@botbuddy/cli 1.64.17 → 1.64.19

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.17",
-  "source_commit": "d2fabc08d075fc51a591dd0ce38dc0ec9d66c168",
-  "source_sha256": "a21dcce44a33eddc1392ae4604533ee412d1c0c2bed64a26f52e99a2e2feed30",
+  "release_version": "1.64.19",
+  "source_commit": "44604deb1f6fa2e2923d532bf4bbab095c3c429f",
+  "source_sha256": "5cd52ae09d485ea806fb37f86b1da9fa75dc6e37e7bb58952c25a6d695e1555b",
   "target": "darwin-arm64",
-  "sha256": "f8f98b5bc212ed676fe2e97381b5a0c548331602ed7165360a331c3e8ff309fd"
+  "sha256": "d180a0533460babac47b360dfce0250ba0ef90ce0f21e40e22df3ab632033f3d"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.17",
-  "source_commit": "d2fabc08d075fc51a591dd0ce38dc0ec9d66c168",
-  "source_sha256": "a21dcce44a33eddc1392ae4604533ee412d1c0c2bed64a26f52e99a2e2feed30",
+  "release_version": "1.64.19",
+  "source_commit": "44604deb1f6fa2e2923d532bf4bbab095c3c429f",
+  "source_sha256": "5cd52ae09d485ea806fb37f86b1da9fa75dc6e37e7bb58952c25a6d695e1555b",
   "target": "linux-x64",
-  "sha256": "f4a8fd0904f99e688e857b3674400b3e088fbca7f557bdea7cd1f14abcd84f31"
+  "sha256": "137ff9f4318cd332d1320847f3837b5d8f23812e626a96fdf61d9d331d750b1d"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.64.17",
-  "source_commit": "d2fabc08d075fc51a591dd0ce38dc0ec9d66c168",
-  "source_sha256": "a21dcce44a33eddc1392ae4604533ee412d1c0c2bed64a26f52e99a2e2feed30",
+  "release_version": "1.64.19",
+  "source_commit": "44604deb1f6fa2e2923d532bf4bbab095c3c429f",
+  "source_sha256": "5cd52ae09d485ea806fb37f86b1da9fa75dc6e37e7bb58952c25a6d695e1555b",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "f8f98b5bc212ed676fe2e97381b5a0c548331602ed7165360a331c3e8ff309fd",
+      "sha256": "d180a0533460babac47b360dfce0250ba0ef90ce0f21e40e22df3ab632033f3d",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "f4a8fd0904f99e688e857b3674400b3e088fbca7f557bdea7cd1f14abcd84f31",
+      "sha256": "137ff9f4318cd332d1320847f3837b5d8f23812e626a96fdf61d9d331d750b1d",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.64.17",
+  "version": "1.64.19",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -147,7 +147,7 @@ export async function run(argv, {
     case "wait": return runWait(args);
     case "pw": return runPw(args);
     // BOT-2084: the human-installed staging session pool broker.
-    case "staging-pool": return (await import("./staging-pool/cli.mjs")).runStagingPool(args);
+    case "staging-pool": return (await import("./staging-pool/cli.mjs")).runStagingPool(args, { cliVersion: VERSION });
     case "mcp": return cmdMcp(args);
     case "resources": return callTool("list_resources");
     case "agents": return callTool("list_agents");

package/src/feedback.mjs

@@ -37,6 +37,19 @@ and its idempotency_key unchanged if delivery is uncertain; retry using the
 same reporter and tenant. Tenant identity sharing follows the server's policy;
 a report cannot override it.
 
+To share separately reviewed anonymous details, prepare .botbuddy/anonymous-evidence.json
+with feedback_id and an evidence object, then run:
+  bb call help --tool preview_feedback_anonymous_evidence
+  bb call preview_feedback_anonymous_evidence --json "$(cat .botbuddy/anonymous-evidence.json)"
+Inspect every field: automatic checks cannot detect every person or organization.
+Prepare .botbuddy/anonymous-approval.json with the exact evidence, preview_sha256,
+expected_revision from the preview, and confirmed: true, then run:
+  bb call share_feedback_anonymous_evidence --json "$(cat .botbuddy/anonymous-approval.json)"
+To withdraw, replace <feedback_id> with the original ID and run:
+  bb call withdraw_feedback_anonymous_evidence --feedback_id <feedback_id>
+The separately approved details stay in BotBuddy and do not enable tenant identification.
+For file templates and all commands, run: curl -fsS https://app.bot-buddy.ai/agent-feedback.json
+
 An unavailable service does not mean a report was recorded. A failed send is
 queued privately only when the original agent and tenant can be bound to the
 cached session. Run bb feedback flush to replay those drafts after reconnecting.

