@botbuddy/cli 1.64.24 → 1.64.25

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.64.25
+
+- `bb pw` staging-pool takes now durably queue a secret-free, server-attributed telemetry receipt before a browser receives the single-use session. The receipt never includes the state file, path, credential, or caller-selected tenant/session/ticket/PR; a successor session reconciles an undelivered receipt under its verified source-session attribution.
+
 ## 1.64.20
 
 - Session checkpoint writes are deprecated. Keep delivery and acceptance evidence on the Linear ticket; the compatibility MCP tool returns a deprecation notice without writing a checkpoint.

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.24",
-  "source_commit": "7bfc909b46cc2bf6f7d45264be7e52ca16e69e13",
-  "source_sha256": "680b44125605dea4db83af948177743740b848b08f26619329e949e5a2e6253a",
+  "release_version": "1.64.25",
+  "source_commit": "c07e6d20430392a68124bc1ec8f8675202725aab",
+  "source_sha256": "41b187e7b8afceb34b0435e24796d9b313cb0255f17ca8c1eae30c7de81ee87b",
   "target": "darwin-arm64",
-  "sha256": "554e01cb52c8966c4946b467858873733afadc9f645e7add1598098bc7ec7b98"
+  "sha256": "94b11bbe78ce60791202df0cb36a4d4eddca15c353ad8adcc9007bedf3f3513c"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.24",
-  "source_commit": "7bfc909b46cc2bf6f7d45264be7e52ca16e69e13",
-  "source_sha256": "680b44125605dea4db83af948177743740b848b08f26619329e949e5a2e6253a",
+  "release_version": "1.64.25",
+  "source_commit": "c07e6d20430392a68124bc1ec8f8675202725aab",
+  "source_sha256": "41b187e7b8afceb34b0435e24796d9b313cb0255f17ca8c1eae30c7de81ee87b",
   "target": "linux-x64",
-  "sha256": "01533501078482e1ac720ba05cd763c6f4196831ad55c6c15dcf5e8dda30d459"
+  "sha256": "2f219ac1910318da6483fe4c5e590c3cdb101b03cf4c67032a14254735130ff8"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.64.24",
-  "source_commit": "7bfc909b46cc2bf6f7d45264be7e52ca16e69e13",
-  "source_sha256": "680b44125605dea4db83af948177743740b848b08f26619329e949e5a2e6253a",
+  "release_version": "1.64.25",
+  "source_commit": "c07e6d20430392a68124bc1ec8f8675202725aab",
+  "source_sha256": "41b187e7b8afceb34b0435e24796d9b313cb0255f17ca8c1eae30c7de81ee87b",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "554e01cb52c8966c4946b467858873733afadc9f645e7add1598098bc7ec7b98",
+      "sha256": "94b11bbe78ce60791202df0cb36a4d4eddca15c353ad8adcc9007bedf3f3513c",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "01533501078482e1ac720ba05cd763c6f4196831ad55c6c15dcf5e8dda30d459",
+      "sha256": "2f219ac1910318da6483fe4c5e590c3cdb101b03cf4c67032a14254735130ff8",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.64.24",
+  "version": "1.64.25",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/pw/staging-auth.mjs

@@ -297,7 +297,7 @@ async function requestPoolRefill({ ctxPool, persona, deps, env }) {
  * lock-gated lane held by this exact agent, and a staging (or untracked) browser
  * session. Returns the process exit code.
  */
-export async function runStagingAuth({ plan, host, env, deps, socketRun, resolveSession, stdout, stderr, holder = null }) {
+export async function runStagingAuth({ plan, host, env, deps, socketRun, resolveSession, stdout, stderr, holder = null, credential = null }) {
   const io = { stdout, stderr };
   const poolModule = deps.stagingPoolModule ?? await loadPool();
   const poolOptions = deps.stagingPool ?? {};
@@ -342,7 +342,13 @@ export async function runStagingAuth({ plan, host, env, deps, socketRun, resolve
   dropGone(ctx, generation);
   let claim;
   try {
-    claim = await poolModule.takeForLane({ persona: persona.email, owner: `lane-${plan.lane}@${host}`, poolId: ctxPool.poolId, tenantHint, ...poolOptions });
+    // The outbox writer is a child `bb call`; carry the gate-verified session
+    // credential into that child so it cannot select a cached/durable identity.
+    const sessionId = credential?.sessionId ?? env.BOTBUDDY_SESSION_ID;
+    const deliveryEnv = credential?.token
+      ? { ...env, BOTBUDDY_AGENT_SESSION_TOKEN: credential.token, BOTBUDDY_SESSION_ID: sessionId }
+      : env;
+    claim = await poolModule.takeForLane({ persona: persona.email, owner: `lane-${plan.lane}@${host}`, poolId: ctxPool.poolId, tenantHint, ...poolOptions, env: deliveryEnv, sessionId });
   } catch (error) {
     if (error?.code === "pool_empty") {
       const refill = await requestPoolRefill({ ctxPool, persona: persona.email, deps, env });

package/src/staging-pool/cli.mjs

@@ -20,6 +20,7 @@
 // runs that copy).
 
