@botbuddy/cli 1.63.27 → 1.63.29

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.27",
-  "source_commit": "7b8d56823a4e1d2935a9c436de5cc8738f333dfa",
-  "source_sha256": "69351ba7fad33c5ce76d7bd76ed782988b44eccec4809bb93b0d2d26d109d641",
+  "release_version": "1.63.29",
+  "source_commit": "732c555dd44141d581f96959ed590007b3ec09de",
+  "source_sha256": "c2f0fc90169b4580f2d8918fb1100b853e0663a65fe470dc399c2a33787d7639",
   "target": "darwin-arm64",
-  "sha256": "9b000a9b8103c438f0f81859538db21844375a5219ddf423e7266e4d9c33dbca"
+  "sha256": "05fd954131e610edd04ff1ee4ee4a0e37047f3ab56bbb0d4fd5fc3cee82bcd86"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.27",
-  "source_commit": "7b8d56823a4e1d2935a9c436de5cc8738f333dfa",
-  "source_sha256": "69351ba7fad33c5ce76d7bd76ed782988b44eccec4809bb93b0d2d26d109d641",
+  "release_version": "1.63.29",
+  "source_commit": "732c555dd44141d581f96959ed590007b3ec09de",
+  "source_sha256": "c2f0fc90169b4580f2d8918fb1100b853e0663a65fe470dc399c2a33787d7639",
   "target": "linux-x64",
-  "sha256": "ed2e4faa813d9c0905703f790a3744d4250d3a85add6dd5ce7efb6498e6a76ad"
+  "sha256": "1b3d42884f57dd70d3946137b704009d42ee027e2ca060b2e4df70325c52c5b7"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.27",
-  "source_commit": "7b8d56823a4e1d2935a9c436de5cc8738f333dfa",
-  "source_sha256": "69351ba7fad33c5ce76d7bd76ed782988b44eccec4809bb93b0d2d26d109d641",
+  "release_version": "1.63.29",
+  "source_commit": "732c555dd44141d581f96959ed590007b3ec09de",
+  "source_sha256": "c2f0fc90169b4580f2d8918fb1100b853e0663a65fe470dc399c2a33787d7639",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "9b000a9b8103c438f0f81859538db21844375a5219ddf423e7266e4d9c33dbca",
+      "sha256": "05fd954131e610edd04ff1ee4ee4a0e37047f3ab56bbb0d4fd5fc3cee82bcd86",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "ed2e4faa813d9c0905703f790a3744d4250d3a85add6dd5ce7efb6498e6a76ad",
+      "sha256": "1b3d42884f57dd70d3946137b704009d42ee027e2ca060b2e4df70325c52c5b7",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.27",
+  "version": "1.63.29",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/stack-native-callback.mjs

@@ -19,6 +19,8 @@ const version=/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
 const fields=['protocol','binary_path','artifact_sha256','config_path','service_uid','runtime_version','runtime_git_sha','runtime_target','host_key','machine_id','engine_id','lease_id','job_id','attempt','tenant_id','project_id','callback_port','producer_pid','producer_start_ticks','producer_boot_id'];
 const fail=(code,message)=>{throw Object.assign(Error(message),{code});};
 const quote=value=>"'"+String(value).replaceAll("'","'\\''")+"'";
+// BOT-2828: a relay-reported cause is one fixed upper-case code, never free text.
