@botbuddy/cli 1.63.32 → 1.63.35

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.32",
-  "source_commit": "91ea9b88abe8effa478b5dcf15d42e1898afc3e9",
-  "source_sha256": "a7741aa15134ea47f319a63a32ee1d40cf993636e693e679d77534d257f31aa7",
+  "release_version": "1.63.35",
+  "source_commit": "4517f4b0fe820afa3c976ac2a07bbbf02253fb86",
+  "source_sha256": "20ba1366169f553685a44b2ffb1d08b8155f8c91e6a6c215909c5fb0825a5f81",
   "target": "darwin-arm64",
-  "sha256": "8f3782ebb257b5676259ae478fe76ae54903e86d9343898cf48c26496ad6e64f"
+  "sha256": "e397a1b045b4ccd213e9a7a7dbc3631b83d8af2e0dff67b90b81c365ed9b1b41"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.32",
-  "source_commit": "91ea9b88abe8effa478b5dcf15d42e1898afc3e9",
-  "source_sha256": "a7741aa15134ea47f319a63a32ee1d40cf993636e693e679d77534d257f31aa7",
+  "release_version": "1.63.35",
+  "source_commit": "4517f4b0fe820afa3c976ac2a07bbbf02253fb86",
+  "source_sha256": "20ba1366169f553685a44b2ffb1d08b8155f8c91e6a6c215909c5fb0825a5f81",
   "target": "linux-x64",
-  "sha256": "404616db3ad3184c701b3330a23b23f3a2636ca5858dbb4e5bdcea93775c6ca3"
+  "sha256": "c2a2d4b815867bf1e6c4008cbb2eda12d1aecee16e3f11727e445307742a5521"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.32",
-  "source_commit": "91ea9b88abe8effa478b5dcf15d42e1898afc3e9",
-  "source_sha256": "a7741aa15134ea47f319a63a32ee1d40cf993636e693e679d77534d257f31aa7",
+  "release_version": "1.63.35",
+  "source_commit": "4517f4b0fe820afa3c976ac2a07bbbf02253fb86",
+  "source_sha256": "20ba1366169f553685a44b2ffb1d08b8155f8c91e6a6c215909c5fb0825a5f81",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "8f3782ebb257b5676259ae478fe76ae54903e86d9343898cf48c26496ad6e64f",
+      "sha256": "e397a1b045b4ccd213e9a7a7dbc3631b83d8af2e0dff67b90b81c365ed9b1b41",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "404616db3ad3184c701b3330a23b23f3a2636ca5858dbb4e5bdcea93775c6ca3",
+      "sha256": "c2a2d4b815867bf1e6c4008cbb2eda12d1aecee16e3f11727e445307742a5521",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.32",
+  "version": "1.63.35",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/run.mjs