 import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
 import * as nodeFs from "node:fs/promises";
 import { readFileSync, readdirSync, realpathSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
@@ -41,6 +42,7 @@ import { HUMAN_ONLY_COMMANDS, formatGuidance, guidance, installLine, isKnownCode
 import { RegistryError, choosePool, fetchRegisteredPools, whoamiTenant } from "./registry.mjs";
 import { STAGING_POOL_HELP } from "./help.mjs";
 import { refreshExistingRuntime } from "./refresh-runtime.mjs";
+import { enqueueStagingPoolTake, flushStagingPoolTakeOutbox, STAGING_POOL_TAKE_OUTBOX_MAX } from "./take-outbox.mjs";
 
 export const BUNDLE_FILES = Object.freeze([
   "binding.mjs",
@@ -58,6 +60,7 @@ export const BUNDLE_FILES = Object.freeze([
   "refresh-runtime.mjs",
   "signin-gotrue-totp.mjs",
   "state-file.mjs",
+  "take-outbox.mjs",
   "totp-botbuddy.mjs",
 ]);
 
@@ -263,6 +266,8 @@ export async function takeForLane({
   fetchImpl = globalThis.fetch,
   exec = promisify(execFile),
   uid = userInfo().uid,
+  env = process.env,
+  sessionId = env.BOTBUDDY_SESSION_ID,
   logger = () => {},
 } = {}) {
   const ctx = resolveInstalledPool({ home, poolId, tenantHint });
@@ -271,8 +276,44 @@ export async function takeForLane({
   if (!entry) assertPersonaAllowed(target, persona);
   const intervalSeconds = ctx.installed && !ctx.installed.error ? ctx.installed.intervalSeconds : undefined;
   const pool = buildPool({ ctx, target, now, logger, intervalSeconds, fetchImpl });
+  // Re-deliver earlier durable receipts before admitting another take. Otherwise
+  // a temporary MCP outage could fill the bounded outbox permanently even after
+  // the control plane recovers.
+  const priorDelivery = await flushStagingPoolTakeOutbox({
+    poolDir: ctx.paths.pool,
+    botbuddyBin: ctx.installed.botbuddyBin,
+    exec,
+    env,
+    sessionId,
+  });
+  if (priorDelivery.pending >= STAGING_POOL_TAKE_OUTBOX_MAX) {
+    throw Object.assign(new Error("The staging-pool take telemetry outbox is full; no session was handed over."), { code: "take_outbox_full" });
+  }
   try {
     const taken = await pool.take({ persona: entry.email, owner });
+    try {
+      // Persist before handing the browser its state. An unavailable control
+      // plane leaves a replayable intent; it never loses the take event.
+      await enqueueStagingPoolTake({
+        poolDir: ctx.paths.pool,
+        poolId: ctx.poolId,
+        personaAlias: entry.alias,
+        // Local slot names contain a persona-derived prefix and timestamp. The
+        // server needs replay correlation only, so persist a one-way opaque id.
+        slotId: createHash("sha256").update(taken.slotId).digest("hex"),
+        sessionId,
+      });
+      await flushStagingPoolTakeOutbox({
+        poolDir: ctx.paths.pool,
+        botbuddyBin: ctx.installed.botbuddyBin,
+        exec,
+        env,
+        sessionId,
+      });
+    } catch (telemetryError) {
+      await pool.discardTaken(taken.slotId).catch(() => {});
+      throw telemetryError;
+    }
     await requestRefill({ ctx, exec, uid });
     return { taken, target, binding: ctx.poolBinding, persona: entry, discard: () => pool.discardTaken(taken.slotId) };
   } catch (error) {

