@botbuddy/cli 1.9.0 → 1.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botbuddy/cli",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "BotBuddy — Swarm coordination CLI for multi-agent workflows",
   "type": "module",
   "bin": {

package/src/api.mjs

@@ -53,20 +53,30 @@ export async function callTool(toolName, args = {}) {
 //   * { ok:true, data }        — tool result JSON (data.success may still be false)
 //   * { ok:false, auth:true }  — not authenticated / token expired
 //   * { ok:false, status }     — HTTP/JSON-RPC/transport error (status may be null)
-export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal } = {}) {
+// BOT-1487: resolve the auth header ONCE so a caller that issues several tool
+// calls (e.g. `profile setup` does whoami → register_agent) can pin the SAME
+// credential across all of them. Without this, each callToolJson independently
+// re-reads the owner token, so a concurrent `botbuddy login` could swap the
+// bound tenant mid-sequence (a TOCTOU that would register in the wrong tenant).
+// Returns { auth } with the header object, or { error } with the structured
+// not-authenticated / token-expired receipt to return verbatim.
+export async function resolveCallAuth() {
   const owner = await resolveOwnerToken({ getConfig });
-  let auth;
   if (owner && !(owner.expiresAt && Date.now() >= owner.expiresAt)) {
-    auth = { Authorization: `Bearer ${owner.token}` };
-  } else {
-    const agentKey = await resolveAgentKey();
-    if (agentKey) {
-      auth = { "x-agent-api-key": agentKey };
-    } else if (owner) {
-      return { ok: false, auth: true, error: "token_expired" };
-    } else {
-      return { ok: false, auth: true, error: "not_authenticated" };
-    }
+    return { auth: { Authorization: `Bearer ${owner.token}` } };
+  }
+  const agentKey = await resolveAgentKey();
+  if (agentKey) return { auth: { "x-agent-api-key": agentKey } };
+  if (owner) return { error: { ok: false, auth: true, error: "token_expired" } };
+  return { error: { ok: false, auth: true, error: "not_authenticated" } };
+}
+
+export async function callToolJson(toolName, args = {}, { fetchImpl = fetch, signal, auth: pinnedAuth = null } = {}) {
+  let auth = pinnedAuth;
+  if (!auth) {
+    const resolved = await resolveCallAuth();
+    if (resolved.error) return resolved.error;
+    auth = resolved.auth;
   }
   const body = { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: toolName, arguments: args } };
   let res;

package/src/botbuddy-release-repair.json

@@ -0,0 +1 @@
+{"schema_version":1,"source_version":"1.9.0","source_identity":"8bc02282f116b4857951c61a187ad7894c3153b36559b46cd171df24b0af98c4"}

package/src/profile-bootstrap.mjs

@@ -2,7 +2,7 @@ import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
 
 import { ensureProfileCredentialBackend, readProfileIdentity, readProfileRetryIdentity, recordProfileRetryIdentity, installProfileCredential, profileCredentialEnvironment, ProfileCredentialStoreError } from "./agent-credential-store.mjs";
-import { callToolJson } from "./api.mjs";
+import { callToolJson, resolveCallAuth } from "./api.mjs";
 import { latestPublicCliCommand } from "./public-invocation.mjs";
 