+const typedCause=value=>typeof value==='string'&&/^CALLBACK_[A-Z_]{1,64}$/.test(value)?value:null;
 const canonicalMachine=value=>typeof value==='string'&&/^(?:[0-9a-f]{32}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i.test(value)?value.replaceAll('-','').toLowerCase():null;
 
 export function validatedCallbackDescriptor(value){
@@ -86,10 +88,17 @@ export async function openNativeCallbackTransport({current,leaseId,hostKey,callb
   const command=`set -eu; relayPid=; cleanup(){ trap - EXIT HUP INT TERM; if [ -n "$relayPid" ]; then kill -TERM "$relayPid" 2>/dev/null || :; wait "$relayPid" 2>/dev/null || :; fi; rm -f -- ${quote(socket)}; rmdir -- ${quote(directory)}; }; trap cleanup EXIT HUP INT TERM; ${quote(d.binary_path)} --callback-relay --config ${quote(d.config_path)} <&0 & relayPid=$!; status=0; wait "$relayPid" || status=$?; relayPid=; exit "$status"`;
   child=spawnImpl(sshBin,[...SSH_FORWARD_OPTIONS.filter(arg=>arg!=='-N'),'-o','StreamLocalBindMask=0177','-R',socket+':127.0.0.1:'+gateway.port,'--',target,command],{env,stdio:['pipe','pipe','pipe']});
   child.stdin.on('error',()=>{});child.stderr.on('data',()=>{});
-  let spawnError=false;child.once('error',()=>{spawnError=true});terminal=new Promise(resolve=>child.once('close',(code,signal)=>resolve({code,signal,reason:spawnError?'callback_process_error':'callback_process_exit'})));
-  terminal.then(exit=>{if(!closed){reportExit(exit);void close().catch(()=>reportExit({code:null,reason:'callback_cleanup_uncertain'}))}});
+  let spawnError=false;child.once('error',()=>{spawnError=true});// BOT-2828: a relay that ends without a typed close frame is classified by its exit: ssh's own
+  // failure (255) or a signal is the SSH hop, any other exit is the relay process itself.
+  terminal=new Promise(resolve=>child.once('close',(exitCode,signal)=>resolve({reason:spawnError?'callback_process_error':'callback_process_exit',code:spawnError||exitCode===255||signal?'CALLBACK_SSH_LOST':'CALLBACK_RELAY_EXITED',exit_code:exitCode,signal})));
+  terminal.then(exit=>{if(!closed){reportExit(exit);void close().catch(()=>reportExit({reason:'callback_cleanup_uncertain',code:'CALLBACK_CLEANUP_UNCERTAIN'}))}});
   const lines=createInterface({input:child.stdout});
-  lines.on('line',line=>{try{const event=JSON.parse(line);if(event.refused===true&&event.code==='CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE'&&pendingAck){const waiter=pendingAck;pendingAck=undefined;const refusal=Error('consuming namespace callback probe failed');refusal.code='CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE';waiter.reject(refusal);}else if(pendingReady){const waiter=pendingReady;pendingReady=undefined;waiter.resolve(event);}else if(pendingAck&&event.renewed===true&&event.route_generation===routeGeneration&&Number.isFinite(Date.parse(event.expires_at))){const waiter=pendingAck;pendingAck=undefined;waiter.resolve(event);}else throw Error('unexpected callback frame');}catch{reportExit({code:null,reason:'callback_protocol_error'});void close().catch(()=>{})}});
+  lines.on('line',line=>{try{const event=JSON.parse(line);
+   // BOT-2828: the relay names why it closed a live route ({closed:true,code}).
+   if(event?.closed===true&&typedCause(event.code)&&!pendingReady){if(!closed){reportExit({reason:'callback_relay_closed',code:event.code});void close().catch(()=>{})}return;}
+   // BOT-2790 AC-5: a typed readiness (or first-renewal) refusal keeps its exact code.