package/src/staging-pool/errors.mjs

@@ -129,6 +129,26 @@ export const ERROR_CODES = Object.freeze({
     "Taking a session from the pool failed unexpectedly (see detail).",
     "A filesystem or pool error outside the known cases.",
     `${AUTH}   # once; if it repeats, report this code and detail`, "retry_once"),
+  take_outbox_unreadable: entry("human", "repair",
+    "The durable staging-pool take receipt cannot be read, so no browser session was handed over.",
+    "The installed pool's receipt journal is unreadable or was edited outside the CLI.",
+    "bb staging-pool uninstall && " + INSTALL),
+  take_outbox_invalid: entry("human", "repair",
+    "The durable staging-pool take receipt is invalid, so no browser session was handed over.",
+    "The installed pool's receipt journal has an invalid pool, persona, or opaque slot record.",
+    "bb staging-pool uninstall && " + INSTALL),
+  take_outbox_full: entry("agent", "take",
+    "The durable staging-pool take receipt journal is full, so no browser session was handed over.",
+    "The control plane has not acknowledged prior secret-free take receipts.",
+    "bb staging-pool status --check   # report this code; do not retry in a loop", "report_blocker"),
+  take_outbox_locked: entry("agent", "take",
+    "Another staging-pool take is recording its durable receipt, so no browser session was handed over.",
+    "A concurrent take still owns the short receipt-journal mutation lock.",
+    `${AUTH}   # retry once; if it repeats, report this code`, "retry_once"),
+  take_outbox_session_required: entry("agent", "take",
+    "The staging-pool take has no registered work-session identity, so no browser session was handed over.",
+    "The agent session was not registered or its work-session environment was lost before the take began.",
+    "bb setup   # restore this worktree's registered session, then retry once", "retry_once"),
 
   // ── the pool's health (human repairs; agents report once and stop)
   // BOT-2836: a healthy pool emptied between ticks is a wait, not a repair. The take

