@botbuddy/cli 1.66.1 → 1.67.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.67.0
+
+- New `bb release-notes submit <note.json>` submits one governed release note for your tenant through the MCP tool `submit_release_note`. It sends the file unchanged, prints the stored source key, state and revision, and exits 1 with the named refusal (`schema_invalid`, `type_unknown`, `markup_refused`, `link_refused`, `entitlement_missing`) when nothing was stored.
+
 ## 1.64.26
 
 - `bb stack run --remote` (and auto runs placed remotely) never binds a local port in the leased serving band 61000–64999 any more. SSH forwards whose remote number falls in that band are remapped to a port outside it, remapped and probe ports are picked from explicit out-of-band candidates instead of the kernel's ephemeral range, and the requester origin and native callback gateway are reserved outside the band too. A `--callback-port` inside the band is refused with `CALLBACK_PORT_RESERVED` before anything is probed or spawned. This stops a remote lease's tunnel from taking ports a co-located stack on the same machine was just given.

package/daemon-release/darwin-arm64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.66.1",
-  "source_commit": "186cf2389659c39f7a7c4caa3f6fda5bdc54d670",
-  "source_sha256": "9809bace87147ec12fee985d3b4877bbefd1b39eabc5f0f047df553f0afcd3a9",
+  "release_version": "1.67.0",
+  "source_commit": "268168df0f1ca0c6e45a7650488ecc1e24e06401",
+  "source_sha256": "28a9fb83409d1d081474ef61a1a8f025837c54284d5809b4d9ebec87c0ee4e7d",
   "target": "darwin-arm64",
-  "sha256": "c3afe8d4c99efe77db044d4d7bb4aef532436e46cdc75179b0e0a847b3e8b190"
+  "sha256": "f75345368910de3b008e4796e6469c60e9026b9db732baadb14fa994b2982cf1"
 }

package/daemon-release/linux-x64.json

@@ -1,7 +1,7 @@
 {
-  "release_version": "1.66.1",
-  "source_commit": "186cf2389659c39f7a7c4caa3f6fda5bdc54d670",
-  "source_sha256": "9809bace87147ec12fee985d3b4877bbefd1b39eabc5f0f047df553f0afcd3a9",
+  "release_version": "1.67.0",
+  "source_commit": "268168df0f1ca0c6e45a7650488ecc1e24e06401",
+  "source_sha256": "28a9fb83409d1d081474ef61a1a8f025837c54284d5809b4d9ebec87c0ee4e7d",
   "target": "linux-x64",
-  "sha256": "d8756014b7ba81cdb244425c82728e42892a5ce701fb435abd65ac8cb2743403"
+  "sha256": "9c1fb4e157e1b86f84b7efda1a3ab25f9e869a9d09a1c30093c3ef4dc67e928f"
 }

package/daemon-release/manifest.json

@@ -1,21 +1,21 @@
 {
   "schema_version": 1,
-  "release_version": "1.66.1",
-  "source_commit": "186cf2389659c39f7a7c4caa3f6fda5bdc54d670",
-  "source_sha256": "9809bace87147ec12fee985d3b4877bbefd1b39eabc5f0f047df553f0afcd3a9",
+  "release_version": "1.67.0",
+  "source_commit": "268168df0f1ca0c6e45a7650488ecc1e24e06401",
+  "source_sha256": "28a9fb83409d1d081474ef61a1a8f025837c54284d5809b4d9ebec87c0ee4e7d",
   "targets": {
     "darwin-arm64": {
       "goos": "darwin",
       "goarch": "arm64",
       "binary": "daemon/bin/darwin-arm64/botbuddy-daemon",
-      "sha256": "c3afe8d4c99efe77db044d4d7bb4aef532436e46cdc75179b0e0a847b3e8b190",
+      "sha256": "f75345368910de3b008e4796e6469c60e9026b9db732baadb14fa994b2982cf1",
       "mode": "0755"
     },
     "linux-x64": {
       "goos": "linux",
       "goarch": "amd64",
       "binary": "daemon/bin/linux-x64/botbuddy-daemon",
-      "sha256": "d8756014b7ba81cdb244425c82728e42892a5ce701fb435abd65ac8cb2743403",
+      "sha256": "9c1fb4e157e1b86f84b7efda1a3ab25f9e869a9d09a1c30093c3ef4dc67e928f",
       "mode": "0755"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.66.1",
+  "version": "1.67.0",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/commands.mjs

