@botbuddy/cli 1.63.13 → 1.63.14

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.13",
-  "source_commit": "36f37695e469a42ec5b85ae0d3db8fefa4c4d5bc",
-  "source_sha256": "ed337e0fa12ed74a93c4eeef069f30a6733a48cd6b3e2de85dc6e1e3f6b1c2c6",
+  "release_version": "1.63.14",
+  "source_commit": "8ec06459dcd6e698ce14b725eb4b6691083ec445",
+  "source_sha256": "b72415fa0cd4b8b19a2613c78573c958809c453191717b9e53fabb23afa6f7ea",
   "target": "darwin-arm64",
-  "sha256": "bd4b5271deee0be522d4d4ff112b18a48999d7a7fbeccd1e59c001b3e54ab3cb"
+  "sha256": "eb7aba5ff1ca0c551f02b1e0ce7e3d136e000443577d4494160da94e3a8ecb68"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.13",
-  "source_commit": "36f37695e469a42ec5b85ae0d3db8fefa4c4d5bc",
-  "source_sha256": "ed337e0fa12ed74a93c4eeef069f30a6733a48cd6b3e2de85dc6e1e3f6b1c2c6",
+  "release_version": "1.63.14",
+  "source_commit": "8ec06459dcd6e698ce14b725eb4b6691083ec445",
+  "source_sha256": "b72415fa0cd4b8b19a2613c78573c958809c453191717b9e53fabb23afa6f7ea",
   "target": "linux-x64",
-  "sha256": "83d29dc25d53a99c882f1df99f6738d175beed460b12f01fef8a8d9dca1185b2"
+  "sha256": "fe9452d4139a7db72844293109e0494605853e8cd3f9603043207b6cd892e990"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.13",
-  "source_commit": "36f37695e469a42ec5b85ae0d3db8fefa4c4d5bc",
-  "source_sha256": "ed337e0fa12ed74a93c4eeef069f30a6733a48cd6b3e2de85dc6e1e3f6b1c2c6",
+  "release_version": "1.63.14",
+  "source_commit": "8ec06459dcd6e698ce14b725eb4b6691083ec445",
+  "source_sha256": "b72415fa0cd4b8b19a2613c78573c958809c453191717b9e53fabb23afa6f7ea",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "bd4b5271deee0be522d4d4ff112b18a48999d7a7fbeccd1e59c001b3e54ab3cb",
+      "sha256": "eb7aba5ff1ca0c551f02b1e0ce7e3d136e000443577d4494160da94e3a8ecb68",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "83d29dc25d53a99c882f1df99f6738d175beed460b12f01fef8a8d9dca1185b2",
+      "sha256": "fe9452d4139a7db72844293109e0494605853e8cd3f9603043207b6cd892e990",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.13",
+  "version": "1.63.14",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack-identified-admission.mjs

@@ -0,0 +1,17 @@
+// BOT-2780 consumer of BOT-2499's identified admission ACK (not a second allocator).
+// A durable ACK is recovery identity; pending delivery is never dispatch authority.
+const uuid = value => typeof value === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
+export function identifiedAdmissionAck(value, requestId) {
+ if(value?.success!==true||!['ADMITTED','EXACT_REPLAY'].includes(value.code)||!uuid(requestId)||!uuid(value.request_id)||value.request_id.toLowerCase()!==requestId.toLowerCase()||!uuid(value.lease_id)||!['created','readopted'].includes(value.admission_kind)||!['queued','provisioning','active'].includes(value.state)||!['pending','bound','none'].includes(value.job_binding)||!(value.provision_job_id===null||uuid(value.provision_job_id))||((value.job_binding==='bound')!==uuid(value.provision_job_id))||(value.admission_kind==='created'&&value.job_binding==='none')||(value.admission_kind==='readopted'&&value.job_binding!=='none')||!['ready','pending'].includes(value.delivery_status))return null;
+ return Object.freeze(Object.fromEntries(['code','request_id','lease_id','admission_kind','state','job_binding','provision_job_id','delivery_status'].map(key=>[key,value[key]])));
+}
+export function identifiedAdmissionDelivery(value, ack) {
+ const delivery=value?.delivery;
+ if(!ack||ack.delivery_status!=='ready'||!delivery||typeof delivery!=='object'||Array.isArray(delivery)||delivery.success===false||delivery.lease_id!=null&&delivery.lease_id!==ack.lease_id||delivery.state!=null&&delivery.state!==ack.state)return null;
+ return {...delivery,success:true,lease_id:ack.lease_id,state:ack.state};
+}
+export function identifiedAdmissionRecovery(request, contextFile, ack=null) {
+ return {request_id:request.request_id,context_file:contextFile,
+  read_tool:'get_stack_lease_admission',read_args:{request_id:request.request_id},
+  ...(ack?{committed_ack:ack}:{})};
+}