package/src/staging-pool/take-outbox.mjs

@@ -0,0 +1,151 @@
+// BOT-2934: the local take is not handed to a browser until its secret-free
+// telemetry intent is atomically durable. Delivery is replayable by take_id;
+// the MCP server, never this file, derives tenant/agent/work-session context.
+import * as fs from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { join } from "node:path";
+
+const FILE = "take-outbox.json";
+const LOCK_FILE = "take-outbox.lock";
+export const STAGING_POOL_TAKE_OUTBOX_MAX = 64;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SESSION_RE = UUID_RE;
+const LOCK_ATTEMPTS = 50;
+const LOCK_RETRY_MS = 20;
+const LOCK_STALE_MS = 30_000;
+
+function valid(event) {
+  return event && typeof event === "object" &&
+    UUID_RE.test(event.take_id ?? "") &&
+    /^[a-z0-9][a-z0-9-]{0,63}$/.test(event.pool_id ?? "") &&
+    /^[a-z0-9][a-z0-9-]{0,39}$/.test(event.persona_alias ?? "") &&
+    /^[a-f0-9]{12,64}$/.test(event.slot_id ?? "") &&
+    SESSION_RE.test(event.origin_session_id ?? "") &&
+    /^[a-f0-9]{64}$/.test(event.origin_session_hash ?? "");
+}
+
+function sessionHash(sessionId) {
+  if (typeof sessionId !== "string" || !SESSION_RE.test(sessionId)) {
+    throw Object.assign(new Error("A registered BotBuddy work session is required to record a staging-pool take."), { code: "take_outbox_session_required" });
+  }
+  return createHash("sha256").update(sessionId.toLowerCase()).digest("hex");
+}
+
+const pathFor = (poolDir) => join(poolDir, FILE);
+const lockPathFor = (poolDir) => join(poolDir, LOCK_FILE);
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+async function withOutboxLock(poolDir, action) {
+  await fs.mkdir(poolDir, { recursive: true, mode: 0o700 });
+  const lockPath = lockPathFor(poolDir);
+  const token = randomUUID();
+  for (let attempt = 0; attempt < LOCK_ATTEMPTS; attempt += 1) {
+    let handle;
+    try {
+      handle = await fs.open(lockPath, "wx", 0o600);
+      await handle.writeFile(JSON.stringify({ token, created_at: new Date().toISOString() }) + "\n");
+      await handle.sync();
+      try {
+        return await action();
+      } finally {
+        await handle.close();
+        try {
+          const holder = JSON.parse(await fs.readFile(lockPath, "utf8"));
+          if (holder?.token === token) await fs.rm(lockPath, { force: true });
+        } catch { /* a later holder owns the path, or it is already released */ }
+      }
+    } catch (error) {
+      await handle?.close().catch(() => {});
+      if (error?.code !== "EEXIST") throw error;
+      try {
+        const stat = await fs.stat(lockPath);
+        if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
+          const tomb = `${lockPath}.stale-${randomUUID()}`;
+          await fs.rename(lockPath, tomb);
+          await fs.rm(tomb, { force: true });
+          continue;
+        }
+      } catch (lockError) {
+        if (lockError?.code !== "ENOENT") throw lockError;
+      }
+      await pause(LOCK_RETRY_MS);
+    }
+  }
+  throw Object.assign(new Error("Another staging-pool take is recording its durable receipt; no session was handed over."), { code: "take_outbox_locked" });
+}
+
+async function read(poolDir) {
+  let source;
+  try {
+    source = await fs.readFile(pathFor(poolDir), "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw Object.assign(new Error("The staging-pool take outbox is unreadable; no session was handed over."), { code: "take_outbox_unreadable" });
+  }
+  let parsed;
+  try { parsed = JSON.parse(source); }
+  catch { throw Object.assign(new Error("The staging-pool take outbox is invalid; no session was handed over."), { code: "take_outbox_invalid" }); }
+  if (!parsed || typeof parsed !== "object" || parsed.version !== 1 || !Array.isArray(parsed.events) || !parsed.events.every(valid)) {
+    throw Object.assign(new Error("The staging-pool take outbox is invalid; no session was handed over."), { code: "take_outbox_invalid" });
+  }
+  return parsed.events;
+}
+
+async function write(poolDir, events) {
+  await fs.mkdir(poolDir, { recursive: true, mode: 0o700 });
+  const output = JSON.stringify({ version: 1, events: events.slice(-STAGING_POOL_TAKE_OUTBOX_MAX) }) + "\n";
+  const temporary = join(poolDir, `.${FILE}.${randomUUID()}.partial`);
+  const handle = await fs.open(temporary, "wx", 0o600);
+  try {
+    await handle.writeFile(output);
+    await handle.sync();
+  } finally { await handle.close(); }
+  try {
+    await fs.rename(temporary, pathFor(poolDir));
+    const directory = await fs.open(poolDir, "r");
+    try { await directory.sync(); } finally { await directory.close(); }
+  } catch (error) {
+    await fs.rm(temporary, { force: true });
+    throw error;
+  }
+}
+
+export async function enqueueStagingPoolTake({ poolDir, poolId, personaAlias, slotId, sessionId, takeId = randomUUID() }) {
+  const event = { take_id: takeId, pool_id: poolId, persona_alias: personaAlias, slot_id: slotId, origin_session_id: sessionId.toLowerCase(), origin_session_hash: sessionHash(sessionId) };
+  if (!valid(event)) throw Object.assign(new Error("The staging-pool take telemetry intent is invalid."), { code: "take_outbox_invalid" });
+  return withOutboxLock(poolDir, async () => {
+    const events = await read(poolDir);
+    if (events.length >= STAGING_POOL_TAKE_OUTBOX_MAX) throw Object.assign(new Error("The staging-pool take telemetry outbox is full; no session was handed over."), { code: "take_outbox_full" });
+    events.push(event);
+    await write(poolDir, events);
+    return event;
+  });
+}
+
+export async function flushStagingPoolTakeOutbox({ poolDir, botbuddyBin, exec, env = process.env, sessionId }) {
+  const pending = await withOutboxLock(poolDir, () => read(poolDir));
+  const originSessionHash = sessionHash(sessionId);
+  const delivered = new Set();
+  for (let index = 0; index < pending.length; index += 1) {
+    const sameSession = pending[index].origin_session_hash === originSessionHash;
+    let body;
+    try {
+      const { origin_session_hash: _originSessionHash, origin_session_id, ...payload } = pending[index];
+      const tool = sameSession ? "record_staging_pool_take" : "reconcile_staging_pool_take";
+      const bodyPayload = sameSession ? payload : { ...payload, origin_session_id };
+      const result = await exec(botbuddyBin, ["call", tool, "--json", JSON.stringify(bodyPayload)], { env, timeout: 10_000, maxBuffer: 64 * 1024 });
+      body = JSON.parse(String(result?.stdout ?? ""));
+    } catch { continue; }
+    if (body?.success === true) delivered.add(pending[index].take_id);
+  }
+  if (!delivered.size) return { delivered: 0, pending: pending.length };
+  const remaining = await withOutboxLock(poolDir, async () => {
+    const current = await read(poolDir);
+    const next = current.filter((event) => !delivered.has(event.take_id));
+    if (next.length !== current.length) await write(poolDir, next);
+    return next.length;
+  });
+  return { delivered: delivered.size, pending: remaining };
+}
+
+export const stagingPoolTakeOutboxPath = pathFor;

