@botbuddy/cli 1.63.13 → 1.63.14

package/src/stack.mjs

@@ -33,7 +33,7 @@ import { existsSync, lstatSync, readFileSync, realpathSync } from "fs";
 import { open, unlink, readFile } from "fs/promises";
 import { homedir, tmpdir } from "os";
 import { basename, dirname, join, relative, isAbsolute } from "path";
-import { randomUUID } from "crypto";
+import { randomUUID, createHash } from "crypto";
 import { fileURLToPath } from "url";
 import { callToolJson, CALL_AUTH_ERROR_CODES } from "./api.mjs";
 import { deepLinkNotice, safeWebUrl } from "./deep-link.mjs";
@@ -43,7 +43,10 @@ import { AGENT_KEY_RE, readAgentSessionTokenEnv } from "./agent-key.mjs";
 import { resolveAgentSessionCredential, selfHealAgentSession } from "./agent-session.mjs";
 import { runDockerCommand, runDockerWorkflow, ADMITTED_DOCKER_VALIDATIONS } from "./docker-hygiene.mjs";
 import { acquireStackLock, lockPathForProject, projectIdFromConfig } from "./stack-file-lock.mjs";
-import { LEASED_STACK_IDLE_RETENTION_SECS, bindLeasedStackClaim, recoverLeasedStackClaim, hasLocalLeaseClaim, leasedClaimContext, assertLeasedStackIsolated, leasedStackClaimHeld, markLeasedStackReleased, stableRunStackReusable, leasedStackIdentity, materializeRunStackDir, portMapInConfig, refreshLeasedStackRetention, releaseLeasedStackClaim, reservePortBlocks } from "./stack-isolation.mjs";
+import { LEASED_STACK_IDLE_RETENTION_SECS, assertFreshRunStackAvailable, recordAdmissionRequest, bindLeasedStackClaim, recoverLeasedStackClaim, hasLocalLeaseClaim, leasedClaimContext, assertLeasedStackIsolated, leasedStackClaimHeld, markLeasedStackReleased, stableRunStackReusable, leasedStackIdentity, materializeRunStackDir, portMapInConfig, refreshLeasedStackRetention, releaseLeasedStackClaim, reservePortBlocks } from "./stack-isolation.mjs";
+import { reserveRequesterOrigin } from "./stack-requester-origin.mjs";
+import { identifiedAdmissionAck, identifiedAdmissionDelivery, identifiedAdmissionRecovery } from "./stack-identified-admission.mjs";
+import { patchRequesterAuthOrigin } from "./stack-requester-origin-config.mjs";
 import { measureStackUsage } from "./stack-usage.mjs";
 import { checkReadoptedStackMounts } from "./stack-mount-health.mjs";
 import { machineUuid } from "./machine-id.mjs";
@@ -57,6 +60,20 @@ import { reportStackRunOutcome } from "./stack-run-outcome.mjs";
 
 export const STACK_SCHEMA_VERSION = 1;
 
+/**
+ * BOT-2780: only `stack run --remote --execution-ring beta --reap` reserves a requester
+ * origin and allocates through BOT-2499's identified admission. The origin cannot outlive
+ * its CLI, so the invocation must own cleanup; stable/auto/local and idle runs are unchanged.
+ */
+export const requesterOriginEnabled = (opts) => opts.execution === "remote" && opts.executionRing === "beta" && opts.reap === true;
+// Exact replays of one identified request after an uncertain answer (lost response, 5xx,
+// ADMISSION_UNCERTAIN, pending delivery). The same request_id can never create a second lease.
+const ADMISSION_REPLAY_DELAYS_MS = [1000, 2000, 4000];
+const ADMISSION_REPLAYABLE = new Set(["ADMISSION_UNCERTAIN", "RETRY_SAME_REQUEST", "HOST_ELIGIBILITY_BUSY"]);
+// The key already has a ledger row (or had one): never replay it blindly or treat it as unallocated.
+const ADMISSION_COMMITTED_UNCERTAIN = new Set(["REQUEST_IDENTITY_MISMATCH", "REQUEST_CLOSED", "ORIGINAL_LEASE_UNAVAILABLE"]);
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 /**
  * Codex #1077 P1 / BOT-2184: an sshd with `GatewayPorts yes` binds a `-R` forward on every
  * interface. A remote lease with --callback-port therefore runs the pre-forward GatewayPorts
@@ -119,6 +136,8 @@ export const STACK_HELP = `${bold("botbuddy stack")} — one command for a batch
 
 ${bold("USAGE")}
   botbuddy stack up [options]        Request a lease; park if the host is full; hold it active
+  botbuddy stack status --admission-request-id <uuid>
+                                    Read an identified admission after a lost response (BOT-2780)
   botbuddy stack status <lease_id>   Show a lease's state + connection; within a live remote run,
                                    include the owner's attested local/remote forwards
   botbuddy stack touch  <lease_id>   Bump the idle clock (and report measured use) so the reaper doesn't stop it
@@ -233,6 +252,12 @@ ${bold("run OPTIONS")}
                          else a remote host with capacity; the bundle digest is sent up front.