package/src/staging-pool/cli.mjs

@@ -398,6 +398,26 @@ export function upgradeNotice(ctx) {
   return { upgrade: { reason: "installed_before_registry", message: "This pool was installed from a repository checkout; re-install it from the BotBuddy control plane (keeps counts and interval).", next: installCommandFor(ctx.tenant) } };
 }
 
+// BOT-3016: the launchd job runs a pinned runtime copy, not this CLI. Status
+// names both versions and, when they differ on a control-plane pool, the
+// agent-safe refresh (bb update runs it too). cliVersion is null inside the
+// bundled job copy, which has no package.json to read.
+export function runtimeNotice(ctx, cliVersion) {
+  if (!ctx?.installed || ctx.installed.error) return {};
+  const runtimeVersion = ctx.installed.runtime?.version ?? null;
+  const versions = { runtimeVersion, ...(cliVersion ? { cliVersion } : {}) };
+  if (!cliVersion || runtimeVersion === cliVersion || ctx.installed.source !== "control-plane" || !ctx.tenant || !ctx.poolId) return versions;
+  const runs = runtimeVersion ? `runs v${runtimeVersion}` : "runs an untracked runtime copy";
+  return {
+    ...versions,
+    runtimeBehind: {
+      reason: "runtime_behind",
+      message: `The pool job ${runs}, but this CLI is v${cliVersion}. bb update refreshes it; so does the next command.`,
+      next: `bb staging-pool refresh-runtime --tenant ${shellWord(String(ctx.tenant))} --pool ${shellWord(String(ctx.poolId))}`,
+    },
+  };
+}
+
 export async function runStagingPool(argv, deps = {}) {
   const {
     env = process.env,
@@ -415,6 +435,7 @@ export async function runStagingPool(argv, deps = {}) {
     nodeBin = process.execPath,
     sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
     readSecretFile = readFileSync,
+    cliVersion = null,
   } = deps;
 
   const redactor = createRedactor();
@@ -599,10 +620,10 @@ export async function runStagingPool(argv, deps = {}) {
         const entry = options.persona ? findPersona(ctx.poolBinding, options.persona) : null;
         if (options.persona && !entry) assertPersonaAllowed(target, options.persona);
         const health = await assessHealth({ ctx, pool, now, exec, uid, requestedPersona: entry?.email });
-        emit({ command: "status", check: true, ...health, ...upgradeNotice(ctx) });
+        emit({ command: "status", check: true, ...health, ...upgradeNotice(ctx), ...runtimeNotice(ctx, cliVersion) });
         return health.ok ? 0 : 5;
       }
-      emit({ ok: true, command: "status", ...(await pool.status()), ...upgradeNotice(ctx) });
+      emit({ ok: true, command: "status", ...(await pool.status()), ...upgradeNotice(ctx), ...runtimeNotice(ctx, cliVersion) });
       return 0;
     },
 

package/src/staging-pool/help.mjs

@@ -96,14 +96,16 @@ ANYONE (agents too) — existing runtime maintenance, never sign-in
       and this published CLI package. Preserves credentials, sessions, counts,
       interval and plist. The existing launchd job refills on its next tick.
       No caller path or runtime content is accepted; no sign-in is performed.
+      bb update runs it for every installed pool after a confirmed upgrade.
 
 HUMAN ONLY (Jono, from Terminal.app or iTerm) — refused inside a Claude or Codex session
   These sign in with the persona password or change the standing sessions.
   install --tenant <slug> [--pool <pool_id>] --botbuddy-bin <absolute path> [--interval <seconds>]
       Reads the tenant's registered pool from the BotBuddy control plane, copies
       the job to the pool home, writes its config and loads the launchd job. Run
-      it from any directory. Re-run after upgrading @botbuddy/cli; it keeps the
-      counts and interval. --pool is needed only when the tenant has several.
+      it from any directory. bb update refreshes the job's runtime, so re-run
+      install only when status or bb update names it; it keeps the counts and
+      interval. --pool is needed only when the tenant has several.
       e.g. bb staging-pool install --tenant botbuddy --botbuddy-bin "$(command -v botbuddy)"
   tick [--pool <pool_id>] [--home <pool home>]
       One refresh and refill pass now (what the job runs).

package/src/update-check.mjs

@@ -11,14 +11,23 @@
 // `cmdUpdate` deliberately does NOT update in-process (BOT-1499: a self-update
 // that replaces its own running files can kill itself mid-install). It hands
 // off to a detached, unref'd `npm install -g` and exits 0.
+//
+// BOT-3016: an installed staging session pool is a standing launchd job that
+// runs a pinned copy of the CLI, so npm alone leaves it on old code. After a
+// confirmed update, `cmdUpdate` refreshes each control-plane pool with the NEW
+// package's agent-safe `staging-pool refresh-runtime` (BOT-2673), which derives
+// its runtime from its own package path — hence a child of the new binary, not
+// this process. A refusal is reported once and never fails the update.
 