package/src/stack-isolation.mjs

@@ -786,6 +786,39 @@ export function stableRunStackReusable(worktreeRoot, dirName, { read = readFileS
   return marker.idle_retained === true || marker.released === true;
 }
 
+/**
+ * BOT-2780: a beta requester-origin run never resumes a retained slot context. Its
+ * generated links name the listener of the invocation that started that stack, so
+ * refuse any unreleased marker for this slot before deriving a new bundle or ports.
+ */
+export function assertFreshRunStackAvailable(worktreeRoot, slot, { read = readFileSync, readdir = readdirSync, lstat = lstatSync } = {}) {
+  const refuse = () => {
+    const error = new Error("requester origin cannot resume a retained slot context; inspect its owning lease with `bb stack status <lease-id>` and use `bb stack done <lease-id> --reap` only after that owner finishes, then confirm reaped before a fresh run");
+    error.code = "REQUESTER_ORIGIN_RETAINED_CONTEXT";
+    throw error;
+  };
+  const stacks = join(worktreeRoot, LEASED_STACKS_DIR);
+  let entries;
+  try { entries = readdir(stacks); } catch (error) { if (error.code === "ENOENT") return; refuse(); }
+  if (entries.length > 4096) refuse();
+  for (const entry of entries) {
+    const path = join(stacks, entry, LEASED_STACK_MARKER);
+    let info;
+    try { info = lstat(path); } catch (error) { if (error.code === "ENOENT" || error.code === "ENOTDIR") continue; refuse(); }
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 65536) refuse();
+    let marker;
+    try { marker = JSON.parse(read(path, "utf8")); } catch { refuse(); }
+    if (!marker || typeof marker.slot !== "string") refuse();
+    if (marker.slot !== slot || marker.released === true) continue;
+    // An expired context whose owner is gone is what materialization GC collects anyway; the
+    // control plane still refuses a new remote lease while any lease on the slot is unreaped.
+    const ownerAlive = Number.isInteger(marker.owner_pid) && marker.owner_pid > 0 &&
+      (!marker.host || marker.host === hostname()) && pidIsAlive(marker.owner_pid);
+    const expired = marker.idle_retained !== true && Number.isFinite(marker.retain_until) && Date.now() >= marker.retain_until;
+    if (!expired || ownerAlive) refuse();
+  }
+}
+
 /** BOT-1803: record a PROVEN reap on the stack's marker, so the next run may reuse the directory. */
 export function markLeasedStackReleased(stackDir, { read = readFileSync, write = writeFileSync, rename = renameSync } = {}) {
   const marker = readStackMarker(stackDir, read);
@@ -1246,6 +1279,22 @@ export function bindLeasedStackClaim(stackDir, leaseId, { registryDir = defaultP
   });
 }
 
