@botbuddy/cli 1.63.43 → 1.64.0

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.43",
-  "source_commit": "580bdbe602c9281c639efbd317018a75011ea70c",
-  "source_sha256": "d04edc606580d8c6304eb6ed88d1fbb9b5a6c8d9b0aad2fea9f92e1cc1cedbb7",
+  "release_version": "1.64.0",
+  "source_commit": "e6cc3786c39bf5326fe5b5dabccd80c1fba8b17d",
+  "source_sha256": "0f97518d4f2ad1ac4d1195fd80ce4fa875a587b3ab2f102fbb5e28d6d5d62172",
   "target": "darwin-arm64",
-  "sha256": "ec91fd06a1a4da1a271c5343619f66f18ea16c2d676247fbd22e5bfaa9a9a976"
+  "sha256": "675ce80ef07e7ef87f3a9111e911cd6241a775d5af4812dd9f53fb29846b9832"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.63.43",
-  "source_commit": "580bdbe602c9281c639efbd317018a75011ea70c",
-  "source_sha256": "d04edc606580d8c6304eb6ed88d1fbb9b5a6c8d9b0aad2fea9f92e1cc1cedbb7",
+  "release_version": "1.64.0",
+  "source_commit": "e6cc3786c39bf5326fe5b5dabccd80c1fba8b17d",
+  "source_sha256": "0f97518d4f2ad1ac4d1195fd80ce4fa875a587b3ab2f102fbb5e28d6d5d62172",
   "target": "linux-x64",
-  "sha256": "8437df29241846a8dddfad4ce6c5a77237c0dc38bf8006512e4c22fe911fb380"
+  "sha256": "3223c862b52f1e81777e7c9403f6c854c5192f618c2c7ee46c56ad5b0a9ccfd9"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.63.43",
-  "source_commit": "580bdbe602c9281c639efbd317018a75011ea70c",
-  "source_sha256": "d04edc606580d8c6304eb6ed88d1fbb9b5a6c8d9b0aad2fea9f92e1cc1cedbb7",
+  "release_version": "1.64.0",
+  "source_commit": "e6cc3786c39bf5326fe5b5dabccd80c1fba8b17d",
+  "source_sha256": "0f97518d4f2ad1ac4d1195fd80ce4fa875a587b3ab2f102fbb5e28d6d5d62172",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "ec91fd06a1a4da1a271c5343619f66f18ea16c2d676247fbd22e5bfaa9a9a976",
+      "sha256": "675ce80ef07e7ef87f3a9111e911cd6241a775d5af4812dd9f53fb29846b9832",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "8437df29241846a8dddfad4ce6c5a77237c0dc38bf8006512e4c22fe911fb380",
+      "sha256": "3223c862b52f1e81777e7c9403f6c854c5192f618c2c7ee46c56ad5b0a9ccfd9",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.63.43",
+  "version": "1.64.0",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/daemon/automatic.mjs

@@ -0,0 +1,81 @@
+import { callToolJson, resolveCallAuth } from "../api.mjs";
+import {
+  assertSshHost,
+  installedBinaryPath,
+  stageRemoteDaemonRelease,
+} from "./installer.mjs";
+import { validateDaemonRelease } from "./release.mjs";
+import { nativeHandoverCommand } from "./handover.mjs";
+const fail = (code) => {
+  throw new Error(code);
+};
+// One explicit administrator installation grants only the fixed native
+// coordinator/schedule. Persisted operator opt-in remains a separate drawer act.
+export async function installAutomaticDaemonUpdater(spec, {
+  validateRelease = validateDaemonRelease,
+  resolveAuth = resolveCallAuth,
+  identity = callToolJson,
+  stage = stageRemoteDaemonRelease,
+  native = nativeHandoverCommand,
+} = {}) {
+  if (
+    !spec || typeof spec !== "object" || Array.isArray(spec) ||
+    Object.keys(spec).some((key) =>
+      ![
+        "platform",
+        "arch",
+        "sshHost",
+        "serviceUser",
+        "releaseRoot",
+        "expectedHostKey",
+        "tenant",
+      ].includes(key)
+    ) || !["linux", "darwin"].includes(spec.platform) ||
+    typeof spec.serviceUser !== "string" || spec.serviceUser === "root" ||
+    !/^[a-z_][a-z0-9_-]*$/i.test(spec.serviceUser) ||
+    !/^bbh-[0-9a-f]{24}$/.test(spec.expectedHostKey) ||
+    typeof spec.tenant !== "string" || !spec.tenant
+  ) fail("daemon_automatic_install_spec_invalid");
+  assertSshHost(spec.sshHost);
+  const release = await validateRelease({ releaseRoot: spec.releaseRoot }, {
+    platform: spec.platform,
+    arch: spec.arch,
+  });
+  const resolved = await resolveAuth({
+    toolName: "daemon_handover",
+    preferSession: false,
+  });
+  if (resolved?.error || !resolved?.auth) {
+    fail("daemon_automatic_install_auth_required");
+  }
+  const who = await identity("whoami", {}, {
+    auth: resolved.auth,
+    tenant: spec.tenant,
+  });
+  if (
+    !who?.ok || who.isError || typeof who.data?.owner_email !== "string" ||
+    !who.data.owner_email.includes("@") || who.data.tenant_id !== spec.tenant
+  ) fail("daemon_automatic_install_owner_unavailable");
+  const staged = await stage({
+    platform: spec.platform,
+    host: spec.sshHost,
+    user: spec.serviceUser,
+    release,
+  });
+  const binary = installedBinaryPath(release);
+  if (staged?.binary !== binary) fail("daemon_automatic_install_stage_invalid");
+  const result = await native({
+    host: spec.sshHost,
+    binary,
+    mode: "automatic-install",
+    input: {
+      host_key: spec.expectedHostKey,
+      owner_email: who.data.owner_email,
+      tenant_id: who.data.tenant_id,
+    },
+  });
+  if (result?.installed !== true || result.protocol !== 2) {
+    fail("daemon_automatic_install_receipt_invalid");
+  }
+  return { installed: true, protocol: 2, host_key: spec.expectedHostKey };
+}