package/src/wait-core.mjs

@@ -140,6 +140,31 @@ function parseParams(raw) {
   return params;
 }
 
+function parseStagingPoolParams(raw) {
+  const params = {};
+  for (const entry of String(raw ?? "").split(",").map((part) => part.trim())) {
+    if (!entry) continue;
+    const named = /^(pool|persona)=([^=,]+)$/.exec(entry);
+    const readiness = /^ready>=([0-9]+)$/.exec(entry);
+    const key = named?.[1] ?? (readiness ? "ready" : undefined);
+    const value = named?.[2] ?? readiness?.[1];
+    if (!key || value === undefined) throw new Error(`staging-pool does not accept ${entry}`);
+    if (Object.prototype.hasOwnProperty.call(params, key)) throw new Error(`staging-pool does not accept duplicate ${key}`);
+    params[key] = value;
+  }
+  const identifier = (value, label) => {
+    if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,119}$/.test(value)) {
+      throw new Error(`staging-pool ${label} must be a registered identifier`);
+    }
+    return value;
+  };
+  const pool = identifier(params.pool, "pool");
+  const persona = identifier(params.persona, "persona");
+  const ready = params.ready === undefined ? 1 : Number(params.ready);
+  if (!Number.isSafeInteger(ready) || ready < 1) throw new Error("staging-pool ready>= must be a positive integer");
+  return { pool, persona, ready };
+}
+
 function asBool(v) {
   if (v === true) return true;
   if (typeof v !== "string") return false;
@@ -225,6 +250,10 @@ const VALIDATORS = {
     if (!CANONICAL_UUID_RE.test(jobId)) throw new Error("staging-pool-refill id must be a canonical UUID");
     return { jobId };
   },
+  // BOT-2934 — server-side arm authorization resolves the caller's installed
+  // instance. The CLI grammar names only its registered pool/persona, never a
+  // host, so it cannot turn a different machine's inventory into readiness.
+  "staging-pool": (_p, raw) => parseStagingPoolParams(raw),
   // BOT-2888: a reporter waits for a revision after the last consumed update.
   // The server binds the report to the registering agent and tenant.
   feedback: (p, raw) => {
@@ -1320,6 +1349,19 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
         signal.subject_key === `staging-pool-refill:${params.jobId}` &&
         signal.payload?.job_id === params.jobId &&
         ["completed", "failed"].includes(signal.payload?.status);
+    case "staging-pool": {
+      const payload = signal.payload;
+      return signal.signal_type === "staging_pool" &&
+        payload?.schema_version === 1 &&
+        typeof payload.instance_id === "string" && payload.instance_id.length > 0 &&
+        signal.subject_key === `staging-pool:${payload.instance_id}:${payload.persona_alias}` &&
+        payload.pool_id === params.pool &&
+        payload.persona_alias === params.persona &&
+        Number.isSafeInteger(payload.epoch) && payload.epoch >= 1 &&
+        Number.isSafeInteger(payload.revision) && payload.revision >= 1 &&
+        Number.isSafeInteger(payload.ready_count) && payload.ready_count >= params.ready &&
+        payload.availability === "ready" && payload.freshness_phase === "fresh";
+    }
     case "feedback":
       return signal.signal_type === "feedback_update" &&
         signal.subject_key === `feedback:${params.feedbackId}` &&

package/src/wait.mjs

@@ -175,6 +175,10 @@ CONDITIONS  (TYPE:key=val,key=val — repeat for several; --any wakes on the fir
                                       completed or failed. This is the only condition of its
                                       wait and is available to each tenant agent that requested
                                       the deduped job; its terminal receipt is safe to display.
+  staging-pool:pool=<id>,persona=<alias>[,ready>=N]
+                                      Wait for N (default 1) fresh, takeable sessions on the
+                                      caller's authorized installed pool instance. This does not
+                                      reserve a session: after a match, run the auth command once.
   feedback:id=<feedback UUID>,after=<revision>
                                       Wait for a later update to your own feedback; use the
                                       revision you last consumed and read/acknowledge updates.
@@ -663,6 +667,8 @@ async function registerWait(opts, conditions, deadlineIso) {
       "command_run_single_condition_required",
       "staging_pool_refill_unavailable",
       "staging_pool_refill_single_condition_required",
+      "staging_pool_unavailable",
+      "staging_pool_single_condition_required",
       "feedback_wait_unavailable",
     ]);
     if (INVALID_CONDITION_CODES.has(body.error)) {