@botbuddy/cli 1.62.5 → 1.63.1

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.62.5",
-  "source_commit": "abebdf325df18fd2d61b76971c59c2d57fd512a1",
-  "source_sha256": "c936de9003230430258fd3ee54cc3fc6aa74618312bbf875a16c47b2320975ce",
+  "release_version": "1.63.1",
+  "source_commit": "7f42fb391734dbc962548fddd42d4ccf84e63039",
+  "source_sha256": "7e21669993256b7566102111fe48ea9a2f7f5a309c962a99b82b4a2d27016d3d",
   "target": "darwin-arm64",
-  "sha256": "3695d85ceebb29aeea8f764924286918409a1fe60c0da85d0e37dff20e893754"
+  "sha256": "a3d98f8e3d76fc7d30266fd5e261880615b5e8377e1211cf87fe3927dfb9f156"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.62.5",
-  "source_commit": "abebdf325df18fd2d61b76971c59c2d57fd512a1",
-  "source_sha256": "c936de9003230430258fd3ee54cc3fc6aa74618312bbf875a16c47b2320975ce",
+  "release_version": "1.63.1",
+  "source_commit": "7f42fb391734dbc962548fddd42d4ccf84e63039",
+  "source_sha256": "7e21669993256b7566102111fe48ea9a2f7f5a309c962a99b82b4a2d27016d3d",
   "target": "linux-x64",
-  "sha256": "f391c6f146dda4ea93ce60a856e4d3e63d64e467c0b928af0299a97b8df626f2"
+  "sha256": "1edca9db4f9e8e8d72b9112acf63ec6ba4ca09423cee8ef0afe4bae0abb78bc2"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.62.5",
-  "source_commit": "abebdf325df18fd2d61b76971c59c2d57fd512a1",
-  "source_sha256": "c936de9003230430258fd3ee54cc3fc6aa74618312bbf875a16c47b2320975ce",
+  "release_version": "1.63.1",
+  "source_commit": "7f42fb391734dbc962548fddd42d4ccf84e63039",
+  "source_sha256": "7e21669993256b7566102111fe48ea9a2f7f5a309c962a99b82b4a2d27016d3d",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "3695d85ceebb29aeea8f764924286918409a1fe60c0da85d0e37dff20e893754",
+      "sha256": "a3d98f8e3d76fc7d30266fd5e261880615b5e8377e1211cf87fe3927dfb9f156",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "f391c6f146dda4ea93ce60a856e4d3e63d64e467c0b928af0299a97b8df626f2",
+      "sha256": "1edca9db4f9e8e8d72b9112acf63ec6ba4ca09423cee8ef0afe4bae0abb78bc2",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.62.5",
+  "version": "1.63.1",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack-forward-attestation.mjs