@@ -35,6 +35,11 @@ export const EXIT = Object.freeze({ OK: 0, AUTH: 3, INVALID: 4, BACKEND: 5, INTE
 export const DEFAULT_TIMEOUT_SECONDS = 8 * 60 * 60;
 export const TIMEOUT_GRACE_MS = 5_000;
 const MAX_CAPTURE_BYTES = 8_192;
+// BOT-2530: a detached worker holds a server-clocked liveness lease on its run.
+// It renews every 30 s; four missed renewals (120 s) let the server's reconciler
+// terminalize the run as owner_lost so a `command-run:` waiter always ends.
+export const WORKER_HEARTBEAT_TTL_SECONDS = 120;
+export const WORKER_HEARTBEAT_INTERVAL_MS = 30_000;
 // BOT-1510: how often the worker flushes lane case verdicts to the backend.
 // Well under AC-3's 5 s so a begin/verdict is visible within the window.
 const LANE_FLUSH_INTERVAL_MS = 2_500;
@@ -583,6 +588,7 @@ export async function launchRun(argv, {
     command_hash: commandFingerprint, ...(launchSourceSha ? { source_sha: launchSourceSha } : {}), environment_hash: environmentHash(cwd, opts.environment),
     environment: opts.environment, command_kind: opts.kind, expected_duration_seconds: opts.expectedDuration,
     rerun_reason: opts.rerunReason,
+    worker_heartbeat_ttl_seconds: WORKER_HEARTBEAT_TTL_SECONDS,
   });
   let registration = await effectiveCall("register_command", registerArgs());
   // A cached session can be revoked server-side before its local expiry.  The
@@ -610,7 +616,7 @@ export async function launchRun(argv, {
   // every callback is attributable to the same agent. It deliberately stays
   // outside child_env, receipts, and the workload's process environment.
   const knownSession = opts.sessionId ?? managedCredential?.identity?.sessionId ?? managedCredential?.sessionId;
-  await writeJson(context, { schema_version: RUN_SCHEMA_VERSION, context_path: context, run_id: runId, run_credential: registration.data.run_credential, receipt_upload: registration.data.receipt_upload, command, command_hash: commandFingerprint, source_sha: launchSourceSha, cwd, timeout_seconds: opts.timeout, receipt_path: receipt, launched_at: new Date().toISOString(), server_url: SERVER_URL, ...(opts.sessionToken ? { callback_session_token: opts.sessionToken } : {}), ...(knownSession ? { callback_session_id: knownSession } : {}), ...(childEnv && Object.keys(childEnv).length ? { child_env: childEnv } : {}), ...(testRun ? { test_run: testRun } : {}) });
+  await writeJson(context, { schema_version: RUN_SCHEMA_VERSION, context_path: context, run_id: runId, run_credential: registration.data.run_credential, receipt_upload: registration.data.receipt_upload, command, command_hash: commandFingerprint, source_sha: launchSourceSha, cwd, timeout_seconds: opts.timeout, receipt_path: receipt, launched_at: new Date().toISOString(), server_url: SERVER_URL, worker_heartbeat_ttl_seconds: WORKER_HEARTBEAT_TTL_SECONDS, ...(opts.sessionToken ? { callback_session_token: opts.sessionToken } : {}), ...(knownSession ? { callback_session_id: knownSession } : {}), ...(childEnv && Object.keys(childEnv).length ? { child_env: childEnv } : {}), ...(testRun ? { test_run: testRun } : {}) });
   const [file, args] = workerInvocation(context);
   try {
     const worker = spawnImpl(file, args, { detached: true, stdio: "ignore", windowsHide: true });
@@ -623,7 +629,10 @@ export async function launchRun(argv, {
   }
   return { exitCode: EXIT.OK, receipt: { schema_version: RUN_SCHEMA_VERSION, outcome: "launched", run_id: runId,
     ...(knownSession ? { session_id: knownSession } : { session_binding: "server_derived" }),
-    durable_owner: "detached_worker", receipt_path: receipt, reentry: "update_command_run publishes the terminal callback for this run_id", exit_code: EXIT.OK } };
+    durable_owner: "detached_worker", receipt_path: receipt, reentry: "update_command_run publishes the terminal callback for this run_id",
+    // BOT-2318: the exact pending wait for this run. Keep its result pending in
+    // the same work session; its return is what resumes the caller (BOT-2501).
+    wait_command: `bb wait 'command-run:id=${runId}'`, exit_code: EXIT.OK } };
 }
 
 export async function runWorker(contextFile, {
@@ -633,11 +642,14 @@ export async function runWorker(contextFile, {
   terminate = terminateProcessGroup,
   // BOT-2600: the bounded terminal delivery (see retryTerminalUpdate).
   sleep, now, terminalBudgetMs, startDelivery,
+  // BOT-2530: worker liveness lease renewal cadence (tests inject a fake timer).
+  workerHeartbeatIntervalMs = WORKER_HEARTBEAT_INTERVAL_MS, setIntervalFn = setInterval,
 } = {}) {
   const retry = { sleep, now, budgetMs: terminalBudgetMs, startDelivery };
   const context = JSON.parse(await readFile(contextFile, "utf8"));
   const callbackCall = callWithContextIdentity(context, call);
   const ownerHeartbeat = startOwnerHeartbeat(context, callbackCall);
+  const workerLease = startWorkerLease(context, callbackCall, { intervalMs: workerHeartbeatIntervalMs, setIntervalFn });
   const startedAt = new Date().toISOString();
   let timedOut = false;
   let child;
@@ -738,11 +750,44 @@ export async function runWorker(contextFile, {
     const receipt = await finalize(context, { status, startedAt, endedAt, exitCode: result.exitCode, signal: result.signal, output: capture.output, outputCharacters: capture.characters }, callbackCall, retry);
     return receipt;
   } finally {
+    if (workerLease) await workerLease.stop();
     if (ownerHeartbeat) await ownerHeartbeat.stop();
     signalEmitter.removeListener("SIGTERM", cancellationHandler);
   }
 }
 
