@botbuddy/cli 1.64.34 → 1.66.0

package/src/staging-pool/test-helpers/fake-okta-browser.mjs

@@ -0,0 +1,239 @@
+// BOT-3145 (ported from supplyspark-ent ENT-5553) test helper: a scripted stand-in for Playwright's chromium.launch() that plays
+// the real Okta tenant. The identifier screen is built from the 2026-10-14 real capture
+// (fixtures/2026-10-14-okta-sso-signin.json), so the okta-steps selectors are tested
+// against the markup Okta actually serves; the later screens follow Okta Sign-In Widget 7.x.
+
+import { readFileSync } from "node:fs";
+
+export const OKTA_FIXTURE = JSON.parse(
+  readFileSync(new URL("../fixtures/2026-10-14-okta-sso-signin.json", import.meta.url), "utf8"),
+);
+
+const OKTA_HOST = OKTA_FIXTURE.okta.host;
+export const ACS_URL = OKTA_FIXTURE.gotrue.acs.request.replace(/^POST /, "");
+
+function identifierScreen() {
+  const visible = new Map();
+  for (const input of OKTA_FIXTURE.okta.identifierScreen.inputs) {
+    if (input.type === "hidden") continue;
+    if (input.name) visible.set(`input[name="${input.name}"]`, "");
+    if (input.type === "submit") visible.set('input[type="submit"]', input.value);
+  }
+  visible.set('[data-se="o-form-head"]', OKTA_FIXTURE.okta.identifierScreen.visibleHeading);
+  return { name: "identifier", visible };
+}
+
+const passwordVisible = () =>
+  new Map([
+    ['input[type="password"]', ""],
+    ['input[name="credentials.passcode"]', ""],
+    ['input[type="submit"]', "Verify"],
+    ['[data-se="o-form-head"]', "Verify with your password"],
+  ]);
+
+const SCREENS = {
+  identifier: identifierScreen,
+  password: () => ({ name: "password", visible: passwordVisible() }),
+  password_error: () => {
+    const visible = passwordVisible();
+    visible.set('[data-se="o-form-error-container"]', "Password is incorrect");
+    return { name: "password_error", visible };
+  },
+  locked: () => {
+    const visible = passwordVisible();
+    visible.set('[data-se="o-form-error-container"]', "Your account is locked. Please contact your administrator.");
+    return { name: "locked", visible };
+  },
+  mfa: () => ({
+    name: "mfa",
+    visible: new Map([
+      ['[data-se="o-form-head"]', "Verify it's you with a security method"],
+      ['[data-se="authenticator-verify-list"]', "Get a push notification Okta Verify"],
+    ]),
+  }),
+  totp_challenge: () => ({
+    name: "totp_challenge",
+    visible: new Map([
+      ['[data-se="o-form-head"]', "Verify with Google Authenticator"],
+      ['input[name="credentials.passcode"]', ""],
+      ['input[type="submit"]', "Verify"],
+    ]),
+  }),
+  blank: () => ({ name: "blank", visible: new Map() }),
+};
+
+const splitSelector = (selector) => selector.split(/,\s*/).map((part) => part.trim());
+
+// Playwright URL glob: `**` any characters, `*` any except "/".
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\u0000").replace(/\*/g, "[^/]*").replace(/\u0000/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+
+/**
+ * outcome after the password submit (Okta auto-posts the SAML assertion to GoTrue's ACS):
+ *   "success"         → ACS answers 302 → app origin with a session fragment (`landingHash`)
+ *   "callback_error"  → ACS answers 302 → app origin with a GoTrue error fragment (`landingHash`)
+ *   "acs_error_body"  → ACS answers 422 with a GoTrue JSON error (`acsBody`)
+ *   "password_error" | "locked" | "mfa" | "totp_challenge" → that Okta screen
+ *   "hang"            → nothing happens
+ * redirectHost: serve the identifier screen on another host (a look-alike). gotoError: page.goto throws it.
+ *   "stuck_off_okta" → after Verify the browser leaves Okta and nothing ever answers
+ *   "click_throws"   → the Verify click throws after the password was filled
+ *   "blank_on_okta"  → after Verify Okta shows neither a form nor an error, on its own host
+ *
+ * Like real Playwright, a route on the ACS sees the POST; the 302's target is a redirect, which
+ * Playwright never routes — an unintercepted ACS therefore lands on the app (`log.appBooted`).
+ */
+export function createFakeOktaBrowser({ appOrigin, outcomes = ["success"], landingHash, acsBody = "", redirectHost, acsUrl = ACS_URL, gotoError } = {}) {
+  const log = { launches: 0, closes: 0, typed: [], routes: [], landings: [], acsFetches: [], blankFulfilled: 0, gotos: [], appBooted: 0 };
+  let launchIndex = 0;
+
+  function newPage(context) {
+    const handlers = [];
+    const frame = { url: () => page._url };
+    let screen = SCREENS.blank();
+    const outcome = outcomes[Math.min(launchIndex - 1, outcomes.length - 1)];
+
+    function commit(url) {
+      page._url = url;
+      for (const handler of handlers) handler(frame);
+    }
+
+    function acsResponse() {
+      if (outcome === "acs_error_body") return { status: 422, headers: { "content-type": "application/json" }, body: acsBody };
+      // Real staging (fixture): success is a 302, an ACS error a 303 redirect with error params.