package/src/daemon/commands.mjs

@@ -5,6 +5,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { registerContainerHost } from "../api.mjs";
+import { installAutomaticDaemonUpdater } from "./automatic.mjs";
 import { upgradeDaemonHost } from "./handover.mjs";
 import { awaitHostApproval } from "./approval-wait.mjs";
 import { bootstrapFreshDaemon } from "./bootstrap.mjs";
@@ -49,6 +50,7 @@ export const daemonHelp = `Usage:
   bb daemon config-render '<json host policy>'
   bb daemon enroll '<json host-bound enrollment spec>'
   bb daemon bootstrap '<json fresh-host bootstrap spec>'
+  bb daemon updater-install '<json automatic updater installation spec>'
   bb daemon upgrade '<json controlled host upgrade spec>'
 
 The Go payload is verified from the extracted universal package before sudo.
@@ -293,6 +295,7 @@ export async function cmdDaemon(args, {
   verifyRemoteHelperIdentity = verifyRemoteHelperIdentityOnTarget,
   bootstrap = bootstrapFreshDaemon,
   upgrade = upgradeDaemonHost,
+  installAutomaticUpdater = installAutomaticDaemonUpdater,
   registerHost = registerContainerHost,
   createBootstrapIdentity = createRemoteBootstrapIdentity,
   inspectBootstrapIdentity = inspectRemoteBootstrapIdentity,
@@ -305,6 +308,11 @@ export async function cmdDaemon(args, {
     log(daemonHelp);
     return 0;
   }
+  if(args[0]==="updater-install"){
+    if(args.length!==2)fail("Usage: bb daemon updater-install '<json automatic updater installation spec>'");
+    let spec;try{spec=JSON.parse(args[1]);}catch{fail("daemon_automatic_install_spec_invalid");}
+    log(JSON.stringify(await installAutomaticUpdater(spec)));return 0;
+  }
   if(args[0]==="upgrade"){
     if(args.length!==2)fail("Usage: bb daemon upgrade '<json controlled host upgrade spec>'");
     let spec;try{spec=JSON.parse(args[1]);}catch{fail("daemon_handover_spec_invalid");}

package/src/daemon/handover.mjs

@@ -27,9 +27,9 @@ export function nativeHandoverCommand(
   { spawnImpl = spawn } = {},
 ) {
   if (
-    !immutableBinaryRE.test(binary) || !["inspect", "submit"].includes(mode)
+    !immutableBinaryRE.test(binary) || !["inspect", "submit", "automatic-install"].includes(mode)
   ) fail("daemon_handover_command_invalid");
-  const flag = mode === "inspect"
+  const flag = mode === "automatic-install" ? "--native-automatic-update-install" : mode === "inspect"
     ? "--native-handover-inspect"
     : "--native-handover-submit";
   let command = "sudo", args = ["-n", binary, flag];

package/src/stack-run-outcome.mjs

@@ -13,7 +13,10 @@
 // path, hostname, env value, argv or command output can reach the server. The
 // server re-validates the same allowlist (supabase/functions/_shared/lib/stackRunOutcome.ts).
 