@@ -19,6 +19,7 @@ import { cmdRun } from "./run.mjs";
 import { cmdTest } from "./test-lane.mjs";
 import { cmdEvidence } from "./evidence.mjs";
 import { cmdFeedback } from "./feedback.mjs";
+import { cmdReleaseNotes } from "./release-notes.mjs";
 import { runWait } from "./wait.mjs";
 import { SETUP_BLOCK } from "./setup-block.mjs";
 import { green, red, cyan, dim, bold, die } from "./utils.mjs";
@@ -63,6 +64,7 @@ export function shouldCheckForUpdates(argv) {
 export const LOCAL_HELP_COMMANDS = Object.freeze([
   "wait", "stack", "pw", "docker", "run", "mcp", "login", "setup", "doctor", "host",
   "staging-pool", "daemon", "evidence", "feedback", "usage", "telemetry", "allocation",
+  "release-notes",
 ]);
 const HELP_WORDS = new Set(["help", "--help", "-h"]);
 
@@ -143,6 +145,8 @@ export async function run(argv, {
     case "test": return cmdTest(args);
     case "evidence": return cmdEvidence(args);
     case "feedback": return cmdFeedback(args);
+    // BOT-3156: governed release notes (submit one note through submit_release_note).
+    case "release-notes": return cmdReleaseNotes(args);
     case "test-ingest": return cmdTestIngest(args);
     case "wait": return runWait(args);
     case "pw": return runPw(args);
@@ -329,6 +333,8 @@ ${bold("DURABLE WORKLOADS")}  (${cyan("bb help run")})
 ${bold("EVIDENCE")}  (${cyan("bb help evidence")})
   feedback init|submit --file <report.json>
                               Prepare or send a BotBuddy issue report
+  release-notes submit <note.json>
+                              Submit one release note for your tenant (stored as draft)
   evidence require <file>    Record an exact-head evidence disposition → botbuddy/ready
   evidence publish <file>    Publish a local evidence statement → botbuddy/ready check-run
 