+/**
+ * BOT-2780: associate this invocation's claims and marker with its identified admission
+ * request BEFORE the request leaves, so a possibly committed but never acknowledged lease
+ * can later release them through matching accepted cleanup (recoverLeasedStackClaim).
+ */
+export function recordAdmissionRequest(stackDir, requestId, { registryDir = defaultPortRegistryDir() } = {}) {
+  const marker = readStackMarker(stackDir, readFileSync);
+  const token = marker?.invocation_token;
+  if (!token || typeof requestId !== "string" || !requestId) throw new Error("local port claim has no invocation identity");
+  return mutateBoundClaims(stackDir, registryDir, (claims) => {
+    if (claims.some(({ claim }) => claim.invocation_token !== token || claim.lease_id != null)) throw new Error("local port claim was replaced or already bound");
+    for (const { path, claim } of claims) atomicWrite(path, JSON.stringify({ ...claim, admission_request_id: requestId }), { write: writeFileSync, rename: renameSync });
+    atomicWrite(join(stackDir, LEASED_STACK_MARKER), JSON.stringify({ ...marker, admission_request_id: requestId }), { write: writeFileSync, rename: renameSync });
+  });
+}
+
 /** Allocation and recovery serialize the inspect/delete against replacement claims. */
 function mutateBoundClaims(stackDir, registryDir, mutate) {
   const config = readFileSync(join(stackDir, "supabase/config.toml"), "utf8");
@@ -1286,8 +1335,12 @@ export function recoverLeasedStackClaim(stackDir, leaseId, proof, { registryDir
       if (!claims.length) return { released: true, reason: "no local claim remains for this stack" };
       const token = claims[0].claim.invocation_token;
       const project = claims[0].claim.project_id;
+      // BOT-2780: an unbound claim recorded for an identified admission request is this lease's
+      // only when the caller proved (owner-scoped admission read) that request named the lease.
+      const requestBound = (entry) => entry?.lease_id == null && typeof proof.admission_request_id === "string" &&
+        proof.admission_request_id.length > 0 && entry?.admission_request_id === proof.admission_request_id;
       if (typeof token !== "string" || !token || typeof project !== "string" || !/^[A-Za-z0-9_-]+$/.test(project) || claims.some(({ claim }) =>
-        claim.lease_id !== leaseId || claim.invocation_token !== token || claim.project_id !== project || claim.host !== hostname() ||
+        (claim.lease_id !== leaseId && !requestBound(claim)) || claim.invocation_token !== token || claim.project_id !== project || claim.host !== hostname() ||
         !Number.isInteger(claim.owner_pid) || claim.owner_pid <= 0 || pidIsAlive(claim.owner_pid))) {
         return { released: false, reason: "local claim is live, replaced, or lacks this lease binding" };
       }
@@ -1302,7 +1355,7 @@ export function recoverLeasedStackClaim(stackDir, leaseId, proof, { registryDir
         if (error?.code !== "ENOENT") return { released: false, reason: "stack marker is unreadable or corrupt; local claim retained" };
         marker = null;
       }
-      if (marker && (marker.invocation_token !== token || marker.lease_id !== leaseId || marker.project_id !== project)) {
+      if (marker && (marker.invocation_token !== token || (marker.lease_id !== leaseId && !requestBound(marker)) || marker.project_id !== project)) {
         return { released: false, reason: "stack marker was replaced" };
       }
       for (const { path } of claims) rmSync(path);
@@ -1687,7 +1740,8 @@ export function materializeRunStackDir(cwd, { slot, ticket, nonce, idleTtlSecs }
   const configPath = join(sourceDir, "config.toml");
   let rootConfig;
   try {
-    rootConfig = read(configPath, "utf8");
+    // BOT-2780: a beta requester-origin run supplies the already patched private copy.
+    rootConfig = io.configText ?? read(configPath, "utf8");
   } catch (error) {
     throw new Error(
       `cannot materialize an isolated leased stack: ${configPath} is missing or unreadable (${error?.code ?? error?.message ?? error}). ` +