+   if(event?.refused===true&&(pendingReady||pendingAck)){const waiter=pendingReady??pendingAck;pendingReady=pendingAck=undefined;const refusal=Error('native callback relay refused readiness');refusal.code=typedCause(event.code)??'CALLBACK_NOT_READY';waiter.reject(refusal);return;}
+   if(pendingReady){const waiter=pendingReady;pendingReady=undefined;waiter.resolve(event);}else if(pendingAck&&event.renewed===true&&event.route_generation===routeGeneration&&Number.isFinite(Date.parse(event.expires_at))){const waiter=pendingAck;pendingAck=undefined;waiter.resolve(event);}else throw Error('unexpected callback frame');}catch{if(!closed){reportExit({reason:'callback_protocol_error',code:'CALLBACK_PROTOCOL_ERROR'});void close().catch(()=>{})}}});
   terminal.then(()=>{lines.close();pendingReady?.reject(Error('callback process ended'));pendingAck?.reject(Error('callback process ended'));});
   const ready=await new Promise((resolve,reject)=>{
    const timeout=setTimeout(()=>reject(Object.assign(Error('callback readiness deadline'),{code:'CALLBACK_NOT_READY'})),20_000);timeout.unref();
@@ -97,7 +106,7 @@ export async function openNativeCallbackTransport({current,leaseId,hostKey,callb
    child.stdin.write(JSON.stringify({binding,capability,socket_path:socket,readiness_nonce:readinessNonce})+'\n');
   });
   const callbackUrl=callbackReadiness(ready,callbackPort);
-  gateway.onClose(()=>{if(!closed){reportExit({code:null,reason:'callback_gateway_closed'});void close().catch(()=>{})}});
+  gateway.onClose(()=>{if(!closed){reportExit({reason:'callback_gateway_closed',code:'CALLBACK_GATEWAY_EXPIRED'});void close().catch(()=>{})}});
   let renewedAt=null;
   const refresh=async(first=false)=>{
    if(closed||refreshing)return;refreshing=true;
@@ -108,15 +117,16 @@ export async function openNativeCallbackTransport({current,leaseId,hostKey,callb
      // A failed status READ is not an authorization answer: keep the live generation (relay and
      // gateway still expire it at 30 s) and retry on the next tick while inside the grace window.
      if(!first&&error?.transient===true&&renewedAt!==null&&performance.now()-renewedAt<transientGraceMs){const retry=setTimeout(()=>{void refresh()},transientRetryMs);retry.unref();return;}
+     if(error?.transient===true&&!error.code&&!first)error.code='CALLBACK_STATUS_UNREADABLE';
      throw error;
     }
     if(closed)return;const renewed=currentCallbackBinding(status,options);if(JSON.stringify(renewed)!==snapshot)fail('CALLBACK_AUTHORIZATION_LOST','callback context changed');
     const sentAt=performance.now();
-    await new Promise((resolve,reject)=>{const timeout=setTimeout(()=>reject(Error('callback renewal acknowledgement deadline')),first?firstAckMs:renewAckMs);timeout.unref();pendingAck={resolve:value=>{clearTimeout(timeout);resolve(value)},reject:error=>{clearTimeout(timeout);reject(error)}};child.stdin.write(JSON.stringify({binding:renewed,renew:true})+'\n');});
+    await new Promise((resolve,reject)=>{const timeout=setTimeout(()=>reject(Object.assign(Error('callback renewal acknowledgement deadline'),first?{}:{code:'CALLBACK_RENEWAL_ACK_TIMEOUT',transport:true})),first?firstAckMs:renewAckMs);timeout.unref();pendingAck={resolve:value=>{clearTimeout(timeout);resolve(value)},reject:error=>{clearTimeout(timeout);reject(error)}};child.stdin.write(JSON.stringify({binding:renewed,renew:true})+'\n');});
     if(closed)return;renewedAt=sentAt;gateway.refresh(Object.freeze({snapshot}),30_000-(performance.now()-sentAt));
    }
    // The first renewal carries the consuming-namespace probe: its uncoded failure is readiness.