   --execution-ring R     Capacity rollout ring: stable (default) excludes beta daemon hosts.
                          beta is explicit opt-in and requires \`stack run --remote\`.
+                         With --remote --execution-ring beta --reap (BOT-2780), run reserves a
+                         loopback requester origin first and writes it as the private stack copy's
+                         [auth] external_url, so generated auth links (/auth/v1/verify…) reach the
+                         stack unchanged even when the SSH API forward is remapped; the child gets
+                         it as connection.requester_origin. The lease is requested through the
+                         identified admission (exact replay after a lost response, no fallback).
   --callback-port N      The caller runs a listener the stack calls back through
                          host.docker.internal:N (e.g. 4600): sent as callback_port. On a REMOTE
                          lease run first probes the host with a throwaway reverse forward and opens
@@ -421,6 +446,7 @@ export function parseStackArgs(argv) {
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     switch (a) {
+      case "--admission-request-id": if (need(a, rest[i + 1])) opts.admissionRequestId = String(rest[++i]).toLowerCase(); break;
       case "--slot": if (need(a, rest[i + 1])) opts.slot = rest[++i]; break;
       case "--host": if (need(a, rest[i + 1])) opts.host = rest[++i]; break;
       case "--repo": if (need(a, rest[i + 1])) opts.repo = rest[++i]; break;
@@ -588,7 +614,11 @@ export function parseStackArgs(argv) {
     errors.push("--stack-path must be a non-empty relative path without '..'");
   }
   const leaseId = positionals[0] ?? null;
-  if (command && ["status", "touch", "done"].includes(command) && !leaseId) {
+  if (opts.admissionRequestId != null && (!UUID_RE.test(opts.admissionRequestId) ||
+      !((command === "status" && !leaseId) || (command === "done" && leaseId && opts.reap && opts.releasePortClaim)))) {
+    errors.push("--admission-request-id takes a request UUID with `status` (no <lease_id>) or `done <lease_id> --reap --release-port-claim`");
+  }
+  if (command && ["status", "touch", "done"].includes(command) && !leaseId && !(command === "status" && opts.admissionRequestId)) {
     errors.push(`${command} needs a <lease_id>`);
   }
   if (["up", "done"].includes(command) && opts.localExec && Boolean(opts.dockerContext) === Boolean(opts.dockerEndpoint)) {
@@ -865,6 +895,16 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
     }
     return execution;
   };
+  // BOT-2780: the requester origin is only for a fresh CLI-managed stack context. A
+  // prepared path, pinned host or fixed nonce could resume a stack whose generated links
+  // already name another invocation's listener.
+  const originRun = requesterOriginEnabled(opts);
+  if (originRun && (opts.host != null || opts.stackNonce != null || (opts.stackPath && opts.stackPath !== ".") ||
+      !UUID_RE.test(opts.admissionRequestId ?? "") || !opts.requesterMachineId)) {
+    const error = new Error("beta requester origins require a fresh CLI-managed stack context (no --host, --stack-path or fixed nonce)");
+    error.code = "REQUESTER_ORIGIN_CONTEXT_REFUSED";
+    throw error;
+  }
   // An explicitly prepared directory is the caller's to manage, but it is NOT
   // exempt from the isolation contract (BOT-1798, Codex #928 R8 P1): a copied root
   // config — same project_id, or merely the same ports — would make the Helper
@@ -930,15 +970,30 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
   const nonce = opts.stackNonce ?? (stableReusable(worktreeRoot, stableDir) ? null : randomUUID());
   const { projectId } = identity({ worktreeRoot, slot: opts.slot, ticket: opts.ticket, nonce });
   const held = await claimProjectLock(projectId, lock, `this batch's isolated stack (${projectId})`);
+  let requesterOrigin = null;
+  let originContext = null;
   try {
+    let configText;
+    if (originRun) {
+      // BOT-2780: refuse a retained slot context, then reserve the listener BEFORE the
+      // private config (and so the bundle digest) is derived. The source config is never
+      // changed; only the private materialized copy names the reserved origin.
+      assertFreshRunStackAvailable(worktreeRoot, opts.slot);
+      originContext = Object.freeze({ request_id: opts.admissionRequestId, worktree: worktreeRoot, slot: opts.slot, machine: opts.requesterMachineId });
+      requesterOrigin = await reserveRequesterOrigin({ context: originContext });
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- canonical realpath of the current worktree; fixed own source config, never a request-supplied path.