+import { spawnSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
+import { lstatSync } from "node:fs";
+import { basename, isAbsolute } from "node:path";
 import { VERSION } from "./version.mjs";
 import { validStackLeaseId } from "./stack-lease-correlation.mjs";
 
@@ -23,7 +26,15 @@ export const STACK_RUN_OUTCOME_TOOL = "record_stack_run_outcome";
 export const STACK_RUN_OUTCOME_TIMEOUT_MS = 2000;
 /** `=off` disables the record (the CLI test suites set it; nothing else should). */
 export const STACK_RUN_OUTCOME_OPT_OUT_ENV = "BOTBUDDY_STACK_RUN_OUTCOME";
-export const STACK_RUN_OUTCOME_CATEGORIES = Object.freeze(["platform", "script", "interrupted", "invocation"]);
+export const STACK_RUN_OUTCOME_CATEGORIES = Object.freeze(["platform", "script", "interrupted", "invocation", "released"]);
+/**
+ * BOT-2881: a signal carries no sender, so a hold's owner says so first. The hold sets this to an
+ * absolute path when it starts `bb stack run`, and its stop command creates that file before
+ * sending SIGTERM. Without it, every signal stays `interrupted`.
+ */
+export const STACK_RELEASE_INTENT_ENV = "BOTBUDDY_STACK_RELEASE_INTENT_FILE";
+export const STACK_SIGNAL_SOURCE_OWNER_RELEASE = "owner_release";
+export const STACK_RELEASE_INTENT_MTIME_SLACK_MS = 2000;
 
 const CODE_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
 const TOKEN_RE = /^[a-z0-9_-]{1,64}$/;
@@ -31,6 +42,7 @@ const LANE_RE = /^[A-Za-z0-9:_.-]{1,128}$/;
 const TICKET_RE = /^[A-Za-z][A-Za-z0-9]*-\d{1,9}$/;
 const REPO_RE = /^[A-Za-z0-9._/-]{1,128}$/;
 const VERSION_RE = /^[0-9A-Za-z.+-]{1,32}$/;
+const SIGNAL_RE = /^SIG[A-Z]{1,12}$/;
 const AUTHORIZATION_REASON_RE = /^[a-z0-9_.:-]{1,64}$/;
 
 // Mirrors stack.mjs EXIT (kept local so this module stays dependency-free for tests).
@@ -57,12 +69,16 @@ function boundedCode(value) {
  *                 (`--hard-ttl` stop → code HARD_TTL)
  *   platform    — the stack, its transport, the credential or the backend failed
  *   interrupted — a signal ended the run (operator Ctrl-C / parent kill)
+ *   released    — the owner of a hold stopped it on purpose (BOT-2881), and its lease and cleanup held
  *   invocation  — exit 4: bad arguments or a refused request before any lease
  */
 export function classifyStackRunOutcome(fields = {}, exitCode) {
   const code = boundedCode(fields.code);
   const child = Number.isInteger(fields.child_exit_code) ? fields.child_exit_code : null;
   const outcome = typeof fields.outcome === "string" ? fields.outcome : null;
+  // BOT-2881: the owner's stop never hides an unproven teardown (exit 143 would otherwise read as a signal).
+  if (fields.stop_signal?.source === STACK_SIGNAL_SOURCE_OWNER_RELEASE && fields.cleanup === false) return { category: "platform", code: "CLEANUP_FAILED" };
+  if (outcome === "released") return { category: "released", code };
   if (outcome === "interrupted") return { category: "interrupted", code };
   if (code && PLATFORM_CODES.has(code)) return { category: "platform", code };
   // The stdout fence also covers unresolved cleanup. The lifecycle supplies its
@@ -92,6 +108,61 @@ export function classifyStackRunOutcome(fields = {}, exitCode) {
   }
 }
 