package/src/stack-requester-origin-config.mjs

@@ -0,0 +1,21 @@
+// BOT-2780: parse and roundtrip the private derived config before bundling.
+// The vendored, hash-pinned smol-toml 1.9.1 parser (src/vendor/smol-toml) is loaded only
+// for the beta requester-origin feature; help and legacy paths never import it.
+import {isDeepStrictEqual} from 'node:util';
+const fail=(code,message)=>{const error=Error(message);error.code=code;throw error};
+let parser;
+export async function patchRequesterAuthOrigin(configText,origin){
+ let url;try{url=new URL(origin)}catch{fail('REQUESTER_ORIGIN_URL_REFUSED','requester origin refused')}
+ if(url.protocol!=='http:'||url.hostname!=='127.0.0.1'||url.username||url.password||url.pathname!=='/'||url.search||url.hash||origin!==url.origin||!Number.isInteger(Number(url.port))||Number(url.port)<1024||Number(url.port)>65535)fail('REQUESTER_ORIGIN_URL_REFUSED','requester origin must be its reserved loopback HTTP listener');
+ if(typeof configText!=='string'||Buffer.byteLength(configText)>1024*1024)fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config is unavailable or exceeds its bound');
+ try{parser??=import('./vendor/smol-toml/index.js');const {parse,stringify}=await parser;let document;try{document=parse(configText,{integersAsBigInt:true,unsafeKeyBehaviour:'throw'})}catch{fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config is not supported valid TOML')}
+  if(!Object.hasOwn(document,'auth'))Object.defineProperty(document,'auth',{value:{},writable:true,enumerable:true,configurable:true});
+  const auth=document.auth;if(!auth||typeof auth!=='object'||Array.isArray(auth))fail('REQUESTER_ORIGIN_AUTH_REFUSED','private auth configuration is ambiguous');
+  const target=origin+'/auth/v1';
+  if(Object.hasOwn(auth,'external_url')&&(typeof auth.external_url!=='string'||auth.external_url!==''&&auth.external_url!==target))fail('REQUESTER_ORIGIN_EXPLICIT_CONFLICT','explicit auth external URL conflicts with the owned requester origin');
+  Object.defineProperty(auth,'external_url',{value:target,writable:true,enumerable:true,configurable:true});
+  let text,roundtrip;try{text=stringify(document,{numbersAsFloat:true,strictTemporal:true});roundtrip=parse(text,{integersAsBigInt:true,unsafeKeyBehaviour:'throw'})}catch{fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config could not roundtrip safely')}
+  if(!isDeepStrictEqual(roundtrip,document))fail('REQUESTER_ORIGIN_TOML_REFUSED','private stack config changed during TOML roundtrip');
+  return text;
+ }catch(error){if(error.code?.startsWith('REQUESTER_ORIGIN_'))throw error;fail('REQUESTER_ORIGIN_PARSER_UNAVAILABLE','vendored requester-origin TOML parser unavailable')}
+}