+      configText = await patchRequesterAuthOrigin(readFileSync(join(worktreeRoot, "supabase", "config.toml"), "utf8"), requesterOrigin.origin);
+    }
     const execution = refuseRoot(resolveStackPath(cwd, materialize(
       cwd,
       { slot: opts.slot, repo: opts.repo, ticket: opts.ticket, nonce, idleTtlSecs: opts.idleTtl ?? undefined },
       // BOT-2403: a functions directory another writer replaced under this stack is reported.
-      { ...(portRegistryDir ? { portRegistryDir } : {}), warn },
+      { ...(portRegistryDir ? { portRegistryDir } : {}), warn, ...(configText !== undefined ? { configText } : {}) },
     )));
     return {
       ...execution,
+      ...(requesterOrigin ? { requesterOrigin, originContext, admissionRequestId: opts.admissionRequestId,
+        recordAdmission: (requestId) => recordAdmissionRequest(stackDirFor(execution), requestId, portRegistryDir ? { registryDir: portRegistryDir } : undefined) } : {}),
       bindLease: (leaseId) => bindLeasedStackClaim(stackDirFor(execution), leaseId, portRegistryDir ? { registryDir: portRegistryDir } : undefined),
       // Release is called once the batch's signed reap is done, so hand the host
       // its port block back immediately rather than holding it for the retention
@@ -951,6 +1006,7 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
       // BOT-2237 (Codex #1168 P2): returns the VERIFIED disposition — whether this stack's
       // claim is gone afterwards — so a failed unlink is never reported as released.
       release: ({ reaped = false } = {}) => {
+        void requesterOrigin?.close();
         const registry = portRegistryDir ? { registryDir: portRegistryDir } : undefined;
         let released = false;
         if (reaped) {
@@ -964,6 +1020,7 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
       },
     };
   } catch (error) {
+    await requesterOrigin?.close();
     held.release();
     throw error;
   }
@@ -2999,6 +3056,21 @@ export async function cmdStatus(leaseId, opts, {
 } = {}) {
   const auth = await rpc.init();
   if (!auth) return emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: "not authenticated — run `botbuddy login`" }), opts, EXIT.AUTH);
+  if (opts.admissionRequestId) {
+    // BOT-2780: the owner-scoped identified-admission read. It never returns a connection or
+    // capability, and an unknown key is not proof that nothing was admitted.
+    const read = await rpc.call("get_stack_lease_admission", { request_id: opts.admissionRequestId });
+    const base = { command: "status", request_id: opts.admissionRequestId };
+    if (!read.ok) return emitResult(buildReceipt({ ...base, outcome: "error", error: read.error }), opts, read.auth ? EXIT.AUTH : EXIT.BACKEND);
+    const a = read.data ?? {};
+    if (a.success !== true) return emitResult(buildReceipt({ ...base, outcome: "error", code: a.code ?? null, error: a.code ?? "admission unreadable" }), opts, EXIT.BACKEND);
+    return emitResult(buildReceipt({
+      ...base, outcome: a.lease_status ?? "unknown", lease_id: a.lease_id ?? null, admission_kind: a.admission_kind ?? null,
+      job_binding: a.job_binding ?? null, provision_job_id: a.provision_job_id ?? null, lease_status: a.lease_status ?? null,
+      closed: a.closed === true, superseded: a.superseded === true, close_reason: a.close_reason ?? null,
+      cleanup_status: a.cleanup_status ?? null, cleanup_evidence: a.cleanup_evidence ?? null,
+    }), opts, 0);
+  }
   const got = await rpc.call("get_stack_lease", { lease_id: leaseId });
   if (!got.ok) return got.auth
     ? emitResult(buildReceipt({ command: "status", outcome: "error", lease_id: leaseId, error: got.error }), opts, EXIT.AUTH)
@@ -3345,9 +3417,19 @@ export async function cmdDone(leaseId, opts, {
           // provable (cleanup_verified strictly false), ends at once; a raw frame keeps waiting.
           (s, p) => (s === "reap_failed" && p?.cleanup_verified === true) || (s === "reaped" && p?.cleanup_verified === false),
           { timeoutSec: opts.reapTimeout ?? 300, auth: rpc.auth });
-        if (verified.woke && verified.cleanupEvidence) {
+        // BOT-2780: a claim bound only to an identified admission request is released only when
+        // the owner-scoped admission read proves that request named this exact lease.