 const PROFILES = Object.freeze({
@@ -38,6 +38,7 @@ function registrationCredential(data) {
 export async function bootstrapProfile(profileName, {
   name = null,
   call = callToolJson,
+  resolveAuth = resolveCallAuth,
   readIdentity = readProfileIdentity,
   readRetryIdentity = readProfileRetryIdentity,
   recordRetryIdentity = recordProfileRetryIdentity,
@@ -55,14 +56,60 @@ export async function bootstrapProfile(profileName, {
   // cannot loop forever on stale metadata.
   const reusableIdentity = existing?.tenant === profile.tenant ? existing.agentId : retryIdentity?.agentId ?? null;
   const agentName = name ?? (existing?.tenant === profile.tenant ? existing.name : retryIdentity?.name ?? defaultProfileAgentName(profileName));
+  // BOT-1487: tenancy is auth-bound after BOT-1416 — register_agent selects the
+  // tenant from the OAuth session / agent key and rejects a runtime tenant_id
+  // with MCP_TENANT_CONTEXT_IS_AUTH_ONLY. So we no longer send tenant_id; the
+  // returned tenant_id is attested against the profile's tenant below instead.
+  //
+  // register_agent is a MUTATING call (it persists the agent, its credential
+  // hash, and tenant membership). If the session is logged into another tenant,
+  // registering first and rejecting the response afterwards would leave a stray,
+  // unreachable agent in the wrong tenant on every attempt (names are randomized
+  // and the wrong-tenant path records no retry identity). So resolve the bound
+  // tenant with the read-only `whoami` FIRST and gate registration on it.
+  //
+  // Fail CLOSED (AGENTS.md — no fallbacks; non-determinism is worse than
+  // failure): the mutating register_agent runs ONLY on a positively attested
+  // tenant that matches the profile. A missing/erroring/malformed whoami never
+  // silently proceeds, because the later attestation cannot undo an agent that
+  // registration already persisted in the wrong tenant.
+  //
+  // Snapshot the credential ONCE and pin it to both whoami and register_agent.
+  // Otherwise each call re-reads the owner token, so a concurrent `botbuddy
+  // login` could swap the bound tenant between the attesting whoami and the
+  // mutating register (a TOCTOU that would register in the second tenant).
+  const pinned = await resolveAuth();
+  if (pinned?.error) throw new ProfileBootstrapError("profile_agent_required");
+  const auth = pinned?.auth ?? null;
+  const identity = await call("whoami", {}, { auth });
+  const identityCode = typeof identity?.data?.code === "string" ? identity.data.code : null;
+  if (identityCode === "MCP_TENANT_SELECTION_REQUIRED" || identityCode === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY") {
+    throw new ProfileBootstrapError("profile_tenant_selection_required");
+  }
+  const boundTenant = typeof identity?.data?.tenant_id === "string" ? identity.data.tenant_id : null;
+  if (!boundTenant) {
+    // whoami did not positively attest a tenant (transport/server error or a
+    // response without a string tenant_id) — refuse rather than register blind.
+    throw new ProfileBootstrapError("profile_tenant_unverified");
+  }
+  if (boundTenant !== profile.tenant) {
+    throw new ProfileBootstrapError("profile_credential_wrong_tenant");
+  }
   const args = {
     name: agentName,
     type: "codex",
-    tenant_id: profile.tenant,
     ...(reusableIdentity ? { agent_id: reusableIdentity } : {}),
   };
-  const response = await call("register_agent", args);
+  const response = await call("register_agent", args, { auth });
   const data = response?.data;
+  // Defense-in-depth: whoami above already gated on the tenant, so register_agent
+  // should not return a tenant-context error here — but if the contract drifts,
+  // surface its own actionable recovery, not the misleading
+  // `profile_agent_required` → `botbuddy login` loop that keeps failing because
+  // login itself is fine.
+  if (data?.code === "MCP_TENANT_CONTEXT_IS_AUTH_ONLY" || data?.code === "MCP_TENANT_SELECTION_REQUIRED") {
+    throw new ProfileBootstrapError("profile_tenant_selection_required");
+  }
   if (!response?.ok || (response.isError && data?.code !== "FRESH_CONNECTION_REQUIRED")) {
     throw new ProfileBootstrapError("profile_agent_required");
   }
@@ -126,6 +173,20 @@ export function profileBootstrapRecovery(code, profileName) {
   if (code === "profile_credential_persist_failed") {
     return `ensure ~/.botbuddy is writable and no other setup is running, then re-run: botbuddy profile setup ${profileName}`;
   }
+  if (code === "profile_tenant_unverified") {
+    // whoami could not confirm the bound tenant, so registration was refused
+    // before any mutation. Usually transient — retry; login only if it persists.
+    return `could not confirm your tenant with the server — retry: botbuddy profile setup ${profileName} (if it persists, run botbuddy login, then re-run setup)`;
+  }
+  if (code === "profile_tenant_selection_required") {
+    // Tenancy is chosen at MCP authentication (BOT-1416), not passed to
+    // register_agent. Point the user at selecting the profile's tenant when
+    // they sign in — never the bare login loop that implies login is broken.
+    const tenant = getAgentProfile(profileName)?.tenant;
+    return tenant
+      ? `sign in and select the "${tenant}" tenant during authentication, then re-run: botbuddy profile setup ${profileName}`
+      : `sign in and select the matching tenant during authentication, then re-run: botbuddy profile setup ${profileName}`;
+  }
   return `botbuddy login && botbuddy profile setup ${profileName}`;
 }
 