+      const status = outcome === "callback_error" ? OKTA_FIXTURE.gotrue.acs.errorRedirect.status : OKTA_FIXTURE.gotrue.acs.status;
+      return { status, headers: { location: `${appOrigin}/#${landingHash}` }, body: "" };
+    }
+
+    async function postToAcs() {
+      const response = acsResponse();
+      const routed = context.routes.find((route) => globToRegExp(route.pattern).test(acsUrl));
+      if (routed) {
+        let fulfilled = false;
+        await routed.handler({
+          request: () => ({ url: () => acsUrl, method: () => "POST" }),
+          async fetch(options = {}) {
+            log.acsFetches.push(options);
+            if (options.maxRedirects !== 0) throw new Error("the recipe must fetch the ACS without following its redirect");
+            return { status: () => response.status, headers: () => response.headers, text: async () => response.body };
+          },
+          async fulfill() {
+            fulfilled = true;
+            log.blankFulfilled += 1;
+          },
+        });
+        if (!fulfilled) throw new Error("ACS route neither fulfilled nor continued");
+        screen = SCREENS.blank();
+        commit(acsUrl);
+        return;
+      }
+      // Not intercepted: the browser follows the 302 and the real app boots on the fragment.
+      if (response.status === 302 || response.status === 303) {
+        log.appBooted += 1;
+        log.landings.push(response.headers.location);
+        screen = SCREENS.blank();
+        commit(response.headers.location);
+      } else {
+        screen = SCREENS.blank();
+        commit(acsUrl);
+      }
+    }
+
+    async function afterPasswordSubmit() {
+      if (outcome === "success" || outcome === "callback_error" || outcome === "acs_error_body") {
+        await postToAcs();
+      } else if (outcome === "click_throws") {
+        // BOT-3145 review: the Verify click itself fails after the password went in.
+        throw new Error("locator.click: Target page, context or browser has been closed");
+      } else if (outcome === "blank_on_okta") {
+        // BOT-3145 review: Okta stays on its own host with no form and no error after Verify.
+        screen = SCREENS.blank();
+      } else if (outcome === "about_blank") {
+        // BOT-3145 review round 2: the tab goes blank after Verify (no host, proves nothing).
+        screen = SCREENS.blank();
+        commit("about:blank");
+      } else if (outcome === "stuck_off_okta") {
+        // Okta moved on (e.g. to GoTrue) but nothing ever answers.
+        screen = SCREENS.blank();
+        commit("https://staging-api.supply-guard.io/auth/v1/sso/saml/pending");
+      } else if (outcome !== "hang") {
+        screen = SCREENS[outcome]();
+      }
+    }
+
+    const locator = (selector) => {
+      const parts = splitSelector(selector);
+      const match = () => parts.find((part) => screen.visible.has(part));
+      const api = {
+        first: () => api,
+        async isVisible() {
+          return Boolean(match());
+        },
+        async waitFor() {
+          if (!match()) throw new Error(`Timeout waiting for ${selector} on ${screen.name}`);
+        },
+        async innerText() {
+          const part = match();
+          if (!part) throw new Error("not visible");
+          return screen.visible.get(part);
+        },
+        async fill(value) {
+          const part = match();
+          if (!part) throw new Error(`fill: ${selector} not visible`);
+          log.typed.push({ host: new URL(page._url).hostname, field: part.includes("identifier") ? "identifier" : "password", value });
+        },
+        async click() {
+          if (screen.name === "identifier") screen = SCREENS.password();
+          else if (screen.name === "password") await afterPasswordSubmit();
+        },
+      };
+      return api;
+    };
+
+    const page = {
+      _url: "about:blank",
+      on(event, handler) {
+        if (event === "framenavigated") handlers.push(handler);
+      },
+      mainFrame: () => frame,
+      url: () => page._url,
+      locator,
+      async goto(url) {
+        log.gotos.push(url);
+        if (gotoError) throw gotoError;
+        const parsed = new URL(url);
+        if (redirectHost) parsed.hostname = redirectHost;
+        commit(parsed.toString());
+        if (parsed.hostname === OKTA_HOST || redirectHost) screen = SCREENS.identifier();
+      },
+    };
+    return page;
+  }
+
+  async function launchBrowser() {
+    log.launches += 1;
+    launchIndex += 1;
+    return {
+      async newContext() {
+        const context = {
+          routes: [],
+          async route(pattern, handler) {
+            context.routes.push({ pattern, handler });
+            log.routes.push(pattern);
+          },
+          async newPage() {
+            return newPage(context);
+          },
+        };
+        return context;
+      },
+      async close() {
+        log.closes += 1;
+      },
+    };
+  }
+
+  return { launchBrowser, log };
+}

