@botbuddy/cli 1.66.0 → 1.67.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.67.0
+
+- New `bb release-notes submit <note.json>` submits one governed release note for your tenant through the MCP tool `submit_release_note`. It sends the file unchanged, prints the stored source key, state and revision, and exits 1 with the named refusal (`schema_invalid`, `type_unknown`, `markup_refused`, `link_refused`, `entitlement_missing`) when nothing was stored.
+
 ## 1.64.26
 
 - `bb stack run --remote` (and auto runs placed remotely) never binds a local port in the leased serving band 61000–64999 any more. SSH forwards whose remote number falls in that band are remapped to a port outside it, remapped and probe ports are picked from explicit out-of-band candidates instead of the kernel's ephemeral range, and the requester origin and native callback gateway are reserved outside the band too. A `--callback-port` inside the band is refused with `CALLBACK_PORT_RESERVED` before anything is probed or spawned. This stops a remote lease's tunnel from taking ports a co-located stack on the same machine was just given.

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.66.0",
-  "source_commit": "6eb7fc060d0908254af17808ce9f110094386a2b",
-  "source_sha256": "fe2df8ccaaaf182e5e2ac8def3be1401adce09dd48a47ccc713ccb7afc04a7e8",
+  "release_version": "1.67.0",
+  "source_commit": "268168df0f1ca0c6e45a7650488ecc1e24e06401",
+  "source_sha256": "28a9fb83409d1d081474ef61a1a8f025837c54284d5809b4d9ebec87c0ee4e7d",
   "target": "darwin-arm64",
-  "sha256": "e7c4da070c2c016743963605c408d7ebb1f16c8c36d304fe52045b7dfc9d9dd1"
+  "sha256": "f75345368910de3b008e4796e6469c60e9026b9db732baadb14fa994b2982cf1"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.66.0",
-  "source_commit": "6eb7fc060d0908254af17808ce9f110094386a2b",
-  "source_sha256": "fe2df8ccaaaf182e5e2ac8def3be1401adce09dd48a47ccc713ccb7afc04a7e8",
+  "release_version": "1.67.0",
+  "source_commit": "268168df0f1ca0c6e45a7650488ecc1e24e06401",
+  "source_sha256": "28a9fb83409d1d081474ef61a1a8f025837c54284d5809b4d9ebec87c0ee4e7d",
   "target": "linux-x64",
-  "sha256": "5e43e75f6a6b2143b00de322fe954811fbfb4f0cda694f80fd44fa3c39bbae3e"
+  "sha256": "9c1fb4e157e1b86f84b7efda1a3ab25f9e869a9d09a1c30093c3ef4dc67e928f"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.66.0",
-  "source_commit": "6eb7fc060d0908254af17808ce9f110094386a2b",
-  "source_sha256": "fe2df8ccaaaf182e5e2ac8def3be1401adce09dd48a47ccc713ccb7afc04a7e8",
+  "release_version": "1.67.0",
+  "source_commit": "268168df0f1ca0c6e45a7650488ecc1e24e06401",
+  "source_sha256": "28a9fb83409d1d081474ef61a1a8f025837c54284d5809b4d9ebec87c0ee4e7d",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "e7c4da070c2c016743963605c408d7ebb1f16c8c36d304fe52045b7dfc9d9dd1",
+      "sha256": "f75345368910de3b008e4796e6469c60e9026b9db732baadb14fa994b2982cf1",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "5e43e75f6a6b2143b00de322fe954811fbfb4f0cda694f80fd44fa3c39bbae3e",
+      "sha256": "9c1fb4e157e1b86f84b7efda1a3ab25f9e869a9d09a1c30093c3ef4dc67e928f",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.66.0",
+  "version": "1.67.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/agent-doctor.mjs