+        let requestBinding = null;
+        if (opts.admissionRequestId) {
+          const admission = await call("get_stack_lease_admission", { request_id: opts.admissionRequestId });
+          requestBinding = admission?.ok && admission.data?.success === true && admission.data.superseded !== true && admission.data.lease_id === leaseId
+            ? { admission_request_id: opts.admissionRequestId } : false;
+        }
+        if (requestBinding === false) {
+          portBlock = { released: false, reason: `admission ${opts.admissionRequestId} does not name lease ${leaseId}; local claim retained` };
+        } else if (verified.woke && verified.cleanupEvidence) {
           state = "reaped";
-          portBlock = await recoverClaim({ ...current.data, lease_id: leaseId }, verified.cleanupEvidence);
+          portBlock = await recoverClaim({ ...current.data, lease_id: leaseId }, { ...verified.cleanupEvidence, ...(requestBinding ?? {}) });
         } else portBlock = { released: false, reason: "accepted cleanup proof is unavailable; local claim retained" };
       }
     } catch (error) {
@@ -3583,6 +3665,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   incidentBox.outcomeChannel = { get auth() { return rpc.auth; }, callTool: adapters.callTool ?? callToolJson };
   const api = adapters.api ?? {
     request: (args) => rpc.call("request_stack_lease", args),
+    // BOT-2780 (beta requester origin): BOT-2499's identified admission, never a fallback.
+    requestIdentified: (args) => rpc.call("request_stack_lease_identified", args),
+    getAdmission: (args) => rpc.call("get_stack_lease_admission", args),
     get: (leaseId) => rpc.call("get_stack_lease", { lease_id: leaseId }),
     // BOT-1803: a heartbeat carries the measured client use when there is one.
     touch: (leaseId, usage) => rpc.call("touch_stack_lease", { lease_id: leaseId, ...(usage ? { usage } : {}) }),
@@ -3675,6 +3760,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   let tunnel = null;
   let forwardAttestation = null;
   let tunnelLost = null;
+  // BOT-2780: the requester origin closed under a live run (SSH loss or forward failure).
+  let originLost = null;
   const placement = { mode: null, hostKey: null, requesterHost: null, transport: "none", forwards: null, bundle: null, placementReason: null, considered: null };
   incidentBox.execution = placement;
   // BOT-1803: idle-lease bookkeeping for the receipt.
@@ -3685,7 +3772,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   let retainBlock = false;
   // BOT-1803: a heartbeat touch found the lease preempted under the running child.
   let preempted = null;
+  // BOT-2780: the requester listener never outlives the run, its tunnel or a reap request.
+  const closeOrigin = async () => { try { await execution?.requesterOrigin?.close(); } catch { /* closed either way */ } };
   const closeTunnel = async () => {
+    await closeOrigin();
     try {
       if (forwardAttestation) {
         const owner = forwardAttestation;
@@ -3711,6 +3801,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     if (!leaseId) return Promise.resolve({ ok: true, state: null });
     if (cleanupPromise) return cleanupPromise;
     cleanupPromise = (async () => {
+    await closeOrigin();
     if (!leaseId) return cleanupResult = { ok: true, state: null };
     const cleanupAbort = new AbortController();
     const cleanupTimer = clock.setTimeout(() => cleanupAbort.abort("reap-timeout"), opts.reapTimeout * 1000);
@@ -3799,6 +3890,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   };
 
   const stopChild = (signal = "SIGTERM", forcedCode = null) => {
+    void closeOrigin();
     if (!child || childResult) return;
     forcedStopCode ??= forcedCode;
     childGroupSignal(child, signal);
@@ -3834,14 +3926,21 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     const slot = deriveSlot(opts);
     // BOT-1798: never "." — materialize/validate an ISOLATED stack dir first.
     try {
-      execution = await resolveExecution({ ...opts, slot });
+      execution = await resolveExecution({ ...opts, slot,
+        // BOT-2780: one identified admission key per invocation, held through replays.
+        ...(requesterOriginEnabled(opts) ? { admissionRequestId: randomUUID(), requesterMachineId: hardwareUuid } : {}),
+      });
+      if (requesterOriginEnabled(opts) && (!execution.requesterOrigin || !execution.admissionRequestId || !execution.originContext)) {
+        await closeOrigin();
+        const error = new Error("requester origin context unavailable"); error.code = "REQUESTER_ORIGIN_CONTEXT_REFUSED"; throw error;
+      }
     } catch (error) {
       // A slot whose stack another live batch owns is a coordination refusal (the
       // same class as the server's duplicate-lease rejection), not bad arguments.
       const exitCode = error?.code === "stack_slot_busy" ? EXIT.BACKEND : EXIT.INVALID;
       // BOT-2490: retain listener/cooldown refusals in the existing public code field;
       // keep the exit mapping and unrelated local-error semantics unchanged.
-      const code = ["stack_port_census_failed", "stack_port_cooldown_failed"].includes(error?.code) ? error.code : null;
+      const code = ["stack_port_census_failed", "stack_port_cooldown_failed"].includes(error?.code) || String(error?.code ?? "").startsWith("REQUESTER_ORIGIN_") ? error.code : null;
       return { exitCode, outcome: "error", ...(code ? { code } : {}), error: String(error?.message ?? error) };
     }
     // BOT-1798 (Codex #928 R13 P2): the queue and provisioning waits can outlast the
@@ -3936,6 +4035,83 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       ...(bundle?.included?.length ? { bundle_included: bundle.included } : {}),
       ...(opts.callbackPort != null ? { callback_port: opts.callbackPort } : {}),
     };
+    // BOT-2780: the identified admission key and a digest of the immutable origin context.