+// BOT-2530: renew this run's liveness lease while the worker lives. The first
+// renewal also moves a registered run to running. A rejected or failed renewal
+// is not retried specially: the next tick tries again, and a terminal run
+// refuses renewals server-side. Contexts sealed by an older launcher (no
+// declared lease) send nothing.
+export function startWorkerLease(context, call, { intervalMs = WORKER_HEARTBEAT_INTERVAL_MS, setIntervalFn = setInterval } = {}) {
+  if (!Number.isInteger(context.worker_heartbeat_ttl_seconds)) return null;
+  let stopped = false;
+  let chain = Promise.resolve();
+  const tick = () => {
+    chain = chain.then(async () => {
+      if (stopped) return;
+      try {
+        await call("update_command_run", { run_id: context.run_id, run_credential: context.run_credential, status: "running", worker_heartbeat: true }, {
+          signal: AbortSignal.timeout(DELIVERY_CALL_TIMEOUT_MS),
+          ...(typeof context.server_url === "string" && context.server_url ? { serverUrl: context.server_url } : {}),
+        });
+      } catch { /* the lease lapses only after several missed renewals */ }
+    });
+  };
+  tick();
+  const timer = setIntervalFn(tick, intervalMs);
+  timer.unref?.();
+  return { async stop() {
+    stopped = true;
+    clearInterval(timer);
+    let bound;
+    await Promise.race([chain, new Promise((resolve) => { bound = setTimeout(resolve, 2_000); bound.unref?.(); })]);
+    clearTimeout(bound);
+  } };
+}
+
 function startOwnerHeartbeat(context, call, { intervalMs = 5 * 60_000, setIntervalFn = setInterval } = {}) {
   // A detached worker must never acquire liveness through its ambient default
   // identity. It can only refresh the bearer sealed for its owner.

package/src/update-check.mjs

@@ -13,6 +13,7 @@
 // off to a detached, unref'd `npm install -g` and exits 0.
 
 import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { readFileSync } from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -22,7 +23,11 @@ import { VERSION } from "./version.mjs";
 export const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export const NPM_LATEST_URL = "https://registry.npmjs.org/@botbuddy/cli/latest";
 export const NPM_LATEST_TIMEOUT_MS = 1500;
-export const UPDATE_COMMAND = "npm i -g @botbuddy/cli@latest";
+export const UPDATE_COMMAND = "npm install -g @botbuddy/cli@latest";
+
+export function formatUpdateOffer(current, latest) {
+  return `\nUpdate available\n  Current: v${current}\n  Latest:  v${latest}\n  Run:     bb update\n`;
+}
 
 export function defaultUpdateCheckCachePath(home = homedir()) {
   return join(home, ".botbuddy", "update-check.json");
@@ -106,16 +111,26 @@ export async function maybeWarnStale({
       await writeCache(cachePath, { checkedAt: now(), latest });
     }
     if (typeof latest !== "string" || !isNewerVersion(latest, version)) return { warned: false, latest: latest ?? null };
-    stderr.write(`botbuddy: update available ${version} → ${latest}: ${UPDATE_COMMAND}\n`);
+    stderr.write(formatUpdateOffer(version, latest));
     return { warned: true, latest };
   } catch {
     return { warned: false, latest: null };
   }
 }
 