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { readFileSync } from "node:fs";
-import { spawn, spawnSync } from "node:child_process";
+import { execFile, spawn, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { promisify } from "node:util";
 
 import { VERSION } from "./version.mjs";
+import { installLine } from "./staging-pool/errors.mjs";
 
 export const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 export const NPM_LATEST_URL = "https://registry.npmjs.org/@botbuddy/cli/latest";
@@ -118,11 +127,16 @@ export async function maybeWarnStale({
   }
 }
 
-export function readInstalledVersion({ npmBin = "npm", shellOpt = {}, probeImpl = spawnSync, readPackage = readFileSync } = {}) {
+export function readNpmGlobalRoot({ npmBin = "npm", shellOpt = {}, probeImpl = spawnSync } = {}) {
   const root = probeImpl(npmBin, ["root", "-g"], { encoding: "utf8", ...shellOpt });
   if (root?.error || root?.status !== 0) throw new Error(`npm global root lookup failed for ${npmBin}`);
   const directory = String(root?.stdout ?? "").trim();
   if (!directory) throw new Error("npm global root lookup returned no directory");
+  return directory;
+}
+
+export function readInstalledVersion({ npmBin = "npm", shellOpt = {}, probeImpl = spawnSync, readPackage = readFileSync } = {}) {
+  const directory = readNpmGlobalRoot({ npmBin, shellOpt, probeImpl });
   const packageJson = JSON.parse(readPackage(join(directory, "@botbuddy", "cli", "package.json"), "utf8"));
   if (typeof packageJson?.version !== "string" || !parseSemver(packageJson.version)) throw new Error("installed @botbuddy/cli package has no valid version");
   return packageJson.version;
@@ -130,7 +144,7 @@ export function readInstalledVersion({ npmBin = "npm", shellOpt = {}, probeImpl
 
