@botbuddy/cli 1.63.22 → 1.63.24

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.22",
-  "source_commit": "f92023885ef6f9fc477091b12f6769cae9d85560",
-  "source_sha256": "2dde93a23b6af3842f96d073bd0bd0113f5a6f3a3343dbb5a0037627aff377e9",
+  "release_version": "1.63.24",
+  "source_commit": "9da358c3b61afaf3c70fcbf9e73cc71500137b65",
+  "source_sha256": "f187bf83378e0de983fa1ab3e97928d784f08d8149598889de8d080b8221512f",
   "target": "darwin-arm64",
-  "sha256": "d06bccfe161d0f6e6d574c8ae01611b696b801705c565a091fbe3a9f2d4d04d8"
+  "sha256": "29947b82499d5e2db4048530bf203f52546aef31625c59e017d2c2666b6ee5d5"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.22",
-  "source_commit": "f92023885ef6f9fc477091b12f6769cae9d85560",
-  "source_sha256": "2dde93a23b6af3842f96d073bd0bd0113f5a6f3a3343dbb5a0037627aff377e9",
+  "release_version": "1.63.24",
+  "source_commit": "9da358c3b61afaf3c70fcbf9e73cc71500137b65",
+  "source_sha256": "f187bf83378e0de983fa1ab3e97928d784f08d8149598889de8d080b8221512f",
   "target": "linux-x64",
-  "sha256": "a5ce863685465d6ef9a20ad98758c2d14f4306f5e60dfb013f6dc8388e8405b4"
+  "sha256": "855a97c0028f1dbd208d7ead972b6ffbc195a945b22e14ba356fdc7365e730b5"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.22",
-  "source_commit": "f92023885ef6f9fc477091b12f6769cae9d85560",
-  "source_sha256": "2dde93a23b6af3842f96d073bd0bd0113f5a6f3a3343dbb5a0037627aff377e9",
+  "release_version": "1.63.24",
+  "source_commit": "9da358c3b61afaf3c70fcbf9e73cc71500137b65",
+  "source_sha256": "f187bf83378e0de983fa1ab3e97928d784f08d8149598889de8d080b8221512f",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "d06bccfe161d0f6e6d574c8ae01611b696b801705c565a091fbe3a9f2d4d04d8",
+      "sha256": "29947b82499d5e2db4048530bf203f52546aef31625c59e017d2c2666b6ee5d5",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "a5ce863685465d6ef9a20ad98758c2d14f4306f5e60dfb013f6dc8388e8405b4",
+      "sha256": "855a97c0028f1dbd208d7ead972b6ffbc195a945b22e14ba356fdc7365e730b5",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.22",
+  "version": "1.63.24",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack.mjs

@@ -65,16 +65,17 @@ export const STACK_SCHEMA_VERSION = 1;
  * BOT-2780 / BOT-2788: a `stack run` that may be served by another host reserves a requester
  * origin and allocates through BOT-2499's identified admission. Stable (the default ring):
  * auto or remote placement, with or without `--reap` (an idle stack is continued on the same
- * logical origin by a later run); runs that pin a host, a prepared stack path, a fixed nonce
- * or a co-located placement, or pass a callback port (BOT-2775), keep the legacy path
- * unchanged. Beta: BOT-2780's `--remote --reap` gate, which refuses those contexts instead.
+ * logical origin by a later run), callback runs included (BOT-2775 stable activation: they ask
+ * for callback_policy auto, see runStackLifecycle); runs that pin a host, a prepared stack
+ * path, a fixed nonce or a co-located placement keep the legacy path unchanged. Beta:
+ * BOT-2780's `--remote --reap` gate, which refuses those contexts instead.
  */
 export const requesterOriginEnabled = (opts) => {
   if (opts.execution === "local" || opts.localOnly || opts.localExec) return false;
   // Beta keeps BOT-2780's gate (remote + --reap); its idle/callback runs stay on BOT-2775's path.
   if (opts.executionRing === "beta") return opts.execution === "remote" && opts.reap === true;
   if (opts.execution != null && opts.execution !== "auto" && opts.execution !== "remote") return false;
-  return opts.host == null && opts.stackNonce == null && (opts.stackPath == null || opts.stackPath === "" || opts.stackPath === ".") && opts.callbackPort == null;
+  return opts.host == null && opts.stackNonce == null && (opts.stackPath == null || opts.stackPath === "" || opts.stackPath === ".");
 };
 // Exact replays of one identified request after an uncertain answer (lost response, 5xx,
 // ADMISSION_UNCERTAIN, pending delivery). The same request_id can never create a second lease.
