@botbuddy/cli 1.61.4 → 1.61.5

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.61.4",
-  "source_commit": "b6e939df36d913c84893c35c4f35a74cb8fb9675",
-  "source_sha256": "4b2c9b81b1e46f417dd3f1b58c19f6e03c4fbb6fa697a6b2ac2db0586551614b",
+  "release_version": "1.61.5",
+  "source_commit": "f53c37db06f6fc5ab544623f2a273c4e21de1b72",
+  "source_sha256": "7280c8ff78ee957cc06bc7d07ed12a4b36a4c64c3a5968a710a1d371ab1b33c9",
   "target": "darwin-arm64",
-  "sha256": "24fe172b82abb3ac4e59574516d614f1a35ec19b1fb2789793e4d877f8b0e526"
+  "sha256": "c57ada939dcf3d5c0ad7cefdbf27ae9995a06a14446ca8774a94c76c61083b00"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.61.4",
-  "source_commit": "b6e939df36d913c84893c35c4f35a74cb8fb9675",
-  "source_sha256": "4b2c9b81b1e46f417dd3f1b58c19f6e03c4fbb6fa697a6b2ac2db0586551614b",
+  "release_version": "1.61.5",
+  "source_commit": "f53c37db06f6fc5ab544623f2a273c4e21de1b72",
+  "source_sha256": "7280c8ff78ee957cc06bc7d07ed12a4b36a4c64c3a5968a710a1d371ab1b33c9",
   "target": "linux-x64",
-  "sha256": "227d9145bedfb733e88e1456e2e8a9c989a12201b2c16427b2a7be2c27661bdf"
+  "sha256": "1002356a262f413e793af8779bec4208426d47bc38d6e5ef115a06b0fa4fd64c"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.61.4",
-  "source_commit": "b6e939df36d913c84893c35c4f35a74cb8fb9675",
-  "source_sha256": "4b2c9b81b1e46f417dd3f1b58c19f6e03c4fbb6fa697a6b2ac2db0586551614b",
+  "release_version": "1.61.5",
+  "source_commit": "f53c37db06f6fc5ab544623f2a273c4e21de1b72",
+  "source_sha256": "7280c8ff78ee957cc06bc7d07ed12a4b36a4c64c3a5968a710a1d371ab1b33c9",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "24fe172b82abb3ac4e59574516d614f1a35ec19b1fb2789793e4d877f8b0e526",
+      "sha256": "c57ada939dcf3d5c0ad7cefdbf27ae9995a06a14446ca8774a94c76c61083b00",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "227d9145bedfb733e88e1456e2e8a9c989a12201b2c16427b2a7be2c27661bdf",
+      "sha256": "1002356a262f413e793af8779bec4208426d47bc38d6e5ef115a06b0fa4fd64c",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.61.4",
+  "version": "1.61.5",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/daemon/bootstrap.mjs

@@ -4,15 +4,18 @@
 // no local approval polling loop: host policy wakes only through the pushed
 // BOT-2324 raw wait condition, then this flow re-registers server-side.
 import { createHash } from "node:crypto";
+import { dirname } from "node:path";
 
 import { DAEMON_PRODUCTION_MCP_SERVER, enrollDaemonDeviceProfileFromBootstrapIdentity } from "./enrollment.mjs";
 import { installRemoteService, installedBinaryPath, stageRemoteDaemonRelease } from "./installer.mjs";
 import {
   createRemoteBootstrapIdentity,
   deliverDaemonProfileFromBootstrapIdentityOverSSH,
+  installDaemonRuntimeConfigOverSSH,
   inspectRemoteBootstrapIdentity,
   verifyRemoteServiceIdentity,
 } from "./profile-delivery.mjs";
+import { buildRuntimeConfig } from "./runtime-config.mjs";
 import { validateDaemonRelease } from "./release.mjs";
 import { renderLinuxUnit, renderMacDaemon } from "./service.mjs";
 