+    // The intent (including the bundle digest that names the reserved origin) is fingerprinted
+    // server-side; replays of this exact request can never create a second lease.
+    let identifiedVerdict = null;
+    let requestIdentified = null;
+    if (execution.admissionRequestId) {
+      if (!stackDigest || !bundle?.sha256) {
+        return { exitCode: EXIT.INTERNAL, outcome: "error", code: "REQUESTER_ORIGIN_DIGEST_UNAVAILABLE", error: "the requester-origin bundle digest could not be computed; no lease was requested" };
+      }
+      leaseArgs.request_id = execution.admissionRequestId;
+      // Durable request-to-context association before any request can commit (recovery key).
+      try { execution.recordAdmission?.(leaseArgs.request_id); } catch (error) {
+        return { exitCode: EXIT.INTERNAL, outcome: "error", code: "REQUESTER_ORIGIN_CONTEXT_REFUSED", error: `could not record the admission request on this stack's claim (${error?.message ?? error}); no lease was requested` };
+      }
+      leaseArgs.origin_identity_sha256 = createHash("sha256")
+        .update(JSON.stringify({ context: execution.originContext, origin: execution.requesterOrigin.origin })).digest("hex");
+      const replayDelays = adapters.admissionReplayDelaysMs ?? ADMISSION_REPLAY_DELAYS_MS;
+      let replays = 0;
+      let mayHaveCommitted = false;
+      let ownedAck = null;
+      const settle = (code) => {
+        identifiedVerdict = ownedAck ? { kind: "owned", code, ack: ownedAck } : { kind: "uncertain", code, ack: null };
+      };
+      // Returns a legacy-shaped answer: the decorated delivery for a ready ACK, a definite
+      // refusal, or (with identifiedVerdict set) the original answer for the caller to retain.
+      requestIdentified = async () => {
+        for (;;) {
+          let res;
+          try { res = await api.requestIdentified(leaseArgs); } catch (error) { res = { ok: false, status: null, error: String(error?.message ?? error) }; }
+          let replayCode = null;
+          if (!res?.ok) {
+            // A rejected credential, or a readable JSON-RPC protocol error over HTTP 200, was refused
+            // before the tool handler ran: a definite refusal on a first answer. An unreadable body
+            // (`invalid_json`) may follow a commit, so it is replayed like a lost response.
+            if (!mayHaveCommitted && (res?.auth || (res?.status === 200 && res.error !== "invalid_json"))) return res;
+            replayCode = "ADMISSION_UNCERTAIN";
+          } else if (!mayHaveCommitted && typeof res.data?.raw === "string" && /^Unknown tool: request_stack_lease_identified\b/.test(res.data.raw)) {
+            // An older backend without BOT-2499's tool: nothing was admitted, and no fallback.
+            identifiedVerdict = { kind: "unsupported" };
+            return res;
+          } else if (res.data?.success !== true) {
+            const code = typeof res.data?.code === "string" ? res.data.code : "ADMISSION_UNCERTAIN";
+            if (ADMISSION_COMMITTED_UNCERTAIN.has(code)) { settle(code); return res; }
+            if (ADMISSION_REPLAYABLE.has(code)) replayCode = code;
+            // After an answer that may have committed, a later refusal is not proof of absence.
+            else if (mayHaveCommitted) { settle("ADMISSION_UNCERTAIN"); return res; }
+            // A definite, effect-free refusal never carries cleanup authority.
+            else return { ...res, data: { success: false, code, ...(res.data?.message ? { message: res.data.message } : {}),
+              ...(res.data?.phase ? { phase: res.data.phase } : {}), ...(res.data?.wait ? { wait: res.data.wait } : {}) } };
+          } else {
+            const ack = identifiedAdmissionAck(res.data, leaseArgs.request_id);
+            // A malformed or foreign ACK is untrusted: never cleanup authority, never adopted.
+            if (!ack || ack.admission_kind !== "created" || (ownedAck && ack.lease_id !== ownedAck.lease_id)) {
+              mayHaveCommitted = true;
+              if (ack && ownedAck && ack.lease_id !== ownedAck.lease_id) ownedAck = null; // two leases for one key: trust neither
+              settle(!ack || ack.admission_kind === "created" ? "ADMISSION_UNCERTAIN" : "ADMISSION_READOPTION_UNSUPPORTED");
+              return res;
+            }
+            const delivery = identifiedAdmissionDelivery(res.data, ack);
+            if (delivery) return { ...res, data: delivery };
+            if (ack.delivery_status === "ready") { mayHaveCommitted = true; settle("ADMISSION_UNCERTAIN"); return res; }
+            ownedAck = ack;
+            replayCode = "ADMISSION_DELIVERY_PENDING";
+          }
+          mayHaveCommitted = mayHaveCommitted || replayCode !== "HOST_ELIGIBILITY_BUSY";
+          if (replays >= replayDelays.length || receivedSignal) {
+            // Only effect-free busy answers so far: still a definite refusal, nothing to retain.