@@ -0,0 +1,131 @@
+// BOT-2738: live transport evidence belongs to the process holding the tunnel,
+// not a connection file which can outlive it. This private Unix socket is a
+// local capability only; cmdStatus still authenticates the lease server-side.
+import { createServer, get } from "node:http";
+import { chmod, lstat, mkdtemp, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { tmpdir } from "node:os";
+import { spawnSync } from "node:child_process";
+
+export const FORWARD_ATTESTATION_ENV = "BOTBUDDY_STACK_FORWARD_ATTESTATION_SOCKET";
+const failure = () => new Error("live stack forward attestation unavailable");
+
+export function ownsLsofSocket(output, ownerPid, socketPath, platform = process.platform) {
+  if (!["darwin", "linux"].includes(platform)) return false;
+  // Linux's native n field appends the socket type; Darwin's does not.
+  // Match the complete dialect-specific field, never trim arbitrary suffixes:
+  // a literal " type=STREAM" may itself be part of an untrusted pathname.
+  const expected = `n${socketPath}${platform === "linux" ? " type=STREAM" : ""}`;
+  let ownedProcess = false;
+  for (const field of String(output ?? "").split("\n")) {
+    if (field.startsWith("p")) ownedProcess = field === `p${ownerPid}`;
+    else if (ownedProcess && field === expected) return true;
+  }
+  return false;
+}
+
+// A caller can replace an environment value or create its own socket. Require
+// kernel evidence that this endpoint belongs to a live ancestor of the status
+// process, rather than granting trust to the capability path or response alone.
+function assertAncestorEndpoint(socketPath, ownerPid) {
+  if (!Number.isInteger(ownerPid) || ownerPid <= 1 || /[\r\n]/.test(socketPath)) throw failure();
+  let pid = process.ppid;
+  let found = false;
+  for (let depth = 0; depth < 32 && pid > 1; depth++) {
+    if (pid === ownerPid) { found = true; break; }
+    const parent = spawnSync("/bin/ps", ["-p", String(pid), "-o", "ppid="], { encoding: "utf8", timeout: 2000, maxBuffer: 1024 });
+    if (parent.status !== 0 || !/^\s*\d+\s*$/.test(parent.stdout)) throw failure();
+    const next = Number(parent.stdout.trim());
+    if (next === pid) throw failure();
+    pid = next;
+  }
+  if (!found) throw failure();
+  const lsof = process.platform === "darwin" ? "/usr/sbin/lsof" : "/usr/bin/lsof";
+  const held = spawnSync(lsof, ["-nP", "-a", "-U", "-p", String(ownerPid), "-F", "pn"], { encoding: "utf8", timeout: 2000, maxBuffer: 256 * 1024 });
+  if (held.status !== 0 || !ownsLsofSocket(held.stdout, ownerPid, socketPath)) throw failure();
+}
+
+function validForwards(rows) {
+  return Array.isArray(rows) && rows.length > 0 && rows.length <= 32
+    && rows.every((row) => typeof row?.name === "string" && row.name.length > 0 && row.name.length <= 64
+      && [row.local, row.remote].every((p) => Number.isInteger(p) && p > 0 && p <= 65535))
+    && ["name", "local", "remote"].every((key) => new Set(rows.map((r) => r[key])).size === rows.length);
+}
+
+export async function startForwardAttestation({ leaseId, sshTarget, forwards, isLive }) {
+  if (typeof leaseId !== "string" || !leaseId || typeof sshTarget !== "string" || !sshTarget
+    || !validForwards(forwards) || typeof isLive !== "function" || isLive() !== true) throw failure();
+  const snapshot = {
+    schema_version: 1, lease_id: leaseId, ssh_target: sshTarget, owner_pid: process.pid,
+    forwards: forwards.map(({ name, local, remote }) => ({ name, local, remote })),
+  };
+  const root = await mkdtemp(join(tmpdir(), "bb-f-"));
+  const socketPath = join(root, "f");
+  const server = createServer((request, response) => {
+    let allowed = false;
+    try {
+      const url = new URL(request.url, "http://local");
+      allowed = request.method === "GET" && url.pathname === "/forwards"
+        && url.searchParams.size === 1 && url.searchParams.get("lease_id") === leaseId && isLive() === true;
+    } catch { /* Unknown evidence is a refusal. */ }
+    response.writeHead(allowed ? 200 : 409, { "content-type": "application/json", "connection": "close" });
+    response.end(JSON.stringify(allowed ? snapshot : { error: "forward attestation unavailable" }));
+  });
+  try {
+    await chmod(root, 0o700);
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(socketPath, resolve);
+    });
+    await chmod(socketPath, 0o600);
+    server.unref();
+  } catch {
+    server.closeAllConnections();
+    server.close();
+    await rm(root, { recursive: true, force: true });
+    throw failure();
+  }
+  let closed;
+  return {
+    socketPath,
+    close() {
+      return closed ??= (async () => {
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(resolve));
+        await rm(root, { recursive: true, force: true });
+      })();
+    },
+  };
+}
+
+export async function readForwardAttestation({ socketPath, leaseId, sshTarget }) {
+  if (!socketPath) return null;
+  try {
+    const [socket, directory] = await Promise.all([lstat(socketPath), lstat(dirname(socketPath))]);
+    if (!socket.isSocket() || !directory.isDirectory()
+      || socket.uid !== process.getuid() || directory.uid !== process.getuid()
+      || (socket.mode & 0o777) !== 0o600 || (directory.mode & 0o777) !== 0o700) throw failure();
+    const payload = await new Promise((resolve, reject) => {
+      const request = get({ socketPath, path: `/forwards?lease_id=${encodeURIComponent(leaseId)}` }, (response) => {
+        if (response.statusCode !== 200) { response.resume(); reject(failure()); return; }
+        let body = "";
+        response.setEncoding("utf8");
+        response.on("data", (chunk) => {
+          body += chunk;
+          if (body.length > 16 * 1024) request.destroy(failure());
+        });
+        response.on("error", reject);
+        response.on("end", () => {
+          try { resolve(JSON.parse(body)); } catch { reject(failure()); }
+        });
+      });
+      const deadline = setTimeout(() => request.destroy(failure()), 2000);
+      request.on("close", () => clearTimeout(deadline));
+      request.on("error", reject);
+    });
+    if (payload?.schema_version !== 1 || payload.lease_id !== leaseId
+      || payload.ssh_target !== sshTarget || !validForwards(payload.forwards)) throw failure();
+    assertAncestorEndpoint(socketPath, payload.owner_pid);
+    return payload.forwards;
+  } catch { throw failure(); }
+}