@@ -45,7 +48,7 @@ function exactObject(value, keys) {
 function checkedSpec(spec) {
   const keys = [
     "mode", "serverUrl", "sshHost", "serviceUser", "daemonBinary", "profilePath", "requestingHost",
-    "runtimeEngineId", "platform", "arch", "releaseRoot", "home", "config", "approvalTimeoutSeconds",
+    "runtimeEngineId", "platform", "arch", "releaseRoot", "home", "config", "hostPolicy", "approvalTimeoutSeconds",
   ];
   const optional = ["caller", "callerHarness", "callerTicket"];
   if (!spec || typeof spec !== "object" || Array.isArray(spec) ||
@@ -59,7 +62,11 @@ function checkedSpec(spec) {
     typeof spec.requestingHost !== "string" || !spec.requestingHost || Buffer.byteLength(spec.requestingHost, "utf8") > 80 ||
     typeof spec.runtimeEngineId !== "string" || !ENGINE_ID_RE.test(spec.runtimeEngineId) ||
     !["darwin", "linux"].includes(spec.platform) || typeof spec.arch !== "string" || !spec.arch ||
-    !validPath(spec.releaseRoot) || !validPath(spec.home) || !validPath(spec.config) ||
+    !validPath(spec.releaseRoot) || !validPath(spec.home) || !validPath(spec.config) || !spec.config.endsWith("/daemon.json") ||
+    dirname(spec.config) !== dirname(spec.profilePath) ||
+    !spec.hostPolicy || typeof spec.hostPolicy !== "object" || Array.isArray(spec.hostPolicy) ||
+    Object.keys(spec.hostPolicy).length !== 4 ||
+    !["machineId", "dockerEndpoint", "supabaseBinary", "dockerCLI"].every((key) => typeof spec.hostPolicy[key] === "string" && spec.hostPolicy[key]) ||
     !Number.isSafeInteger(spec.approvalTimeoutSeconds) || spec.approvalTimeoutSeconds < 1 || spec.approvalTimeoutSeconds > 3_600 ||
     optional.some((key) => spec[key] !== undefined && (typeof spec[key] !== "string" || !spec[key]))
   ) fail("daemon_bootstrap_spec_invalid");
@@ -215,12 +222,14 @@ export async function bootstrapFreshDaemon(input, {
   enroll = enrollDaemonDeviceProfileFromBootstrapIdentity,
   deliver = deliverDaemonProfileFromBootstrapIdentityOverSSH,
   installRemote = installRemoteService,
+  installRuntimeConfig = installDaemonRuntimeConfigOverSSH,
 } = {}) {
   const spec = checkedSpec(input);
   if (typeof registerHost !== "function" || typeof verifyRemoteIdentity !== "function" ||
       typeof createIdentity !== "function" || typeof inspectIdentity !== "function" ||
       typeof validateRelease !== "function" || typeof stageRemote !== "function" || typeof enroll !== "function" ||
       typeof deliver !== "function" || typeof installRemote !== "function" ||
+      typeof installRuntimeConfig !== "function" ||
       (awaitApproval !== null && typeof awaitApproval !== "function") ||
       (onApprovalRequired !== null && typeof onApprovalRequired !== "function") ||
       (resumeStore !== null && (typeof resumeStore !== "object" || typeof resumeStore.save !== "function" ||
@@ -355,6 +364,42 @@ export async function bootstrapFreshDaemon(input, {
     }
   }
 