@@ -83,6 +84,7 @@ const ADMISSION_REPLAYABLE = new Set(["ADMISSION_UNCERTAIN", "RETRY_SAME_REQUEST
 // The key already has a ledger row (or had one): never replay it blindly or treat it as unallocated.
 const ADMISSION_COMMITTED_UNCERTAIN = new Set(["REQUEST_IDENTITY_MISMATCH", "REQUEST_CLOSED", "ORIGINAL_LEASE_UNAVAILABLE"]);
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SQLSTATE_RE = /^[0-9A-Z]{5}$/;
 
 /**
  * Codex #1077 P1 / BOT-2184: an sshd with `GatewayPorts yes` binds a `-R` forward on every
@@ -276,16 +278,20 @@ ${bold("run OPTIONS")}
                          is requested through the identified admission (exact replay after a lost
                          response, no fallback).
   --callback-port N      The caller runs a listener the stack calls back through
-                         host.docker.internal:N (e.g. 4600): sent as callback_port. On a stable or
-                         auto REMOTE lease run first probes the host with a throwaway reverse forward
-                         and opens -R 127.0.0.1:N:127.0.0.1:N only when the host keeps it on loopback
-                         (sshd GatewayPorts no/clientspecified); otherwise exit 5
-                         CALLBACK_NOT_LOOPBACK (BOT-2184). With --remote --execution-ring beta it
-                         instead requires a Linux Go runtime with native callbacks (protocol 5): a
-                         private SSH Unix-socket route to a fixed requester gateway, renewed against
-                         current owned authorization (BOT-2775). Unknown/older hosts or a backend
-                         that does not acknowledge it fail HOST_CALLBACK_TRANSPORT_UNSUPPORTED; the
-                         child never receives the route capability.
+                         host.docker.internal:N (e.g. 4600): sent as callback_port. A remote
+                         callback is served by a Linux Go runtime with native callbacks (protocol
+                         5): a private SSH Unix-socket route to a fixed requester gateway, renewed
+                         against current owned authorization (BOT-2775). An unpinned stable/auto run
+                         asks for callback_policy auto: it runs co-located or on a host with native
+                         callbacks, and Swift Helper hosts no longer take it remotely. With --remote
+                         --execution-ring beta the native transport is required explicitly. A remote
+                         lease the backend does not acknowledge with it fails
+                         HOST_CALLBACK_TRANSPORT_UNSUPPORTED (never a legacy -R); the child never
+                         receives the route capability. A run pinned with --host, --stack-path or a
+                         fixed nonce keeps the legacy -R forward: it first probes the host with a
+                         throwaway reverse forward and opens -R 127.0.0.1:N:127.0.0.1:N only when
+                         the host keeps it on loopback (sshd GatewayPorts no/clientspecified);
+                         otherwise exit 5 CALLBACK_NOT_LOOPBACK (BOT-2184).
   --bundle-max-mb N      Remote-lease bundle size cap in MB (default 50, compressed). The bundle
                          excludes .bb-stack.json, node_modules, supabase/.temp|.branches and
                          untracked-secret dotenv files (.env, .env.local, .env.*.local).
@@ -330,9 +336,11 @@ ${bold("IDLE LEASES")} (BOT-1803)
 
 ${bold("REMOTE LEASES")} (BOT-2142, stack run)
   The receipt carries execution_mode (local|remote), execution_host_key, requester_host,
-  transport (none|ssh-forward), and for a remote lease forwards [{name, remote, local}] + bundle.
+  transport (none|ssh-forward), and for a remote lease forwards [{name, remote, local}] + bundle,
+  plus callback_transport "native_origin_v1" when --callback-port used the native route (BOT-2775).
