@botbuddy/cli 1.64.3 → 1.64.6

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.3",
-  "source_commit": "634df060858643bd56911a1fe7b6ba67365db699",
-  "source_sha256": "d528ffeaeead9808cb96676be4eaebe5ba9848e6521e2e98eb48ae8e62bc6cbf",
+  "release_version": "1.64.6",
+  "source_commit": "22c3be9ffc20b3c25bcd76247bee9d12ed8a8aeb",
+  "source_sha256": "4f95dec7b3bda9bf9675eeec92008d8bdb1b7e1df792b6dbe90a645890a53a3e",
   "target": "darwin-arm64",
-  "sha256": "68ed8a8899b1db98c41971ada10ee5e4ac316424160344e73a0a9963ba2a8b5f"
+  "sha256": "80a7d10d04aa260664b35db1774c33a7a5263e039a5c40c1b434db9cf24f419e"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.64.3",
-  "source_commit": "634df060858643bd56911a1fe7b6ba67365db699",
-  "source_sha256": "d528ffeaeead9808cb96676be4eaebe5ba9848e6521e2e98eb48ae8e62bc6cbf",
+  "release_version": "1.64.6",
+  "source_commit": "22c3be9ffc20b3c25bcd76247bee9d12ed8a8aeb",
+  "source_sha256": "4f95dec7b3bda9bf9675eeec92008d8bdb1b7e1df792b6dbe90a645890a53a3e",
   "target": "linux-x64",
-  "sha256": "9b3d6023dffead51e60d2b260ab4be39c0264157617428cf432775e5040bf7b0"
+  "sha256": "cfbd912f8d720cae1061e2fd69933e00f714713def6065cf7e3de84c8c649286"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.64.3",
-  "source_commit": "634df060858643bd56911a1fe7b6ba67365db699",
-  "source_sha256": "d528ffeaeead9808cb96676be4eaebe5ba9848e6521e2e98eb48ae8e62bc6cbf",
+  "release_version": "1.64.6",
+  "source_commit": "22c3be9ffc20b3c25bcd76247bee9d12ed8a8aeb",
+  "source_sha256": "4f95dec7b3bda9bf9675eeec92008d8bdb1b7e1df792b6dbe90a645890a53a3e",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "68ed8a8899b1db98c41971ada10ee5e4ac316424160344e73a0a9963ba2a8b5f",
+      "sha256": "80a7d10d04aa260664b35db1774c33a7a5263e039a5c40c1b434db9cf24f419e",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "9b3d6023dffead51e60d2b260ab4be39c0264157617428cf432775e5040bf7b0",
+      "sha256": "cfbd912f8d720cae1061e2fd69933e00f714713def6065cf7e3de84c8c649286",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.64.3",
+  "version": "1.64.6",
   "description": "BotBuddy \u2014 Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/staging-pool/errors.mjs

@@ -155,7 +155,7 @@ export const ERROR_CODES = Object.freeze({
     "launchctl kickstart -k gui/$(id -u)/{label}"),
   mint_backing_off: entry("human", "repair",
     "Staging sign-in for {persona} keeps failing, so the job is backing off.",
-    "The last mint_failed line in {log} names it: password_rejected or no_verified_totp_factor = seed drift; password_source_* = the password env file; totp_source_failed = the botbuddy CLI login.",
+    "The last mint_failed line in {log} names it: password_rejected or no_verified_totp_factor = seed drift; mint_retries_exhausted = a staging Auth outage, so wait for the next attempt; password_source_* = the password env file; totp_source_failed = the botbuddy CLI login.",
     "grep mint_failed {log} | tail -1   # then run bb help symptom with the code that line names"),
   last_tick_failed: entry("human", "repair",
     "The pool job's last tick had sign-in (mint) failures.",
@@ -285,6 +285,10 @@ export const ERROR_CODES = Object.freeze({
     "Staging Auth rejected the persona password.",
     "Seed drift: the staging persona was re-seeded with another password, or the env file is stale.",
     "bb staging-pool mint-one --persona {persona}   # after re-running the staging persona seed or updating the env file"),
+  password_grant_failed: entry("human", "repair",
+    "Staging Auth answered the first sign-in step with an unexpected status, which is not a credential refusal.",
+    "A blocked request, a banned or unconfirmed user, or a GoTrue change; {log} has the status and error code.",
+    "grep mint_failed {log} | tail -1   # then: bb staging-pool mint-one --persona {persona}"),
   no_verified_totp_factor: entry("human", "repair",
     "The persona has no verified TOTP factor on staging.",
     "Seed drift: the staging seed job has not enrolled the factor.",
@@ -303,7 +307,7 @@ export const ERROR_CODES = Object.freeze({
     "grep mint_failed {log} | tail -1   # report this code"),
   mint_retries_exhausted: entry("human", "repair",
     "The sign-in gave up after its retries.",
-    "Transient Auth or network failures; {log} names the last one.",
+    "A staging Auth outage (for example a Cloudflare 52x while staging restarts) or network failures; {log} names the last one.",
     "grep mint_failed {log} | tail -1   # then: bb staging-pool mint-one --persona {persona}"),
   not_aal2: entry("human", "repair",
     "MFA verify returned a session that is not AAL2.",

package/src/staging-pool/signin-gotrue-totp.mjs

@@ -25,7 +25,9 @@ export class SignInError extends Error {
   }
 }
 
-const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
+// 520-524 are Cloudflare's own answers while the origin is down or unreachable (BOT-2947):
+// Auth never saw the request or never answered it, so they say nothing about the credentials.
+const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504, 520, 521, 522, 523, 524]);
 const REVOKED_ERROR_CODES = new Set(["session_not_found", "bad_jwt", "refresh_token_not_found"]);
 
 function describeFailure(response) {
@@ -75,6 +77,7 @@ export function createGoTrueTotpSignIn({
   const isTransient = (response) => response.status === 0 || RETRYABLE_STATUSES.has(response.status);
   const isRevoked = (response) =>
     (response.status === 401 || response.status === 403) && REVOKED_ERROR_CODES.has(response.body?.error_code);
+  const isCredentialRefusal = (response) => response.status === 400 && response.body?.error_code === "invalid_credentials";
 
   function assertAal2ForPersona(storedSession, persona) {
     const claims = decodeJwtClaims(storedSession.access_token);
@@ -108,7 +111,12 @@ export function createGoTrueTotpSignIn({
           await retry(`password grant ${describeFailure(password)}`);
           continue;
         }
-        throw new SignInError("password_rejected", `Password grant refused: ${describeFailure(password)}.`, {
+        if (isCredentialRefusal(password)) {
+          throw new SignInError("password_rejected", `Password grant refused: ${describeFailure(password)}.`, {
+            status: password.status,
+          });
+        }
+        throw new SignInError("password_grant_failed", `Password grant failed: ${describeFailure(password)}.`, {
           status: password.status,
         });
       }