+  let runtimeConfig;
+  try {
+    runtimeConfig = buildRuntimeConfig({
+      host_key: publicIdentity.hostKey,
+      state_dir: dirname(spec.config),
+      docker_endpoint: spec.hostPolicy.dockerEndpoint,
+      expected_engine_id: spec.runtimeEngineId,
+      machine_id: spec.hostPolicy.machineId,
+      supabase_binary: spec.hostPolicy.supabaseBinary,
+      docker_cli: spec.hostPolicy.dockerCLI,
+      host_credential_profile: spec.profilePath,
+      device_consent: true,
+      runtime_version: `go-daemon/${release.releaseVersion}`,
+      runtime_git_sha: release.sourceCommit,
+      runtime_protocol_version: 2,
+    });
+  } catch {
+    fail("daemon_bootstrap_runtime_config_invalid");
+  }
+  try {
+    const installed = await installRuntimeConfig({
+      config: JSON.stringify(runtimeConfig),
+      configPath: spec.config,
+      sshHost: spec.sshHost,
+      serviceUser: spec.serviceUser,
+      daemonBinary: trustedDaemonBinary,
+      profilePath: spec.profilePath,
+      expectedHostKey: publicIdentity.hostKey,
+      directInstall: remote.directInstall,
+    });
+    if (!installed || installed.installed !== true) fail("daemon_bootstrap_runtime_config_failed");
+  } catch (error) {
+    if (error instanceof DaemonBootstrapError) throw error;
+    fail("daemon_bootstrap_runtime_config_failed");
+  }
+
   const serviceSpec = {
     user: spec.serviceUser,
     home: spec.home,

package/src/daemon/commands.mjs

@@ -29,6 +29,7 @@ import {
   createRemoteBootstrapIdentity,
   deliverDaemonProfileFromBootstrapIdentityOverSSH,
   deliverDaemonProfileFromHelperIdentityOverSSH,
+  installDaemonRuntimeConfigOverSSH,
   inspectRemoteBootstrapIdentity,
   verifyRemoteHelperIdentity as verifyRemoteHelperIdentityOnTarget,
   verifyRemoteServiceIdentity,
@@ -285,6 +286,7 @@ export async function cmdDaemon(args, {
   verifyRuntime = checkRuntimeConfig,
   enroll = enrollDaemonDeviceProfileFromHelperIdentity,
   deliver = deliverDaemonProfileFromHelperIdentityOverSSH,
+  installRuntimeConfig = installDaemonRuntimeConfigOverSSH,
   verifyRemoteIdentity = verifyRemoteServiceIdentity,
   verifyRemoteHelperIdentity = verifyRemoteHelperIdentityOnTarget,
   bootstrap = bootstrapFreshDaemon,
@@ -332,6 +334,7 @@ export async function cmdDaemon(args, {
         },
         enroll: enrollBootstrap,
         deliver: deliverBootstrap,
+        installRuntimeConfig,
         installRemote,
         onApprovalRequired: ({ approval_url: approvalUrl, host_key: hostKey }) => {
           notice(`bb daemon bootstrap: owner approval required for ${hostKey}: ${approvalUrl}`);

package/src/daemon/profile-delivery.mjs

@@ -334,3 +334,32 @@ export async function deliverDaemonProfileFromBootstrapIdentityOverSSH({
     installFlag: "--install-profile-from-bootstrap-identity",
   });
 }
+
+// Runtime policy is public host metadata, never a credential. It is still
+// installed through the daemon's descriptor-pinned private root so a caller
+// cannot redirect it with a symlink or broaden a prior host's policy.
+export async function installDaemonRuntimeConfigOverSSH({
+  config,
+  configPath,
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  profilePath,
+  expectedHostKey,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  directInstall = false,
+} = {}) {
+  safeInputs({ sshHost, serviceUser, daemonBinary, profilePath, expectedHostKey, sshBin, spawnImpl, env, timeoutMs, directInstall });
+  if (typeof config !== "string" || config.length === 0 || Buffer.byteLength(config, "utf8") > 64 * 1024 ||
+      typeof configPath !== "string" || !SAFE_ABSOLUTE_PATH.test(configPath) || !configPath.endsWith("/daemon.json")) throw invalid();
+  const command = remoteDaemonCommand({
+    serviceUser, daemonBinary, directInstall,
+    args: ["--install-runtime-config", "--config", configPath, "--profile", profilePath, "--expected-host-key", expectedHostKey],
+  });
+  const stdout = await fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command, stdin: Buffer.from(config, "utf8") });
+  if (!stdout.equals(Buffer.from('{"installed":true}\n'))) throw failed();
+  return { installed: true };
+}