-// `botbuddy update` — hand off to npm and get out of the way.
-export function cmdUpdate({ version = VERSION, spawnImpl = spawn, probeImpl = spawnSync, log = (line) => console.log(line), platform = process.platform, stderr = process.stderr } = {}) {
-  log(`current: ${version}`);
+export function readInstalledVersion({ npmBin = "npm", shellOpt = {}, probeImpl = spawnSync, readPackage = readFileSync } = {}) {
+  const root = probeImpl(npmBin, ["root", "-g"], { encoding: "utf8", ...shellOpt });
+  if (root?.error || root?.status !== 0) throw new Error(`npm global root lookup failed for ${npmBin}`);
+  const directory = String(root?.stdout ?? "").trim();
+  if (!directory) throw new Error("npm global root lookup returned no directory");
+  const packageJson = JSON.parse(readPackage(join(directory, "@botbuddy", "cli", "package.json"), "utf8"));
+  if (typeof packageJson?.version !== "string" || !parseSemver(packageJson.version)) throw new Error("installed @botbuddy/cli package has no valid version");
+  return packageJson.version;
+}
+
+// `botbuddy update` waits for npm because the terminal result, rather than the
+// child-process launch, is the only trustworthy confirmation an update worked.
+export function cmdUpdate({ version = VERSION, spawnImpl = spawn, probeImpl = spawnSync, readInstalledVersion: installedVersion = readInstalledVersion, log = (line) => console.log(line), platform = process.platform, stderr = process.stderr } = {}) {
   // BOT-1566 (Codex P1/P2): on Windows npm is the `npm.cmd` shim, and Node
   // cannot spawn a .cmd file shell-free (docs) — run it through a shell on
   // win32 (args are all static constants, so no injection surface) and select
@@ -134,34 +149,44 @@ export function cmdUpdate({ version = VERSION, spawnImpl = spawn, probeImpl = sp
     try { stderr.write(`botbuddy update: npm was not found — install Node.js/npm, then retry (looked for ${npmBin})\n`); } catch { /* ignore */ }
     return Promise.resolve(1);
   }
+  log(`BotBuddy CLI update\n  Current: v${version}\n\n$ ${UPDATE_COMMAND}`);
   const child = spawnImpl(npmBin, ["install", "-g", "@botbuddy/cli@latest"], {
     stdio: "inherit",
-    detached: true,
     ...shellOpt,
   });
-  // Node reports a launch failure asynchronously via the `error` event, so we
-  // must NOT announce success until the child has actually spawned (Codex P2).
-  // Race spawn vs error: print + unref only on `spawn`, exit nonzero on `error`.
+  // Node reports a launch failure asynchronously via the `error` event. A
+  // successfully spawned child can still fail its install, so only `close: 0`
+  // plus a readable npm global package metadata record is a success.
   return new Promise((resolve) => {
     if (!child || typeof child.once !== "function") {
-      log("updating in background — re-run botbuddy --version to confirm");
-      if (child && typeof child.unref === "function") child.unref();
-      resolve(0);
+      try { stderr.write("botbuddy update: npm did not return a trackable process\n"); } catch { /* ignore */ }
+      resolve(1);
       return;
     }
     let settled = false;
-    child.once("spawn", () => {
-      if (settled) return;
-      settled = true;
-      if (typeof child.unref === "function") child.unref();
-      log("updating in background — re-run botbuddy --version to confirm");
-      resolve(0);
-    });
     child.once("error", (err) => {
       if (settled) return;
       settled = true;
       try { stderr.write(`botbuddy update: failed to launch npm (${err?.message ?? err})\n`); } catch { /* ignore */ }
       resolve(1);
     });
+    child.once("close", (code, signal) => {
+      if (settled) return;
+      settled = true;
+      if (code !== 0 || signal) {
+        const reason = signal ? `signal ${signal}` : `code ${code ?? "unknown"}`;
+        try { stderr.write(`botbuddy update: npm exited with ${reason}; no update was confirmed\n`); } catch { /* ignore */ }
+        resolve(1);
+        return;
+      }
+      try {
+        const installed = installedVersion({ npmBin, shellOpt });
+        log(`✓ Updated to v${installed}`);
+        resolve(0);
+      } catch (error) {
+        try { stderr.write(`botbuddy update: npm completed but could not verify the installed version (${error?.message ?? error})\n`); } catch { /* ignore */ }
+        resolve(1);
+      }
+    });
   });
 }

package/src/wait-core.mjs

@@ -46,6 +46,12 @@ export const EXIT = Object.freeze({
 // four, optionally wrapped in ONE pair of braces.
 const LEASE_UUID_SPELLING = /^(?:\{(?=.*\}$)|(?!.*\}$))((?:[0-9a-f]{4}-?){7}[0-9a-f]{4})\}?$/;
 