package/src/test-lane.mjs

@@ -26,12 +26,19 @@ import { callToolJson } from "./api.mjs";
 export const EXIT_TEST = Object.freeze({ ...EXIT, TIMEOUT: 2 });
 export const WAITS_URL = "https://app.bot-buddy.ai/waits";
 const KNOWN_RUNNERS = new Set(["playwright", "generic"]);
+// BOT-1549: mirror of the DB enum public.test_lane_kind (BOT-1547) and
+// supabase/functions/_shared/test-adapters.ts LANE_KINDS. A lane declares its
+// kind in .botbuddy/lanes.json; an unknown value (config or --lane-kind) is a
+// hard, named failure — never a guessed default (gate 9).
+export const LANE_KINDS = Object.freeze(["smoke", "regression", "diagnostics", "e2e", "unit", "integration", "other"]);
+const LANE_KIND_SET = new Set(LANE_KINDS);
 
 export function parseTestArgs(argv, { env = process.env } = {}) {
   const opts = {
     sessionId: env.BOTBUDDY_SESSION_ID ?? null,
     environment: "local",
     ticket: null, pr: null, repo: null,
+    laneKind: null,
     wait: false, json: false,
   };
   const errors = [];
@@ -49,6 +56,7 @@ export function parseTestArgs(argv, { env = process.env } = {}) {
       case "--ticket": opts.ticket = value(flag, i); i++; break;
       case "--pr": { const raw = value(flag, i); i++; opts.pr = raw == null ? null : Number(raw); if (raw != null && !Number.isInteger(opts.pr)) errors.push("--pr must be an integer"); break; }
       case "--repo": opts.repo = value(flag, i); i++; break;
+      case "--lane-kind": opts.laneKind = value(flag, i); i++; break;
       case "--wait": opts.wait = true; break;
       case "--json": opts.json = true; break;
       default:
@@ -88,7 +96,12 @@ export function resolveLane(laneName, { cwd = process.cwd(), readFileImpl = read
   const lane = lanes[laneName];
   if (!Array.isArray(lane.command) || lane.command.length === 0) return { ok: false, error: "invalid", path, root, detail: `lane "${laneName}" has no command` };
   if (!KNOWN_RUNNERS.has(lane.runner)) return { ok: false, error: "invalid", path, root, detail: `lane "${laneName}" runner must be playwright|generic` };
-  return { ok: true, appSlug: config.app_slug ?? null, lane, path, root };
+  // BOT-1549: an optional per-lane `kind` must be a known lane_kind — a bad
+  // value is rejected here, never coerced or defaulted (gate 9).
+  if (lane.kind != null && !LANE_KIND_SET.has(lane.kind)) {
+    return { ok: false, error: "invalid", path, root, detail: `lane "${laneName}" lane_kind must be one of ${LANE_KINDS.join("|")} (got "${lane.kind}")` };
+  }
+  return { ok: true, appSlug: config.app_slug ?? null, lane, laneKind: lane.kind ?? null, path, root };
 }
 
