { dirname } from "node:path";
 
 import { DAEMON_PRODUCTION_MCP_SERVER, enrollDaemonDeviceProfileFromBootstrapIdentity } from "./enrollment.mjs";
 import { installRemoteService, installedBinaryPath, stageRemoteDaemonRelease } from "./installer.mjs";
 import {
   createRemoteBootstrapIdentity,
   deliverDaemonProfileFromBootstrapIdentityOverSSH,
+  installDaemonRuntimeConfigOverSSH,
   inspectRemoteBootstrapIdentity,
   verifyRemoteServiceIdentity,
 } from "./profile-delivery.mjs";
+import { buildRuntimeConfig } from "./runtime-config.mjs";
 import { validateDaemonRelease } from "./release.mjs";
 import { renderLinuxUnit, renderMacDaemon } from "./service.mjs";
 
@@ -45,7 +48,7 @@ function exactObject(value, keys) {
 function checkedSpec(spec) {
   const keys = [
     "mode", "serverUrl", "sshHost", "serviceUser", "daemonBinary", "profilePath", "requestingHost",
-    "runtimeEngineId", "platform", "arch", "releaseRoot", "home", "config", "approvalTimeoutSeconds",
+    "runtimeEngineId", "platform", "arch", "releaseRoot", "home", "config", "hostPolicy", "approvalTimeoutSeconds",
   ];
   const optional = ["caller", "callerHarness", "callerTicket"];
   if (!spec || typeof spec !== "object" || Array.isArray(spec) ||
@@ -59,7 +62,11 @@ function checkedSpec(spec) {
     typeof spec.requestingHost !== "string" || !spec.requestingHost || Buffer.byteLength(spec.requestingHost, "utf8") > 80 ||
     typeof spec.runtimeEngineId !== "string" || !ENGINE_ID_RE.test(spec.runtimeEngineId) ||
     !["darwin", "linux"].includes(spec.platform) || typeof spec.arch !== "string" || !spec.arch ||
-    !validPath(spec.releaseRoot) || !validPath(spec.home) || !validPath(spec.config) ||
+    !validPath(spec.releaseRoot) || !validPath(spec.home) || !validPath(spec.config) || !spec.config.endsWith("/daemon.json") ||
+    dirname(spec.config) !== dirname(spec.profilePath) ||
+    !spec.hostPolicy || typeof spec.hostPolicy !== "object" || Array.isArray(spec.hostPolicy) ||
+    Object.keys(spec.hostPolicy).length !== 4 ||
+    !["machineId", "dockerEndpoint", "supabaseBinary", "dockerCLI"].every((key) => typeof spec.hostPolicy[key] === "string" && spec.hostPolicy[key]) ||
     !Number.isSafeInteger(spec.approvalTimeoutSeconds) || spec.approvalTimeoutSeconds < 1 || spec.approvalTimeoutSeconds > 3_600 ||
     optional.some((key) => spec[key] !== undefined && (typeof spec[key] !== "string" || !spec[key]))
   ) fail("daemon_bootstrap_spec_invalid");
@@ -215,12 +222,14 @@ export async function bootstrapFreshDaemon(input, {
   enroll = enrollDaemonDeviceProfileFromBootstrapIdentity,
   deliver = deliverDaemonProfileFromBootstrapIdentityOverSSH,
   installRemote = installRemoteService,
+  installRuntimeConfig = installDaemonRuntimeConfigOverSSH,
 } = {}) {
   const spec = checkedSpec(input);
   if (typeof registerHost !== "function" || typeof verifyRemoteIdentity !== "function" ||
       typeof createIdentity !== "function" || typeof inspectIdentity !== "function" ||
       typeof validateRelease !== "function" || typeof stageRemote !== "function" || typeof enroll !== "function" ||
       typeof deliver !== "function" || typeof installRemote !== "function" ||
+      typeof installRuntimeConfig !== "function" ||
       (awaitApproval !== null && typeof awaitApproval !== "function") ||
       (onApprovalRequired !== null && typeof onApprovalRequired !== "function") ||
       (resumeStore !== null && (typeof resumeStore !== "object" || typeof resumeStore.save !== "function" ||
@@ -355,6 +364,42 @@ export async function bootstrapFreshDaemon(input, {
     }
   }
 