+            if (!mayHaveCommitted) return { ...res, data: { success: false, code: replayCode } };
+            settle(replayCode);
+            return res;
+          }
+          const delay = replayDelays[replays++];
+          stderrLine(`stack: identified admission ${leaseArgs.request_id} is ${replayCode} — replaying the same request in ${delay}ms`);
+          if (delay > 0) await new Promise((resolve) => { clock.setTimeout(resolve, delay); });
+        }
+      };
+    }
     // The retrying caller (api → rpc.call) transparently renews+retries the
     // FIRST auth rejection among any of request/get/touch/release.
     // BOT-2024: a stale-capacity refusal prints phase-aware guidance; with the opt-in
@@ -3948,11 +4124,51 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     let idleRetried = false;
     for (let attempt = 0; ; attempt++) {
       activeWaitAbort = new AbortController();
-      const admission = await requestWithCapacityWait(() => api.request(leaseArgs), opts, {
+      const admission = await requestWithCapacityWait(() => requestIdentified ? requestIdentified() : api.request(leaseArgs), opts, {
         waitCapacity: adapters.waitCapacity ?? defaultWaitCapacity, log: stderrLine, signal: activeWaitAbort.signal,
       });
       activeWaitAbort = null;
       request = admission.req;
+      if (identifiedVerdict) {
+        const verdict = identifiedVerdict;
+        if (verdict.kind === "unsupported") {
+          return { exitCode: EXIT.BACKEND, outcome: "error", code: "IDENTIFIED_ADMISSION_UNSUPPORTED",
+            error: "this backend has no identified stack-lease admission (request_stack_lease_identified); a beta requester-origin run never falls back to the legacy allocator" };
+        }
+        if (verdict.kind === "owned") {
+          // The exact ACK proves this lease is ours, but it never became deliverable: reap it.
+          leaseId = verdict.ack.lease_id;
+          leaseProvisioned = true;
+          execution.bindLease?.(leaseId);
+          const cleanup = await requestCleanup();
+          return { exitCode: receivedSignal ? SIGNAL_EXIT[receivedSignal] : cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED,
+            outcome: receivedSignal ? "interrupted" : "error", code: verdict.code, leaseId, cleanup,
+            error: `identified admission ${leaseArgs.request_id} committed lease ${leaseId} but its delivery never became ready; it was released` };
+        }
+        // Possibly committed with no trustworthy ACK. One owner-scoped admission read can still
+        // prove which lease this exact request created: then it is ours to reap normally.
+        let observed = null;
+        try { observed = await api.getAdmission?.({ request_id: leaseArgs.request_id }); } catch { observed = null; }
+        const named = observed?.ok && observed.data?.success === true && observed.data.superseded !== true &&
+          typeof observed.data.lease_id === "string" && UUID_RE.test(observed.data.lease_id) ? observed.data.lease_id : null;
+        if (named) {
+          leaseId = named;
+          leaseProvisioned = true;
+          execution.bindLease?.(leaseId);
+          const cleanup = await requestCleanup();
+          return { exitCode: receivedSignal ? SIGNAL_EXIT[receivedSignal] : cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED,
+            outcome: receivedSignal ? "interrupted" : "error", code: verdict.code, leaseId, cleanup,
+            error: `identified admission ${leaseArgs.request_id} was uncertain; its owner-scoped read names lease ${leaseId}, which was released` };
+        }
+        // Still unknown: keep the port claim (bound to this request) and hand back the key.
+        retainBlock = true;
+        leaseProvisioned = true;
+        return { exitCode: receivedSignal ? SIGNAL_EXIT[receivedSignal] : EXIT.BACKEND, outcome: receivedSignal ? "interrupted" : "error", code: verdict.code,
+          allocationRecovery: identifiedAdmissionRecovery(leaseArgs, null, verdict.ack),
+          error: `identified admission ${leaseArgs.request_id} may have committed; its port claim is retained. Read it with ` +
+            `\`bb stack status --admission-request-id ${leaseArgs.request_id}\`, then release any lease it names with ` +
+            `\`bb stack done <lease-id> --reap --release-port-claim --admission-request-id ${leaseArgs.request_id}\`` };
+      }
 
       // Interrupted DURING the capacity park: the refused request created no lease, so
       // there is nothing to release. (A signal during a request that DID admit falls
@@ -4267,7 +4483,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         // BOT-2400 (item 1): the park deadline never gives the queue place up. Hold the lease
         // for the owner's next run (which re-attaches to it) and exit PARK_DEADLINE; only
         // `stack cancel` / `stack done` or the owner's death releases it.