package/src/stack-tunnel.mjs

@@ -286,6 +286,7 @@ export async function openSshForwards({
   }
   return {
     pid: child.pid,
+    isLive: () => !exited && !closing,
     argv,
     exited: exitPromise,
     onExit: (fn) => { listeners.push(fn); if (exited && !closing) fn({ ...exited, stderr: stderrText() }); },

package/src/stack.mjs

@@ -49,6 +49,7 @@ import { checkReadoptedStackMounts } from "./stack-mount-health.mjs";
 import { machineUuid } from "./machine-id.mjs";
 import { DEFAULT_BUNDLE_MAX_BYTES, buildStackBundle, uploadStackBundle, validateBundleIncludePath } from "./stack-bundle.mjs";
 import { assertSshTarget, establishSshTunnel } from "./stack-tunnel.mjs";
+import { FORWARD_ATTESTATION_ENV, startForwardAttestation, readForwardAttestation } from "./stack-forward-attestation.mjs";
 import { ENGINE_PUBLISHES_BEYOND_LOOPBACK, engineSocketIsLocal, formatPublishIp, isLoopbackIp, publishIpFix, resolvePublishIp } from "./docker-publish-ip.mjs";
 import { bold, dim, yellow } from "./utils.mjs";
 import { reportStackRunOutcome } from "./stack-run-outcome.mjs";
@@ -108,7 +109,8 @@ export const STACK_HELP = `${bold("botbuddy stack")} — one command for a batch
 
 ${bold("USAGE")}
   botbuddy stack up [options]        Request a lease; park if the host is full; hold it active
-  botbuddy stack status <lease_id>   Show a lease's state + connection
+  botbuddy stack status <lease_id>   Show a lease's state + connection; within a live remote run,
+                                   include the owner's attested local/remote forwards
   botbuddy stack touch  <lease_id>   Bump the idle clock (and report measured use) so the reaper doesn't stop it
   botbuddy stack done   <lease_id>   Release (done): idle the stack for re-adoption (--reap tears it down)
   botbuddy stack cancel <lease_id>   Give a queued lease's place up (= done --reap; BOT-2400)
@@ -2960,6 +2962,7 @@ export async function cmdUp(opts, {
 