package/src/wait-core.mjs

@@ -116,6 +116,9 @@ export const SIGNAL_TYPES = Object.freeze([
   // It is intentionally consumed through the existing raw `event:` escape
   // hatch rather than adding another parallel wait grammar.
   "host_approval",
+  // BOT-3136: one signal per member-issue change of a Linear project (an epic),
+  // subject = the project's lower-case UUID. Tenant-primary like linear_issue.
+  "linear_project",
 ]);
 
 const LOCK_SUBTYPES = Object.freeze(["playwright_lane", "vite_port", "backend_port", "supabase_local"]);
@@ -525,6 +528,15 @@ const VALIDATORS = {
     if (p.type === "host_approval" && (!subject || !HOST_APPROVAL_HOST_KEY_RE.test(subject))) {
       throw new Error("event:type=host_approval needs subject=<canonical bbh- host key>");
     }
+    // BOT-3136: a project subject is its Linear UUID, matched exactly as the
+    // emitter writes it (lower-case), so normalize here and refuse anything else.
+    if (p.type === "linear_project") {
+      const id = subject ? subject.toLowerCase() : "";
+      if (!CANONICAL_UUID_RE.test(id)) {
+        throw new Error("event:type=linear_project needs subject=<Linear project UUID>");
+      }
+      return { type: p.type, subject: id };
+    }
     return { type: p.type, subject };
   },
 };

package/src/wait.mjs

@@ -251,6 +251,10 @@ CONDITIONS  (TYPE:key=val,key=val — repeat for several; --any wakes on the fir
                                       event:type=host_approval,subject=bbh-<24 lowercase hex>;
                                       it wakes only for the authenticated owner's one bound
                                       tenant after current server-side approval revalidation.
+                                      Epic progress uses
+                                      event:type=linear_project,subject=<Linear project UUID>;
+                                      it wakes when any issue in that project changes, joins
+                                      or leaves it (the band's epic row, BOT-3136).
 
 OPTIONS
   Review intervention: exact-head Codex waits have a durable one-shot diagnostic.