+/**
+ * BOT-2881: whether a lifecycle result is an owner's release that held: the signal decided the
+ * exit, not fenced, not a typed platform loss, and cleanup not refused. Anything else keeps its
+ * own outcome and category.
+ */
+export function ownerReleaseHeld(result = {}) {
+  return result.stopSignal?.source === STACK_SIGNAL_SOURCE_OWNER_RELEASE && SIGNAL_EXITS.has(result.exitCode)
+    // Any typed code (a platform loss, CALLBACK_CLEANUP_UNCERTAIN, …) keeps the run's own outcome.
+    && result.fenced !== true && result.cleanup?.ok !== false && result.code == null;
+}
+
+/** BOT-2881: the declared intent exists, is a regular file and was written after this run began. */
+export function stackReleaseIntentDeclared({ env = process.env, startedAtMs } = {}) {
+  const file = env?.[STACK_RELEASE_INTENT_ENV];
+  if (typeof file !== "string" || !isAbsolute(file) || !Number.isFinite(startedAtMs)) return false;
+  try {
+    const entry = lstatSync(file);
+    // A filesystem clock may trail Date.now() by a few ms (coarse Linux mtimes); an earlier run's
+    // file is minutes or hours old, so a small slack never admits it.
+    return entry.isFile() && entry.mtimeMs >= startedAtMs - STACK_RELEASE_INTENT_MTIME_SLACK_MS;
+  } catch {
+    return false;
+  }
+}
+
+/** BOT-2881: the parent's process name as a bounded token, or null. A name only: never its argv. */
+export function readParentProcessName(ppid, { run = spawnSync } = {}) {
+  if (!Number.isInteger(ppid) || ppid <= 1) return null;
+  try {
+    const ps = run("ps", ["-o", "comm=", "-p", String(ppid)], { encoding: "utf8", timeout: 300 });
+    if (ps?.status !== 0 || typeof ps.stdout !== "string") return null;
+    const name = basename(ps.stdout.trim()).replace(/^-/, "").toLowerCase();
+    return TOKEN_RE.test(name) ? name : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * BOT-2881: what this process can know about the signal that is ending it. Node exposes no sender,
+ * so `source` is one of: the owner's declared release, a terminal (SIGINT/SIGHUP with a TTY), a
+ * parent that had already gone, or unknown, with the parent that could have sent it named.
+ * `lossFirst`: the lease or its transport was already lost, so this stop did not end the run.
+ */
+export function observeStackRunSignal(signal, {
+  env = process.env, startedAtMs, startPpid = null, ppid = process.ppid, stdinIsTty = process.stdin?.isTTY === true,
+  lossFirst = false, intentDeclared = stackReleaseIntentDeclared, parentName = readParentProcessName,
+} = {}) {
+  if (signal === "SIGTERM" && !lossFirst && intentDeclared({ env, startedAtMs })) {
+    return { signal, source: STACK_SIGNAL_SOURCE_OWNER_RELEASE, parent: null };
+  }
+  if (startPpid != null && ppid !== startPpid) return { signal, source: "parent_exited", parent: null };
+  return { signal, source: stdinIsTty && signal !== "SIGTERM" ? "terminal" : "unknown", parent: parentName(ppid) };
+}
+
 /** The lane id from `$BOTBUDDY_LANE_SOURCE_RUN_ID` (`lefthook:<invocation>:<lane>`), or null. */
 export function laneFromSourceRunId(value) {
   if (typeof value !== "string" || !value.startsWith("lefthook:")) return null;
@@ -110,6 +181,8 @@ const exitInt = (value) => (Number.isInteger(value) && value >= 0 && value <= 25
  */
 export function buildStackRunOutcomePayload({ fields = {}, exitCode, runId = randomUUID(), opts = {}, env = process.env, durationMs = null }) {
   const { category, code } = classifyStackRunOutcome(fields, exitCode);
+  // BOT-2881: present only when a signal ended the run, so an unsignalled run's payload is unchanged.
+  const signal = pick(fields.stop_signal?.signal, SIGNAL_RE);
   // BOT-2880: sent only when present, because an older server refuses an unknown key.
   const callbackAuthorizationReason = pick(fields.callback_authorization_reason, AUTHORIZATION_REASON_RE);
   return {
@@ -129,6 +202,11 @@ export function buildStackRunOutcomePayload({ fields = {}, exitCode, runId = ran
     repo: pick(opts.repo, REPO_RE),
     duration_ms: Number.isFinite(durationMs) && durationMs >= 0 ? Math.round(durationMs) : null,
     cli_version: pick(VERSION, VERSION_RE) ?? "unknown",
+    ...(signal ? {
+      signal,
+      signal_source: pick(fields.stop_signal.source, TOKEN_RE),
+      signal_parent: pick(fields.stop_signal.parent, TOKEN_RE),
+    } : {}),
     ...(callbackAuthorizationReason ? { callback_authorization_reason: callbackAuthorizationReason } : {}),
   };
 }

package/src/stack.mjs

@@ -58,7 +58,7 @@ import { FORWARD_ATTESTATION_ENV, startForwardAttestation, readForwardAttestatio
 import { stackServicesForForwards } from "./stack-service-discovery.mjs";
 import { ENGINE_PUBLISHES_BEYOND_LOOPBACK, engineSocketIsLocal, formatPublishIp, isLoopbackIp, publishIpFix, resolvePublishIp } from "./docker-publish-ip.mjs";
 import { bold, dim, yellow } from "./utils.mjs";
-import { reportStackRunOutcome } from "./stack-run-outcome.mjs";
+import { STACK_RELEASE_INTENT_ENV, observeStackRunSignal, ownerReleaseHeld, reportStackRunOutcome } from "./stack-run-outcome.mjs";
 
 export const STACK_SCHEMA_VERSION = 1;
 