 export async function cmdStatus(leaseId, opts, {
   rpc = retryingStackCall(), emitResult = emit, stderr = (line) => process.stderr.write(`${line}\n`),
+  forwardSocket = process.env[FORWARD_ATTESTATION_ENV],
 } = {}) {
   const auth = await rpc.init();
   if (!auth) return emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
@@ -2969,6 +2972,14 @@ export async function cmdStatus(leaseId, opts, {
     : emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: got.error }), opts, EXIT.BACKEND);
   const g = got.data;
   if (!g.success) return emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, code: g.code, error: g.code }), opts, EXIT.BACKEND);
+  let forwards;
+  if (g.state === "active" && forwardSocket) {
+    try {
+      forwards = await readForwardAttestation({ socketPath: forwardSocket, leaseId, sshTarget: g.connection?.ssh_target ?? g.ssh_target });
+    } catch {
+      return emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, code: "FORWARD_ATTESTATION_UNAVAILABLE", error: "live stack forward attestation unavailable" }), opts, EXIT.BACKEND);
+    }
+  }
   // BOT-2019: a queued lease names its server dispatch rank (or why it has none) and the
   // ticket it is scored under; a null position is reported, never a crash.
   const queued = g.state === "queued";
@@ -2976,7 +2987,9 @@ export async function cmdStatus(leaseId, opts, {
   if (queued) for (const line of describeUnitLedger(g.ledger)) stderr(`stack: ${line}`);
   return emitResult(buildReceipt({
     command: "status", outcome: g.state, lease_id: leaseId, state: g.state,
-    host_key: g.host_key, slot: g.slot, connection: g.connection,
+    host_key: g.host_key, slot: g.slot,
+    connection: forwards ? { ...g.connection, ssh_target: g.connection?.ssh_target ?? g.ssh_target } : g.connection,
+    ...(forwards ? { forwards } : {}),
     ...(queued ? queueReceiptFields(g) : { queue_position: g.queue_position }),
     idle_ttl_secs: g.idle_ttl_secs, queued: g.queued,
     // BOT-2099 (Codex #1057 R3): machine callers get the unit ledger of a queued lease too.
@@ -3621,6 +3634,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   let activeWaitAbort = null;
   // BOT-2142: the remote lease's forwards, and whether they died under a running child.
   let tunnel = null;
+  let forwardAttestation = null;
   let tunnelLost = null;
   const placement = { mode: null, hostKey: null, requesterHost: null, transport: "none", forwards: null, bundle: null, placementReason: null, considered: null };
   incidentBox.execution = placement;
@@ -3633,10 +3647,19 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   // BOT-1803: a heartbeat touch found the lease preempted under the running child.
   let preempted = null;
   const closeTunnel = async () => {
-    if (!tunnel) return;
-    const open = tunnel;
-    tunnel = null;
-    try { await open.close(); } catch { /* best effort: the process is gone either way */ }
+    try {
+      if (forwardAttestation) {
+        const owner = forwardAttestation;
+        forwardAttestation = null;
+        await owner.close();
+      }
+    } finally {
+      if (tunnel) {
+        const open = tunnel;
+        tunnel = null;
+        try { await open.close(); } catch { /* best effort: the process is gone either way */ }
+      }
+    }
   };
 
   // BOT-1803: `idle` (only the normal end of a run) asks the server to idle the ACTIVE lease
@@ -4352,13 +4375,17 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       placement.transport = "ssh-forward";
       placement.forwards = tunnel.forwards.map(({ name, remote, local }) => ({ name, remote, local }));
       for (const f of tunnel.forwards.filter((x) => x.remapped)) stderrLine(`stack: forward ${f.name} remapped: local ${f.local} → ${placement.hostKey ?? "remote"} ${f.remote}`);
-      childConnection = tunnel.connection;
+      childConnection = { ...tunnel.connection, ssh_target: sshTarget };
       const forwardTarget = sshTarget;
       tunnel.onExit((exit) => {
         if (childResult) return;
         tunnelLost = { ...exit, target: forwardTarget };
         stopChild("SIGTERM", EXIT.LEASE_FAILED);
       });
+      forwardAttestation = await startForwardAttestation({
+        leaseId, sshTarget, forwards: placement.forwards,
+        isLive: () => Boolean(tunnel && !tunnelLost && !receivedSignal && tunnel.isLive()),
+      });
     }
     connectionFile = await writeConnection(safeConnectionPath(opts.connectionFile, leaseId), childConnection);
     if (receivedSignal) {
@@ -4376,6 +4403,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       ...process.env,
       BOTBUDDY_STACK_LEASE_ID: leaseId,
       BOTBUDDY_STACK_CONNECTION_FILE: connectionFile,
+      // A nested co-located run must not inherit its parent's capability.
+      [FORWARD_ATTESTATION_ENV]: forwardAttestation?.socketPath ?? "",
       // BOT-2142: lets a lane's own checks (e.g. the port-owner preflight) know the
       // listeners are SSH forwards to another host, not this machine's Docker.
       BOTBUDDY_STACK_EXECUTION_MODE: servedRemote ? "remote" : (placement.mode ?? "local"),

