@botbuddy/cli 1.8.3 → 1.8.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.8.3",
+  "version": "1.8.5",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/botbuddy-release-repair.json

@@ -0,0 +1 @@
+{"schema_version":1,"source_version":"1.8.3","source_identity":"a3c85408868d913b2ab265f910ab062916c1c394895cec71cae0f79fc99f5a6c"}

package/src/docker-hygiene.mjs

@@ -8,6 +8,7 @@ import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 import { callToolJson } from "./api.mjs";
 import { acquireStackLock, lockPathForProject, projectIdFromConfig } from "./stack-file-lock.mjs";
+import { machineUuid } from "./machine-id.mjs";
 
 export const SCHEMA_VERSION = 1;
 export const DEFAULT_PROJECTED_ENDPOINTS = 10;
@@ -1118,6 +1119,7 @@ async function runDockerCommandWithBotBuddyLock(argv, {
   runWorkflow = runDockerWorkflow,
   workflowOptions = {},
   machineHost = hostname(),
+  machineId = machineUuid(),
   monotonicNow = Date.now,
 } = {}) {
   const parsed = parseDockerArgs(argv);
@@ -1131,6 +1133,10 @@ async function runDockerCommandWithBotBuddyLock(argv, {
     host: machineHost,
     slot: parsed.opts.lockSlot,
     mode: "lock",
+    // BOT-1239: report THIS machine's unique id so the supabase_local stack lock states
+    // which physical machine holds it (host is a hostname two machines can share). Only
+    // sent when the probe found one — a NULL degrades to hostname grouping.
+    ...(machineId ? { machine_uuid: machineId } : {}),
     ticket_id: parsed.opts.ticket,
     no_pr_reason: "local OrbStack hygiene",
   });

package/src/machine-id.mjs

@@ -0,0 +1,70 @@
+// BOT-1239 — the machine-UNIQUE identity of THIS physical machine.
+//
+// A hostname is not machine-unique (two machines can both be "ubuntu"), so a
+// supabase_local lock keyed only on hostname cannot be attributed to the machine
+// that holds it. This reads the same machine-unique token a BotBuddy Helper attests
+// at enrollment (container_hosts.hardware_uuid) so a lock the CLI acquires reports the
+// SAME identity — letting /docker merge a machine's Helper with its own stack lock and
+// never with a foreign machine's under a shared hostname.
+//
+//   * macOS : IOPlatformUUID from `ioreg -rd1 -c IOPlatformExpertDevice` (what the
+//             Helper attests, so the two identities match for one machine).
+//   * Linux : /etc/machine-id (falling back to /var/lib/dbus/machine-id).
+//   * else / on any error : null — the lock then degrades to hostname grouping, never
+//             a wrong merge. This must NEVER throw or block a lock acquisition.
+//
+// `BOTBUDDY_MACHINE_UUID` overrides the probe (explicit operator control / tests).
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+
+const IOREG_UUID_RE = /"IOPlatformUUID"\s*=\s*"([^"]+)"/;
+
+export function readMachineUuid({
+  platform = process.platform,
+  env = process.env,
+  exec = (cmd, args) => spawnSync(cmd, args, { encoding: "utf8", timeout: 4000 }),
+  readFile = (p) => readFileSync(p, "utf8"),
+} = {}) {
+  try {
+    const override = (env.BOTBUDDY_MACHINE_UUID || "").trim();
+    if (override) return override;
+
+    if (platform === "darwin") {
+      const out = exec("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+      if (out && out.status === 0 && typeof out.stdout === "string") {
+        const m = out.stdout.match(IOREG_UUID_RE);
+        const uuid = m && m[1] ? m[1].trim() : "";
+        return uuid || null;
+      }
+      return null;
+    }
+
+    if (platform === "linux") {
+      for (const path of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+        try {
+          const id = String(readFile(path) || "").trim();
+          if (id) return id;
+        } catch { /* try the next source */ }
+      }
+      return null;
+    }
+
+    return null;
+  } catch {
+    // A machine id is a best-effort disambiguator; never let it fail an acquire.
+    return null;
+  }
+}
+
+let _cached;
+let _cachedComputed = false;
+
+// Cached, zero-argument accessor for the real process. Tests call readMachineUuid
+// directly with injected dependencies instead of hitting this cache.
+export function machineUuid() {
+  if (!_cachedComputed) {
+    _cached = readMachineUuid();
+    _cachedComputed = true;
+  }
+  return _cached;
+}