package/src/release-notes.mjs

@@ -0,0 +1,102 @@
+// BOT-3156: `bb release-notes submit <note.json>` — submit one governed release
+// note through the MCP tool `submit_release_note`. The server is the only
+// validator: the CLI sends the file's JSON unchanged (no rewriting, no filling
+// in), records the route as `cli`, and prints the stored source key, state and
+// revision, or the named refusal. The tenant is the authenticated agent's.
+import { readFile } from "node:fs/promises";
+import { CALL_EXIT, callToolJson, resolveCallAuth } from "./api.mjs";
+
+export const RELEASE_NOTES_USAGE = `Usage: bb release-notes submit <note.json> [--json]
+
+Submits one release note for your tenant. The file is a schema-1 payload:
+
+  { "schema_version": 1,
+    "source_key": "BOT-1234",
+    "type": "Feature",
+    "internal": { "title": "…", "body": "…" },
+    "external": { "title": "…", "body": "…" },
+    "internal_links": [ { "name": "PR #12", "url": "https://github.com/…", "kind": "pr" } ],
+    "external_links": [ { "name": "Open the report", "url": "/reports?tab=x", "kind": "deep_link" } ] }
+
+type is one of Feature, Improvement, Fix, Security, Deprecation, Internal.
+external and both link lists are optional. A body uses bbrn-md-1: paragraphs,
+"- " lists, **bold**, *italic* and \`code\`; a backslash escapes only \\ * \` and <.
+No HTML and no links inside a body. A link url is https://… or an app path
+starting with one /. Write the text yourself: BotBuddy stores exactly what you
+submit.
+
+Submitting the same source_key again updates the note and adds a revision.
+An unchanged resubmit (a retry) adds none. A refusal names its code
+(schema_invalid, type_unknown, markup_refused, link_refused,
+entitlement_missing) and stores nothing.
+
+Exit codes: 0 stored · 1 refused · 2 usage · 3 authentication · 5 BotBuddy unreachable.`;
+
+const TOOL = "submit_release_note";
+
+export async function cmdReleaseNotes(args, {
+  read = readFile,
+  resolveAuth = resolveCallAuth,
+  call = callToolJson,
+  log = console.log,
+  errorLog = console.error,
+} = {}) {
+  if (args.length === 0 || ["help", "--help", "-h"].includes(args[0])) {
+    (args.length === 0 ? errorLog : log)(RELEASE_NOTES_USAGE);
+    return args.length === 0 ? 2 : CALL_EXIT.OK;
+  }
+  const json = args.includes("--json");
+  const rest = args.filter((a) => a !== "--json");
+  if (rest[0] !== "submit" || rest.length !== 2 || !rest[1] || rest[1].startsWith("-")) {
+    errorLog(RELEASE_NOTES_USAGE);
+    return 2;
+  }
+  const file = rest[1];
+  let note;
+  try {
+    note = JSON.parse(await read(file, "utf8"));
+  } catch {
+    errorLog(`Could not read ${file} as JSON; nothing was submitted.`);
+    return 2;
+  }
+
+  let result;
+  try {
+    const resolved = await resolveAuth({ toolName: TOOL, preferSession: true });
+    result = resolved?.error || !resolved?.auth
+      ? { ok: false, auth: true }
+      : await call(TOOL, { note, route: "cli" }, { auth: resolved.auth, signal: AbortSignal.timeout(30_000) });
+  } catch {
+    result = { ok: false, status: null };
+  }
+
+  const data = result?.data;
+  if (result?.ok && data?.ok === true && typeof data.source_key === "string" && Number.isInteger(data.revision)) {
+    const receipt = { ok: true, source_key: data.source_key, state: data.state, revision: data.revision, created: data.created === true, changed: data.changed === true, tenant: data.tenant ?? null };
+    if (json) log(JSON.stringify(receipt));
+    else {
+      const what = receipt.created ? "stored" : receipt.changed ? "updated" : "unchanged (no new revision)";
+      log(`Release note ${receipt.source_key} ${what}: state ${receipt.state}, revision ${receipt.revision}${receipt.tenant ? `, tenant ${receipt.tenant}` : ""}.`);
+    }
+    return CALL_EXIT.OK;
+  }
+  if (result?.ok && data?.ok === false && typeof data.error === "string") {
+    const refusal = { ok: false, error: data.error, ...(data.field ? { field: data.field } : {}), message: data.message ?? null };
+    if (json) log(JSON.stringify(refusal));
+    errorLog(`✗ ${refusal.error}${refusal.field ? ` (${refusal.field})` : ""}: ${refusal.message ?? "Nothing was stored."}`);
+    return CALL_EXIT.ERROR;
+  }
+  if (result?.auth) {
+    if (json) log(JSON.stringify({ ok: false, error: "authentication_failed" }));
+    errorLog("✗ BotBuddy could not authenticate this command. Run bb doctor --fix in this worktree, then retry. Nothing was stored.");
+    return CALL_EXIT.AUTH;
+  }
+  if (!result?.ok && result?.status == null) {
+    if (json) log(JSON.stringify({ ok: false, error: "transport_unavailable" }));
+    errorLog("✗ BotBuddy is unreachable. Retry the same command; an unchanged resubmit adds no revision.");
+    return CALL_EXIT.TRANSPORT;
+  }
+  if (json) log(JSON.stringify({ ok: false, error: "receipt_unavailable" }));
+  errorLog("✗ BotBuddy did not confirm the submit. Retry the same command; an unchanged resubmit adds no revision.");
+  return CALL_EXIT.ERROR;
+}