package/src/wait-result.mjs

@@ -10,6 +10,7 @@ import { WaitCheckpointError } from "./wait-checkpoint.mjs";
 const MAX_ARTIFACT_BYTES = 256 * 1024;
 const MAX_RECEIPT_BYTES = 64 * 1024;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const COMMAND_STATUSES = new Set(["success", "failure", "cancelled", "timed_out", "owner_lost"]);
 const TERMINAL_OUTCOMES = new Set(["matched", "timeout", "error", "superseded", "lease_lost", "abandoned", "cancelled"]);
 
 // Persisted != delivered. Await the stream callback before exiting, including
@@ -73,16 +74,37 @@ async function receiptFromArtifact(path) {
     const buffer = Buffer.alloc(MAX_ARTIFACT_BYTES + 1);
     const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
     if (bytesRead > MAX_ARTIFACT_BYTES) throw new Error("unbounded artifact");
-    const receipts = [];
-    for (const line of buffer.subarray(0, bytesRead).toString("utf8").split(/\r?\n/)) {
-      if (!line.trimStart().startsWith("{")) continue;
-      let value;
-      try { value = JSON.parse(line); } catch { continue; }
-      if (value?.schema_version === 1 && typeof value.outcome === "string") receipts.push(value);
+    const content = buffer.subarray(0, bytesRead).toString("utf8");
+    let values;
+    try { values = [JSON.parse(content)]; }
+    catch {
+      values = [];
+      for (const line of content.split(/\r?\n/)) {
+        if (!line.trimStart().startsWith("{")) continue;
+        // A partial JSON document alongside a receipt is ambiguous. In
+        // particular, never ignore a pretty command receipt and accept a later
+        // wait line from the same artifact.
+        values.push(JSON.parse(line));
+      }
     }
+    const receipts = values.filter((value) => value?.schema_version === 1 &&
+      (typeof value.outcome === "string" || (typeof value.run_id === "string" && typeof value.status === "string")));
     if (receipts.length !== 1) throw new Error("expected exactly one receipt");
-    return receipts[0];
-  } catch {
+    const [receipt] = receipts;
+    if (!receipt.outcome && UUID.test(receipt.run_id) && COMMAND_STATUSES.has(receipt.status)) {
+      // A diagnostic, never evidence that this caller owns the command or that
+      // its workload passed. Only a validated UUID may enter recovery argv;
+      // never echo command text, logs, paths, or recovery_command from the file.
+      const recovery = `Run bb run inspect ${receipt.run_id} from the owning checkout; preserve the command receipt and read its bounded_log for the workload verdict. Do not rerun unchanged validation.`;
+      const error = new WaitCheckpointError("wait_result_wrong_artifact", `This is a command-run receipt, not a bb wait receipt. ${recovery}`);
+      error.recoveryArgv = ["run", "inspect", receipt.run_id];
+      error.recovery = recovery;
+      throw error;
+    }
+    if (typeof receipt.outcome !== "string") throw new Error("not a wait receipt");
+    return receipt;
+  } catch (error) {
+    if (error instanceof WaitCheckpointError) throw error;
     // Never echo arbitrary artifact contents (which may include credentials).
     throw new WaitCheckpointError("wait_observation_gap", "completion artifact must contain exactly one bounded terminal receipt");
   } finally { await handle?.close(); }

package/src/wait.mjs

@@ -241,7 +241,8 @@ SUBCOMMANDS  (saved waits live in this worktree's .botbuddy/waits/)
   bb wait result [<local_wait_id>] [--from-file <path> --exit-code <n>]
                                read a terminal receipt without re-arming or acknowledging;
                                --from-file validates redirected output AFTER the original
-                               command exits (see EXAMPLES)
+                               wait command exits (see EXAMPLES). Command-run .receipt.json files
+                               belong to bb run inspect <run_id>, not bb wait result.
   bb wait resume <local_wait_id>       recover one explicitly named saved wait
   bb wait cancel <local_wait_id>       explicitly stop one saved wait
   bb wait acknowledge <local_wait_id>  mark one saved terminal receipt read (after acting on it)