@botbuddy/cli 1.64.0 → 1.64.2

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.0",
-  "source_commit": "e6cc3786c39bf5326fe5b5dabccd80c1fba8b17d",
-  "source_sha256": "0f97518d4f2ad1ac4d1195fd80ce4fa875a587b3ab2f102fbb5e28d6d5d62172",
+  "release_version": "1.64.2",
+  "source_commit": "48e7d1b3e42d27353ef734e0c61402b9051eb51c",
+  "source_sha256": "8f806cc487b47875fd051cf2c3f4cfbcf4a3b3e7f25930cd81ff613a2e400d86",
   "target": "darwin-arm64",
-  "sha256": "675ce80ef07e7ef87f3a9111e911cd6241a775d5af4812dd9f53fb29846b9832"
+  "sha256": "1f1bff159d7c87ec19a13539afee99b58a325bb695d1ab2c22c0c794d59907d6"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.0",
-  "source_commit": "e6cc3786c39bf5326fe5b5dabccd80c1fba8b17d",
-  "source_sha256": "0f97518d4f2ad1ac4d1195fd80ce4fa875a587b3ab2f102fbb5e28d6d5d62172",
+  "release_version": "1.64.2",
+  "source_commit": "48e7d1b3e42d27353ef734e0c61402b9051eb51c",
+  "source_sha256": "8f806cc487b47875fd051cf2c3f4cfbcf4a3b3e7f25930cd81ff613a2e400d86",
   "target": "linux-x64",
-  "sha256": "3223c862b52f1e81777e7c9403f6c854c5192f618c2c7ee46c56ad5b0a9ccfd9"
+  "sha256": "806aa3ac12cba1b8fce8e29848f1c47be489201e7dd1f3347f0b9ce0b7ec2c1a"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.64.0",
-  "source_commit": "e6cc3786c39bf5326fe5b5dabccd80c1fba8b17d",
-  "source_sha256": "0f97518d4f2ad1ac4d1195fd80ce4fa875a587b3ab2f102fbb5e28d6d5d62172",
+  "release_version": "1.64.2",
+  "source_commit": "48e7d1b3e42d27353ef734e0c61402b9051eb51c",
+  "source_sha256": "8f806cc487b47875fd051cf2c3f4cfbcf4a3b3e7f25930cd81ff613a2e400d86",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "675ce80ef07e7ef87f3a9111e911cd6241a775d5af4812dd9f53fb29846b9832",
+      "sha256": "1f1bff159d7c87ec19a13539afee99b58a325bb695d1ab2c22c0c794d59907d6",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "3223c862b52f1e81777e7c9403f6c854c5192f618c2c7ee46c56ad5b0a9ccfd9",
+      "sha256": "806aa3ac12cba1b8fce8e29848f1c47be489201e7dd1f3347f0b9ce0b7ec2c1a",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.64.0",
+  "version": "1.64.2",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/pw/staging-auth.mjs

@@ -263,6 +263,35 @@ export function refuse({ stdout, stderr }, code, exitCode = 3, extra = {}, vars
 async function loadPool() { return import("../staging-pool/cli.mjs"); }
 async function loadBinding() { return import("../staging-pool/binding.mjs"); }
 