-   catch(error){if(!closed){reportExit({code:null,reason:'callback_authorization_lost',...(error.code?{code:error.code}:first?{code:'CALLBACK_NOT_READY'}:{})});void close().catch(()=>{});}}
+   catch(error){if(!closed){reportExit({reason:error?.transport===true?'callback_renewal_unacknowledged':'callback_authorization_lost',code:error?.code??(first?'CALLBACK_NOT_READY':'CALLBACK_AUTHORIZATION_LOST')});void close().catch(()=>{});}}
    finally{refreshing=false}
   };
   await refresh(true);if(closed||!gateway.isLive())fail(exitResult?.code??'CALLBACK_NOT_READY','callback route not ready after readiness');

package/src/stack.mjs

@@ -351,6 +351,8 @@ ${bold("REMOTE LEASES")} (BOT-2142, stack run)
   5 HOST_NO_SSH_TARGET    the (pinned) remote host has no ssh_target — operator: set container_hosts.ssh_target
   5 HOST_HELPER_OUTDATED  the (pinned) remote host's Helper predates protocol 4 — upgrade that Helper
   5 NO_HELPER_HOST        no co-located host admits and no owned host qualifies as remote
+  5 NO_COLOCATED_HELPER_HOST  --local-only (or stack up / --local-exec): this machine has no active Docker
+                          host (none enrolled, or draining/maintenance/retired) — run without --local-only
   4 STACK_EXECUTION_MODE_MISMATCH  the slot already holds a lease in another mode/host — stack done it first
   (the four codes above create NO lease)
   5 BUNDLE_UPLOAD_FAILED  the signed bundle upload failed (the lease is released first)
@@ -362,9 +364,16 @@ ${bold("REMOTE LEASES")} (BOT-2142, stack run)
   4 REQUESTER_ORIGIN_EXPLICIT_CONFLICT  an unpinned stable --callback-port run in a repo whose
                           supabase/config.toml sets its own [auth] external_url (no lease requested)
   5 CALLBACK_NOT_READY / CALLBACK_CONSUMING_NAMESPACE_UNREACHABLE  the native route did not
-                          answer from the stack's own network before the child (lease reaped)
+                          answer from the stack's own network before the child (lease reaped);
+                          a typed relay refusal keeps its own code (BOT-2790): CALLBACK_ALIAS_DRIFT,
+                          CALLBACK_PRODUCER_MISMATCH, CALLBACK_BIND_REFUSED, CALLBACK_ENDPOINT_REFUSED, …
   6 CALLBACK_TRANSPORT_LOST / CALLBACK_AUTHORIZATION_LOST  the native route or its current
-                          authorization closed; the child is stopped and the lease reaped
+                          authorization closed; the child is stopped and the lease reaped.
+                          callback_cause names why (BOT-2828): relay CALLBACK_RUNTIME_DRIFT,
+                          CALLBACK_VALIDATION_UNAVAILABLE (Docker unanswered 20 s), CALLBACK_PRODUCER_ENDED,
+                          CALLBACK_GENERATION_EXPIRED, CALLBACK_RENEWAL_REFUSED; requester CALLBACK_SSH_LOST,
+                          CALLBACK_RELAY_EXITED, CALLBACK_GATEWAY_EXPIRED, CALLBACK_RENEWAL_ACK_TIMEOUT,
+                          CALLBACK_STATUS_UNREADABLE, CALLBACK_PROTOCOL_ERROR, CALLBACK_AUTHORIZATION_LOST
   5 CALLBACK_PORT_BUSY    --callback-port is already listening on the serving host (another run or
                           service), the host refused this run's -R because another run took the
                           port first, or another listener shares the port; this run holds no -R —
@@ -1363,6 +1372,13 @@ export const REMOTE_REFUSAL_GUIDANCE = Object.freeze({
   NO_HELPER_HOST: "no host can serve this lease: no co-located Helper admits it and no other host you own qualifies as remote " +
     "(an owned, device-consented, beacon-fresh Helper on protocol 4 with an operator-set ssh_target). No lease was created.",
   HOST_NOT_OWNED: "the pinned host is not a device-consented Helper host your owner owns. No lease was created.",
+  // BOT-2845: a co-located request (`stack up`, `--local-exec`, `stack run --local-only`) from a
+  // machine that no longer hosts Docker. The server considers only ACTIVE, device-consented,
+  // owner-bound hosts for this hardware id and sends no message with this code.