+  let runtimeConfig;
+  try {
+    runtimeConfig = buildRuntimeConfig({
+      host_key: publicIdentity.hostKey,
+      state_dir: dirname(spec.config),
+      docker_endpoint: spec.hostPolicy.dockerEndpoint,
+      expected_engine_id: spec.runtimeEngineId,
+      machine_id: spec.hostPolicy.machineId,
+      supabase_binary: spec.hostPolicy.supabaseBinary,
+      docker_cli: spec.hostPolicy.dockerCLI,
+      host_credential_profile: spec.profilePath,
+      device_consent: true,
+      runtime_version: `go-daemon/${release.releaseVersion}`,
+      runtime_git_sha: release.sourceCommit,
+      runtime_protocol_version: 2,
+    });
+  } catch {
+    fail("daemon_bootstrap_runtime_config_invalid");
+  }
+  try {
+    const installed = await installRuntimeConfig({
+      config: JSON.stringify(runtimeConfig),
+      configPath: spec.config,
+      sshHost: spec.sshHost,
+      serviceUser: spec.serviceUser,
+      daemonBinary: trustedDaemonBinary,
+      profilePath: spec.profilePath,
+      expectedHostKey: publicIdentity.hostKey,
+      directInstall: remote.directInstall,
+    });
+    if (!installed || installed.installed !== true) fail("daemon_bootstrap_runtime_config_failed");
+  } catch (error) {
+    if (error instanceof DaemonBootstrapError) throw error;
+    fail("daemon_bootstrap_runtime_config_failed");
+  }
+
   const serviceSpec = {
     user: spec.serviceUser,
     home: spec.home,

package/src/daemon/commands.mjs

@@ -29,6 +29,7 @@ import {
   createRemoteBootstrapIdentity,
   deliverDaemonProfileFromBootstrapIdentityOverSSH,
   deliverDaemonProfileFromHelperIdentityOverSSH,
+  installDaemonRuntimeConfigOverSSH,
   inspectRemoteBootstrapIdentity,
   verifyRemoteHelperIdentity as verifyRemoteHelperIdentityOnTarget,
   verifyRemoteServiceIdentity,
@@ -285,6 +286,7 @@ export async function cmdDaemon(args, {
   verifyRuntime = checkRuntimeConfig,
   enroll = enrollDaemonDeviceProfileFromHelperIdentity,
   deliver = deliverDaemonProfileFromHelperIdentityOverSSH,
+  installRuntimeConfig = installDaemonRuntimeConfigOverSSH,
   verifyRemoteIdentity = verifyRemoteServiceIdentity,
   verifyRemoteHelperIdentity = verifyRemoteHelperIdentityOnTarget,
   bootstrap = bootstrapFreshDaemon,
@@ -332,6 +334,7 @@ export async function cmdDaemon(args, {
         },
         enroll: enrollBootstrap,
         deliver: deliverBootstrap,
+        installRuntimeConfig,
         installRemote,
         onApprovalRequired: ({ approval_url: approvalUrl, host_key: hostKey }) => {
           notice(`bb daemon bootstrap: owner approval required for ${hostKey}: ${approvalUrl}`);