+// BOT-2894: pool_empty is an agent-visible symptom, but recovery is owned by
+// the control plane. This fixed call sends only the registered tenant/pool and
+// persona; no host, path, command, credential or retry policy can cross it.
+async function requestPoolRefill({ ctxPool, persona, deps, env }) {
+  try {
+    if (deps.requestPoolRefill) return await deps.requestPoolRefill({
+      tenant: ctxPool.tenant, poolId: ctxPool.poolId, persona,
+    });
+    const bin = ctxPool.installed?.botbuddyBin;
+    if (!bin || !ctxPool.tenant) return { ok: false, code: "POOL_REFILL_UNAVAILABLE" };
+    const run = deps.poolRefillExec ?? execFileSync;
+    const stdout = String(run(bin, ["call", "request_staging_pool_refill", "--pin", ctxPool.tenant, "--json", JSON.stringify({ pool_id: ctxPool.poolId, persona })], {
+      encoding: "utf8", timeout: 10_000, env, stdio: ["ignore", "pipe", "ignore"],
+    }));
+    const parsed = JSON.parse(stdout);
+    return {
+      ok: parsed?.ok === true,
+      ...(typeof parsed?.job_id === "string" ? { job_id: parsed.job_id } : {}),
+      ...(typeof parsed?.status === "string" ? { status: parsed.status } : {}),
+      ...(typeof parsed?.code === "string" ? { code: parsed.code } : {}),
+    };
+  } catch {
+    // Recovery request failure does not turn an already truthful pool_empty
+    // into a hidden success. The one wait/retry remains bounded and reports its
+    // original symptom; the next attempt will request recovery again.
+    return { ok: false, code: "POOL_REFILL_UNAVAILABLE" };
+  }
+}
+
 /**
  * `auth --persona <alias>` after the wrapper has proven: environment=staging, a
  * lock-gated lane held by this exact agent, and a staging (or untracked) browser
@@ -316,13 +345,24 @@ export async function runStagingAuth({ plan, host, env, deps, socketRun, resolve
     claim = await poolModule.takeForLane({ persona: persona.email, owner: `lane-${plan.lane}@${host}`, poolId: ctxPool.poolId, tenantHint, ...poolOptions });
   } catch (error) {
     if (error?.code === "pool_empty") {
+      const refill = await requestPoolRefill({ ctxPool, persona: persona.email, deps, env });
       // The refusal's code is the pool's health reason when it is unhealthy (e.g. a
       // count-0 persona is persona_not_configured), so code, message and help agree.
       const reasonCode = typeof error.reason === "string" && error.reason !== "healthy" && isKnownCode(error.reason) ? error.reason : "pool_empty";
+      // A terminal refill receipt is a real, durable recovery boundary. Without
+      // one, never tell the agent to await a signal that does not exist.
+      const refillNext = refill.ok === true && typeof refill.job_id === "string"
+        ? `bb wait 'staging-pool-refill:id=${refill.job_id}' && ${vars.retry ?? authLine}   # once; if it fails, report this code`
+        : undefined;
       // BOT-2836: a healthy empty pool is the agent's own wait-and-retry, so it is
       // rendered here with this lane; an unhealthy pool keeps the pool's health guidance.
       const forwarded = reasonCode === "pool_empty" ? ["reason", "detail"] : ["reason", "detail", ...GUIDED_FIELDS];
-      return refuse(io, reasonCode, 3, Object.fromEntries(forwarded.filter((key) => error[key] !== undefined).map((key) => [key, error[key]])), vars);
+      const code = reasonCode === "pool_empty" && !refillNext ? "pool_refill_unavailable" : reasonCode;
+      return refuse(io, code, 3, {
+        ...Object.fromEntries(forwarded.filter((key) => error[key] !== undefined).map((key) => [key, error[key]])),
+        ...(refillNext ? { next: refillNext } : {}),
+        automatic_refill: refill.ok === true ? { requested: true, ...(refill.job_id ? { job_id: refill.job_id } : {}), ...(refill.status ? { status: refill.status } : {}) } : { requested: false, code: refill.code },
+      }, vars);
     }
     const code = typeof error?.code === "string" && isKnownCode(error.code) ? error.code : "pool_take_failed";
     return refuse(io, code, 3, { detail: String(error?.message ?? error).slice(0, 300) }, vars);

package/src/staging-pool/cli.mjs

@@ -514,6 +514,7 @@ export async function runStagingPool(argv, deps = {}) {
         rawBinding,
         poolBinding,
         botbuddyBin,
+        nodeBin,
         intervalSeconds: explicitInterval ?? existing?.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS,
         existingPersonas: existing?.personas,
         tenant,

package/src/staging-pool/config.mjs

@@ -37,7 +37,7 @@ export function poolHomePaths({ home = homedir(), poolId, root } = {}) {
 }
 