 // `botbuddy update` waits for npm because the terminal result, rather than the
 // child-process launch, is the only trustworthy confirmation an update worked.
-export function cmdUpdate({ version = VERSION, spawnImpl = spawn, probeImpl = spawnSync, readInstalledVersion: installedVersion = readInstalledVersion, log = (line) => console.log(line), platform = process.platform, stderr = process.stderr } = {}) {
+export function cmdUpdate({ version = VERSION, spawnImpl = spawn, probeImpl = spawnSync, readInstalledVersion: installedVersion = readInstalledVersion, refreshPools = refreshPoolsFromNewPackage, log = (line) => console.log(line), platform = process.platform, stderr = process.stderr } = {}) {
   // BOT-1566 (Codex P1/P2): on Windows npm is the `npm.cmd` shim, and Node
   // cannot spawn a .cmd file shell-free (docs) — run it through a shell on
   // win32 (args are all static constants, so no injection surface) and select
@@ -179,14 +193,114 @@ export function cmdUpdate({ version = VERSION, spawnImpl = spawn, probeImpl = sp
         resolve(1);
         return;
       }
+      let installed;
       try {
-        const installed = installedVersion({ npmBin, shellOpt });
-        log(`✓ Updated to v${installed}`);
-        resolve(0);
+        installed = installedVersion({ npmBin, shellOpt });
       } catch (error) {
         try { stderr.write(`botbuddy update: npm completed but could not verify the installed version (${error?.message ?? error})\n`); } catch { /* ignore */ }
         resolve(1);
+        return;
       }
+      log(`✓ Updated to v${installed}`);
+      // BOT-3016: the update succeeded; a pool refresh problem is reported, never an exit code.
+      Promise.resolve()
+        .then(() => refreshPools({ installedVersion: installed, npmBin, shellOpt, probeImpl, log, stderr }))
+        .catch((error) => {
+          try { stderr.write(`botbuddy update: the installed staging pools were not refreshed (${error?.message ?? error}); run bb staging-pool status\n`); } catch { /* ignore */ }
+        })
+        .finally(() => resolve(0));
     });
   });
 }
+
+// ─── BOT-3016: refresh installed staging-pool runtimes after an update ───────
+
+export const REFRESH_TIMEOUT_MS = 120_000;
+const HUMAN_NEXT = "human, from Terminal.app or iTerm";
+
+export function stagingPoolsRoot(home = homedir()) {
+  return join(home, ".botbuddy", "staging-session-pool");
+}
+
+function lastJsonLine(text) {
+  const lines = String(text ?? "").split("\n").filter((line) => line.startsWith("{"));
+  for (const line of lines.reverse()) {
+    try { return JSON.parse(line); } catch { /* keep looking */ }
+  }
+  return null;
+}
+
+async function refreshOne({ dirName, installedVersion, cliEntry, nodeBin, home, execFileImpl }) {
+  let config;
+  try {
+    config = JSON.parse(await readFile(join(stagingPoolsRoot(home), dirName, "config.json"), "utf8"));
+  } catch (error) {
+    if (error?.code === "ENOENT") return null; // not a pool home
+    return { poolId: dirName, status: "unreadable", code: "config_unreadable", message: `Its config.json could not be read (${error?.message ?? error}).`, next: "bb staging-pool status --check --pool " + dirName, actor: "agent or human" };
+  }
+  const poolId = typeof config?.poolId === "string" ? config.poolId : dirName;
+  const tenant = config?.tenant ?? config?.binding?.tenant ?? null;
+  if (config?.source !== "control-plane" || !tenant) {
+    return { poolId, status: "legacy", code: "installed_before_registry", message: "It was installed before the control-plane registry, so only a human re-install can update it.", next: tenant ? installLine(tenant, poolId) : `bb staging-pool status --pool ${poolId}`, actor: HUMAN_NEXT };
+  }
+  const runtimeVersion = config?.runtime?.version ?? null;
+  if (runtimeVersion === installedVersion) return { poolId, status: "current", runtimeVersion };
+  const retry = `bb staging-pool refresh-runtime --tenant ${tenant} --pool ${poolId}`;
+  try {
+    const { stdout } = await execFileImpl(nodeBin, [cliEntry, "staging-pool", "refresh-runtime", "--tenant", tenant, "--pool", poolId], { timeout: REFRESH_TIMEOUT_MS, maxBuffer: 1024 * 1024 });
+    const receipt = lastJsonLine(stdout);
+    if (receipt?.ok === true) return { poolId, status: "refreshed", runtimeVersion: receipt.runtimeVersion ?? installedVersion };
+    return { poolId, status: "refused", code: receipt?.code ?? "refresh_failed", message: receipt?.message ?? "The refresh printed no success receipt.", next: retry, actor: "agent or human" };
+  } catch (error) {
+    // A refusal is one JSON line on stderr (then text guidance); stdout stays empty.
+    const receipt = lastJsonLine(error?.stderr) ?? lastJsonLine(error?.stdout);
+    if (receipt?.code) {
+      const human = /^human/i.test(String(receipt.actor ?? "")) || /install/.test(String(receipt.next ?? ""));
+      const actor = typeof receipt.actor === "string" && receipt.actor ? (human ? `${receipt.actor}, from Terminal.app or iTerm` : receipt.actor) : (human ? HUMAN_NEXT : "agent or human");
+      return { poolId, status: "refused", code: receipt.code, message: [receipt.message, receipt.detail].filter(Boolean).join(" "), next: receipt.next ?? retry, actor };
+    }
+    return { poolId, status: "refused", code: "refresh_failed", message: `The refresh did not finish (${error?.message ?? error}).`, next: retry, actor: "agent or human" };
+  }
+}
+
+/**
+ * Refresh every control-plane staging pool installed under ~/.botbuddy whose
+ * recorded runtime differs from `installedVersion`, by running the new
+ * package's `staging-pool refresh-runtime`. Reports one line per pool and
+ * never throws for a pool's refusal. Returns [{ poolId, status, ... }].
+ */
+export async function refreshInstalledPools({
+  installedVersion,
+  cliEntry,
+  nodeBin = process.execPath,
+  home = homedir(),
+  execFileImpl = promisify(execFile),
+  log = (line) => console.log(line),
+  stderr = process.stderr,
+} = {}) {
+  let entries;
+  try {
+    entries = await readdir(stagingPoolsRoot(home), { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  }
+  const results = [];
+  for (const entry of entries.filter((e) => e.isDirectory()).sort((a, b) => a.name.localeCompare(b.name))) {
+    const result = await refreshOne({ dirName: entry.name, installedVersion, cliEntry, nodeBin, home, execFileImpl });
+    if (!result) continue;
+    results.push(result);
+    if (result.status === "refreshed") log(`✓ Staging pool ${result.poolId} now runs v${result.runtimeVersion}`);
+    else if (result.status === "current") log(`✓ Staging pool ${result.poolId} already runs v${result.runtimeVersion}`);
+    else {
+      try { stderr.write(`! Staging pool ${result.poolId} was not refreshed (${result.code}): ${result.message}\n  Next (${result.actor}): ${result.next}\n`); } catch { /* ignore */ }
+    }
+  }
+  return results;
+}
+
+// The default for `cmdUpdate`: locate the newly installed package and refresh with it.
+export async function refreshPoolsFromNewPackage({ installedVersion, npmBin, shellOpt, probeImpl, log, stderr }) {
+  const root = readNpmGlobalRoot({ npmBin, shellOpt, probeImpl });
+  return refreshInstalledPools({ installedVersion, cliEntry: join(root, "@botbuddy", "cli", "bin", "botbuddy.mjs"), log, stderr });
+}