@@ -126,8 +126,19 @@ export function repairFailureRecovery(code, error = null) {
  */
 function applyStackLeaseCapability(report, capability) {
   if (!capability || typeof capability.status !== "string") return;
-  report.stack_lease.capability = capability.status;
+  // BOT-3144: the server names this owner's own revoked (disabled) host record; say
+  // "refused" rather than a generic "unattested", and make its fix the recovery.
+  const revoked = typeof capability.host_state === "string" && capability.host_state.length > 0 && capability.status !== "established";
+  report.stack_lease.capability = revoked ? "refused" : capability.status;
   if (capability.reason) report.stack_lease.reason = capability.reason;
+  if (revoked) {
+    report.stack_lease.host_state = capability.host_state;
+    if (typeof capability.host_key === "string") report.stack_lease.host_key = capability.host_key;
+    // Codex #1609 P2: the server names the fix (withdrawn consent needs the Helper first).
+    if (typeof capability.fix === "string" && capability.fix) report.stack_lease.fix = capability.fix;
+    if (!report.recovery) report.recovery = capability.reason ?? `this machine's host record is ${capability.host_state}; set it to maintenance or re-enable it on /docker, then run \`bb doctor --fix\``;
+  }
+  if (typeof capability.checked_at === "string") report.stack_lease.checked_at = capability.checked_at;
   if (capability.reported_host && capability.enrolled_host) {
     report.stack_lease.hostname_drift = {
       reported: capability.reported_host,
@@ -207,6 +218,9 @@ export async function doctorAgentAuth({
       remediation: "ticketed Codex requires --codex-thread-id <UUID>; ticketed Claude Desktop requires CLAUDE_CODE_HOST_SESSION_ID=local_<uuid>; use --no-ticket-reason for terminal or cloud work without a native link",
     },
   };
+  // BOT-3144: a plain `bb doctor` registers nothing, so report the verdict cached by the
+  // last registration (with when it was checked) instead of a bare `unverified`.
+  if (fresh && !fix) applyStackLeaseCapability(report, state.stack_lease_capability);
   let credential = fresh
     ? { token: state.agent_session_token, sessionId: state.session_id, agentId: state.agent_id, source: "cache" }
     : null;

package/src/agent-session.mjs

@@ -439,6 +439,11 @@ export async function selfHealAgentSession({
       ...(typeof data.session_token_generation === "string" && data.session_token_generation
         ? { session_token_generation: data.session_token_generation }
         : {}),
+      // BOT-3144: the registration's stack-lease verdict, so a plain `bb doctor` can
+      // report "refused" for a revoked host record instead of `unverified`.
+      ...(data.stack_lease_capability && typeof data.stack_lease_capability.status === "string"
+        ? { stack_lease_capability: { ...data.stack_lease_capability, checked_at: issued.toISOString() } }
+        : {}),
     };
     if (renewal && !isAgentStateFresh(state, issued, 0)) {
       throw missing("session_mint_invalid", "register_agent returned an invalid replacement session record.");

package/src/commands.mjs

@@ -19,6 +19,7 @@ import { cmdRun } from "./run.mjs";
 import { cmdTest } from "./test-lane.mjs";
 import { cmdEvidence } from "./evidence.mjs";
 import { cmdFeedback } from "./feedback.mjs";
+import { cmdReleaseNotes } from "./release-notes.mjs";
 import { runWait } from "./wait.mjs";
 import { SETUP_BLOCK } from "./setup-block.mjs";
 import { green, red, cyan, dim, bold, die } from "./utils.mjs";
@@ -63,6 +64,7 @@ export function shouldCheckForUpdates(argv) {
 export const LOCAL_HELP_COMMANDS = Object.freeze([
   "wait", "stack", "pw", "docker", "run", "mcp", "login", "setup", "doctor", "host",
   "staging-pool", "daemon", "evidence", "feedback", "usage", "telemetry", "allocation",
+  "release-notes",
 ]);
 const HELP_WORDS = new Set(["help", "--help", "-h"]);
 