 // The installed config: { version, binding: <raw .botbuddy-agent.json subset>,
-// personas: { email: count }, botbuddyBin, intervalSeconds }. Returns it with the
+// personas: { email: count }, botbuddyBin, nodeBin, intervalSeconds }. Returns it with the
 // parsed binding attached as `poolBinding`.
 export function validateInstalledConfig(config) {
   if (!config || typeof config !== "object") throw new ConfigError("Pool config is not an object.", "config_invalid");
@@ -52,6 +52,11 @@ export function validateInstalledConfig(config) {
   if (typeof config.botbuddyBin !== "string" || !config.botbuddyBin.startsWith("/")) {
     throw new ConfigError("Pool config botbuddyBin must be an absolute path (re-run install).", "config_invalid");
   }
+  // `nodeBin` is added by BOT-2894. Older human-installed pools remain valid,
+  // but an autonomous Helper may only advertise a pool that pins its runtime.
+  if (config.nodeBin !== undefined && (typeof config.nodeBin !== "string" || !config.nodeBin.startsWith("/"))) {
+    throw new ConfigError("Pool config nodeBin must be an absolute path (re-run install).", "config_invalid");
+  }
   if (!Number.isInteger(config.intervalSeconds) || config.intervalSeconds < 60 || config.intervalSeconds > 3600) {
     throw new ConfigError("Pool config intervalSeconds must be an integer 60-3600.", "config_invalid");
   }
@@ -87,7 +92,7 @@ export function readInstalledConfig(path, { readFile = readFileSync } = {}) {
 }
 
 // rawBinding: { tenant, staging_session_pool } exactly as committed.
-export function buildInstalledConfig({ rawBinding, poolBinding, botbuddyBin, intervalSeconds = DEFAULT_INTERVAL_SECONDS, existingPersonas, tenant, registry, installedAt }) {
+export function buildInstalledConfig({ rawBinding, poolBinding, botbuddyBin, nodeBin, intervalSeconds = DEFAULT_INTERVAL_SECONDS, existingPersonas, tenant, registry, installedAt }) {
   const personas = {};
   for (const persona of Object.values(poolBinding.personas)) {
     personas[persona.email] = Number.isInteger(existingPersonas?.[persona.email]) ? existingPersonas[persona.email] : persona.defaultCount;
@@ -97,6 +102,7 @@ export function buildInstalledConfig({ rawBinding, poolBinding, botbuddyBin, int
     binding: { tenant: rawBinding.tenant, staging_session_pool: rawBinding.staging_session_pool },
     personas,
     botbuddyBin,
+    ...(nodeBin ? { nodeBin } : {}),
     intervalSeconds,
     // BOT-2648: installed from the tenant's control-plane registration.
     ...(tenant ? { tenant, poolId: poolBinding.poolId, source: "control-plane" } : {}),

package/src/staging-pool/errors.mjs

@@ -135,8 +135,12 @@ export const ERROR_CODES = Object.freeze({
   // already asked the human-installed job to refill now, so the agent waits once and retries.
   pool_empty: entry("agent", "take",
     "The staging session pool is healthy but has no ready session for {persona}.",
-    "Agents took every ready session since the last tick, or the ready ones were dead or AAL1 (factor rotated) and were discarded; the pool job was asked to refill now.",
-    "bb wait 'timer:duration=60' && {retry}   # once; if it repeats, report this code", "retry_once"),
+    "Agents took every ready session since the last tick, or the ready ones were dead or AAL1 (factor rotated) and were discarded; automatic refill creates a durable job before the single retry.",
+    "Automatic refill is requested by bb pw auth; wait for its refill job, then {retry} once; if it fails, report this code", "retry_once"),
+  pool_refill_unavailable: entry("agent", "take",
+    "The staging session pool is empty and automatic refill did not return a durable job.",
+    "The control plane was unavailable or rejected the refill request, so there is no job signal to await.",
+    "{retry}   # automatic refill did not return a job; retry once; if it repeats, report this code", "retry_once"),
   job_not_loaded: entry("human", "install",
     "The staging session pool is not installed (or not loaded) on this Mac.",
     "The one-time install has not been run here, or the Mac was migrated.",
@@ -322,7 +326,7 @@ export const AUTH_ONLY_CODES = Object.freeze(new Set([
   "tenant_binding_required", "persona_not_allowlisted", "lane_browser_not_open", "browser_session_not_staging", "persistent_profile_refused",
   "session_install_failed", "staging_session_cleanup_pending", "session_not_aal2", "session_expired",
   "session_persona_mismatch", "slot_state_invalid", "slot_state_unreadable", "daemon_node_unsupported",
-  "daemon_run_failed", "daemon_result_missing", "daemon_result_invalid", "pool_take_failed", "pool_empty",
+  "daemon_run_failed", "daemon_result_missing", "daemon_result_invalid", "pool_take_failed", "pool_empty", "pool_refill_unavailable",
 ]));
 