-        const queueHold = holdPlace ? await holdPlace(leaseId, HOLD_ON_TIMEOUT_MAX_SEC) : null;
+        // BOT-2780: a requester-origin run cannot be resumed by a later invocation (its stack
+        // names this CLI's listener, which closes now), so it releases instead of holding a place.
+        const queueHold = holdPlace && !execution.requesterOrigin ? await holdPlace(leaseId, HOLD_ON_TIMEOUT_MAX_SEC) : null;
         if (queueHold) {
           // A refused/lost hold reply is not an owner cancellation: it may have
           // committed before the reply was lost, or the queued lease may have
@@ -4425,6 +4643,28 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         leaseId, sshTarget, forwards: placement.forwards,
         isLive: () => Boolean(tunnel && !tunnelLost && !receivedSignal && tunnel.isLive()),
       });
+      if (execution.requesterOrigin) {
+        // BOT-2780: bind the reserved listener to exactly this lease's API forward. It is not
+        // another SSH forward: connection.api_url/ports/attestation stay physical-only.
+        try {
+          execution.requesterOrigin.onLost((loss) => { originLost = loss; if (!receivedSignal && !childResult) stopChild("SIGTERM", EXIT.LEASE_FAILED); });
+          execution.requesterOrigin.activate({
+            context: execution.originContext, leaseId, projectId: current.data.connection.project_id, sshTarget,
+            remoteConnection: current.data.connection, forwardedConnection: tunnel.connection, forwards: placement.forwards,
+            isLive: () => Boolean(tunnel && forwardAttestation && !tunnelLost && !receivedSignal && tunnel.isLive()),
+            watchLoss: (callback) => tunnel.onExit(callback),
+          });
+        } catch (error) {
+          await closeTunnel();
+          const cleanup = await requestCleanup();
+          return { exitCode: cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: error?.code ?? "REQUESTER_ORIGIN_FORWARD_REFUSED", leaseId, error: String(error?.message ?? error), cleanup };
+        }
+        placement.requesterOrigin = execution.requesterOrigin.origin;
+        stderrLine(`stack: requester origin ${execution.requesterOrigin.origin} → ${placement.hostKey ?? "remote"} API (generated auth links use it unchanged)`);
+        childConnection = { ...childConnection, requester_origin: execution.requesterOrigin.origin };
+      }
+    } else if (execution.requesterOrigin) {
+      await closeOrigin();
     }
     connectionFile = await writeConnection(safeConnectionPath(opts.connectionFile, leaseId), childConnection);
     if (receivedSignal) {
@@ -4461,6 +4701,12 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     // there would fail on a missing package.json AFTER the stack was provisioned.
     // The child therefore always runs in the (canonicalised) worktree root.
     const childCwd = execution.worktreeRoot;
+    if (!tunnelLost && execution.requesterOrigin && servedRemote && (originLost || !execution.requesterOrigin.isLive())) {
+      await closeTunnel();
+      const cleanup = await requestCleanup();
+      return { exitCode: cleanup.ok ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "error", code: originLost?.code ?? "REQUESTER_ORIGIN_TUNNEL_LOST", leaseId, cleanup,
+        error: "the requester origin closed before the child started; the lease was released" };
+    }
     if (tunnelLost) {
       // The forwards died between being verified and the child starting.
       await closeTunnel();
@@ -4521,6 +4767,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       try { execution.renew?.({ idleTtlSecs: LEASED_STACK_IDLE_RETENTION_SECS, idleRetained: true }); } catch { /* advisory */ }
       stderrLine(`stack: lease ${leaseId} is idle${cleanup.idle_since ? ` since ${cleanup.idle_since}` : ""} — its stack keeps running for the next run on this slot (\`bb stack done ${leaseId} --reap\` tears it down)`);
     }
+    if (originLost && !tunnelLost && !receivedSignal) {
+      return { exitCode: cleanup.ok ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "failed", code: originLost.code, leaseId, childExitCode: childResult.code, cleanup, fenced: true,
+        error: "the requester origin closed while the child was running, so the child was stopped and the lease released" };
+    }
     if (tunnelLost && !receivedSignal) {
       return tunnelLostResult(tunnelLost, { leaseId, cleanup, childExitCode: childResult.code, fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) });
     }
@@ -4617,6 +4867,9 @@ export function runReceiptFields(result) {
     execution_host_key: result.execution?.hostKey ?? null,
     requester_host: result.execution?.requesterHost ?? null,
     transport: result.execution?.transport ?? "none",
+    // BOT-2780: the reserved requester origin generated auth links name (never a credential).
+    ...(result.execution?.requesterOrigin ? { requester_origin: result.execution.requesterOrigin } : {}),
+    ...(result.allocationRecovery ? { allocation_recovery: result.allocationRecovery } : {}),
     ...(result.execution?.forwards ? { forwards: result.execution.forwards } : {}),
     ...(result.execution?.bundle ? { bundle: result.execution.bundle } : {}),
     // BOT-2269: the opted-in files that shipped in that bundle — paths, sha256, key names.