@@ -143,6 +145,8 @@ export async function run(argv, {
     case "test": return cmdTest(args);
     case "evidence": return cmdEvidence(args);
     case "feedback": return cmdFeedback(args);
+    // BOT-3156: governed release notes (submit one note through submit_release_note).
+    case "release-notes": return cmdReleaseNotes(args);
     case "test-ingest": return cmdTestIngest(args);
     case "wait": return runWait(args);
     case "pw": return runPw(args);
@@ -329,6 +333,8 @@ ${bold("DURABLE WORKLOADS")}  (${cyan("bb help run")})
 ${bold("EVIDENCE")}  (${cyan("bb help evidence")})
   feedback init|submit --file <report.json>
                               Prepare or send a BotBuddy issue report
+  release-notes submit <note.json>
+                              Submit one release note for your tenant (stored as draft)
   evidence require <file>    Record an exact-head evidence disposition → botbuddy/ready
   evidence publish <file>    Publish a local evidence statement → botbuddy/ready check-run
 
@@ -423,7 +429,12 @@ export async function cmdDoctor(args, {
     log(`agent session: ${result.report.session.status}${result.report.session.minted_with ? ` (minted_with: ${result.report.session.minted_with})` : ""}`);
     if (result.report.stack_lease) {
       const sl = result.report.stack_lease;
-      log(`stack lease: ${sl.capability} (host ${sl.host}, machine id ${sl.machine_id_readable ? "readable" : "unavailable"})${sl.reason ? ` — ${sl.reason}` : ""}${publish ? ` ${formatPublishIp(publish)}` : ""}`);
+      // BOT-3144: a revoked host record leads with the cause and the fix.
+      if (sl.capability === "refused" && sl.host_state) {
+        log(`stack lease: refused — this machine's host record is ${sl.host_state}${sl.host_key ? ` (${sl.host_key})` : ""}: ${sl.fix ?? "set it to maintenance or re-enable it on /docker, then run \`bb doctor --fix\`"} (host ${sl.host}${sl.checked_at ? `, checked ${sl.checked_at}` : ""})`);
+      } else {
+        log(`stack lease: ${sl.capability} (host ${sl.host}, machine id ${sl.machine_id_readable ? "readable" : "unavailable"})${sl.reason ? ` — ${sl.reason}` : ""}${publish ? ` ${formatPublishIp(publish)}` : ""}`);
+      }
       if (publish && !isLoopbackIp(publish.publish_ip)) {
         log(`stack publish: leased stacks on this host are reachable beyond loopback (\`bb stack up --local-exec\` refuses; the Helper refuses ports_exposed_beyond_loopback) — fix: ${publishIpFix(publish.engine)}`);
       }