 // `bb staging-pool` subcommands only a human runs. A refusal from one names

package/src/staging-pool/refresh-runtime.mjs

@@ -91,7 +91,7 @@ export async function refreshExistingRuntime({ options, home, uid, env, exec, bu
   const contentDigest = hash.digest("hex");
   const runtimeName = `runtime-${metadata.version}-${contentDigest}`;
   const runtime = join(root, runtimeName);
-  const config = validateInstalledConfig({ ...installed, binding: rawBinding, personas, source: "control-plane", tenant, poolId, registry: { commit_sha: row.commit_sha ?? null, updated_at: row.updated_at ?? null }, runtime: { version: metadata.version, sha256: contentDigest } });
+  const config = validateInstalledConfig({ ...installed, binding: rawBinding, personas, nodeBin: installed.nodeBin ?? await fs.realpath(process.execPath), source: "control-plane", tenant, poolId, registry: { commit_sha: row.commit_sha ?? null, updated_at: row.updated_at ?? null }, runtime: { version: metadata.version, sha256: contentDigest } });
   const token = randomUUID();
   const lockPath = join(root, ".runtime-refresh.lock");
   const lock = await fs.open(lockPath, "wx", 0o600);

package/src/wait-core.mjs

@@ -216,6 +216,15 @@ const VALIDATORS = {
     }
     return { runId };
   },
+  "staging-pool-refill": (p, raw) => {
+    const pair = /^\s*id\s*=\s*([0-9A-Fa-f-]+)\s*$/.exec(raw ?? "");
+    if (!pair || Object.keys(p).length !== 1 || p.id !== pair[1]) {
+      throw new Error("staging-pool-refill needs exactly one id=<refill job UUID>");
+    }
+    const jobId = pair[1].toLowerCase();
+    if (!CANONICAL_UUID_RE.test(jobId)) throw new Error("staging-pool-refill id must be a canonical UUID");
+    return { jobId };
+  },
   // BOT-2629: this is deliberately a dedicated condition rather than a raw
   // event escape hatch. The UUID is chosen before dispatch and the exact subject
   // prevents another run on the same idle/re-adopted lease waking this waiter.
@@ -1295,6 +1304,11 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
         signal.subject_key === `run:${params.runId}` &&
         signal.payload?.run_id === params.runId &&
         COMMAND_RUN_TERMINAL_STATUSES.has(signal.payload?.status);
+    case "staging-pool-refill":
+      return signal.signal_type === "staging_pool_refill" &&
+        signal.subject_key === `staging-pool-refill:${params.jobId}` &&
+        signal.payload?.job_id === params.jobId &&
+        ["completed", "failed"].includes(signal.payload?.status);
     case "stack-run":
       return signal.signal_type === "stack_run" && signal.subject_key === `stack-run:${params.id}` &&
         signal.payload?.run_id === params.id && Number.isInteger(signal.payload?.exit_code);

package/src/wait.mjs

@@ -165,6 +165,10 @@ CONDITIONS  (TYPE:key=val,key=val — repeat for several; --any wakes on the fir
                                       condition, and keep this wait's result pending: its
                                       return is what resumes your task. A run whose worker is
                                       lost ends owner_lost (bb run inspect <run_id>).
+  staging-pool-refill:id=<job UUID>   BOT-2894: a requested staging-pool refill reaching
+                                      completed or failed. This is the only condition of its
+                                      wait and is available to each tenant agent that requested
+                                      the deduped job; its terminal receipt is safe to display.
   stack-run:id=<run UUID>             one named bb stack run reaching its terminal outcome
                                       (BOT-2629). Choose the UUID BEFORE dispatch and pass it as
                                       bb stack run --run-id <UUID>; the receipt carries exit_code,
@@ -648,6 +652,8 @@ async function registerWait(opts, conditions, deadlineIso) {
       // back to an untracked wait would only hide that error behind a timeout.
       "command_run_unavailable",
       "command_run_single_condition_required",
+      "staging_pool_refill_unavailable",
+      "staging_pool_refill_single_condition_required",
     ]);
     if (INVALID_CONDITION_CODES.has(body.error)) {
       const err = new Error(body.detail || body.error);