package/src/wait-core.mjs

@@ -196,20 +196,44 @@ const VALIDATORS = {
   // BOT-1066 — ci: wake when a PR's CI reaches a terminal conclusion. Exactly one
   // selector: scope=latest (follows the PR's latest run — needs pr=), run_id=<id>
   // (pinned to one run), or sha=<sha> (pinned to a commit). repo= is always required.
+  // BOT-1507 — scope=next adds a fourth, LIVE-ONLY selector: it names no run, sha,
+  // or PR (they must all already exist at arm time) and wakes on the first terminal
+  // CI run for the repo delivered AFTER the wait was armed — the post-merge / cron
+  // train case. Optional branch=/workflow= filter that first run; both are valid
+  // ONLY with scope=next (a run_id/sha/latest wait already names its run).
   ci(p) {
     const repo = p.repo != null ? String(p.repo).trim() : null;
     if (!repo || !repo.includes("/")) throw new Error("ci needs repo=<owner/repo>");
     const selectors = ["scope", "run_id", "sha"].filter((k) => p[k] !== undefined);
     if (selectors.length !== 1) {
-      throw new Error("ci needs exactly one of scope=latest | run_id=<id> | sha=<sha>");
+      throw new Error("ci needs exactly one of scope=latest|next | run_id=<id> | sha=<sha>");
     }
+    const hasFilter = p.branch !== undefined || p.workflow !== undefined;
     if (p.scope !== undefined) {
-      if (p.scope !== "latest") throw new Error("ci scope must be 'latest' (or use run_id=/sha=)");
-      if (p.pr === undefined || !/^\d+$/.test(String(p.pr).trim())) {
-        throw new Error("ci scope=latest needs pr=<number>");
+      if (p.scope === "latest") {
+        if (hasFilter) throw new Error("ci branch=/workflow= are only valid with scope=next");
+        if (p.pr === undefined || !/^\d+$/.test(String(p.pr).trim())) {
+          throw new Error("ci scope=latest needs pr=<number>");
+        }
+        return { repo, scope: "latest", pr: String(p.pr).trim() };
+      }
+      if (p.scope === "next") {
+        // A future run has no PR head to follow — pr= is meaningless (and run_id/sha
+        // are already excluded by the single-selector check above).
+        if (p.pr !== undefined) {
+          throw new Error("ci scope=next takes no pr= (it targets a future run, not a PR head)");
+        }
+        const filter = (key) => {
+          if (p[key] === undefined) return null;
+          const v = String(p[key]).trim();
+          if (v === "") throw new Error(`ci ${key}= must be non-empty`);
+          return v;
+        };
+        return { repo, scope: "next", branch: filter("branch"), workflow: filter("workflow"), pr: null };
       }
-      return { repo, scope: "latest", pr: String(p.pr).trim() };
+      throw new Error("ci scope must be 'latest' or 'next' (or use run_id=/sha=)");
     }
+    if (hasFilter) throw new Error("ci branch=/workflow= are only valid with scope=next");
     if (p.run_id !== undefined) {
       if (!String(p.run_id).trim()) throw new Error("ci run_id must be non-empty");
       return { repo, scope: "run_id", runId: String(p.run_id).trim(), pr: p.pr != null ? String(p.pr).trim() : null };
@@ -679,6 +703,23 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
       if (String(signal.payload?.repo ?? "").toLowerCase() !== params.repo.toLowerCase()) return false;
       if (params.scope === "run_id") return String(signal.payload?.run_id) === params.runId;
       if (params.scope === "sha") return signal.payload?.head_sha === params.sha;
+      if (params.scope === "next") {
+        // BOT-1507 — live-only: the first TERMINAL run for the repo. Never keys on
+        // subject_key (it is run:<id> for post-merge runs and owner/repo#n for PR
+        // runs — both are legitimate wakes); a null/empty conclusion is an
+        // in-progress signal and never terminal. Optional branch/workflow filters:
+        // branch is exact, workflow is the GitHub display name (case/space-insensitive).
+        const conclusion = signal.payload?.conclusion;
+        if (typeof conclusion !== "string" || conclusion.trim() === "") return false;
+        if (params.branch != null && signal.payload?.head_branch !== params.branch) return false;
+        if (params.workflow != null) {
+          const wf = signal.payload?.workflow_name;
+          if (typeof wf !== "string" || wf.trim().toLowerCase() !== params.workflow.trim().toLowerCase()) {
+            return false;
+          }
+        }
+        return true;
+      }
       // scope=latest: the PR's run (by subject owner/repo#pr or payload pr_number).
       return signal.subject_key === `${params.repo}#${params.pr}` ||
         (signal.payload?.pr_number != null && String(signal.payload.pr_number) === params.pr);

package/src/wait.mjs

@@ -75,10 +75,16 @@ CONDITIONS  (TYPE:key=val,key=val — repeat for several; --any wakes on the fir
                                       Host-shared; a silently-dead host is detected server-side
                                       (capacity_source_stale) via a host beacon — the client
                                       grace (default 900s) is a backstop, no longer the only guard.
-  ci:repo=<owner/repo>,{scope=latest,pr=<n> | run_id=<id> | sha=<sha>}
+  ci:repo=<owner/repo>,{scope=latest,pr=<n> | run_id=<id> | sha=<sha>
+                        | scope=next[,branch=<name>][,workflow=<name>]}
                                       a PR's CI reaching a terminal conclusion (owner-scoped);
                                       GitHub Actions or an external check_suite provider.
                                       A repo with no CI feed is rejected (no_signal_source).
+                                      scope=next is LIVE-ONLY: it wakes on the first terminal
+                                      run delivered AFTER arm (post-merge / cron / scheduled),
+                                      never replays a finished run, and needs no run_id/sha/pr.
+                                      Optional branch= (exact) / workflow= (GitHub workflow
+                                      DISPLAY name, case-insensitive) narrow that first run.
   staging-green:repo=<owner/repo>    verified automatic recovery of an enabled staging gate.
                                       Wakes only after a complete non-vacuous workflow success;
                                       manual resolutions, overrides, skipped, and neutral runs do not match.