   The child also gets BOTBUDDY_STACK_EXECUTION_MODE and BOTBUDDY_STACK_TRANSPORT.
-  Requeue (BOT-2207/BOT-2334): under auto, including --callback-port, a lease that QUEUES on this machine uploads its bundle at once;
+  Requeue (BOT-2207/BOT-2334): under auto, including --callback-port, a lease that QUEUES on this machine uploads its bundle at once
+  (a callback lease moves only to a host with native callbacks, BOT-2775);
   every minute the control plane re-offers it to this owner's other hosts and it may move there
   (placement_reason moved_remote_on_requeue), and run then forwards to the new host. While queued,
   run prints one \`considered: <host> — <verdict>\` line per host weighed (e.g. "census stale 131 s");
@@ -346,11 +354,13 @@ ${bold("REMOTE LEASES")} (BOT-2142, stack run)
   4 STACK_EXECUTION_MODE_MISMATCH  the slot already holds a lease in another mode/host — stack done it first
   (the four codes above create NO lease)
   5 BUNDLE_UPLOAD_FAILED  the signed bundle upload failed (the lease is released first)
-  5 CALLBACK_NOT_LOOPBACK --callback-port (stable/auto): the GatewayPorts probe (before any real -R)
+  5 CALLBACK_NOT_LOOPBACK --callback-port (pinned legacy -R): the GatewayPorts probe (before any real -R)
                           or the post-forward check found the host's -R listener not loopback-only
                           (sshd GatewayPorts yes), or could not check it (no lsof, no listener)
-  5 HOST_CALLBACK_TRANSPORT_UNSUPPORTED  --callback-port (beta remote): native callback transport is
+  5 HOST_CALLBACK_TRANSPORT_UNSUPPORTED  --callback-port (remote native): native callback transport is
                           unavailable; needs the installed Linux Go runtime (protocol 5) and backend
+  4 REQUESTER_ORIGIN_EXPLICIT_CONFLICT  an unpinned stable --callback-port run in a repo whose
+                          supabase/config.toml sets its own [auth] external_url (no lease requested)
   5 CALLBACK_NOT_READY / CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE  the native route did not
                           answer from the stack's own network before the child (lease reaped)
   6 CALLBACK_TRANSPORT_LOST / CALLBACK_AUTHORIZATION_LOST  the native route or its current
@@ -1039,7 +1049,9 @@ export async function resolveRunExecution(cwd, opts, { materialize = materialize
         // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- canonical realpath of the current worktree; fixed own source config, never a request-supplied path.
         await patchRequesterAuthOrigin(readFileSync(join(worktreeRoot, "supabase", "config.toml"), "utf8"), requesterOrigin.origin);
       } catch (error) {
-        if (error?.code !== "REQUESTER_ORIGIN_EXPLICIT_CONFLICT" || opts.executionRing === "beta") throw error;
+        // BOT-2775: a stable callback run is refused too. The legacy allocator would place it
+        // on any remote host with the legacy -R callback, which Linux Go hosts cannot serve.
+        if (error?.code !== "REQUESTER_ORIGIN_EXPLICIT_CONFLICT" || opts.executionRing === "beta" || opts.callbackPort != null) throw error;
         warn("stack: supabase/config.toml sets its own [auth] external_url, so this run keeps the legacy (non-requester-origin) path");
         await requesterOrigin.close();
         requesterOrigin = null;
@@ -1364,6 +1376,11 @@ export function leaseRefusalError(data) {
       `Inspect with \`bb stack status ${data.lease_id}\`; after the owning batch ends, release with \`bb stack done ${data.lease_id} --reap\`, ` +
       `then wait with \`bb wait 'lease:id=${data.lease_id},state=reaped' --heartbeat\`.`;
   }
+  // BOT-2812: a server fault, not the caller's: the database rolled the admission back.
+  if (data?.code === "ADMISSION_FAILED") {
+    return `the server's identified admission failed in the database${data.sqlstate ? ` (SQLSTATE ${data.sqlstate})` : ""} and rolled back, ` +
+      "so no lease was created and this stack's port claim is released. This is a BotBuddy server fault: report it with this run's admission request id.";
+  }
   return data?.message || REMOTE_REFUSAL_GUIDANCE[data?.code] || data?.code || "lease request refused";
 }
 
@@ -4122,8 +4139,14 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         "an idle stack on this slot will be re-provisioned rather than reused.");
     }
     idleLease.stackDigest = stackDigest;
-    // Runtime-first rollout: only explicit beta callers activate the new transport.