@@ -253,6 +253,9 @@ ${bold("run OPTIONS")}
                          goes IDLE (no reap wait; receipt cleanup {idle, idle_since}) and the stack
                          directory + port block stay reserved (24 h, renewed on re-adoption).
                          Interrupts, --hard-ttl, a fenced heartbeat or a lost tunnel always reap.
+                         A hold that outlives its starter sets ${STACK_RELEASE_INTENT_ENV}
+                         to an absolute path and creates that file just before its stop sends SIGTERM:
+                         the run is then recorded as released, not interrupted (BOT-2881).
   --connection-file P    Optional empty file path for the mode-0600 connection JSON.
   --hard-ttl N           Bound the child runtime; timeout requests normal cleanup.
   --local-exec           Rejected: stack run never starts Docker directly.
@@ -3752,7 +3755,8 @@ export async function runStackLifecycle(opts, childArgv, adapters = {}) {
   const withExecution = incidentBox.execution && !withIncident?.execution ? { ...withIncident, execution: incidentBox.execution } : withIncident;
   const withIdle = incidentBox.idleLease && !withExecution?.idleLease ? { ...withExecution, idleLease: incidentBox.idleLease } : withExecution;
   const withPortBlock = incidentBox.portBlock && !withIdle?.portBlock ? { ...withIdle, portBlock: incidentBox.portBlock } : withIdle;
-  const final = incidentBox.webUrl && withPortBlock && !withPortBlock.webUrl ? { ...withPortBlock, webUrl: incidentBox.webUrl } : withPortBlock;
+  const withWebUrl = incidentBox.webUrl && withPortBlock && !withPortBlock.webUrl ? { ...withPortBlock, webUrl: incidentBox.webUrl } : withPortBlock;
+  const final = incidentBox.stopSignal && withWebUrl ? { ...withWebUrl, stopSignal: incidentBox.stopSignal } : withWebUrl;
   // BOT-2467: non-enumerable, so the receipt fields and result comparisons never see it.
   if (final && typeof final === "object" && incidentBox.outcomeChannel) {
     Object.defineProperty(final, OUTCOME_CHANNEL, { value: incidentBox.outcomeChannel, enumerable: false });
@@ -3875,6 +3879,10 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   let execution = null;
   let leaseProvisioned = false;
   let receivedSignal = null;
+  // BOT-2881: an intent counts only when written after this run began; a parent change is an orphan.
+  const observeSignal = adapters.observeSignal ?? observeStackRunSignal;
+  const runStartedAtMs = Date.now();
+  const startPpid = process.ppid;
   let forcedStopCode = null;
   let fencing = false;
   let activeWaitAbort = null;
@@ -4080,6 +4088,11 @@ async function runStackLifecycleOnce(opts, childArgv, adapters, incidentBox) {
   const onSignal = (signal) => {
     if (receivedSignal) return;
     receivedSignal = signal;
+    try {
+      incidentBox.stopSignal = observeSignal(signal, { startedAtMs: runStartedAtMs, startPpid, lossFirst: fencing || forcedStopCode != null });
+    } catch {
+      incidentBox.stopSignal = { signal, source: "unknown", parent: null };
+    }
     activeWaitAbort?.abort("interrupted");
     stopChild(signal);
     // If capacity is still queued/provisioning there is no child to hold open;
@@ -5151,7 +5164,9 @@ export function runReceiptFields(result) {
   return {
     // BOT-1797: carry the server's typed refusal code (e.g. stack_path_root_refused)
     // so automation can branch on it instead of matching the message text.
-    command: "run", outcome: result.outcome, code: result.code ?? null, lease_id: result.leaseId ?? null,
+    command: "run", outcome: ownerReleaseHeld(result) ? "released" : result.outcome, code: result.code ?? null, lease_id: result.leaseId ?? null,
+    // BOT-2881: the signal that ended this run and what is known of its source (never on a run no signal touched).
+    ...(result.stopSignal ? { stop_signal: result.stopSignal } : {}),
     ...(result.state ? { state: result.state } : {}),
     // BOT-2468: the lease's /docker?lease= deeplink (null when the server sent none).
     web_url: result.webUrl ?? null,