 // Best-effort git/gh context. Every field falls back to null — never fabricated
@@ -151,8 +164,18 @@ export async function launchTestLane(argv, {
     if (resolved.error === "missing") process.stderr.write(`botbuddy test: no lane config — create ${resolved.path}\n`);
     else if (resolved.error === "unknown") process.stderr.write(`botbuddy test: unknown lane "${laneName}". Available: ${resolved.available.join(", ") || "(none)"}\n`);
     else process.stderr.write(`botbuddy test: invalid lane config (${resolved.detail}) at ${resolved.path}\n`);
-    return { exitCode: EXIT_TEST.INVALID, line: JSON.stringify({ outcome: "rejected", error: resolved.error, path: resolved.path }) };
+    return { exitCode: EXIT_TEST.INVALID, line: JSON.stringify({ outcome: "rejected", error: resolved.error, path: resolved.path, detail: resolved.detail }) };
+  }
+
+  // BOT-1549: resolve the effective lane kind — a --lane-kind flag overrides
+  // the lane's config kind for this run. An invalid flag value is rejected
+  // before any run is created (gate 9), mirroring the config-side check.
+  if (opts.laneKind != null && !LANE_KIND_SET.has(opts.laneKind)) {
+    const detail = `invalid lane_kind: --lane-kind must be one of ${LANE_KINDS.join("|")} (got "${opts.laneKind}")`;
+    process.stderr.write(`botbuddy test: ${detail}\n`);
+    return { exitCode: EXIT_TEST.INVALID, line: JSON.stringify({ outcome: "rejected", error: "invalid", detail }) };
   }
+  const laneKind = opts.laneKind ?? resolved.laneKind ?? null;
 
   const git = gitInfo({ cwd, ticket: opts.ticket, pr: opts.pr, repo: opts.repo });
   const sha7 = (git.sha ?? "").slice(0, 7) || "nosha";
@@ -167,6 +190,8 @@ export async function launchTestLane(argv, {
     commit_sha: git.sha ?? undefined, branch_name: git.branch ?? undefined,
     pr_number: git.prNumber ?? undefined, pr_url: git.prUrl ?? undefined,
     source_kind: "cli-lane", source_id: laneRunId,
+    // BOT-1549: stamp the resolved lane kind on the run; absent ⇒ omitted (NULL).
+    lane_kind: laneKind ?? undefined,
   };
   const created = await call("create_test_run", createArgs);
   const testRunId = created?.ok && !created.isError ? created.data?.id ?? null : null;
@@ -183,6 +208,15 @@ export async function launchTestLane(argv, {
 
   // Step 3: launch the lane under the durable worker, telemetry env in the child.
   const childEnv = { BOTBUDDY_LANE: laneName };
+  // BOT-1549: carry the lane kind to the child so uploaded executions
+  // (test-ingest / playwright-upload) can stamp lane_kind too. ALWAYS set the
+  // key: runWorker spawns the child with `{ ...process.env, ...child_env }`
+  // (run.mjs), so a bare `if (laneKind)` would let a stale BOTBUDDY_LANE_KIND
+  // already in the environment leak into the child even though this run's
+  // lane_kind is NULL — making child-uploaded executions disagree with their
+  // run (Codex P2). Setting "" when there is no effective kind deterministically
+  // clears any inherited value; empty ⇒ unset by parseLaneKind's contract.
+  childEnv.BOTBUDDY_LANE_KIND = laneKind ?? "";
   if (testRunId) { childEnv.BOTBUDDY_TEST_RUN_ID = testRunId; childEnv.BOTBUDDY_TEST_RUN_EVENTS = eventsPath; }
   const testRun = testRunId
     ? { test_run_id: testRunId, events_path: eventsPath, lane: laneName, runner: resolved.lane.runner, git_sha: git.sha ?? null, branch: git.branch ?? null }
@@ -248,7 +282,7 @@ function laneList(cwd) {
 }
 
 function testHelp() {
-  console.log(`botbuddy test <lane> [--session-id <uuid>] [--environment local] [--ticket <KEY>] [--pr <n>] [--repo <owner/repo>] [--wait] [--json] [-- <extra args>]
+  console.log(`botbuddy test <lane> [--session-id <uuid>] [--environment local] [--ticket <KEY>] [--pr <n>] [--repo <owner/repo>] [--lane-kind <${LANE_KINDS.join("|")}>] [--wait] [--json] [-- <extra args>]
 botbuddy test list      List the lanes configured in .botbuddy/lanes.json
 botbuddy test help      Show this help