+// BOT-2318: bb run generates a lower-case UUID before register_command.
+const COMMAND_RUN_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+export const COMMAND_RUN_TERMINAL_STATUSES = Object.freeze(new Set([
+  "succeeded", "failed", "cancelled", "timed_out", "owner_lost", "invalidated",
+]));
+
 // BOT-2013: stack_lease frame states that mean the lease is gone, not granted.
 export const LEASE_LOST_STATES = Object.freeze(new Set(["reaping", "reaped", "reap_failed"]));
 // BOT-2400: the lease states a `lease:id=…,state=<s>` wait may target.
@@ -198,6 +204,18 @@ const VALIDATORS = {
     if (!p.id) throw new Error("test-run needs id=<run_id>");
     return { runId: String(p.id) };
   },
+  // BOT-2318: server binds this selector to the registering tenant, agent and work session.
+  "command-run": (p, raw) => {
+    const pair = /^\s*id\s*=\s*([0-9A-Fa-f-]+)\s*$/.exec(raw ?? "");
+    if (!pair || Object.keys(p).length !== 1 || p.id !== pair[1]) {
+      throw new Error("command-run needs exactly one id=<registered run id>");
+    }
+    const runId = pair[1].toLowerCase();
+    if (!COMMAND_RUN_ID.test(runId)) {
+      throw new Error("command-run id must be the canonical UUID that bb run printed");
+    }
+    return { runId };
+  },
   // BOT-2629: this is deliberately a dedicated condition rather than a raw
   // event escape hatch. The UUID is chosen before dispatch and the exact subject
   // prevents another run on the same idle/re-adopted lease waking this waiter.
@@ -620,7 +638,7 @@ export function parseConditions(specs) {
       return;
     }
     try {
-      const params = validator(parseParams(rawParams));
+      const params = validator(parseParams(rawParams), rawParams);
       conditions.push({ id: `c${index + 1}`, type, params });
     } catch (err) {
       errors.push({ spec, message: err.message });
@@ -1210,6 +1228,11 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
         prReviewFiltersMatch(signal, params, condition.review_guard);
     case "test-run":
       return signal.signal_type === "test_run" && signal.subject_key === `run:${params.runId}`;
+    case "command-run":
+      return signal.signal_type === "command_run" &&
+        signal.subject_key === `run:${params.runId}` &&
+        signal.payload?.run_id === params.runId &&
+        COMMAND_RUN_TERMINAL_STATUSES.has(signal.payload?.status);
     case "stack-run":
       return signal.signal_type === "stack_run" && signal.subject_key === `stack-run:${params.id}` &&
         signal.payload?.run_id === params.id && Number.isInteger(signal.payload?.exit_code);

package/src/wait.mjs

@@ -152,6 +152,14 @@ CONDITIONS  (TYPE:key=val,key=val — repeat for several; --any wakes on the fir
                                       valid workflow=/workflow_id=/workflow_path= lines.
   test-run:id=<run_id>                a test run reaching a terminal status (owner-scoped);
                                       bb test <lane> prints the exact line to arm.
+  command-run:id=<run_id>             BOT-2318: the bb run you registered reaching a terminal
+                                      outcome (succeeded, failed, cancelled, timed_out,
+                                      owner_lost, invalidated). Exit 0 on any terminal outcome;
+                                      the receipt's status says how the command ended. Arm it
+                                      from the same work session that ran bb run, as the ONLY
+                                      condition, and keep this wait's result pending: its
+                                      return is what resumes your task. A run whose worker is
+                                      lost ends owner_lost (bb run inspect <run_id>).
   stack-run:id=<run UUID>             one named bb stack run reaching its terminal outcome
                                       (BOT-2629). Choose the UUID BEFORE dispatch and pass it as
                                       bb stack run --run-id <UUID>; the receipt carries exit_code,
@@ -585,6 +593,12 @@ async function registerWait(opts, conditions, deadlineIso) {
       // caller-actionable hard stops, not the untracked live-only fallback.
       "chat_not_participant",
       "chat_participant_ambiguous",
+      // BOT-2318: command-run targets are authorization-bound to the registering
+      // tenant, agent and work session, and the condition cannot be composed.
+      // Both refusals require the caller to change its target/conditions; falling
+      // back to an untracked wait would only hide that error behind a timeout.
+      "command_run_unavailable",
+      "command_run_single_condition_required",
     ]);
     if (INVALID_CONDITION_CODES.has(body.error)) {
       const err = new Error(body.detail || body.error);