+    // BOT-2775: an explicit beta caller requires the native transport up front. A stable/default
+    // run with a callback asks for callback_policy auto on its identified admission (BOT-2779):
+    // the backend places it on a host that serves native callbacks (Linux Go protocol 5) or
+    // co-located, and the transport the lease answers with decides the route (useNativeCallback).
+    // A remote answer without the native transport fails closed; it never falls back to -R.
     const requireNativeCallback = opts.callbackPort != null && opts.executionRing === "beta" && executionRequest !== "local";
+    const autoCallbackPolicy = opts.callbackPort != null && opts.executionRing !== "beta" && executionRequest !== "local" && Boolean(execution.admissionRequestId);
+    let useNativeCallback = requireNativeCallback;
     const leaseArgs = {
       slot, host_key: opts.host || undefined, repo: opts.repo, ticket_id: opts.ticket,
       ticket_url: opts.ticketUrl || undefined, pr_id: opts.prId || undefined, pr_url: opts.prUrl || undefined,
@@ -4138,7 +4161,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       require_stack_digest: true,
       // BOT-2269: what the bundle carries beyond the defaults (paths, sha256, key NAMES).
       ...(bundle?.included?.length ? { bundle_included: bundle.included } : {}),
-      ...(opts.callbackPort != null ? { callback_port: opts.callbackPort, ...(requireNativeCallback ? { callback_transport: NATIVE_CALLBACK_TRANSPORT } : {}) } : {}),
+      ...(opts.callbackPort != null ? { callback_port: opts.callbackPort,
+        ...(requireNativeCallback ? { callback_transport: NATIVE_CALLBACK_TRANSPORT } : autoCallbackPolicy ? { callback_policy: "auto" } : {}) } : {}),
     };
     // BOT-2780: the identified admission key and a digest of the immutable origin context.
     // The intent (including the bundle digest that names the reserved origin) is fingerprinted
@@ -4207,6 +4231,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
             // for its reap and send this same request again; it is never adopted or released.
             else return { ...res, data: { success: false, code, ...(res.data?.message ? { message: res.data.message } : {}),
               ...(res.data?.phase ? { phase: res.data.phase } : {}), ...(res.data?.wait ? { wait: res.data.wait } : {}),
+              // BOT-2812: the database ran the call and rolled it back; its SQLSTATE names the class.
+              ...(code === "ADMISSION_FAILED" && SQLSTATE_RE.test(res.data?.sqlstate ?? "") ? { sqlstate: res.data.sqlstate } : {}),
               ...(code === HOST_CAPACITY_SOURCE_STALE_CODE ? capacityStaleReceiptFields(res.data) : {}) } };
           } else {
             const ack = identifiedAdmissionAck(res.data, leaseArgs.request_id);
@@ -4450,6 +4476,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       return {
         exitCode: leaseRefusalExit(request.data?.code), outcome: "error", code: request.data?.code,
         ...capacityStaleReceiptFields(request.data), error: leaseRefusalError(request.data),
+        ...(request.data?.sqlstate ? { sqlstate: request.data.sqlstate } : {}),
         ...(request.data.lease_id ? { leaseId: request.data.lease_id, state: request.data.state ?? null } : {}),
       };
     }
@@ -4499,7 +4526,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     placement.mode = request.data.execution_mode ?? null;
     placement.hostKey = request.data.host_key ?? null;
     placement.requesterHost = request.data.requester_host ?? null;
-    if (remoteLease && requireNativeCallback && request.data.callback_transport !== NATIVE_CALLBACK_TRANSPORT) {
+    if (remoteLease && (requireNativeCallback || autoCallbackPolicy) && request.data.callback_transport !== NATIVE_CALLBACK_TRANSPORT) {
       const cleanup = await requestCleanup();
       return { exitCode: cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: "HOST_CALLBACK_TRANSPORT_UNSUPPORTED", leaseId, error: "backend did not acknowledge required remote callback transport", cleanup };
     }
@@ -4770,17 +4797,27 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
       stderrLine(`stack: lease ${leaseId} moved to ${placement.hostKey ?? "another host"} while queued (${placement.placementReason ?? "moved"}) — forwarding to it`);
     }
     let childConnection = current.data.connection;
+    // BOT-2775: a callback_policy auto lease serves its callback natively whenever it is remote,
+    // including one that moved to a remote host while queued. Its current lease must name the
+    // native transport; anything else is refused before any forward opens.