package/src/release-notes.mjs

@@ -0,0 +1,102 @@
+// BOT-3156: `bb release-notes submit <note.json>` — submit one governed release
+// note through the MCP tool `submit_release_note`. The server is the only
+// validator: the CLI sends the file's JSON unchanged (no rewriting, no filling
+// in), records the route as `cli`, and prints the stored source key, state and
+// revision, or the named refusal. The tenant is the authenticated agent's.
+import { readFile } from "node:fs/promises";
+import { CALL_EXIT, callToolJson, resolveCallAuth } from "./api.mjs";
+
+export const RELEASE_NOTES_USAGE = `Usage: bb release-notes submit <note.json> [--json]
+
+Submits one release note for your tenant. The file is a schema-1 payload:
+
+  { "schema_version": 1,
+    "source_key": "BOT-1234",
+    "type": "Feature",
+    "internal": { "title": "…", "body": "…" },
+    "external": { "title": "…", "body": "…" },
+    "internal_links": [ { "name": "PR #12", "url": "https://github.com/…", "kind": "pr" } ],
+    "external_links": [ { "name": "Open the report", "url": "/reports?tab=x", "kind": "deep_link" } ] }
+
+type is one of Feature, Improvement, Fix, Security, Deprecation, Internal.
+external and both link lists are optional. A body uses bbrn-md-1: paragraphs,
+"- " lists, **bold**, *italic* and \`code\`; a backslash escapes only \\ * \` and <.
+No HTML and no links inside a body. A link url is https://… or an app path
+starting with one /. Write the text yourself: BotBuddy stores exactly what you
+submit.
+
+Submitting the same source_key again updates the note and adds a revision.
+An unchanged resubmit (a retry) adds none. A refusal names its code
+(schema_invalid, type_unknown, markup_refused, link_refused,
+entitlement_missing) and stores nothing.
+
+Exit codes: 0 stored · 1 refused · 2 usage · 3 authentication · 5 BotBuddy unreachable.`;
+
+const TOOL = "submit_release_note";
+
+export async function cmdReleaseNotes(args, {
+  read = readFile,
+  resolveAuth = resolveCallAuth,
+  call = callToolJson,
+  log = console.log,
+  errorLog = console.error,
+} = {}) {
+  if (args.length === 0 || ["help", "--help", "-h"].includes(args[0])) {
+    (args.length === 0 ? errorLog : log)(RELEASE_NOTES_USAGE);
+    return args.length === 0 ? 2 : CALL_EXIT.OK;
+  }
+  const json = args.includes("--json");
+  const rest = args.filter((a) => a !== "--json");
+  if (rest[0] !== "submit" || rest.length !== 2 || !rest[1] || rest[1].startsWith("-")) {
+    errorLog(RELEASE_NOTES_USAGE);
+    return 2;
+  }
+  const file = rest[1];
+  let note;
+  try {
+    note = JSON.parse(await read(file, "utf8"));
+  } catch {
+    errorLog(`Could not read ${file} as JSON; nothing was submitted.`);
+    return 2;
+  }
+
+  let result;
+  try {
+    const resolved = await resolveAuth({ toolName: TOOL, preferSession: true });
+    result = resolved?.error || !resolved?.auth
+      ? { ok: false, auth: true }
+      : await call(TOOL, { note, route: "cli" }, { auth: resolved.auth, signal: AbortSignal.timeout(30_000) });
+  } catch {
+    result = { ok: false, status: null };
+  }
+
+  const data = result?.data;
+  if (result?.ok && data?.ok === true && typeof data.source_key === "string" && Number.isInteger(data.revision)) {
+    const receipt = { ok: true, source_key: data.source_key, state: data.state, revision: data.revision, created: data.created === true, changed: data.changed === true, tenant: data.tenant ?? null };
+    if (json) log(JSON.stringify(receipt));
+    else {
+      const what = receipt.created ? "stored" : receipt.changed ? "updated" : "unchanged (no new revision)";
+      log(`Release note ${receipt.source_key} ${what}: state ${receipt.state}, revision ${receipt.revision}${receipt.tenant ? `, tenant ${receipt.tenant}` : ""}.`);
+    }
+    return CALL_EXIT.OK;
+  }
+  if (result?.ok && data?.ok === false && typeof data.error === "string") {
+    const refusal = { ok: false, error: data.error, ...(data.field ? { field: data.field } : {}), message: data.message ?? null };
+    if (json) log(JSON.stringify(refusal));
+    errorLog(`✗ ${refusal.error}${refusal.field ? ` (${refusal.field})` : ""}: ${refusal.message ?? "Nothing was stored."}`);
+    return CALL_EXIT.ERROR;
+  }
+  if (result?.auth) {
+    if (json) log(JSON.stringify({ ok: false, error: "authentication_failed" }));
+    errorLog("✗ BotBuddy could not authenticate this command. Run bb doctor --fix in this worktree, then retry. Nothing was stored.");
+    return CALL_EXIT.AUTH;
+  }
+  if (!result?.ok && result?.status == null) {
+    if (json) log(JSON.stringify({ ok: false, error: "transport_unavailable" }));
+    errorLog("✗ BotBuddy is unreachable. Retry the same command; an unchanged resubmit adds no revision.");
+    return CALL_EXIT.TRANSPORT;
+  }
+  if (json) log(JSON.stringify({ ok: false, error: "receipt_unavailable" }));
+  errorLog("✗ BotBuddy did not confirm the submit. Retry the same command; an unchanged resubmit adds no revision.");
+  return CALL_EXIT.ERROR;
+}