+  NO_COLOCATED_HELPER_HOST: "this machine has no active, device-consented Docker host your owner owns (none is enrolled for " +
+    "this hardware id, or its host is draining, in maintenance or retired), so a co-located lease (`stack up`, `--local-exec`, " +
+    "`stack run --local-only`) cannot be placed here. No lease was created. Run `bb stack run` without --local-only " +
+    "(execution auto) or with --remote, so another host you own serves the stack.",
   HOST_STALE: "the pinned remote host's Helper beacon is stale. No lease was created; retry once it beacons, or drop --host.",
   HOST_NOT_REMOTE: "--remote pinned this machine's own host; drop --host or --remote. No lease was created.",
   BUNDLE_REQUIRED: "the server picked a remote host but this request carried no bundle digest. No lease was created; " +
@@ -4826,6 +4842,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
               const transient = !observed?.auth && (observed?.status == null || observed.status >= 500 || observed.status === 408 || observed.status === 429 || observed.error === "invalid_json");
               throw Object.assign(new Error(transient ? "current callback status unreadable" : "current callback authorization refused"), transient ? { transient: true } : { code: "CALLBACK_AUTHORIZATION_LOST" });
             }
+            // BOT-2790 AC-6 (BOT-2828): a backend RPC_ERROR (e.g. a statement timeout) is an unanswered read.
+            if (observed.data?.success !== true && observed.data?.code === "RPC_ERROR") throw Object.assign(new Error("current callback status unreadable (RPC_ERROR)"), { transient: true });
             if (observed.data?.success !== true) throw Object.assign(new Error("current callback authorization unavailable"), { code: "CALLBACK_AUTHORIZATION_LOST" });
             return observed.data; },
           });
@@ -4917,7 +4935,8 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
     }
     if (callbackLost || nativeCallback && !nativeCallback.isLive()) {
       await closeTunnel(); const cleanup = await requestCleanup();
-      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "error", code: "CALLBACK_TRANSPORT_LOST", leaseId, error: "callback transport closed before child start", cleanup };
+      const callbackCause = callbackLost?.code ?? "CALLBACK_RELAY_EXITED";
+      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "error", code: "CALLBACK_TRANSPORT_LOST", callbackCause, leaseId, error: `callback transport closed before child start (${callbackCause})`, cleanup };
     }
     if (tunnelLost) {
       // The forwards died between being verified and the child starting.
@@ -4984,7 +5003,9 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
         error: "the requester origin closed while the child was running, so the child was stopped and the lease released" };
     }
     if (callbackLost && !receivedSignal) {
-      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "failed", code: callbackLost.reason === "callback_authorization_lost" ? "CALLBACK_AUTHORIZATION_LOST" : "CALLBACK_TRANSPORT_LOST", leaseId, childExitCode: childResult.code, cleanup, fenced: true, error: "callback transport authorization or runtime context was lost; child stopped" };
+      // BOT-2828: the receipt names the hop and cause that closed the route, not only the class.
+      const callbackCause = callbackLost.code ?? (callbackLost.reason === "callback_authorization_lost" ? "CALLBACK_AUTHORIZATION_LOST" : "CALLBACK_RELAY_EXITED");
+      return { exitCode: cleanup.ok && !callbackCleanupError ? EXIT.LEASE_FAILED : EXIT.CLEANUP_FAILED, outcome: "failed", code: callbackLost.reason === "callback_authorization_lost" ? "CALLBACK_AUTHORIZATION_LOST" : "CALLBACK_TRANSPORT_LOST", callbackCause, leaseId, childExitCode: childResult.code, cleanup, fenced: true, error: `callback transport authorization or runtime context was lost (${callbackCause}); child stopped` };
     }
     if (tunnelLost && !receivedSignal) {
       return tunnelLostResult(tunnelLost, { leaseId, cleanup, childExitCode: childResult.code, fenced: fencing, ...(parkIncident ? { incident: parkIncident } : {}) });
@@ -5092,6 +5113,8 @@ export function runReceiptFields(result) {
     transport: result.execution?.transport ?? "none",
     // BOT-2775: present only when the callback was served over the native route.
     ...(result.execution?.callbackTransport ? { callback_transport: result.execution.callbackTransport } : {}),
+    // BOT-2828: the typed cause of a native callback route close (e.g. CALLBACK_RUNTIME_DRIFT).
+    ...(result.callbackCause ? { callback_cause: result.callbackCause } : {}),
     // BOT-2780: the reserved requester origin generated auth links name (never a credential).
     ...(result.execution?.requesterOrigin ? { requester_origin: result.execution.requesterOrigin } : {}),
     // BOT-2788: "previous" (an idle stack's origin re-reserved), "previous_port_busy" or "new".