package/src/vendor/smol-toml/LICENSE

@@ -0,0 +1,24 @@
+Copyright (c) Squirrel Chat et al., All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/src/vendor/smol-toml/date.js

@@ -0,0 +1,156 @@
+/*!
+ * Copyright (c) Squirrel Chat et al., All rights reserved.
+ * SPDX-License-Identifier: BSD-3-Clause
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+export class TomlDate extends Date {
+    #hasDate = false;
+    #hasTime = false;
+    #offset = null;
+    constructor(date, fasttype, unsafeDelim) {
+        let hasDate = true;
+        let hasTime = true;
+        let offset = 'Z';
+        let c;
+        if (typeof date === 'string') {
+            if (fasttype)
+                prep: {
+                    // Date-time
+                    if (fasttype < 3) {
+                        if (+date.slice(11, 13) > 23) {
+                            date = '';
+                            break prep;
+                        }
+                        // Local
+                        if (fasttype === 2) {
+                            offset = null;
+                            date += 'Z';
+                        }
+                        // Offset; keep track of offset if not Z
+                        else if ((c = date.charCodeAt(date.length - 1)) !== 0x5a /* Z */ && c !== 0x7a /* z */) {
+                            offset = date.slice(date.length - 6);
+                        }
+                        if (unsafeDelim)
+                            date = date.slice(0, 10) + 'T' + date.slice(11);
+                    }
+                    // Time
+                    else if (fasttype === 4) {
+                        date = +date.slice(0, 2) > 23 ? '' : `0000-01-01T${date}Z`;
+                    }
+                    hasDate = fasttype !== 4;
+                    hasTime = fasttype !== 3;
+                }
+            else {
+                let match = date.match(DATE_TIME_RE);
+                if (match) {
+                    if (!match[1]) {
+                        hasDate = false;
+                        date = `0000-01-01T${date}`;
+                    }
+                    hasTime = !!match[2];
+                    // Make sure to use T instead of a space. Breaks in case of extreme values otherwise.
+                    hasTime && date[10] === ' ' && (date = date.replace(' ', 'T'));
+                    // Do not allow rollover hours.
+                    if (match[2] && +match[2] > 23) {
+                        date = '';
+                    }
+                    else {
+                        offset = match[3] || null;
+                        if (!offset && hasTime)
+                            date += 'Z';
+                    }
+                }
+                else {
+                    date = '';
+                }
+            }
+        }
+        super(date);
+        if (!isNaN(this.getTime())) {
+            this.#hasDate = hasDate;
+            this.#hasTime = hasTime;
+            this.#offset = offset;
+        }
+    }
+    isDateTime() {
+        return this.#hasDate && this.#hasTime;
+    }
+    isLocal() {
+        return !this.#hasDate || !this.#hasTime || !this.#offset;
+    }
+    isDate() {
+        return this.#hasDate && !this.#hasTime;
+    }
+    isTime() {
+        return this.#hasTime && !this.#hasDate;
+    }
+    isValid() {
+        return this.#hasDate || this.#hasTime;
+    }
+    toISOString() {
+        let iso = super.toISOString();
+        // Local Date
+        if (this.isDate())
+            return iso.slice(0, 10);
+        // Local Time
+        if (this.isTime())
+            return iso.slice(11, 23);
+        // Local DateTime
+        if (this.#offset === null)
+            return iso.slice(0, -1);
+        // Offset DateTime
+        if (this.#offset === 'Z' || this.#offset === 'z')
+            return iso;
+        // This part is quite annoying: JS strips the original timezone from the ISO string representation
+        // Instead of using a "modified" date and "Z", we restore the representation "as authored"
+        let offset = (+(this.#offset.slice(1, 3)) * 60) + +(this.#offset.slice(4, 6));
+        offset = this.#offset[0] === '-' ? offset : -offset;
+        let offsetDate = new Date(this.getTime() - (offset * 60e3));
+        return offsetDate.toISOString().slice(0, -1) + this.#offset;
+    }
+    static wrapAsOffsetDateTime(jsDate, offset = 'Z') {
+        let date = new TomlDate(jsDate);
+        date.#offset = offset;
+        return date;
+    }
+    static wrapAsLocalDateTime(jsDate) {
+        let date = new TomlDate(jsDate);
+        date.#offset = null;
+        return date;
+    }
+    static wrapAsLocalDate(jsDate) {
+        let date = new TomlDate(jsDate);
+        date.#hasTime = false;
+        date.#offset = null;
+        return date;
+    }
+    static wrapAsLocalTime(jsDate) {
+        let date = new TomlDate(jsDate);
+        date.#hasDate = false;
+        date.#offset = null;
+        return date;
+    }
+}