package/src/daemon/profile-delivery.mjs

@@ -334,3 +334,32 @@ export async function deliverDaemonProfileFromBootstrapIdentityOverSSH({
     installFlag: "--install-profile-from-bootstrap-identity",
   });
 }
+
+// Runtime policy is public host metadata, never a credential. It is still
+// installed through the daemon's descriptor-pinned private root so a caller
+// cannot redirect it with a symlink or broaden a prior host's policy.
+export async function installDaemonRuntimeConfigOverSSH({
+  config,
+  configPath,
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  profilePath,
+  expectedHostKey,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  directInstall = false,
+} = {}) {
+  safeInputs({ sshHost, serviceUser, daemonBinary, profilePath, expectedHostKey, sshBin, spawnImpl, env, timeoutMs, directInstall });
+  if (typeof config !== "string" || config.length === 0 || Buffer.byteLength(config, "utf8") > 64 * 1024 ||
+      typeof configPath !== "string" || !SAFE_ABSOLUTE_PATH.test(configPath) || !configPath.endsWith("/daemon.json")) throw invalid();
+  const command = remoteDaemonCommand({
+    serviceUser, daemonBinary, directInstall,
+    args: ["--install-runtime-config", "--config", configPath, "--profile", profilePath, "--expected-host-key", expectedHostKey],
+  });
+  const stdout = await fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command, stdin: Buffer.from(config, "utf8") });
+  if (!stdout.equals(Buffer.from('{"installed":true}\n'))) throw failed();
+  return { installed: true };
+}

package/src/stack.mjs

@@ -219,6 +219,8 @@ ${bold("run OPTIONS")}
   --local-only           Require a co-located host (execution "local"); no bundle is built.
                          Default (neither flag): execution "auto" — co-located if it admits now,
                          else a remote host with capacity; the bundle digest is sent up front.
+  --execution-ring R     Capacity rollout ring: stable (default) excludes beta daemon hosts.
+                         beta is explicit opt-in and requires \`stack run --remote\`.
   --callback-port N      The caller runs a listener the stack calls back through
                          host.docker.internal:N (e.g. 4600): sent as callback_port. On a REMOTE
                          lease run first probes the host with a throwaway reverse forward and opens
@@ -365,7 +367,7 @@ export function parseStackArgs(argv) {
     connectionFile: null, noWait: false, claimOnly: false, localExec: false, keepVolumes: false, waitCapacity: null, holdOnTimeout: null,
     dockerContext: null, dockerEndpoint: null,
     // BOT-2142: execution placement (null = command default), remote-lease callback + bundle cap.
-    execution: null, remote: false, localOnly: false, callbackPort: null, bundleMaxBytes: null,
+    execution: null, remote: false, localOnly: false, executionRing: "stable", callbackPort: null, bundleMaxBytes: null,
     // BOT-2269: exact stack-relative files shipped in the remote-lease bundle despite the
     // default exclusions (`--bundle-include`, repeatable).
     bundleInclude: [],
@@ -453,6 +455,14 @@ export function parseStackArgs(argv) {
       }
       case "--remote": opts.remote = true; break;
       case "--local-only": opts.localOnly = true; break;
+      case "--execution-ring": {
+        if (need(a, rest[i + 1])) {
+          const ring = rest[++i];
+          if (ring !== "stable" && ring !== "beta") errors.push("--execution-ring must be stable or beta");
+          else opts.executionRing = ring;
+        }
+        break;
+      }
       case "--callback-port": {
         if (need(a, rest[i + 1])) {
           const n = Number(rest[++i]);
@@ -508,6 +518,12 @@ export function parseStackArgs(argv) {
   if (opts.remote && opts.localExec) {
     errors.push("--remote cannot be combined with --local-exec: a local-exec stack is started on THIS machine");
   }
+  if (opts.executionRing === "beta" && command !== "run") {
+    errors.push("--execution-ring beta is valid only with `stack run`");
+  }
+  if (opts.executionRing === "beta" && !opts.remote) {
+    errors.push("--execution-ring beta requires --remote so the beta daemon can serve the stack");
+  }
   if ((opts.remote || opts.localOnly) && !["up", "run"].includes(command)) {
     errors.push("--remote and --local-only are valid only with `stack up` or `stack run`");
   } else if (command === "up" && opts.remote) {
@@ -3846,6 +3862,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       stack_path: execution.stackPath, worktree_root: execution.worktreeRoot,
       machine_uuid: hardwareUuid,
       execution: executionRequest,
+      execution_ring: opts.executionRing,
       ...(bundle ? { bundle_sha256: bundle.sha256 } : {}),
       ...(stackDigest ? { stack_digest: stackDigest } : {}),
       // BOT-1803 (Codex #1160 P1): a run never re-adopts an idle stack it cannot prove current.