+    if (servedRemote && autoCallbackPolicy) {
+      if (current.data.callback_transport !== NATIVE_CALLBACK_TRANSPORT) {
+        const cleanup = await requestCleanup();
+        return { exitCode: cleanup.ok ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: "HOST_CALLBACK_TRANSPORT_UNSUPPORTED", leaseId, error: "the remote lease does not carry the native callback transport its callback policy requires", cleanup };
+      }
+      useNativeCallback = true;
+    }
     if (servedRemote) {
       // BOT-2142: forward every stack port over ONE ssh and hand the child the local ports.
       sshTarget = current.data.connection?.ssh_target ?? current.data.ssh_target ?? sshTarget;
       try {
-        tunnel = await openTunnel({ connection: current.data.connection, sshTarget, hostKey: placement.hostKey, callbackPort: requireNativeCallback ? null : opts.callbackPort,
-          ...(requireNativeCallback ? { reserveLocalPorts: [opts.callbackPort] } : {}) });
+        tunnel = await openTunnel({ connection: current.data.connection, sshTarget, hostKey: placement.hostKey, callbackPort: useNativeCallback ? null : opts.callbackPort,
+          ...(useNativeCallback ? { reserveLocalPorts: [opts.callbackPort] } : {}) });
       } catch (error) {
         const cleanup = await requestCleanup();
         return { exitCode: EXIT.BACKEND, outcome: "error", code: error?.code ?? "REMOTE_UNREACHABLE", leaseId, error: String(error?.message ?? error), cleanup };
       }
-      if (requireNativeCallback) {
+      if (useNativeCallback) {
         try {
           nativeCallback = await openCallback({ current: current.data, leaseId, hostKey: placement.hostKey, callbackPort: opts.callbackPort, requesterMachineId: machineUuidFn(), sshTarget,
             readCurrent: async (signal) => { let observed; try { observed = await api.get(leaseId, { signal }); } catch (error) { throw Object.assign(new Error(`current callback status unreadable (${error?.message ?? error})`), { transient: true }); } if (!observed?.ok) {
@@ -4793,6 +4830,7 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
             return observed.data; },
           });
           nativeCallback.onExit((exit) => { if (childResult) return; callbackLost = exit; fencing = true; stopChild("SIGTERM", EXIT.LEASE_FAILED); });
+          placement.callbackTransport = NATIVE_CALLBACK_TRANSPORT;
         } catch (error) {
           await closeTunnel(); const cleanup = await requestCleanup();
           return { exitCode: cleanup.ok && !callbackCleanupError && error?.code !== "CALLBACK_CLEANUP_UNCERTAIN" ? EXIT.BACKEND : EXIT.CLEANUP_FAILED, outcome: "error", code: error?.code ?? "CALLBACK_NOT_READY", leaseId, error: String(error?.message ?? "callback transport unavailable"), cleanup };
@@ -5052,6 +5090,8 @@ export function runReceiptFields(result) {
     execution_host_key: result.execution?.hostKey ?? null,
     requester_host: result.execution?.requesterHost ?? null,
     transport: result.execution?.transport ?? "none",
+    // BOT-2775: present only when the callback was served over the native route.
+    ...(result.execution?.callbackTransport ? { callback_transport: result.execution.callbackTransport } : {}),
     // BOT-2780: the reserved requester origin generated auth links name (never a credential).
     ...(result.execution?.requesterOrigin ? { requester_origin: result.execution.requesterOrigin } : {}),
     // BOT-2788: "previous" (an idle stack's origin re-reserved), "previous_port_busy" or "new".