package/src/stack-requester-origin.mjs

@@ -0,0 +1,62 @@
+// BOT-2780: one requester listener, reserved before a service generates URLs.
+// The CLI later binds it to exactly one API port on its owned SSH tunnel. This
+// listener is not itself an SSH forward and never supplies forward attestation.
+import {createServer,connect} from 'node:net';
+
+const fail=(code,message)=>{const error=Error(message);error.code=code;throw error};
+const validPort=value=>Number.isInteger(value)&&value>=1024&&value<=65535;
+const identity=value=>typeof value==='string'&&value.length>0&&value.length<=4096&&!/[\x00-\x1f\x7f]/.test(value);
+function contextSnapshot(value){
+ if(!value||typeof value!=='object'||Array.isArray(value)||!Object.isFrozen(value))fail('REQUESTER_ORIGIN_CONTEXT_REFUSED','immutable requester context required');
+ const keys=Object.keys(value).sort();if(!keys.length||keys.length>16||keys.some(key=>!identity(key)||!identity(value[key])))fail('REQUESTER_ORIGIN_CONTEXT_REFUSED','requester context refused');
+ return JSON.stringify(keys.map(key=>[key,value[key]]));
+}
+function apiPort(value){
+ let url;try{url=new URL(value)}catch{fail('REQUESTER_ORIGIN_FORWARD_REFUSED','owned API URL unavailable')}
+ if(url.protocol!=='http:'||url.hostname!=='127.0.0.1'||url.username||url.password||url.pathname!=='/'||url.search||url.hash||!validPort(Number(url.port)))fail('REQUESTER_ORIGIN_FORWARD_REFUSED','API target must be the owned loopback HTTP endpoint');
+ return Number(url.port);
+}
+export async function reserveRequesterOrigin({context,port=0}={}){
+ const snapshot=contextSnapshot(context);if(port!==0&&!validPort(port))fail('REQUESTER_ORIGIN_PORT_REFUSED','requester origin port refused');
+ const sockets=new Set(),lossListeners=new Set();let route,closed=false,lostCode,closePromise;
+ const live=()=>{try{return !closed&&route?.isLive()===true}catch{return false}};
+ const close=code=>{
+  if(closePromise)return closePromise;closed=true;lostCode=code??lostCode;
+  for(const socket of sockets)socket.destroy();sockets.clear();
+  closePromise=new Promise(resolve=>server.close(()=>resolve()));
+  if(code)for(const listener of lossListeners){try{listener({code})}catch{}}
+  return closePromise;
+ };
+ const server=createServer({pauseOnConnect:true},socket=>{
+  if(!route){socket.destroy();return}
+  if(!live()){socket.destroy();void close('REQUESTER_ORIGIN_TUNNEL_LOST');return}
+  sockets.add(socket);const upstream=connect({host:'127.0.0.1',port:route.targetPort});sockets.add(upstream);
+  socket.once('error',()=>upstream.destroy());socket.once('close',()=>{sockets.delete(socket);upstream.destroy()});upstream.once('close',()=>sockets.delete(upstream));
+  upstream.once('error',()=>{socket.destroy();void close('REQUESTER_ORIGIN_FORWARD_LOST')});
+  upstream.once('connect',()=>{
+   if(!live()){socket.destroy();upstream.destroy();void close('REQUESTER_ORIGIN_TUNNEL_LOST');return}
+   // Pipe only after rechecking custody at connect time. Request paths, auth,
+   // bodies and WebSocket upgrade bytes are transparent; there is no URL target.
+   socket.pipe(upstream);upstream.pipe(socket);socket.resume();
+  });
+ });
+ server.maxConnections=64;
+ try{await new Promise((resolve,reject)=>{server.once('error',reject);server.listen({host:'127.0.0.1',port,exclusive:true},resolve)})}catch(error){await close();fail(error.code==='EADDRINUSE'?'REQUESTER_ORIGIN_PORT_BUSY':'REQUESTER_ORIGIN_BIND_FAILED','requester origin could not be reserved')}
+ const boundPort=server.address().port;server.on('error',()=>{void close('REQUESTER_ORIGIN_BIND_FAILED')});
+ return{
+  origin:'http://127.0.0.1:'+boundPort,
+  activate({context:current,leaseId,projectId,sshTarget,remoteConnection,forwardedConnection,forwards,isLive,watchLoss}={}){
+   if(closed||route)fail('REQUESTER_ORIGIN_STATE_REFUSED','requester origin cannot be rebound in place');
+   if(contextSnapshot(current)!==snapshot||![leaseId,projectId,sshTarget].every(identity)||typeof isLive!=='function'||typeof watchLoss!=='function')fail('REQUESTER_ORIGIN_CONTEXT_REFUSED','owned current lease/forward context required');
+   const remote=apiPort(remoteConnection?.api_url),local=apiPort(forwardedConnection?.api_url);
+   if(!Array.isArray(forwards)||forwards.length<1||forwards.length>32||forwards.some(row=>!identity(row?.name)||!validPort(row.remote)||!validPort(row.local))||['name','remote','local'].some(key=>new Set(forwards.map(row=>row[key])).size!==forwards.length))fail('REQUESTER_ORIGIN_FORWARD_REFUSED','SSH forward table refused');
+   const api=forwards.find(row=>row.remote===remote);if(!api||api.local!==local||local===boundPort)fail('REQUESTER_ORIGIN_FORWARD_REFUSED','API URL differs from actual SSH forward');
+   if(isLive()!==true)fail('REQUESTER_ORIGIN_TUNNEL_LOST','owned SSH tunnel is not live');
+   route=Object.freeze({leaseId,projectId,sshTarget,targetPort:local,isLive});
+   try{watchLoss(()=>{void close('REQUESTER_ORIGIN_TUNNEL_LOST')})}catch{void close('REQUESTER_ORIGIN_TUNNEL_LOST');fail('REQUESTER_ORIGIN_TUNNEL_LOST','owned SSH loss subscription unavailable')}
+   if(!live()){void close('REQUESTER_ORIGIN_TUNNEL_LOST');fail('REQUESTER_ORIGIN_TUNNEL_LOST','owned SSH tunnel ended during activation')}
+  },
+  close:()=>close(),isLive:live,
+  onLost(listener){lossListeners.add(listener);if(lostCode)listener({code:lostCode})},
+ };
+}